Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub Actions has a package manager, and it might be the worst

nesbitt.io

Post reply on HN
Print view View original

171–180 of 267 posts

Re: GitHub Actions has a package manager, and it might be the worst

#171

Post by woodruffw »

captn3m0 wrote: post #85
weikju wrote: post #73

Earlier quoted context omitted.

they probably have a half-assed plan to push some sort of checkout action copilot button instead of dependable scripts/actions.

https://githubnext.com/projects/agentic-workflows/ > Instead of writing bespoke scripts that operate over GitHub using the GitHub API, you describe the desired behavior in plain language. This is converted into an executable GitHub Actions workflow that runs on GitHub using an agentic "engine" such as Claude Code or Open AI Codex. It's a GitHub Action, but the "source code" is natural language in a markdown file.

This seems like a real headache to me. I understand the value proposition of LLMs in the development cycle, but CI/CD is probably the last place where I want any degree of nondeterminism.

Re: GitHub Actions has a package manager, and it might be the worst

#172

Post by bksmithconnor »

joshgachnang wrote: post #165
samhh wrote: post #16

Earlier quoted context omitted.

I was surprised to learn that Depot runners, which are much faster, are also much cheaper. Would highly recommend them for anyone trapped on GitHub.

Blacksmith.sh has been great for us. Massively sped up tests and a huge improvement for Docker builds over both Actions and Google Cloud Build. Only downside is they never got back to us about their startup discount.

hey there! blacksmith solutions engineer here :) love to hear we've helped speed up your tests and docker builds!!

could you shoot me your GH org so I can apply your startup discount? feel free to reach out to support@blacksmith.sh and I'll get back to you asap. thanks for using blacksmith!

Re: GitHub Actions has a package manager, and it might be the worst

#173

Post by woodruffw »

XCabbage wrote: post #97
miohtama wrote: post #30

Earlier quoted context omitted.

Everyone is free to use alternative CI/CD workflow pipelines. These are often better than Github Actions. These include - https://circleci.com/ - https://www.travis-ci.com/ - Gitlab Open source: - https://concourse-ci.org/ (discussed in the context of Radicle here https://news.ycombinator.com/item?id=44658820 ) - Jenkins -etc. Anyone can complain as much as they want, but unless they put the money where their mouth i…

Well, actually, no, not everyone is free to use alternatives. Anyone using CI for "Trusted Publishing" of packages to PyPI or npm needs to use GitHub Actions or GitLab CI/CD. CircleCI and Travis CI are not supported. So many big open source projects for the two most popular languages in the world are now locked out of the alternatives you propose. (I find it extremely sketchy from a competition law perspective that M…

Trusted Publishing on PyPI supports Google Cloud and ActiveState as well. It’s not tied to GitHub or GitLab. To my recollection I looked at CircleCI support a while back, and ran into limitations on the claims they exposed.

(It can also be extended to arbitrary third party IdPs, although the benefit of that is dependent on usage. But if you have another CI/CD provider that you’d like to integrate into PyPI, you should definitely flag it on the issue tracker.)

Re: GitHub Actions has a package manager, and it might be the worst

#174

Post by joshgachnang »

bksmithconnor wrote: post #172
joshgachnang wrote: post #165

Earlier quoted context omitted.

Blacksmith.sh has been great for us. Massively sped up tests and a huge improvement for Docker builds over both Actions and Google Cloud Build. Only downside is they never got back to us about their startup discount.

hey there! blacksmith solutions engineer here :) love to hear we've helped speed up your tests and docker builds!! could you shoot me your GH org so I can apply your startup discount? feel free to reach out to support@blacksmith.sh and I'll get back to you asap. thanks for using blacksmith!

Thank you! We've loved it! Looks like you found me, thank you :)

Re: GitHub Actions has a package manager, and it might be the worst

#175

Post by amarant »

wnevets wrote: post #167
saagarjha wrote: post #2

What’s more, GitHub has basically stopped maintaining their own actions, pushing people to sketchy forks to do basic things. Their entire ecosystem is basically held up with duct tape and gets very little investment.

