Live data from Hacker News

I'll think twice before using GitHub Actions again

ninkovic.dev

271–280 of 284 posts

Re: I'll think twice before using GitHub Actions again

#271

Earlier quoted context omitted.

If you don't value your and your developer's time, certainly, containerize everything. I've rarely seen a feedback loop with containers that's not longer than 10s only due to containerization itself, and that breaks the "golden" 10s rule (see https://www.nngroup.com/articles/response-times-3-important-... ). If you aim for quicker turn-around (eg. just running a single test in <1s), you'll have to either aggressively…

Are you talking about CI or local development? Why would you run a single test in CI? And why would a container add 10+ seconds to a local task?

I am talking about either, because the GP post was about "containerizing a build environment": you need your project built to either run it in CI or locally.

Why would it be slow?

It needs to be rebuilt? (on a fast moving project with mid-sized or large team, you'll get dependency or Dockerfile changes frequently)

It needs to restart a bunch of dependent services?

Container itself is slow to initialize?

Caching of Docker layers is tricky, silly (you re-arrange a single command line and poof, it's invalidated, including all the layers after) and hard to make the most of.

If you can't get a single test running in <1s, you are never going to get a full test suite running in a couple of seconds, and never be able to do an urgent deploy in <30s.

Re: I'll think twice before using GitHub Actions again

#272
post #63

Earlier quoted context omitted.

It never becomes unbearably messy this way though. The reason it gets unbearably messy is because most people google "how to do x in github actions" (e.g. send a slack message) and there is a way and it's almost always worse than scripting it yourself.

The reason it gets unbearably messy is that GitHub has constructed an ecosystem that encourages developers to write Turing complete imperative behavior into YAML without providing the same language constructs/tooling that a proper adult language provides to encourage code reuse and debugging. Without tooling like this any sufficiently complex system is guaranteed to evolve into a spaghetti mess, because no sane way e…

It's not just Github, Gitlab uses the same mess of YAML-programming with custom extensions. So do, I believe, many other systems.

Ironically, Jenkins does this one correctly, they just give you a regular programming language. It's a shame there are so many other pitfalls, though.

Re: I'll think twice before using GitHub Actions again

#273
Many if not all mentioned issues derive from the fact that nowadays pipelines are most of the time - YML based - which is terrible choise for programming , you might want take a look at Sparky which is 100% Raku cicd system thst does not have many of mentioned pitfalls and super flexible …

Disclaimer I am the tool author - https://github.com/melezhik/sparky

Re: I'll think twice before using GitHub Actions again

#274
post #266

Earlier quoted context omitted.

> What in particular did you find "bad" with Python tech stack? Stateful virtualenvs with no way to check if they're clean (or undo mistakes), no locking of version resolution (much less deterministic resolution), only one-way pip freeze that only works for leaf projects (and poorly even then), no consistency/standards about how the project management works or even basic things like the directory layout, no structure…

Sounds a lot like nitpicking, and I'll demonstrate why. With docker containers, you can shell into it, do a couple of changes and "docker commit" it afterwards: similarly stateful, right? You resolve both by recreating them from scratch (and you could easily chmod -w the entire virtualenv directory if you don't want it to change accidentally). The pattern of using requirements.txt.in and pip-freeze generated requirem…

> With docker containers, you can shell into it, do a couple of changes and "docker commit" it afterwards: similarly stateful, right?

I guess theoretically you could, but I don't think that's part of anyone's normal workflow. Whereas it's extremely easy to run "pip install" from project A's directory with project B's virtualenv active (or vice versa). You might not even notice you've done it.

> You resolve both by recreating them from scratch

But with Docker you can wipe the container and start again from the image, which is fixed. You don't have to re-run the Dockerfile and potentially end up with different versions of everything, which is what you have to do with virtualenv (you run pip install and get something completely different from the virtualenv you deleted).

> you could easily chmod -w the entire virtualenv directory if you don't want it to change accidentally

But you have to undo it every time you want to add or update a dependency. In other ecosystems it's easy to keep my dependencies in line with what's in the equivalent of requirements.txt, but hard to install some random other unmanaged dependency. In the best ecosystems there's no need to "install" your dependencies at all, you just always have exactly the packages listed in the requirements.txt equivalent available at runtime when you run things.

> The pattern of using requirements.txt.in and pip-freeze generated requirements.txt has been around for a looong time, so it sounds like non-idiomatic way to use pip if you've got problems with locking of versions or non-leaf projects.

I've literally never seen a project that does that. And even if you do that, it's still harder to work with because you can't upgrade one dependency without unlocking all of your dependencies, right?

> As for directory layout, it's pretty clear it's guided by Python import rules

I don't mean within my actual code, I mean like: where does source code go, where does test code go, where do non-code assets go.

> Can you clarify what do you mean with "structured unit tests"?

I mean, like, if I'm at looking at a particular module in the source code, where do I go to find the tests for that module? Where's the test-support code as distinct from the specific tests?

> rarely do you need exactly a particular version of Python and any of the dev tools to be able to get a virtualenv off the ground

Whether virtualenv is available is a relatively recent change, so you already have a fractal problem. Having an uncontrolled way of installing your build environment is another of those things that's fine until it isn't.

> And there's a bunch of new dev tools springing up recently that are written in Rust for Python

Yeah, that's the one thing that gives me some hope that there might be light at the end of the tunnel, since I hear they mostly ignore all this idiocy (and avoid e.g. having user-facing virtualenvs at all) and just do the right thing. Hopefully once they catch on we'll see Python start to be ok without containers too and maybe the container hype will die down. But it's certainly not the case that everything has been fine since 2007; quite the opposite.

