Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub Actions has a package manager, and it might be the worst

nesbitt.io

Post reply on HN
Print view View original

71–80 of 267 posts

Re: GitHub Actions has a package manager, and it might be the worst

#71

Post by trueno »

worldsayshi wrote: post #64

I've not understood the propensity for using yaml for CI pipelines and workflows in general. A decent programming language would be a big improvement. Why not just build the workflows themselves as docker images? I guess running other docker images in the workflow would then become a problem.

it's wild I can wiz through a ton of code for hours on end but seeing a yaml file for something like a CI pipeline actually makes my brain eject i dunno why. my brain has some sort of proverbial capacity limit with how many different configuration-file looking things I can tolerate in a day, and the prospect of becoming intimately familiar with what is effectively an auto integration presented to me as some sort of config makes me completely unjustifiably butthurt for no reason. have i not suffered enough needless and often times limiting abstractions already

Re: GitHub Actions has a package manager, and it might be the worst

#72

Post by ignoramous »

> Some teams vendor actions into their own repos. zizmor is excellent at scanning workflows and finding security issues. But these are workarounds for a system that lacks the basics.

Harsh given GitHub makes it very easy to setup attestations for Artifact (like build & sbom) provenances.

That said, Zizmor (static analyser for GitHub Actions) with Step Security's Harden Runner (a runtime analyser) [0] pair nicely, even if the latter is a bit of an involved setup.

[0] https://github.com/step-security/harden-runner

> The fix is a lockfile.

Hopefully, SLSA drafts in Hermetic build process as a requirement: https://slsa.dev/spec/v1.2/future-directions

Re: GitHub Actions has a package manager, and it might be the worst

#73

Post by weikju »

conartist6 wrote: post #63
saagarjha wrote: post #48

Earlier quoted context omitted.

This is on the checkout action too, by the way. You know, the very first thing people put in their CI pipeline.

Wow, Microsoft just can't stop taking a dump on their users

they probably have a half-assed plan to push some sort of checkout action copilot button instead of dependable scripts/actions.

Re: GitHub Actions has a package manager, and it might be the worst

#74

Post by LilBytes »

samhh wrote: post #16
mixedbit wrote: post #10

Earlier quoted context omitted.

An interesting things is that GitHub is an expensive service and my guess would be that MS makes good money on it. Our small company paid about 200+ USD monthly for GitHub, much larger cumulative cost than Windows licenses. My believe was that Windows is getting worse, because it is considered legacy business by MS in favor of new offerings such as GitHub subscriptions.

I was surprised to learn that Depot runners, which are much faster, are also much cheaper. Would highly recommend them for anyone trapped on GitHub.

Depot.dev is great.

Re: GitHub Actions has a package manager, and it might be the worst

#75

Post by Bombthecat »

saagarjha wrote: post #2

What’s more, GitHub has basically stopped maintaining their own actions, pushing people to sketchy forks to do basic things. Their entire ecosystem is basically held up with duct tape and gets very little investment.

Didn't they announce to slow down development for AI?

Re: GitHub Actions has a package manager, and it might be the worst

#76

Post by amluto »

qznc wrote: post #62
amluto wrote: post #8

> The researchers identified four fundamental security properties that CI/CD systems need: admittance control, execution control, code control, and access to secrets. Why do CI/CD systems need access to secrets? I would argue need access to APIs and they need privileges to perform specific API calls. But there is absolutely nothing about calling an API that fundamentally requires that the caller know a secret. I woul…

We use proprietary tools (QNX compiler, Coverity static analysis, ...) and those require access to a license server which requires some secret. I don't really understand what you mean by "secure enclave style"? How would that be different?

With a secure enclave or an HSM, there's a secret, but the users do not have access to the secret. So, if you have a workflow that needs to, say, sign with a given private key, you would get an API that signs for you. If you need to open a TLS connection with a client certificate, you get a proxy that authenticates for you.

I suppose I would make an exception for license keys. Those have minimal blast radii if they leak.

Re: GitHub Actions has a package manager, and it might be the worst

#77

Post by thrdbndndn »

rjzzleep wrote: post #61
saagarjha wrote: post #44

Earlier quoted context omitted.

I’d appreciate not being called lazy for mentioning a lack of investment on Microsoft’s side to secure their paid and fairly lucrative service that they bought a popular code hosting platform to integrate with.

Can someone explain what this somewhat recent phenomenon is where people feel the need to defend the worlds biggest billion dollar businesses, that are also often subsidized by tax payer money in weird ways? How did we go in 20 years from holding these companies to account when they'd misbehave to acting as if they are poor damsels in distress whenever someone points out a flaw?

I won't "defend" Microsoft in this case, but I am always annoyed by phrases like "world's biggest billion-dollar businesses... bablah".

Their size or past misbehaviors shouldn't be relevant to this discussion. Bringing those up feels a bit like an ad hominem. Whether criticism is valid should depend entirely on how GitHub Actions actually works and how it compares to similar services.

Re: GitHub Actions has a package manager, and it might be the worst

#78

Post by ChrisMarshallNY »

mvc wrote: post #65
baq wrote: post #14

Normally I’d say stop kicking the dead horse, but GHA deserves all the complaints it gets and then some. It’s the embodiment of everything that’s bad in ‘less is more’. My biggest concern with it is that it’s somehow the de facto industry standard. You could do so much better with relatively small investments, but MS went full IE6 with it… and now there’s a whole generation of young engineers who don’t know how short…

> there’s a whole generation of young engineers who don’t know how short their end of the stick actually is I'm from a generation who had to use VSS for a few years. The sticks are pretty long these days, even the ones you get from github.

> VSS

I just had trauma!

I will say that SourceSafe had one advantage: You could create "composite" proxy workspaces.

You could add one or two files from one workspace, and a few from another, etc. The resulting "avatar" workspace would act like they were all in the same workspace. It was cool.

However, absolutely everything else sucked.

I don't miss it.

Re: GitHub Actions has a package manager, and it might be the worst

#79

Post by eviks »

mixedbit wrote: post #10
saagarjha wrote: post #2

What’s more, GitHub has basically stopped maintaining their own actions, pushing people to sketchy forks to do basic things. Their entire ecosystem is basically held up with duct tape and gets very little investment.

An interesting things is that GitHub is an expensive service and my guess would be that MS makes good money on it. Our small company paid about 200+ USD monthly for GitHub, much larger cumulative cost than Windows licenses. My believe was that Windows is getting worse, because it is considered legacy business by MS in favor of new offerings such as GitHub subscriptions.

The legacy business usually explains why there are no new features, only minor maintenance, it doesn't explain why there is a lot of investment into work that makes it worse

Re: GitHub Actions has a package manager, and it might be the worst

#80

Post by blibble »

mixedbit wrote: post #10
saagarjha wrote: post #2

What’s more, GitHub has basically stopped maintaining their own actions, pushing people to sketchy forks to do basic things. Their entire ecosystem is basically held up with duct tape and gets very little investment.

An interesting things is that GitHub is an expensive service and my guess would be that MS makes good money on it. Our small company paid about 200+ USD monthly for GitHub, much larger cumulative cost than Windows licenses. My believe was that Windows is getting worse, because it is considered legacy business by MS in favor of new offerings such as GitHub subscriptions.

I wouldn't be surprised if there isn't some plan to make all of GitHub's backend "legacy"

and switch everyone to the dumpster fire that is Azure DevOps

and if you thought GitHub Actions was bad...

Post reply on HN