Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub Actions has a package manager, and it might be the worst

nesbitt.io

Post reply on HN
Print view View original

61–70 of 267 posts

Re: GitHub Actions has a package manager, and it might be the worst

#61

Post by rjzzleep »

saagarjha wrote: post #44
miohtama wrote: post #30

Earlier quoted context omitted.

Everyone is free to use alternative CI/CD workflow pipelines. These are often better than Github Actions. These include - https://circleci.com/ - https://www.travis-ci.com/ - Gitlab Open source: - https://concourse-ci.org/ (discussed in the context of Radicle here https://news.ycombinator.com/item?id=44658820 ) - Jenkins -etc. Anyone can complain as much as they want, but unless they put the money where their mouth i…

I’d appreciate not being called lazy for mentioning a lack of investment on Microsoft’s side to secure their paid and fairly lucrative service that they bought a popular code hosting platform to integrate with.

Can someone explain what this somewhat recent phenomenon is where people feel the need to defend the worlds biggest billion dollar businesses, that are also often subsidized by tax payer money in weird ways?

How did we go in 20 years from holding these companies to account when they'd misbehave to acting as if they are poor damsels in distress whenever someone points out a flaw?

Re: GitHub Actions has a package manager, and it might be the worst

#62

Post by qznc »

amluto wrote: post #8

> The researchers identified four fundamental security properties that CI/CD systems need: admittance control, execution control, code control, and access to secrets. Why do CI/CD systems need access to secrets? I would argue need access to APIs and they need privileges to perform specific API calls. But there is absolutely nothing about calling an API that fundamentally requires that the caller know a secret. I woul…

We use proprietary tools (QNX compiler, Coverity static analysis, ...) and those require access to a license server which requires some secret.

I don't really understand what you mean by "secure enclave style"? How would that be different?

Re: GitHub Actions has a package manager, and it might be the worst

#63

Post by conartist6 »

saagarjha wrote: post #48
crote wrote: post #38

Earlier quoted context omitted.

That's insane, so they are basically dropping support on a core feature of GH Actions?

This is on the checkout action too, by the way. You know, the very first thing people put in their CI pipeline.

Wow, Microsoft just can't stop taking a dump on their users

Re: GitHub Actions has a package manager, and it might be the worst

#64

Post by worldsayshi »

I've not understood the propensity for using yaml for CI pipelines and workflows in general. A decent programming language would be a big improvement.

Why not just build the workflows themselves as docker images? I guess running other docker images in the workflow would then become a problem.

Re: GitHub Actions has a package manager, and it might be the worst

#65

Post by mvc »

baq wrote: post #14

Normally I’d say stop kicking the dead horse, but GHA deserves all the complaints it gets and then some. It’s the embodiment of everything that’s bad in ‘less is more’. My biggest concern with it is that it’s somehow the de facto industry standard. You could do so much better with relatively small investments, but MS went full IE6 with it… and now there’s a whole generation of young engineers who don’t know how short…

> there’s a whole generation of young engineers who don’t know how short their end of the stick actually is

I'm from a generation who had to use VSS for a few years. The sticks are pretty long these days, even the ones you get from github.

Re: GitHub Actions has a package manager, and it might be the worst

#66

Post by input_sh »

ramon156 wrote: post #37
miohtama wrote: post #30

Earlier quoted context omitted.

Everyone is free to use alternative CI/CD workflow pipelines. These are often better than Github Actions. These include - https://circleci.com/ - https://www.travis-ci.com/ - Gitlab Open source: - https://concourse-ci.org/ (discussed in the context of Radicle here https://news.ycombinator.com/item?id=44658820 ) - Jenkins -etc. Anyone can complain as much as they want, but unless they put the money where their mouth i…

according to travis-ci, Microsoft uses that? Lol

You're falling for a marketing trick.

What that type of section usually means is "there's someone from Microsoft that signed up for our service using his work account", sometimes it means "there's some tiny team within Microsoft that uses our product", but it very rarely (if ever) means "the entire company is completely reliant on our product".

Re: GitHub Actions has a package manager, and it might be the worst

#67

Post by rjzzleep »

ironmagma wrote: post #59
saagarjha wrote: post #44

Earlier quoted context omitted.

I’d appreciate not being called lazy for mentioning a lack of investment on Microsoft’s side to secure their paid and fairly lucrative service that they bought a popular code hosting platform to integrate with.

There is a massive problem in open source where some people equate pointing out a problem with being too lazy to solve it — when in reality this just stifles the conversation. Especially when a prerequisite to any group project accomplishing anything is to first discuss the problem to be solved.

No that's actually a completely different issue. You're talking about volunteers working on side projects that are sometimes foundational to the way the internet works and then people feel entitled to tell them what to do without contributing.

Here we are talking about one of the worlds most valuable companies that gets all sorts of perks, benefits and preferential treatment from various entities and governments on the globe and somehow we have to be grateful when they deliver garbage while milking the business they bought.

Re: GitHub Actions has a package manager, and it might be the worst

#68

Post by hexbin010 »

rjzzleep wrote: post #61
saagarjha wrote: post #44

Earlier quoted context omitted.

I’d appreciate not being called lazy for mentioning a lack of investment on Microsoft’s side to secure their paid and fairly lucrative service that they bought a popular code hosting platform to integrate with.

Can someone explain what this somewhat recent phenomenon is where people feel the need to defend the worlds biggest billion dollar businesses, that are also often subsidized by tax payer money in weird ways? How did we go in 20 years from holding these companies to account when they'd misbehave to acting as if they are poor damsels in distress whenever someone points out a flaw?

> How did we go in 20 years from holding these companies to account when they'd misbehave to acting as if they are poor damsels in distress whenever someone points out a flaw?

They hired a ton of people on very very good salaries

Re: GitHub Actions has a package manager, and it might be the worst

#69

Post by tom1337 »

We are currently using GitHub Actions for all our CI tasks and I hate it. Yes, the marketplace is nice and there are a lot of utility actions which make life easier, but they all come with the issues the post highlights. Additionally, testing Actions locally is a nightmare. I know that act exists but for us it wasn't working most of the time. Also the whole environment management is kinda odd to me and the fact, that when using an environment (which then allows to access secrets set in that environment) it always creates a new deployment is just annoying [1]

I guess the best solution is to just write custom scripts in whatever language one prefers and just call those from the CI runner. Probably missing out on some fancy user interfaces but at least we'd no longer be completely locked into GHA...

[1] https://github.com/orgs/community/discussions/36919

Re: GitHub Actions has a package manager, and it might be the worst

#70

Post by nsoqm »

rjzzleep wrote: post #61
saagarjha wrote: post #44

Earlier quoted context omitted.

I’d appreciate not being called lazy for mentioning a lack of investment on Microsoft’s side to secure their paid and fairly lucrative service that they bought a popular code hosting platform to integrate with.

Can someone explain what this somewhat recent phenomenon is where people feel the need to defend the worlds biggest billion dollar businesses, that are also often subsidized by tax payer money in weird ways? How did we go in 20 years from holding these companies to account when they'd misbehave to acting as if they are poor damsels in distress whenever someone points out a flaw?

The original comment said to stop giving money to these companies if they are not giving you a satisfactory service.

The opposite, to be lazy and to continue giving them money whilst being unhappy with what you get in return, would actually be more like defending the companies.

Post reply on HN