Re: I'll think twice before using GitHub Actions again

#275
post #90

Earlier quoted context omitted.

If you're not containerizing your CI/CD, you're really lost.

That might be the case if Docker did in fact guarantee (or at least make it easy to guarantee) deterministic builds -- but it doesn't really even try: 1. Image tags ("latest", etc.) can change over time. Does any layer in your Dockerfile -- including inside transitive deps -- build on an existing layer identified by tag? If so, you never had reproducibility. 2. Plenty of Dockerfiles include things like "apt-get some-…

I agree that Docker doesn't do the best job here, you can still get a lot better reproducibility than without though.

You can use specific image hashes to work around image tag changes.

For problem 2 ideally use something like NixOS as a base or at least nix package manager.

But IMO Nix is quite complicated, even though the working model is really good. So this is mostly if you really need deterministic builds.

Docker already gets you 80% of the way with 20% of the effort.

Re: I'll think twice before using GitHub Actions again

#276

Earlier quoted context omitted.

1. Use a hash for the base images. 2. The meaning of “latest” is dependent on what base images you are using. Using UBI images for example means your versions are not going to change because redhat versions don’t really change. But really containerizing the build environment is not related to deterministic builds as there’s a lot more work needed to guarantee that. Including possible changes in the application itself…

>But really containerizing the build environment is not related to deterministic builds What would you say the goal of containerising builds is, if not reproducibility?

They didn't say reproducibility, they said determinism.

If you use a container with the same apt-get commands and the same OS, you already separate out almost all the reproducibility issues. What you get will be a very similar environment.

But it's not deterministic as you point out, that takes a lot more effort.

Re: I'll think twice before using GitHub Actions again

#277

One thing that sounds very nice about Github are merge queues: Once your PR is ready, rather than merging, you submit it to the merge queue, which will rebase it on the last PR also on the merge queue. It then runs the CI on each PR, and finally merges them automatically once successful. If CI fails, doesn't get merged, and the next PR skips yours on the chain. Still a lot of computation & some wait time, but you can…

I remember when OpenStack had this a decade ago in open source software. How much the dream of OS has faded. :'(

https://opensource.com/article/20/2/zuul

Re: I'll think twice before using GitHub Actions again

#278
post #86

Earlier quoted context omitted.

Containerize the build environment so everything is captured (dependencies, build tools, etc)

If you don't value your and your developer's time, certainly, containerize everything. I've rarely seen a feedback loop with containers that's not longer than 10s only due to containerization itself, and that breaks the "golden" 10s rule (see https://www.nngroup.com/articles/response-times-3-important-... ). If you aim for quicker turn-around (eg. just running a single test in <1s), you'll have to either aggressively…

> I've rarely seen a feedback loop with containers that's not longer than 10s only due to containerization itself

Sounds like a skill issue tbh.

`time podman run —-rm -it fedora:latest echo hello` will return in a few milliseconds, whatever delay you are complaining about would be from the application running in the container.

Lastly containers != docker.

Re: I'll think twice before using GitHub Actions again

#279
post #5

> no way of running actions locally My policy is to never let pipeline DSLs contain any actual logic outside orchestration for the task, relying solely on one-liner build or test commands. If the task is more complicated than a one-liner, make a script for it in the repo to make it a one-liner. Doesn't matter if it's GitHub Actions, Jenkins, Azure DevOps (which has super cursed yaml), etc. This in turn means that you…

Although there are definitely merits in moving the complex logic outside of the CI/CD JSON/YAML DSL, especially when using monorepo setups that can become rather complex in their logic (that they made Google create Bazel, I can think of some interesting Borg/K8s analogies btw), I also believe that modern CI/CD platforms have made several sensible steps in the right direction to handle these more complicated use cases.

(Disclaimer: I work at CircleCI)

At CircleCI for example, we have added valuable features like a VSCode extension[0] to validate and "dry-run" config from within your IDE, we have local runners[1] that you can use to test and run pipelines on your local machine and your own infra, we have dynamic config[2], a Javascript/Typescript SDK[3], a CLI that can validate and run workflows locally[4], and QoL additions like a no-op job type[5] and flexible requires, along with flexible when statements and expression based job filters[6].

And finally, it's of course also possible to combine different approaches into a "best of both worlds" approach, f.e. combining Dagger with CircleCI[7].

[0]https://circleci.com/docs/vs-code-extension-overview/

[1]https://circleci.com/blog/using-runner-for-local-testing/

[2]https://circleci.com/docs/dynamic-config/

[3]https://circleci.com/docs/circleci-config-sdk/

[4]https://circleci.com/docs/how-to-use-the-circleci-local-cli/

[5]https://circleci.com/changelog/new-job-type-no-op-job-can-ma...

[6]https://circleci.com/changelog/more-flexible-job-required-ca...

[7]https://docs.dagger.io/integrations/circleci/

Re: I'll think twice before using GitHub Actions again

#280
post #220
post #179

Earlier quoted context omitted.

The job of senior people should mostly be to make sure the organisation runs smoothly. If no one else is doing anything about the mess, then it falls to the senior person to sort it out. As a rule of thumb: - Ideally your people do the Right Thing by themselves by the magic of 'leadership'. - Second best: you chase the people to do the Right Thing. - Third: you as the senior person do the Right Thing. - Least ideal:…

Where I work, which granted is a very large company, the enterprise architects focus on ERP processes, logistic flows, how prices flow from the system where they are managed to the places that need them, and so on. They are several levels removed from devops teams. DevOps concerns are maybe handled by tech leads, system architects or technical product managers.

Makes sense. From datavirtue's comment is sounded like they joined a much smaller outfit without much in terms of established _working_ procedures here.
Post reply on HN