3 ms·

We use Git submodules for Actions because our security has disabled 3rd party Actions. So we add them as a module and update the module regularly. It's faster

We use Git submodules for Actions because our security has disabled 3rd party Actions. So we add them as a module and update the module regularly. It's faster than having to fill out 3 sets of paperwork, 2 meeting with some guy just out of school in a time zone opposite mine and a 3 week delay. All while it's all good to adopt npm packages left and right. And this way it's checked for security issues, so it's even better than going through the paperwork hassle and get it adopted like that.

cube00 4y ago
What the "security" team doesn't realize is by blocking actions in this way they've opened up a wider hole. If a third party action had a problem it can be blocked centrally, instead these modules now live scattered throughout the code base relying on individual development teams to keep them updated. Those teams will not always be fully funded to keep an eye on every vulnerability in every module and keep everything up to date the same way a centrally managed dependency system can.