Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub Actions has a package manager, and it might be the worst

nesbitt.io

Post reply on HN
Print view View original

91–100 of 267 posts

Re: GitHub Actions has a package manager, and it might be the worst

#91

Post by tonyhart7 »

Normal_gaussian wrote: post #88
mixedbit wrote: post #10

Earlier quoted context omitted.

An interesting things is that GitHub is an expensive service and my guess would be that MS makes good money on it. Our small company paid about 200+ USD monthly for GitHub, much larger cumulative cost than Windows licenses. My believe was that Windows is getting worse, because it is considered legacy business by MS in favor of new offerings such as GitHub subscriptions.

Very many more people use Windows to GitHub. GitHub also runs a free tier with significant usage. There are ~1.4b paid instances of Windows 10/11 desktop; and ~150m Monthly active accounts on GitHub, of which only a fraction are paid users. Windows is generating something in the region of $30b/yr for MS, and GitHub is around $2b/yr. MS have called out that Copilot is responsible for 40% of revenue growth in GitHub. W…

github value maybe as not apparent as other product

but github is pair well with MS other core product like Azure and VS/VSC department

MS has a good chance to have vertical integration on how software get written from scratch to production, if they can somehow bundle everything to all in one membership like Google one subs, I think they have a good chance

Re: GitHub Actions has a package manager, and it might be the worst

#92

Post by souenzzo »

saagarjha wrote: post #2

What’s more, GitHub has basically stopped maintaining their own actions, pushing people to sketchy forks to do basic things. Their entire ecosystem is basically held up with duct tape and gets very little investment.

you just described every microsoft business model.

Re: GitHub Actions has a package manager, and it might be the worst

#93

Post by tonyhart7 »

rjzzleep wrote: post #61
saagarjha wrote: post #44

Earlier quoted context omitted.

I’d appreciate not being called lazy for mentioning a lack of investment on Microsoft’s side to secure their paid and fairly lucrative service that they bought a popular code hosting platform to integrate with.

Can someone explain what this somewhat recent phenomenon is where people feel the need to defend the worlds biggest billion dollar businesses, that are also often subsidized by tax payer money in weird ways? How did we go in 20 years from holding these companies to account when they'd misbehave to acting as if they are poor damsels in distress whenever someone points out a flaw?

I think big tech being so big now that these "issue" is too small for their priority is saying something

You better thank god for MS for being lazy and incompetent, the last thing we want for big tech is being innovative and have a stronger monopoly

Re: GitHub Actions has a package manager, and it might be the worst

#94

Post by gabrielgio »

miohtama wrote: post #30
saagarjha wrote: post #2

What’s more, GitHub has basically stopped maintaining their own actions, pushing people to sketchy forks to do basic things. Their entire ecosystem is basically held up with duct tape and gets very little investment.

Everyone is free to use alternative CI/CD workflow pipelines. These are often better than Github Actions. These include - https://circleci.com/ - https://www.travis-ci.com/ - Gitlab Open source: - https://concourse-ci.org/ (discussed in the context of Radicle here https://news.ycombinator.com/item?id=44658820 ) - Jenkins -etc. Anyone can complain as much as they want, but unless they put the money where their mouth i…

> Anyone can complain as much as they want, but unless they put the money where their mouth is, it's just noise from lazy people.

Once I'm encharged of budge decisions of my company I'll make sure that none will go to any MS and Atlassian product. Until then I'll keep complaining.

Re: GitHub Actions has a package manager, and it might be the worst

#95

Post by PunchyHamster »

amluto wrote: post #83
PunchyHamster wrote: post #15

Earlier quoted context omitted.

> I would argue that a good CI/CD system should not support secrets as a first-class object at all. Instead steps may have privileges assigned. At most there should be an adapter, secure enclave style, that may hold a secret and give CI/CD steps the ability to do something with that secret, to be used for APIs that don’t support OIDC or some other mechanism to avoid secrets entirely. CI/CD does not exist in the vacuu…

You seem to be talking mostly about the CD part. Some thoughts: On the one hand, CD workflows are less exposed than CI workflows. You only deploy code that has made it through your review and CI processes. In a non-continuous deployment model, you only deploy code when you decide to. You are not running your CD workflow on a third-party pull request. On the other hand, the actual CD permission is a big deal. If you l…

Well, in my mind the build system should build an artifact (a container, or a .deb package), and then the separate system should deploy it (with smaller amount of permitted people), and have option to roll it back. So in principle I agree on that .

...but I saw that anti-pattern of "just add a step that does the deploy after CI in same" often enough that I think it might be the most common way to do it.

Re: GitHub Actions has a package manager, and it might be the worst

#96

Post by Sl1mb0 »

thrdbndndn wrote: post #77
rjzzleep wrote: post #61

Earlier quoted context omitted.

