5 ms·

GitHub Actions is the weakest link

252 points by dochtman 5mo ago

KolmogorovComp 5mo ago
This should really what LLM ought to bring in terms of security. Be able to break things faster considering it is now easier for the maintainers to fix them. This has downsides of course, moving further into the "everything rot so fast these days" trope, but we will in a adversarial world where the threat is constantly evolving. Tomorrow (today) the servers and repo won't be scanned by scripts anymore but by increasingly capable models with knowledge about more security issues than many searchers.
tomaytotomato 5mo ago
<tangent> Github actions is running like treacle now. Even when our company pays lots of money for cloud and private Github runners. I know its the go-to punchbag but I think enabling Copilot reviews globally for a large proportion of Github was a bit hasty. The security problems aside, if it continues this way, people won't be able to ship and deploy code from Github actions. We might dare I say it, have to go back to self hosted Jenkins or Travis CI.
- tagraves 5mo ago
  shameless self plug, but please check out RWX! (rwx.com)
rmunn 5mo ago
Back when GitHub Actions first came out, I used commit hashes rather than tags in all my `uses:` lines. Some of my colleagues disagreed, saying that tags were secure enough. I eventually said, "Well, for well-known actions like actions/checkout, sure; if that one gets compromised it'll be all over the news within minutes." But for all the third-party actions, I kept commit hashes. I feel rather vindicated now. There's still a small possibility of getting supply-chain attacked via a SHA collision, or a relatively much larger (though still small in absolute terms) possibility of getting supply-chain attacked via NPM dependencies of the action you're relying on. But if you're not using a commit hash in your `uses:` lines, go switch to it now. And if you're just using major-version-only tags like `v5` then do it RIGHT now, before that action gets a compromised version uploaded with a `v5.2.3` tag.
- samuelknight 5mo ago
  There is no realistic risk of a SHA collision attack. Getting supply chain attacked via NPM dependencies is much more likely. Hopefully the actions creators are also pinning their hashes.
  - kbolino 5mo ago
    > There is no realistic risk of a SHA collision attack. Indeed. To illustrate why: 1. It is not possible to "retroactively" find a SHA-1 collision for an already known hash. If somebody has produced a SHA-1 hash non-maliciously at any point in the past, it is safe from collisions. This is due to second-preimage resistance, which hasn't been broken for SHA-1 and doesn't seem likely to be broken any time soon. 2. The only way to obtain a SHA-1 collision is to do so knowingly when producing the original hash. You generate a pair of inputs at the same time that both hash to the same value. Certainly, this is an imaginable scenario; e.g. a trusted committer could push one half of the pair wittingly or a reviewer could be fooled into accepting one half of the pair unwittingly, both scenarios creating a timebomb where the malicious actor swaps the commit to the second half of the pair (which presumably carries a malicious payload) later. However, there are two blockers to this approach: Git (not just GitHub) will not accept a commit with a duplicate hash, always sticking with the original one, and GitHub specifically has implemented signature detection for the known SHA-1 collision-generating methods and will reject both halves of such a pair. In short, there's just no practical way to exploit this weakness of SHA-1 with Git.
- arionmiles 5mo ago
  I feel pretty happy we use Renovator (EDIT: It's Renovate) at my current workplace which by default will raise PRs to change any tags for actions with the SHA instead. Then, even when it bumps the version in future PRs, it bumps the SHA (with a comment of which tag version it represents)
  - tecleandor 5mo ago
    Is it Renovator or Renovate? I'm trying to find it to check it out...
faangguyindia 5mo ago
I just have a Spot instance we use for our builds. It's turned on via serverless, runs it's job with a timeout and exits. Lately i don't use any managed services and life couldn't be any simpler.
- kevin_nisbet 5mo ago
  My team has been using https://runs-on.com/ https://runs-on.com/ for AWS instance runners, had a few glitches but largely been great for using AWS instances for runners.
indigodaddy 5mo ago
This aligns nicely with today's/current GitHub Actions outage
- iso1631 5mo ago
  Github outage? Must be a Y in the day
recursivedoubts 5mo ago
Programming in YAML has always seemed crazy to me. Actions seem like a great place to create a simple mixed imperative/declarative scripting language (js extension or whatever) with a solid instrumented/observable/debuggable runtime and an OO API that can be run locally against mock infrastructure.
- bastardoperator 5mo ago
  No thanks, Jenkins has three DSL languages and none of it is good. You dont have to inline code in yaml, you can call a script and call it day, write that script in any language you want.
  - cenamus 5mo ago
    You can do the same in jenkins, but a bit of scripting is probably more readable in Groovy than whatever Yaml dsl. But I totally agree that the Jenkins langs are terrible, the errors even worse, somehow they managed to make jvm backtraces even more unreadable.
