Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub Actions has a package manager, and it might be the worst

nesbitt.io

Post reply on HN
Print view View original

231–240 of 267 posts

Re: GitHub Actions has a package manager, and it might be the worst

#231

Post by godelski »

theamk wrote: post #199
phantasmish wrote: post #178

Earlier quoted context omitted.

They had working infra and a great case for keeping fairly "close to the metal". Complicated files-heavy workload that needs tons of clever caching to perform well, lots of writes, lots of non-HTTP TCP traffic. Retrofitting that into "cloud" bullshit is such a bad idea.

meh, I dunno. Using bare-metal requires competent Unix admins, and Actions team is full of javascript clowns (see: decision to use dashes in environment variable; lack of any sort of shell quoting support in templates; keeping logs next to binaries in self-hosted runners). Perhaps they would be better off using infra someone else maintains.

  > requires competent Unix admins
Who knows where a $3.7T company is ever going to find competent Unix admins...

  > Perhaps they would be better off using infra someone else maintains.
They're handing it from themselves to themselves. We're talking about Microsoft, not some startup.

Re: GitHub Actions has a package manager, and it might be the worst

#232

Post by blackqueeriroh »

Hamuko wrote: post #166
mixedbit wrote: post #10

Earlier quoted context omitted.

An interesting things is that GitHub is an expensive service and my guess would be that MS makes good money on it. Our small company paid about 200+ USD monthly for GitHub, much larger cumulative cost than Windows licenses. My believe was that Windows is getting worse, because it is considered legacy business by MS in favor of new offerings such as GitHub subscriptions.

It's not really that expensive. GitHub Enterprise is like $21/month/user while GitLab Ultimate was $100/month/user the last time GitLab published prices. These days GitLab Ultimate is "contact us for pricing" while the cheaper GitLab Premium is $29/month/user. I guess Bitbucket is cheaper but you'll lose the savings in your employees bitching about Bitbucket to each other on Slack.

When’s the last time you looked at or used Bitbucket?

Re: GitHub Actions has a package manager, and it might be the worst

#233

Post by vbezhenar »

esafak wrote: post #217
vbezhenar wrote: post #159

Earlier quoted context omitted.

I never used any actions and never understood why would I need to. I just wrote bash script to build my project and that's about it. This modern tendency to add dependencies for trivial things baffles me. You don't need "action" to do `git clone`.

bash scripts are as inscrutable as any GHA.

They are perfectly supportable and auditable as you're writing them yourself. It's just ordinary shell commands, there's nothing inscrutable about it.

Re: GitHub Actions has a package manager, and it might be the worst

#234

Post by Hamuko »

blackqueeriroh wrote: post #232
Hamuko wrote: post #166

Earlier quoted context omitted.

It's not really that expensive. GitHub Enterprise is like $21/month/user while GitLab Ultimate was $100/month/user the last time GitLab published prices. These days GitLab Ultimate is "contact us for pricing" while the cheaper GitLab Premium is $29/month/user. I guess Bitbucket is cheaper but you'll lose the savings in your employees bitching about Bitbucket to each other on Slack.

When’s the last time you looked at or used Bitbucket?

Like a week ago? We’re currently migrating away from it as everyone hated it.

Re: GitHub Actions has a package manager, and it might be the worst

#235

Post by nextaccountic »

WillDaSilva wrote: post #129
amake wrote: post #57

Earlier quoted context omitted.

> it doesn't work for transitive deps unless those are specified by SHA as well, which is out of your control So in other words the strategy in the docs doesn't actually address the issue

There's a repository setting you can enable to prevent actions from running unless they have their version pinned to a SHA digest. This setting applies transitively, so while you can't force your dependencies to use SHA pinning for their dependencies, you can block any workflow from running if it doesn't.

A lockfile would address this issue, with the added benefit that it would work

Re: GitHub Actions has a package manager, and it might be the worst

#236

Post by klausa »

miohtama wrote: post #158
klausa wrote: post #53

Earlier quoted context omitted.

I don’t make the purchasing decision for my employer, but I certainly have to deal with their fallout, so I’ll keep complaining if that’s okay with you.

If you are not part of the solution, then you are part of the problem.

What is it that you actually want me to do here?

Just refuse to do my job because I think the tools suck?

Re: GitHub Actions has a package manager, and it might be the worst

#237

Post by woodruffw »

gcr wrote: post #169
mrweasel wrote: post #157

Earlier quoted context omitted.

> The secret is held by the metadata server that the CI instance has access to But how does the metadata server know that the CI instance is allowed to access the secret? Especially when the CI/CD system is hosted at a 3rd. party. It needs to present some form of credentials. The CI system may also need permission or credentials for a private repository of packages or artifacts needed in the build process. For me, a…

Yeah I was confused about that bit too. AWS and GCP's metadata servers know which instances were deployed, so they presumably have some way of verifying the instance's identity out-of-band, such as being tagged by an internal job or machine identifier. As for deploying from a trusted service without managing credentials, PyPI calls this "trusted publishing": https://docs.pypi.org/trusted-publishers/ From the docs: 1.…

PyPI is sure that it’s talking to GitHub because it establishes trust in the GitHub’s IdP public keys over HTTPS. I guess you could then question the security of HTTPS, but that seems like a significant rabbit hole to jump down given that OAuth, etc. all depend on the same basic scheme.

Re: GitHub Actions has a package manager, and it might be the worst

#238

Post by LoganDark »

regularfry wrote: post #40
LoganDark wrote: post #28

I checked out the linked GitHub repo https://github.com/ecosyste-ms/package-manager-resolvers and it appears to be just a README.md that collects summaries of different package managers? How do I know these weren't just LLM-generated?

You don't, but that's the wrong question. How do you know they're accurate?

I feel it's not that controversial to treat LLM output as unreliable without proper verification. So even if the output were accurate, if it's LLM-generated without proper verification I don't trust it.

Re: GitHub Actions has a package manager, and it might be the worst

#239

Post by lijok »

999900000999 wrote: post #225
lijok wrote: post #197

Earlier quoted context omitted.

Why is gha just for short scripts, out of interest?

It's just short on features. I get the vibe it was never intended to seriously compete with real CI/CD systems. But then people started using it as such, thus this thread is full of complaints.

What features is it missing that you would like to see it implement?

Re: GitHub Actions has a package manager, and it might be the worst

#240

Post by rurban »

I agree that github actions has a horrible syntax and can do much less than travis, appveyor, circle, ... I'd really have to resort to yaml references to do anything elegant. But yaml references aren't elegant at all. But it still is free and vastly outperforms the other free CI's.

I just converted our old parrot travis runners to github actions. There I had constant troubles with travis timeouts of 15m 10 years ago. With the new github actions I can run the full tests (which was not possible with travis) in 3 minutes. About 8x faster hardware.

Post reply on HN