Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I'll think twice before using GitHub Actions again

ninkovic.dev

Post reply on HN
Print view View original

241–250 of 284 posts

Re: I'll think twice before using GitHub Actions again

#241

Post by 0xbadcafebee »

OldOneEye wrote: post #214
hardwaresofton wrote: post #136

Earlier quoted context omitted.

Hey if you’ve never heard of it consider using just[0], it’s a better makefile and supports shell scripting explicitly (so at least equivalent in power, though so is Make) [0]: https://github.com/casey/just

I discovered Just with a similar comment in Hacker News and I want to add my +1. It is so much better to run scripts with Just than it is doing it with Make. And although I frankly tend to prefer using a bash script directly (much as described by the parent commenter), Just is much less terrible than Make. Now the only problem is convincing teams to stop following the Make dogma, because it is so massively ingrained…

Make has a lot of features that you don't use at first, but do end up using eventually, that Just does not support (because it's trying to be simpler). If you learn it formally (go through the whole HTML manual) it's not hard to use, and you can always refer back to the manual for a forgotten detail.

Re: I'll think twice before using GitHub Actions again

#242

Post by WorldMaker »

SOLAR_FIELDS wrote: post #237
pydry wrote: post #63

Earlier quoted context omitted.

It never becomes unbearably messy this way though. The reason it gets unbearably messy is because most people google "how to do x in github actions" (e.g. send a slack message) and there is a way and it's almost always worse than scripting it yourself.

The reason it gets unbearably messy is that GitHub has constructed an ecosystem that encourages developers to write Turing complete imperative behavior into YAML without providing the same language constructs/tooling that a proper adult language provides to encourage code reuse and debugging. Without tooling like this any sufficiently complex system is guaranteed to evolve into a spaghetti mess, because no sane way e…

Which I feel is a recurring lesson in CI in general. CI systems have to be scriptable to get their job done because they can't anticipate every build system. With even terrible scriptability comes Turing completeness, because it is hard to avoid, a natural law. Eventually someone figures out how to make it do wild things. Eventually those wild things becomes someone's requirements in their CI pipeline. Eventually someone is blog posting about how terrible that entire CI system is because of how baroque their pipeline has become and how many crazy scripts it has that are hard to test and harder to fix.

It's like the circle of life for CI systems.

Re: I'll think twice before using GitHub Actions again

#243

Post by WorldMaker »

noen wrote: post #170
arghwhat wrote: post #46

Earlier quoted context omitted.

Azure DevOps specifically has a very broken approach to YAML pipelines, because they effectively took their old graphical pipeline builder and just made a YAML representation of it. The trick to working with this is that you don't need any of their custom Azure DevOps task types, and can use the shell type (which has a convenient shorthand) just as well as in any other CI environment. Even the installer tasks are red…

It has been on life support for a long time AFAIK. I designed Visual Studio Online (the first launch of AzDO) - and every engineer, PM, and executive I worked with is either in leadership at GitHub or retired.

It feels clear from an outside perspective that all the work on AzDO Pipelines has shifted to focus on GitHub Actions and Actions is now like 3 or 4 versions ahead. Especially because the public Issue trackers for some of AzDO Pipelines "Roadmap" are still up (on GitHub, naturally) and haven't been updated since ~2020.

I wish Microsoft would just announce AzDO's time of death and save companies increasingly crazy AzDO blinders and/or weird mixes of GitHub and AzDO as GitHub-only is clearly the present/future.

Re: I'll think twice before using GitHub Actions again

#244

Post by mdaniel »

joshstrange wrote: post #228
mdaniel wrote: post #165

Earlier quoted context omitted.

> Search for and leak `AWS_ACCESS_KEY_ID` anyone? Well that's just someone being a dumbass, since AssumeRoleWithWebIdentity (and its Azure and GCP equivalent) have existed for quite a while. It works flawlessly and if someone does do something stupid like `export HURP_DURP=$AWS_ACCESS_KEY_ID; printenv` in a log, that key is only live for about 15 minutes so the attacker better hurry Further, at least in AWS and GCP (…

I never knew how easy it was to setup role assuming for AWS/GHA. It’s much easier than managing the access/secret. I wrote a little about it in this blog post: https://joshstrange.com/2024/04/26/nightly-postgres-backups-...

If you, or others, are interested I have found that those role-session-name variables make for a great traceability signal when trying to figure out what GHA run is responsible for AWS actions. So instead of

  role-session-name: GitHubActionSession
one can consider

  role-session-name: gha-${{ github.run_id }}  # or your favorite
I don't this second recall what the upper limit is on that session name so you may be able to fit quite a bit of stuff in there

Re: I'll think twice before using GitHub Actions again

#245

Post by smaudet »

harrall wrote: post #240
smaudet wrote: post #190

Earlier quoted context omitted.

1) If possible, don't run shell scripts with Python. Evaluate why you are trying to do that and don't. 2) Python has a bunch of infrastructure compared to shell, you can use it. Shell scripts don't. 3) Apply the same you used for the script to what it calls. CI calls control script for job, script calls tools/libraries for heavy lifting. Often the shell script just calls a python/Ruby/rust exec anyways... Shell scrip…

Sure but I already know all this at a level deeper than most people. Your average person is going to be blindsighted.

Your average person will be blind sighted either way, at least one way they have a much better set of tools to help them out, once they are blind sighted.

Re: I'll think twice before using GitHub Actions again

#246

Post by mdaniel »

8n4vidtmkvmk wrote: post #176
arccy wrote: post #73

Earlier quoted context omitted.

git commit --allow-empty -m "bump ci" unless your pipeline does magic with trying to detect changed files

I use Mercurial + hg-git like a weirdo. Not sure if Mercurial supports empty commits, I don't think it does.

I was curious and it certainly appears that you are right

  $ hg init
  $ hg commit -m"initial"
  nothing changed

Re: I'll think twice before using GitHub Actions again

#247

Post by azriel91 »

arghwhat wrote: post #5

> no way of running actions locally My policy is to never let pipeline DSLs contain any actual logic outside orchestration for the task, relying solely on one-liner build or test commands. If the task is more complicated than a one-liner, make a script for it in the repo to make it a one-liner. Doesn't matter if it's GitHub Actions, Jenkins, Azure DevOps (which has super cursed yaml), etc. This in turn means that you…

there's:

https://github.com/Pernosco/gha-runner

but I'm not sure how complete it is, and probably doesn't satisfy the author's use cases

Re: I'll think twice before using GitHub Actions again

#249

Post by slt2021 »

surajrmal wrote: post #217
slt2021 wrote: post #187

Earlier quoted context omitted.

yeah if you author CI jobs, you should know linux, otherwise a person should not even touch the CI system with 10ft pole

I've been working with Linux since I was 10 (I'm much older now), and I still don't think I "know Linux". The upper bound on understanding it is incredibly high. Where do you draw the line?

just basics enough to understand typical bash commands, scripts, how env variables work, etc
Post reply on HN