    - LelouBil 5mo ago
      I don't know why they don't pivot to Kotlin. Gradle did it successfully and it's great now.
      - cenamus 5mo ago
        Don't they have a major thing going on with CSP (as with Scheme) that sort ot persists pipeline state automatically? That would allow you to kill Jenkins and afterwards restart the pipeline from exactly where you left off? But I never tried it personally
  - lstodd 5mo ago
    idk I always just wrote shell to be called by jenkins. none of this idiocy of programming with html comboboxes. DSL for the domain is shell, no need to invent hyperwheels here.
shykes 5mo ago
I apologize in advance for the plug. I've spent the last 5 years warning of the importance of not leaving CI locked in a black box platform and proprietary DSL. All the while going on a quest to reinvent CI as an open, programmable platform. Honestly it's still a work-in-progress: it turns out that reinvention is hard! But, if you want a glimpse of what CI can be when you shed 30 years of legacy, consider checking out Dagger (https://dagger.io https://dagger.io). Or, if you just want to talk about the future of CI with like-minded systems engineers, without committing to using a particular product, consider joining our Discord: https://discord.com/invite/dagger-io https://discord.com/invite/dagger-io
- sureglymop 5mo ago
  Looks cool. Can it be self hosted? I.e. can I self host it next to my self hosted forgejo instance?
  - shykes 5mo ago
    Yes, the Dagger engine is open source. Note that the engine on its own is not a CI replacement: it provides a runtime for your pipelines, but you still need an external system to trigger pipelines from git events. This decoupling is intentional, because CI should not be tightly coupled to git events. Sometimes you want to run a pipeline after pushing; but sometimes you need it before pushing, or even before committing. The pipeline runtime therefore should operate at a different layer than git events. In practice this means you can combine Dagger with, say, Github Actions or another "legacy" CI platform. And use it as runner & event infrastructure for your portable Dagger pipelines. We also offer a complete Dagger-native CI platform, which combines hosted Dagger engines, git triggers, and all the infrastructure necessary to run your CI end-to-end. That is in early access as part of Dagger Cloud, our commercial offering.
    - sureglymop 5mo ago
      Well, I'm sold! Trying out your offering this weekend :)
- 5mo ago
electricapps 5mo ago
Great writeup. Though combined with the lack of lockfiles for transitive actions, relying purely on static analysis is tough. Linter like zizmor are great, but they struggle with deep composite actions trees and runtime template injection. I got frustrated with the lack of security to started working myself on an open-source runtime sandbox for GHA: https://github.com/electricapp/hasp https://github.com/electricapp/hasp The first check was inspired by the trivy attack. hasp enforces SHA pinning AND checks that a comment (# v4.1.2) actaully resolves to its preceding SHA. That grew into a larger suite of checks. Instead of just statically parsing YAML it hooks into the runner env itself. Some of its runtime checks mirror what zizmor already does including resolving upstream SHAs to canonical branches (no impostor commits) and traversing the transitive dependency tree. I have a PR up with a comparison document here (hasp vs. zizmor): https://github.com/electricapp/hasp/pull/13/changes#diff-aabc9094e587e83d619e533afa93f1c8ddf33687b1a3a9cab33de15e8e25695d https://github.com/electricapp/hasp/pull/13/changes#diff-aab... Furthermore, it sandboxes itself to prevent sensitive exfiltration by acting as a token broker which injects the secret at runtime -- the GH token can only ever be used to call the GH API. It uses landlock, seccomp, and eBPF via Rust, so no docker. The token broker sandbox can also be used to wrap a generic executable giving hasp generic applicability beyond GHA context (i.e. agentic or other contexts, where token runtime injection seems quite in vogue) I'm using this as a stopgap until GH rolls out some of the features on its roadmap. I'm moving torward treating the runner as a zero-trust or actively malicious environment, so this was my small contribution on that front.
peterldowns 5mo ago
Yup! Still haven't switched off of Github, but considering it at this point. If you're in my shoes, here's some tools we use that help: - https://github.com/sethvargo/ratchet https://github.com/sethvargo/ratchet for pinning external Actions/Workflows to specific commit hashes - https://www.warpbuild.com/ https://www.warpbuild.com/ for much faster runners (also: runs-on/namespace/buildjet/blacksmith/depot/... take your pick) - soon moving to Buildkite for orchestration of our CI jobs I still just need a reasonable alternative for the "store our git repo, allow us to make and merge prs" part of things. Hopefully someone takes all the pieces that the Pierre team is publishing and makes this available soon. The Github UI and the `gh` cli are actually really nice and the existing alternative code storage tools are not great IMO.
- a_t48 5mo ago
  Why warpbuild over the alternatives? I've seen depot before and am tempted, but open to other platforms.
  - suryao 5mo ago