> Their entire ecosystem is basically held up with duct tape and gets very little investment. That isn't gonna get better anytime soon. "GitHub Will Prioritize Migrating to Azure Over Feature Development" [1] [1] https://thenewstack.io/github-will-prioritize-migrating-to-a...

Hey at least we can all expect lots of extra days off because "GitHub is down" once they're done with that migration!

Re: GitHub Actions has a package manager, and it might be the worst

#176

Post by regularfry »

Kinrany wrote: post #154
regularfry wrote: post #133

Earlier quoted context omitted.

Technically yes. It depends on whether you consider the account ID to be a secret or not (AWS say "sensitive but not secret" which doesn't help much). But also it can make sense to treat all environment variables as secrets by default just so you don't accidentally end up putting something somewhere that turns out to have been Wrong.

GP is saying that GHA would need zero information about AWS if CodeBuild used a Github token and listened for GHA runs.

That may be true, but it's not what the link describes.

Re: GitHub Actions has a package manager, and it might be the worst

#177

Post by bastardoperator »

999900000999 wrote: post #162
samhh wrote: post #16

Earlier quoted context omitted.

I was surprised to learn that Depot runners, which are much faster, are also much cheaper. Would highly recommend them for anyone trapped on GitHub.

Yeah, but I have to set that up. GitHub actions more or less just work for what most people need. If you have a complex setup, use a real CI/CD system.

Such as?

Re: GitHub Actions has a package manager, and it might be the worst

#178

Post by phantasmish »

amarant wrote: post #175
wnevets wrote: post #167

Earlier quoted context omitted.

> Their entire ecosystem is basically held up with duct tape and gets very little investment. That isn't gonna get better anytime soon. "GitHub Will Prioritize Migrating to Azure Over Feature Development" [1] [1] https://thenewstack.io/github-will-prioritize-migrating-to-a...

Hey at least we can all expect lots of extra days off because "GitHub is down" once they're done with that migration!

They had working infra and a great case for keeping fairly "close to the metal". Complicated files-heavy workload that needs tons of clever caching to perform well, lots of writes, lots of non-HTTP TCP traffic.

Retrofitting that into "cloud" bullshit is such a bad idea.

Re: GitHub Actions has a package manager, and it might be the worst

#179

Post by WorldMaker »

fuzzy2 wrote: post #89
blibble wrote: post #80

Earlier quoted context omitted.

I wouldn't be surprised if there isn't some plan to make all of GitHub's backend "legacy" and switch everyone to the dumpster fire that is Azure DevOps and if you thought GitHub Actions was bad...

IIRC Azure DevOps was the “dead one”, all new development only takes place on GitHub. From my perspective, Azure Pipelines is largely the same as GitHub Actions. I abhor this concept of having abstract and opaque “tasks”.

There's direct evidence that GitHub Actions was the rewrite of Azure Pipelines that was originally planned to finish 5 years ago and got "stuck" (because all their resources moved to GitHub). For a while you could find 2020 roadmap repositories (on GitHub) for AzDO talking up a Pipelines rewrite bringing a lot more features (including better Docker alignment versus Pipelines' much more complex "runner skills") that instead showed up in the first version of GitHub Actions.

Microsoft claims Azure DevOps still has a roadmap, but it's hard to imagine that the real roadmap isn't simply "Wait for more VPs in North Carolina to retire before finally killing the brand".

Re: GitHub Actions has a package manager, and it might be the worst

#180

Post by DalekBaldwin »

I'm assuming the lockfile should be checked into the repo itself, which presents a bootstrapping problem if you have to run an action to create the lockfile in the first place. They may need to build proper support for running actions locally -- there is the third-party https://github.com/nektos/act tool which might be a starting point, but that's mostly designed so you can debug actions without having to repeatedly push and rerun. Probably they'll need a separate mechanism to statically analyze actions without running them.
Post reply on HN