Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub Actions has a package manager, and it might be the worst

nesbitt.io

Post reply on HN
Print view View original

201–210 of 267 posts

Re: GitHub Actions has a package manager, and it might be the worst

#201

Post by hinkley »

gcr wrote: post #110
hinkley wrote: post #24

Earlier quoted context omitted.

CI is arguable, but how do you intend to do deployments with no secrets?

The secret is held by the metadata server that the CI instance has access to Or: the deployment service knows the identity of the instance, so its secret is its private key Or, how PyPI does it: the deployment service coordinates with the trusted CI/CD service to learn the identity of the machine (like its IP address, or a trusted assertion of which repository it’s running on), so the secret is handled in however tha…

That is secret management.

Re: GitHub Actions has a package manager, and it might be the worst

#202

Post by bastardoperator »

999900000999 wrote: post #182
bastardoperator wrote: post #177

Earlier quoted context omitted.

Such as?

Jenkins is open source and very well documented. GitHub Actions are really for just short scripts. Don't take your Miata off road.

LOL, I worked on the Jenkins project paid for three years. Even they use actions to build Jenkins.

https://github.com/jenkinsci/jenkins/tree/master/.github/wor...

Re: GitHub Actions has a package manager, and it might be the worst

#203

Post by hinkley »

mrweasel wrote: post #157
gcr wrote: post #110

Earlier quoted context omitted.

The secret is held by the metadata server that the CI instance has access to Or: the deployment service knows the identity of the instance, so its secret is its private key Or, how PyPI does it: the deployment service coordinates with the trusted CI/CD service to learn the identity of the machine (like its IP address, or a trusted assertion of which repository it’s running on), so the secret is handled in however tha…

> The secret is held by the metadata server that the CI instance has access to But how does the metadata server know that the CI instance is allowed to access the secret? Especially when the CI/CD system is hosted at a 3rd. party. It needs to present some form of credentials. The CI system may also need permission or credentials for a private repository of packages or artifacts needed in the build process. For me, a…

It would be good if it could also scan build output like code coverage and test results. But that’s about all it should do.

I keep meaning to write a partially federated CI tool that uses Prometheus for all of its telemetry data but never get around to it. I ended up carving out a couple other things I’d like to be part of the process as a separate app because I was still getting panopticon vibes and some data should just be private.

Re: GitHub Actions has a package manager, and it might be the worst

#204

Post by gcr »

hinkley wrote: post #201
gcr wrote: post #110

Earlier quoted context omitted.

The secret is held by the metadata server that the CI instance has access to Or: the deployment service knows the identity of the instance, so its secret is its private key Or, how PyPI does it: the deployment service coordinates with the trusted CI/CD service to learn the identity of the machine (like its IP address, or a trusted assertion of which repository it’s running on), so the secret is handled in however tha…

That is secret management.

Yes, that's what I'm saying. I'm agreeing with your response to amluto.

Re: GitHub Actions has a package manager, and it might be the worst

#205

Post by herpdyderp »

kylegalbraith wrote: post #187
herpdyderp wrote: post #168

Earlier quoted context omitted.

What are Depot runners?

Founder of Depot here. We provide faster and more reliable GitHub Actions runners (as well as other build performance services) at half the cost of GitHub [0] [0] https://depot.dev/

Ah got it, thanks. I thought there was another kind of GitHub runner (like their "large" runners) that I hadn't heard of.

Re: GitHub Actions has a package manager, and it might be the worst

#206

Post by sebazzz »

wnevets wrote: post #167
saagarjha wrote: post #2

What’s more, GitHub has basically stopped maintaining their own actions, pushing people to sketchy forks to do basic things. Their entire ecosystem is basically held up with duct tape and gets very little investment.

> Their entire ecosystem is basically held up with duct tape and gets very little investment. That isn't gonna get better anytime soon. "GitHub Will Prioritize Migrating to Azure Over Feature Development" [1] [1] https://thenewstack.io/github-will-prioritize-migrating-to-a...

Except actions/ai-task. Im sure that one will come.

Re: GitHub Actions has a package manager, and it might be the worst

#207

Post by ironmagma »

baq wrote: post #198
ironmagma wrote: post #192

Earlier quoted context omitted.

Is not the whole FOSS movement about receiving something you did not pay for? Going as far as to say that’s even what users deserve?

don't confuse 'receiving something you did not pay for' with 'being allowed to feel entitled to anything' is all. 'open source' is just that, nothing more. if you want a service with your source, be prepared to sponsor it.

I still think people should want things and be vocal about what they want. This is the natural way for people to know what needs to be built. It is different from demanding something.

And besides that, a lot of people on here do pay for Github in the first place.

Re: GitHub Actions has a package manager, and it might be the worst

#208

Post by shepherdjerred »

worldsayshi wrote: post #64

I've not understood the propensity for using yaml for CI pipelines and workflows in general. A decent programming language would be a big improvement. Why not just build the workflows themselves as docker images? I guess running other docker images in the workflow would then become a problem.

Dagger does what you're describing: https://dagger.io/

Re: GitHub Actions has a package manager, and it might be the worst

#209

Post by duped »

bjackman wrote: post #56
baq wrote: post #14

Normally I’d say stop kicking the dead horse, but GHA deserves all the complaints it gets and then some. It’s the embodiment of everything that’s bad in ‘less is more’. My biggest concern with it is that it’s somehow the de facto industry standard. You could do so much better with relatively small investments, but MS went full IE6 with it… and now there’s a whole generation of young engineers who don’t know how short…

It's funny that absolutely everything about GHA fucking sucks, and everyone agrees about this. BUT, the fact that it's free compute, and it's "right there"... means it's very very difficult to say no to! Personally I've just retired a laptop and I'm planning to turn it into a little home server. I think I'm gonna try spinning up Woodpecker on there, I'm curious to see what a CI system people don't hate is like to liv…

> absolutely everything about GHA fucking sucks

By adding one file to your git repo, you get cross-platform build & test of your software that can run on every PR. If your code is open source, it's free(ish) too.

It feels like a weekend project that a couple people threw together and then has been held together by hope and prayers with more focus on scaling it than making it well designed.

Re: GitHub Actions has a package manager, and it might be the worst

#210

Post by duped »

amluto wrote: post #8

> The researchers identified four fundamental security properties that CI/CD systems need: admittance control, execution control, code control, and access to secrets. Why do CI/CD systems need access to secrets? I would argue need access to APIs and they need privileges to perform specific API calls. But there is absolutely nothing about calling an API that fundamentally requires that the caller know a secret. I woul…

> Why do CI/CD systems need access to secrets?

Because you need to be able to sign/notarize with private keys and deploy to cloud environments. Both of these require secrets known to the runner.

Post reply on HN