    Founder of WarpBuild here. We have faster compute: baremetal for amd64 workloads, AWS for arm64 etc. We optimize for overall performance in real world jobs and have a broad selection of regions/OSes/arch available. There aren't any fixed subscription fees either.
    - a_t48 5mo ago
      Thanks for replying. Just a heads up https://www.warpbuild.com/compare/depot https://www.warpbuild.com/compare/depot spins and doesn't show anything for me.
      - suryao 5mo ago
        Ack. Will take a look.
  - peterldowns 5mo ago
kfarr 5mo ago
I still don't understand why the official github pages action is on an account called "peaceiris" ?? peaceiris/actions-gh-pages@v3
- woodruffw 5mo ago
  It's not[1]. That's a third-party action. [1]: https://github.com/actions/deploy-pages https://github.com/actions/deploy-pages
ossianericson 5mo ago
The OIDC federation between the runner and the cloud resources it touches , that credential gets created once. Permissive enough to not block the first deploy, and it is not what is reviewed when a pinning incident happens. Every one is looking at the action. The identity it runs as just sits there.
- nulltrace 5mo ago
  Common mistake is trusting the repo instead of the workflow. Then any workflow inherits the same cloud access.
globular-toast 5mo ago
I thought GitHub was great back in the day. My account goes back to 2009. It was so much better than what came before, e.g. Sourceforge. Admittedly, the centralised nature was a problem. I was heartbroken when Microsoft bought it. There should be a way for citizens to rebel against such things. It feels like it's been on a downward trajectory ever since.
octorian 5mo ago
I'm personally not a fan of GitHub actions, because of those dependencies outside your control and more because they're a pain to debug. A lot of the time, it feels like I'm tinkering with this huge script then holding my breath and hoping I got it right. The reason I use them, however, is because its more trouble than its worth to maintain build servers for the 3 platforms I care about (Windows, macOS, Linux) myself. Especially for projects that get built sporadically. I think one reason for this pain is that while you can easily run VMs for Windows and Linux on the same host, macOS is kinda its own special unicorn and might need a dedicated box. (But even that aside, maintaining machines you don't use every day can get annoying.)
60secs 5mo ago
pull_request_target is criminally negligent -- github should simply disable it. The security risk for running unvalidated code on any random PR with access to account secrets has no legitimate use case which outweighs its unbounded risk.
pimeys 5mo ago
We just use GHA as a simple caller, and everything is coded in nix scripts. The best part of this is how you can call the CI run directly from your own machine and it works the same.
pss314 5mo ago
John Howard (one of the maintainers of Istio and currently with Solo.io) blogged about "Fast GitHub Actions with Blacksmith" [1]. The blog also contains a link to "GitHub Action Runner Alternatives" [2]. [1]: https://blog.howardjohn.info/posts/blacksmith-gha/ https://blog.howardjohn.info/posts/blacksmith-gha/ [2]: https://binhong.me/blog/github-action-runner-alternatives/ https://binhong.me/blog/github-action-runner-alternatives/
a1o 5mo ago
Question: could someone make a GitHub pages website that runs zismor in a dropped yml file and tells if it’s bad in some way?
- woodruffw 5mo ago
  You’d need to build zizmor for WASM. I’ve thought about doing that work, but I’d happily accept contributions from people towards that who understand WASM better than I do.
blinded 5mo ago
The crazy thing is there are sooo many good alternatives and things built on top of it that github / ms could purchase and integrate. Product is asleep at the wheel.
jpgvm 5mo ago
Github Actions is a decidedly unserious product, used largely by unserious people. It's always been poo, the YAML is bad, the reliability is bad and the cost is bad. So there is really no redeeming features because even if you tout forge integration it's UI is, you guessed it, also bad. Putting aside the anti-pattern of using vendor YAML for literally anything (please don't do that) you are distinctly better off with literally any other CI/orchestration service. Buildkite is good, dynamic pipeline = good, there are other good options. If you are a serious person you will find good things to use. Getting back to vendor YAML, please just use a real build system instead. Define all the actual logic there with entry points/targets the YAML hits. Also generally make sure that you don't need the actual CI system to be up to do releases, deployments etc. A sufficiently elevated local user should be able to run the appropriate target with the appropriate credentials to get the job done in absence of said CI system.
ttrahan2 5mo ago
[flagged]
poelzi 5mo ago
I'm building a fix since over half a year. Very sophisticated workflow engine for the paranoid with strong AI integration and fully decentralized and deterministic behavior. Nix, Rust, SUI, Walrus, SEAL, IKA and my engine/framework + many tools. One goal is to have multiple workflows by independent parties that not only check the compiler output, but do advanced source chain analysis. When enough parties report successful run, the IKA network signs the build digests. You can hold the second part of the key, so only you + successful pipeline will result in a release. No single point of failure, no single party that can be hacked.

