3 ms·
Sorry, that whole github actions concept gives me the screaming heeby-jeebies. We're really not even pulling the dependency locally, we're just going to run so
by marcus_holmes 7y ago
Sorry, that whole github actions concept gives me the screaming heeby-jeebies.
We're really not even pulling the dependency locally, we're just going to run someone else's code from their repo, on github's server, with our data and secrets?
What could possibly go wrong with that? /s
- edaemon 7y agoThis isn't much different than other CI/CD pipelines. Docker images come to mind.
- marcosdumay 7y agoThis isn't much different than other SaaS CI/CD pipelines.
- jrochkind1 7y agoRight, such as travis, circleci, gitlab, etc. All of which are pretty popular, so clearly there is interest in SaaS CI/CD.
- marcosdumay 7y agoYes, they are popular. But on-premises ones also exist, are popular too, and mostly do not have this one problem. It's a relevant distinction on this context.
- deleted 7y ago[deleted]
- edaemon 7y agoOn-premise CI/CD may still (and often does) use someone else's code, which can expose data and secrets in the same way as outlined. The only difference is that it's on your own infrastructure. There's something to be said for on-premise solutions, but they won't save you from a malicious maintainer.