Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub Actions is the weakest link

nesbitt.io

Post reply on HN
Print view View original

61–70 of 95 posts

Re: GitHub Actions is the weakest link

#61

Post by mmarian »

woodruffw wrote: post #56
mmarian wrote: post #55

Earlier quoted context omitted.

I agree, silly limitation. On zizmor, there's no mention of coverage on commit SHA the section you've linked, nor in the entire page when I do Ctrl+F. Is there anything I'm missing?

Oh, I guess I didn't document it explicitly. My bad! You can see it in the source here[1]. [1]: https://github.com/zizmorcore/zizmor/blob/db5ed6b3bb445848a8...

Oh, nice, will look into it, thanks! Let me know if you're aware of any other tools that do this. I had a look before and couldn't find any.

Re: GitHub Actions is the weakest link

#63

Post by xenophonf »

maxloh wrote: post #12
rmunn wrote: post #4

Back when GitHub Actions first came out, I used commit hashes rather than tags in all my `uses:` lines. Some of my colleagues disagreed, saying that tags were secure enough. I eventually said, "Well, for well-known actions like actions/checkout, sure; if that one gets compromised it'll be all over the news within minutes." But for all the third-party actions, I kept commit hashes. I feel rather vindicated now. There'…

GitHub Actions doesn't have a lock file, so your repo is still prone to transitive attacks if the SHA-locked actions you use also happen to use other composite actions by tags, which could be compromised in the future.

"Require actions to be pinned to a full-length commit SHA" applies to composite actions, too. I had to replace pre-commit/action as a result.

Re: GitHub Actions is the weakest link

#64

Post by dnnddidiej »

recursivedoubts wrote: post #10

Programming in YAML has always seemed crazy to me. Actions seem like a great place to create a simple mixed imperative/declarative scripting language (js extension or whatever) with a solid instrumented/observable/debuggable runtime and an OO API that can be run locally against mock infrastructure.

Having tried Pulumi for IaC I am not a fan. Pulumi is excellent but the concept is what I am not keen on. It is a rabbit hole for devs and it allows complexity where in Yaml you are forced to KISS.

Re: GitHub Actions is the weakest link

#65

Post by pss314 »

John Howard (one of the maintainers of Istio and currently with Solo.io) blogged about "Fast GitHub Actions with Blacksmith" [1]. The blog also contains a link to "GitHub Action Runner Alternatives" [2].

[1]: https://blog.howardjohn.info/posts/blacksmith-gha/

[2]: https://binhong.me/blog/github-action-runner-alternatives/

Re: GitHub Actions is the weakest link

#66

Post by mehackernewsacc »

shykes wrote: post #14

I apologize in advance for the plug. I've spent the last 5 years warning of the importance of not leaving CI locked in a black box platform and proprietary DSL. All the while going on a quest to reinvent CI as an open, programmable platform. Honestly it's still a work-in-progress: it turns out that reinvention is hard! But, if you want a glimpse of what CI can be when you shed 30 years of legacy, consider checking ou…

Are you hiring? This sounds like a really cool space and product to work on.

Re: GitHub Actions is the weakest link

#67

Post by koolba »

rmunn wrote: post #4

Back when GitHub Actions first came out, I used commit hashes rather than tags in all my `uses:` lines. Some of my colleagues disagreed, saying that tags were secure enough. I eventually said, "Well, for well-known actions like actions/checkout, sure; if that one gets compromised it'll be all over the news within minutes." But for all the third-party actions, I kept commit hashes. I feel rather vindicated now. There'…

Even SHA pinning only lets you go one hop. If the pinned action itself uses any non pinned actions, you’re still susceptible.

I don’t think this problem is fixable without a higher level way to specify the full nested tree. Something like TOFU for the first time your action ran (pinning all children as of that run) might be an improvement, but that is still can be gamed by a timed attack that modifies the action at a later date (literally, if time greater than X do …).

Re: GitHub Actions is the weakest link

#68

Post by deepsun »

rmunn wrote: post #4

Back when GitHub Actions first came out, I used commit hashes rather than tags in all my `uses:` lines. Some of my colleagues disagreed, saying that tags were secure enough. I eventually said, "Well, for well-known actions like actions/checkout, sure; if that one gets compromised it'll be all over the news within minutes." But for all the third-party actions, I kept commit hashes. I feel rather vindicated now. There'…

Maybe it's better to pull that dependency source in your action altogether?

Re: GitHub Actions is the weakest link

#70

Post by ostkai »

shykes wrote: post #14

I apologize in advance for the plug. I've spent the last 5 years warning of the importance of not leaving CI locked in a black box platform and proprietary DSL. All the while going on a quest to reinvent CI as an open, programmable platform. Honestly it's still a work-in-progress: it turns out that reinvention is hard! But, if you want a glimpse of what CI can be when you shed 30 years of legacy, consider checking ou…

I ALMOST chose dagger, but the idea of writing code to build my code felt like maintaining two applications. While I didn't chose it, the idea that new paradigms are needed was the draw.
Post reply on HN