Can someone explain what this somewhat recent phenomenon is where people feel the need to defend the worlds biggest billion dollar businesses, that are also often subsidized by tax payer money in weird ways? How did we go in 20 years from holding these companies to account when they'd misbehave to acting as if they are poor damsels in distress whenever someone points out a flaw?

I won't "defend" Microsoft in this case, but I am always annoyed by phrases like "world's biggest billion-dollar businesses... bablah". Their size or past misbehaviors shouldn't be relevant to this discussion. Bringing those up feels a bit like an ad hominem. Whether criticism is valid should depend entirely on how GitHub Actions actually works and how it compares to similar services.

Microsoft's past behavior _may_ explain *why* there is a lack of investment in Github Actions; so yes, TheFeelz are relevant.

Re: GitHub Actions has a package manager, and it might be the worst

#97

Post by XCabbage »

miohtama wrote: post #30
saagarjha wrote: post #2

What’s more, GitHub has basically stopped maintaining their own actions, pushing people to sketchy forks to do basic things. Their entire ecosystem is basically held up with duct tape and gets very little investment.

Everyone is free to use alternative CI/CD workflow pipelines. These are often better than Github Actions. These include - https://circleci.com/ - https://www.travis-ci.com/ - Gitlab Open source: - https://concourse-ci.org/ (discussed in the context of Radicle here https://news.ycombinator.com/item?id=44658820 ) - Jenkins -etc. Anyone can complain as much as they want, but unless they put the money where their mouth i…

Well, actually, no, not everyone is free to use alternatives. Anyone using CI for "Trusted Publishing" of packages to PyPI or npm needs to use GitHub Actions or GitLab CI/CD. CircleCI and Travis CI are not supported. So many big open source projects for the two most popular languages in the world are now locked out of the alternatives you propose.

(I find it extremely sketchy from a competition law perspective that Microsoft, as the owner of npm, has implemented a policy banning npm publishers from publishing via competitors to GitHub Actions - a product that Microsoft also owns. But they have; that is the reality right now, whether it's legal or not.)

Re: GitHub Actions has a package manager, and it might be the worst

#98

Post by gcr »

thrdbndndn wrote: post #77
rjzzleep wrote: post #61

Earlier quoted context omitted.

Can someone explain what this somewhat recent phenomenon is where people feel the need to defend the worlds biggest billion dollar businesses, that are also often subsidized by tax payer money in weird ways? How did we go in 20 years from holding these companies to account when they'd misbehave to acting as if they are poor damsels in distress whenever someone points out a flaw?

I won't "defend" Microsoft in this case, but I am always annoyed by phrases like "world's biggest billion-dollar businesses... bablah". Their size or past misbehaviors shouldn't be relevant to this discussion. Bringing those up feels a bit like an ad hominem. Whether criticism is valid should depend entirely on how GitHub Actions actually works and how it compares to similar services.

Ad hominem applies to people. Corporations aren’t people, and ICs aren’t corporations.

Re: GitHub Actions has a package manager, and it might be the worst

#99

Post by dimgl »

miohtama wrote: post #30
saagarjha wrote: post #2

What’s more, GitHub has basically stopped maintaining their own actions, pushing people to sketchy forks to do basic things. Their entire ecosystem is basically held up with duct tape and gets very little investment.

Everyone is free to use alternative CI/CD workflow pipelines. These are often better than Github Actions. These include - https://circleci.com/ - https://www.travis-ci.com/ - Gitlab Open source: - https://concourse-ci.org/ (discussed in the context of Radicle here https://news.ycombinator.com/item?id=44658820 ) - Jenkins -etc. Anyone can complain as much as they want, but unless they put the money where their mouth i…

I tried to use CircleCI and I gotta say, it is absolutely not better than GitHub Actions…

Re: GitHub Actions has a package manager, and it might be the worst

#100

Post by drdec »

rjzzleep wrote: post #61
saagarjha wrote: post #44

Earlier quoted context omitted.

I’d appreciate not being called lazy for mentioning a lack of investment on Microsoft’s side to secure their paid and fairly lucrative service that they bought a popular code hosting platform to integrate with.

Can someone explain what this somewhat recent phenomenon is where people feel the need to defend the worlds biggest billion dollar businesses, that are also often subsidized by tax payer money in weird ways? How did we go in 20 years from holding these companies to account when they'd misbehave to acting as if they are poor damsels in distress whenever someone points out a flaw?

> How did we go in 20 years from holding these companies to account when they'd misbehave to acting as if they are poor damsels in distress whenever someone points out a flaw?

Honestly I think the problem is more a rosy view of the past versus any actual change in behavior. There have always been defenders of such companies.

Post reply on HN