252 points by dochtman 5mo ago

This should really what LLM ought to bring in terms of security. Be able to break things faster considering it is now easier for the maintainers to fix them. This has downsides of course, moving further into the "everything rot so fast these days" trope, but we will in a adversarial world where the threat is constantly evolving. Tomorrow (today) the servers and repo won't be scanned by scripts anymore but by increasingly capable models with knowledge about more security issues than many searchers.

tomaytotomato 5mo ago

<tangent> Github actions is running like treacle now. Even when our company pays lots of money for cloud and private Github runners. I know its the go-to punchbag but I think enabling Copilot reviews globally for a large proportion of Github was a bit hasty. The security problems aside, if it continues this way, people won't be able to ship and deploy code from Github actions. We might dare I say it, have to go back to self hosted Jenkins or Travis CI.

tagraves 5mo ago
shameless self plug, but please check out RWX! (rwx.com)

rmunn 5mo ago

Back when GitHub Actions first came out, I used commit hashes rather than tags in all my `uses:` lines. Some of my colleagues disagreed, saying that tags were secure enough. I eventually said, "Well, for well-known actions like actions/checkout, sure; if that one gets compromised it'll be all over the news within minutes." But for all the third-party actions, I kept commit hashes. I feel rather vindicated now. There's still a small possibility of getting supply-chain attacked via a SHA collision, or a relatively much larger (though still small in absolute terms) possibility of getting supply-chain attacked via NPM dependencies of the action you're relying on. But if you're not using a commit hash in your `uses:` lines, go switch to it now. And if you're just using major-version-only tags like `v5` then do it RIGHT now, before that action gets a compromised version uploaded with a `v5.2.3` tag.

samuelknight 5mo ago
There is no realistic risk of a SHA collision attack. Getting supply chain attacked via NPM dependencies is much more likely. Hopefully the actions creators are also pinning their hashes.
- kbolino 5mo ago
  > There is no realistic risk of a SHA collision attack. Indeed. To illustrate why: 1. It is not possible to "retroactively" find a SHA-1 collision for an already known hash. If somebody has produced a SHA-1 hash non-maliciously at any point in the past, it is safe from collisions. This is due to second-preimage resistance, which hasn't been broken for SHA-1 and doesn't seem likely to be broken any time soon. 2. The only way to obtain a SHA-1 collision is to do so knowingly when producing the original hash. You generate a pair of inputs at the same time that both hash to the same value. Certainly, this is an imaginable scenario; e.g. a trusted committer could push one half of the pair wittingly or a reviewer could be fooled into accepting one half of the pair unwittingly, both scenarios creating a timebomb where the malicious actor swaps the commit to the second half of the pair (which presumably carries a malicious payload) later. However, there are two blockers to this approach: Git (not just GitHub) will not accept a commit with a duplicate hash, always sticking with the original one, and GitHub specifically has implemented signature detection for the known SHA-1 collision-generating methods and will reject both halves of such a pair. In short, there's just no practical way to exploit this weakness of SHA-1 with Git.
arionmiles 5mo ago
I feel pretty happy we use Renovator (EDIT: It's Renovate) at my current workplace which by default will raise PRs to change any tags for actions with the SHA instead. Then, even when it bumps the version in future PRs, it bumps the SHA (with a comment of which tag version it represents)
- tecleandor 5mo ago
  Is it Renovator or Renovate? I'm trying to find it to check it out...

