3 ms·

Wait, people actually just blindly paste together calls into GitHub actions written by someone else who can change it at any time? You know what, no this makes

Wait, people actually just blindly paste together calls into GitHub actions written by someone else who can change it at any time? You know what, no this makes perfect sense. This is exactly, perfectly in line with the modern software ethos. Jesus. I'm so glad that 100% of my GitLab pipelines is code I wrote. It's owned by the company and it lives in our source control and runs on our hardware. I think you'd be nuts to do anything else, honestly. For entirely related reasons, I'm thrilled that my career is moving in a direction away from devops and software in general. I can't stomach it anymore.

Gigachad 2y ago
Before this article I had no idea this was even something you could do let alone something that's common. Why would you not just copy the couple of lines in to your own config. It's not like you need to subscribe to updates on a command to get changed files. You want the exact opposite so your CI doesn't randomly break due to external changes.
- dboreham 2y ago
  And then 2 years later you discover there was a security bug in that code you copied..
  - Gigachad 2y ago
    A security bug on a one liner regex to select some files in my own repo that changed? Seems far fetched.
re-thc 2y ago
> just blindly paste together calls into GitHub actions written by someone else who can change it at any time? That’s old news. Now they have the AI do it.
achierius 2y ago
Where to (just out of curiosity)?
jillesvangurp 2y ago
Most people use several hundreds millions of lines of code provided by somebody else on a daily basis (your laptop, your phone, your hair dryer, car, etc). Most of that stuff gets built using libraries, components, frameworks, etc. provided by third parties. The whole system runs on trust that all those people do the right things. Sometimes that trust is broken. But mostly it's surprisingly fine. Part of the reason is that bad people are the exception and not the norm and all those other people react when we find one, some are mildly paranoid about this, and processes exist for flagging suspicious things (e.g. CVEs). What we need is not to audit everything ourselves. Because that's humanly impossible. But better trust verification mechanisms and tools. Github has some mechanisms for actions but it still has some vulnerabilities. It's not perfect. But it's better than nothing. Replacing those by auditing/building yourself is going to either result in a lot of work or security with holes in it (i.e. you are moving the problem, not solving it). You could argue that most GH Actions are simple enough that building yourself is not the end of the world. It depends on what you are doing. I take the middleground. I use GH actions but only with widely used actions maintained by Github. Actions are just docker containers. So, the advice can be generalized to those. Check where they come from; who is building them; what their release practices are. Etc.

Gigachad 2y ago

Before this article I had no idea this was even something you could do let alone something that's common. Why would you not just copy the couple of lines in to your own config. It's not like you need to subscribe to updates on a command to get changed files. You want the exact opposite so your CI doesn't randomly break due to external changes.

dboreham 2y ago
And then 2 years later you discover there was a security bug in that code you copied..
- Gigachad 2y ago
  A security bug on a one liner regex to select some files in my own repo that changed? Seems far fetched.

re-thc 2y ago

> just blindly paste together calls into GitHub actions written by someone else who can change it at any time? That’s old news. Now they have the AI do it.

achierius 2y ago

Where to (just out of curiosity)?

jillesvangurp 2y ago

Most people use several hundreds millions of lines of code provided by somebody else on a daily basis (your laptop, your phone, your hair dryer, car, etc). Most of that stuff gets built using libraries, components, frameworks, etc. provided by third parties. The whole system runs on trust that all those people do the right things. Sometimes that trust is broken. But mostly it's surprisingly fine. Part of the reason is that bad people are the exception and not the norm and all those other people react when we find one, some are mildly paranoid about this, and processes exist for flagging suspicious things (e.g. CVEs). What we need is not to audit everything ourselves. Because that's humanly impossible. But better trust verification mechanisms and tools. Github has some mechanisms for actions but it still has some vulnerabilities. It's not perfect. But it's better than nothing. Replacing those by auditing/building yourself is going to either result in a lot of work or security with holes in it (i.e. you are moving the problem, not solving it). You could argue that most GH Actions are simple enough that building yourself is not the end of the world. It depends on what you are doing. I take the middleground. I use GH actions but only with widely used actions maintained by Github. Actions are just docker containers. So, the advice can be generalized to those. Check where they come from; who is building them; what their release practices are. Etc.