Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub Actions has a package manager, and it might be the worst

nesbitt.io

Post reply on HN
Print view View original

31–40 of 267 posts

Re: GitHub Actions has a package manager, and it might be the worst

#31

Post by barrkel »

TrianguloY wrote: post #27

I'm not sure I follow. If I write actions/setup-python@v1, I'm expecting the action to run with the v1 tag of that repository. If I rerun it, I expect it to run with the v1 tag of that repository...which I'm aware may not be the same if the tag was updated. If I instead use actions/setup-python@27b31702a0e7fc50959f5ad993c78deac1bdfc29 then I'm expecting the action to run with that specific commit. And if I run it aga…

You specifying the top level hash doesn't do anything to pin transitive dependencies, and as the article points out, transitive dependencies - especially dependencies common to a lot of actions - would be the juciest target for a supply chain attack.

Re: GitHub Actions has a package manager, and it might be the worst

#33

Post by barrkel »

amluto wrote: post #8

> The researchers identified four fundamental security properties that CI/CD systems need: admittance control, execution control, code control, and access to secrets. Why do CI/CD systems need access to secrets? I would argue need access to APIs and they need privileges to perform specific API calls. But there is absolutely nothing about calling an API that fundamentally requires that the caller know a secret. I woul…

How do you e.g. validate that a database product works with all the different cloud databases? Every time you change up SQL generation you're going to want to make sure the SQL parses and evaluates as expected on all supported platforms.

Those tests will need creds to access third party database endpoints.

Re: GitHub Actions has a package manager, and it might be the worst

#34

Post by [deleted] »

zahlman wrote: post #20
baq wrote: post #14

Normally I’d say stop kicking the dead horse, but GHA deserves all the complaints it gets and then some. It’s the embodiment of everything that’s bad in ‘less is more’. My biggest concern with it is that it’s somehow the de facto industry standard. You could do so much better with relatively small investments, but MS went full IE6 with it… and now there’s a whole generation of young engineers who don’t know how short…

I'm accustomed to just doing as much as possible locally. GHA doesn't even seem like a value-add over that for me.

[deleted]

Re: GitHub Actions has a package manager, and it might be the worst

#35

Post by jdeastwood »

cyberax wrote: post #11
amluto wrote: post #8

> The researchers identified four fundamental security properties that CI/CD systems need: admittance control, execution control, code control, and access to secrets. Why do CI/CD systems need access to secrets? I would argue need access to APIs and they need privileges to perform specific API calls. But there is absolutely nothing about calling an API that fundamentally requires that the caller know a secret. I woul…

You might want (or _need_) to sign your binary, for example. Or you might want to trigger a deployment. Github actually is doing something right here. You can set it up as a trusted identity provider in AWS, and then use Github to assume a role in your AWS account. And from there, you can get access to credentials stored in Secret Manager or SSM.

Yes, their oidc setup was probably their last good feature back when they were actually delivering features back in 2020ish. Everyone else copied it within a few months though.

Re: GitHub Actions has a package manager, and it might be the worst

#36

Post by pjc50 »

This is making me feel quietly vindicated in pushing back on migrating our Jenkins/Ansible setup to GHA simply because corporate wanted the new shiny thing. Fortunately the "this will be a lot of work, i.e. cost" argument won.

Mind you, CI does always involve a surprising amount of maintenance. Update churn is real. And Macs still are very much more fiddly to treat as "cattle" machines.

Re: GitHub Actions has a package manager, and it might be the worst

#37

Post by ramon156 »

miohtama wrote: post #30
saagarjha wrote: post #2

What’s more, GitHub has basically stopped maintaining their own actions, pushing people to sketchy forks to do basic things. Their entire ecosystem is basically held up with duct tape and gets very little investment.

Everyone is free to use alternative CI/CD workflow pipelines. These are often better than Github Actions. These include - https://circleci.com/ - https://www.travis-ci.com/ - Gitlab Open source: - https://concourse-ci.org/ (discussed in the context of Radicle here https://news.ycombinator.com/item?id=44658820 ) - Jenkins -etc. Anyone can complain as much as they want, but unless they put the money where their mouth i…

according to travis-ci, Microsoft uses that? Lol

Re: GitHub Actions has a package manager, and it might be the worst

#38

Post by crote »

coryrc wrote: post #17
crote wrote: post #7

Earlier quoted context omitted.

This is the first time I've heard of this, do you happen to have an example?

https://github.com/search?q=org%3Aactions+%22we+are+allocati... i.e. from https://github.com/actions/cache/?tab=readme-ov-file#note Thank you for your interest in this GitHub repo, however, right now we are not taking contributions. We continue to focus our resources on strategic areas that help our customers be successful while making developers' lives easier. While GitHub Actions remains a key part of this vision,…

That's insane, so they are basically dropping support on a core feature of GH Actions?

Re: GitHub Actions has a package manager, and it might be the worst

#39

Post by regularfry »

Kinrany wrote: post #19
PunchyHamster wrote: post #15

Earlier quoted context omitted.

> I would argue that a good CI/CD system should not support secrets as a first-class object at all. Instead steps may have privileges assigned. At most there should be an adapter, secure enclave style, that may hold a secret and give CI/CD steps the ability to do something with that secret, to be used for APIs that don’t support OIDC or some other mechanism to avoid secrets entirely. CI/CD does not exist in the vacuu…

CI shouldn't do deployments, deployment pipelines should run separately when a new release passes CI Of course the general purpose task runner that both run on does need to support secrets

We're iterating towards GHA for CI, AWS CodeBuild for the CD. At least on AWS projects. Mainly because managing IAM permissions to permit the github runner to do everything the deployment wants is an astonishingly large waste of time. But you need a secret to trigger one from the other.

Re: GitHub Actions has a package manager, and it might be the worst

#40

Post by regularfry »

LoganDark wrote: post #28

I checked out the linked GitHub repo https://github.com/ecosyste-ms/package-manager-resolvers and it appears to be just a README.md that collects summaries of different package managers? How do I know these weren't just LLM-generated?

You don't, but that's the wrong question. How do you know they're accurate?
Post reply on HN