faangguyindia 5mo ago

I just have a Spot instance we use for our builds. It's turned on via serverless, runs it's job with a timeout and exits. Lately i don't use any managed services and life couldn't be any simpler.

kevin_nisbet 5mo ago
My team has been using https://runs-on.com/ https://runs-on.com/ for AWS instance runners, had a few glitches but largely been great for using AWS instances for runners.

indigodaddy 5mo ago

This aligns nicely with today's/current GitHub Actions outage

iso1631 5mo ago
Github outage? Must be a Y in the day

recursivedoubts 5mo ago

Programming in YAML has always seemed crazy to me. Actions seem like a great place to create a simple mixed imperative/declarative scripting language (js extension or whatever) with a solid instrumented/observable/debuggable runtime and an OO API that can be run locally against mock infrastructure.

bastardoperator 5mo ago
No thanks, Jenkins has three DSL languages and none of it is good. You dont have to inline code in yaml, you can call a script and call it day, write that script in any language you want.
- cenamus 5mo ago
  You can do the same in jenkins, but a bit of scripting is probably more readable in Groovy than whatever Yaml dsl. But I totally agree that the Jenkins langs are terrible, the errors even worse, somehow they managed to make jvm backtraces even more unreadable.
  - LelouBil 5mo ago
    I don't know why they don't pivot to Kotlin. Gradle did it successfully and it's great now.
    - cenamus 5mo ago
      Don't they have a major thing going on with CSP (as with Scheme) that sort ot persists pipeline state automatically? That would allow you to kill Jenkins and afterwards restart the pipeline from exactly where you left off? But I never tried it personally
- lstodd 5mo ago
  idk I always just wrote shell to be called by jenkins. none of this idiocy of programming with html comboboxes. DSL for the domain is shell, no need to invent hyperwheels here.

shykes 5mo ago

I apologize in advance for the plug. I've spent the last 5 years warning of the importance of not leaving CI locked in a black box platform and proprietary DSL. All the while going on a quest to reinvent CI as an open, programmable platform. Honestly it's still a work-in-progress: it turns out that reinvention is hard! But, if you want a glimpse of what CI can be when you shed 30 years of legacy, consider checking out Dagger (https://dagger.io https://dagger.io). Or, if you just want to talk about the future of CI with like-minded systems engineers, without committing to using a particular product, consider joining our Discord: https://discord.com/invite/dagger-io https://discord.com/invite/dagger-io

sureglymop 5mo ago
Looks cool. Can it be self hosted? I.e. can I self host it next to my self hosted forgejo instance?
- shykes 5mo ago
  Yes, the Dagger engine is open source. Note that the engine on its own is not a CI replacement: it provides a runtime for your pipelines, but you still need an external system to trigger pipelines from git events. This decoupling is intentional, because CI should not be tightly coupled to git events. Sometimes you want to run a pipeline after pushing; but sometimes you need it before pushing, or even before committing. The pipeline runtime therefore should operate at a different layer than git events. In practice this means you can combine Dagger with, say, Github Actions or another "legacy" CI platform. And use it as runner & event infrastructure for your portable Dagger pipelines. We also offer a complete Dagger-native CI platform, which combines hosted Dagger engines, git triggers, and all the infrastructure necessary to run your CI end-to-end. That is in early access as part of Dagger Cloud, our commercial offering.
  - sureglymop 5mo ago
    Well, I'm sold! Trying out your offering this weekend :)
5mo ago

