Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub Actions has a package manager, and it might be the worst

nesbitt.io

Post reply on HN
Print view View original

221–230 of 267 posts

Re: GitHub Actions has a package manager, and it might be the worst

#221

Post by esafak »

mfenniak wrote: post #142
carschno wrote: post #135

It is concerning that GitHub hosts the majority of open-source software, while actively locking its users into a platform that is based on closed source for eerything except Git itself. This issue with Actions shows how maintaining proprietary software inevitably ends up rather low on the priority list. Adding new features is much more marketable, just like for any other software product. Enshittification ensues. For…

On the plus side, Forgejo Action's implementation is still actively improving, where it seems that for GitHub if it's not AI, it's not being touched. However, as noted in the article, Forgejo's implementation currently has all the same "package manager" problems.

I don't know why they basically copied GHA.

Re: GitHub Actions has a package manager, and it might be the worst

#222

Post by dijit »

theamk wrote: post #199
phantasmish wrote: post #178

Earlier quoted context omitted.

They had working infra and a great case for keeping fairly "close to the metal". Complicated files-heavy workload that needs tons of clever caching to perform well, lots of writes, lots of non-HTTP TCP traffic. Retrofitting that into "cloud" bullshit is such a bad idea.

meh, I dunno. Using bare-metal requires competent Unix admins, and Actions team is full of javascript clowns (see: decision to use dashes in environment variable; lack of any sort of shell quoting support in templates; keeping logs next to binaries in self-hosted runners). Perhaps they would be better off using infra someone else maintains.

> Using bare-metal requires competent Unix admins

So does running VMs in a cloud provider.

Except now we call them "DevOps" or "SRE" and pay them 1.5-2x.

(as a former SRE myself, I'm not complaining).

Re: GitHub Actions has a package manager, and it might be the worst

#225

Post by 999900000999 »

lijok wrote: post #197
999900000999 wrote: post #182

Earlier quoted context omitted.

Jenkins is open source and very well documented. GitHub Actions are really for just short scripts. Don't take your Miata off road.

Why is gha just for short scripts, out of interest?

It's just short on features.

I get the vibe it was never intended to seriously compete with real CI/CD systems.

But then people started using it as such, thus this thread is full of complaints.

Re: GitHub Actions has a package manager, and it might be the worst

#227

Post by cedws »

Kovah wrote: post #87
barrkel wrote: post #32

Earlier quoted context omitted.

Transitive dependencies?

Yeah, only works if all used Actions would use SHAs too, which is not the case. Positive example: https://github.com/codecov/codecov-action/blob/96b38e9e60ee6... Negative example: https://github.com/armbian/build/blob/54808ecff253fb71615161...

I've also found many Actions that do other dodgy stuff, like pulling and executing unpinned scripts from external websites, or installing unpinned binaries from GitHub releases. Pinning an Action isn't enough, you have to audit it.

Re: GitHub Actions has a package manager, and it might be the worst

#229

Post by drdrey »

999900000999 wrote: post #182
bastardoperator wrote: post #177

Earlier quoted context omitted.

Such as?

Jenkins is open source and very well documented. GitHub Actions are really for just short scripts. Don't take your Miata off road.

death before Jenkins
Post reply on HN