4 ms·
This is why I like GitLab much more. They implemented a proper CI. I think what GitHub was going for is to create some kind of ecosystem for proprietary 3rd pa
by takeda 5y ago
This is why I like GitLab much more. They implemented a proper CI.
I think what GitHub was going for is to create some kind of ecosystem for proprietary 3rd party applications and use that as a revenue. That approach only crippled the whole functionality.
- jaxn 5y agoMaybe it's just me, but I refuse to use third party actions in our build and deployment steps. It seems like such an obvious and avoidable attack surface to me, and one where an attached can have root on our production instances and at least some access to all developer machines.
- ameliaquining 5y agoYou can solve that by pinning commit hashes, so that nobody can change the code of the actions you use without your consent. You can then use Dependabot to automatically get PRs to update to the latest version of each action when it comes out. You still get the chance to review each PR before it goes in. I wish GitHub would implement a security setting requiring repositories to do this within an organization.