electricapps 5mo ago

Great writeup. Though combined with the lack of lockfiles for transitive actions, relying purely on static analysis is tough. Linter like zizmor are great, but they struggle with deep composite actions trees and runtime template injection. I got frustrated with the lack of security to started working myself on an open-source runtime sandbox for GHA: https://github.com/electricapp/hasp https://github.com/electricapp/hasp The first check was inspired by the trivy attack. hasp enforces SHA pinning AND checks that a comment (# v4.1.2) actaully resolves to its preceding SHA. That grew into a larger suite of checks. Instead of just statically parsing YAML it hooks into the runner env itself. Some of its runtime checks mirror what zizmor already does including resolving upstream SHAs to canonical branches (no impostor commits) and traversing the transitive dependency tree. I have a PR up with a comparison document here (hasp vs. zizmor): https://github.com/electricapp/hasp/pull/13/changes#diff-aabc9094e587e83d619e533afa93f1c8ddf33687b1a3a9cab33de15e8e25695d https://github.com/electricapp/hasp/pull/13/changes#diff-aab... Furthermore, it sandboxes itself to prevent sensitive exfiltration by acting as a token broker which injects the secret at runtime -- the GH token can only ever be used to call the GH API. It uses landlock, seccomp, and eBPF via Rust, so no docker. The token broker sandbox can also be used to wrap a generic executable giving hasp generic applicability beyond GHA context (i.e. agentic or other contexts, where token runtime injection seems quite in vogue) I'm using this as a stopgap until GH rolls out some of the features on its roadmap. I'm moving torward treating the runner as a zero-trust or actively malicious environment, so this was my small contribution on that front.

peterldowns 5mo ago

Yup! Still haven't switched off of Github, but considering it at this point. If you're in my shoes, here's some tools we use that help: - https://github.com/sethvargo/ratchet https://github.com/sethvargo/ratchet for pinning external Actions/Workflows to specific commit hashes - https://www.warpbuild.com/ https://www.warpbuild.com/ for much faster runners (also: runs-on/namespace/buildjet/blacksmith/depot/... take your pick) - soon moving to Buildkite for orchestration of our CI jobs I still just need a reasonable alternative for the "store our git repo, allow us to make and merge prs" part of things. Hopefully someone takes all the pieces that the Pierre team is publishing and makes this available soon. The Github UI and the `gh` cli are actually really nice and the existing alternative code storage tools are not great IMO.

a_t48 5mo ago
Why warpbuild over the alternatives? I've seen depot before and am tempted, but open to other platforms.
- suryao 5mo ago
  Founder of WarpBuild here. We have faster compute: baremetal for amd64 workloads, AWS for arm64 etc. We optimize for overall performance in real world jobs and have a broad selection of regions/OSes/arch available. There aren't any fixed subscription fees either.
  - a_t48 5mo ago
    Thanks for replying. Just a heads up https://www.warpbuild.com/compare/depot https://www.warpbuild.com/compare/depot spins and doesn't show anything for me.
    - suryao 5mo ago
      Ack. Will take a look.
- peterldowns 5mo ago

kfarr 5mo ago

I still don't understand why the official github pages action is on an account called "peaceiris" ?? peaceiris/actions-gh-pages@v3

woodruffw 5mo ago
It's not[1]. That's a third-party action. [1]: https://github.com/actions/deploy-pages https://github.com/actions/deploy-pages

ossianericson 5mo ago

The OIDC federation between the runner and the cloud resources it touches , that credential gets created once. Permissive enough to not block the first deploy, and it is not what is reviewed when a pinning incident happens. Every one is looking at the action. The identity it runs as just sits there.

nulltrace 5mo ago
Common mistake is trusting the repo instead of the workflow. Then any workflow inherits the same cloud access.

globular-toast 5mo ago

I thought GitHub was great back in the day. My account goes back to 2009. It was so much better than what came before, e.g. Sourceforge. Admittedly, the centralised nature was a problem. I was heartbroken when Microsoft bought it. There should be a way for citizens to rebel against such things. It feels like it's been on a downward trajectory ever since.

octorian 5mo ago

I'm personally not a fan of GitHub actions, because of those dependencies outside your control and more because they're a pain to debug. A lot of the time, it feels like I'm tinkering with this huge script then holding my breath and hoping I got it right. The reason I use them, however, is because its more trouble than its worth to maintain build servers for the 3 platforms I care about (Windows, macOS, Linux) myself. Especially for projects that get built sporadically. I think one reason for this pain is that while you can easily run VMs for Windows and Linux on the same host, macOS is kinda its own special unicorn and might need a dedicated box. (But even that aside, maintaining machines you don't use every day can get annoying.)

60secs 5mo ago

pull_request_target is criminally negligent -- github should simply disable it. The security risk for running unvalidated code on any random PR with access to account secrets has no legitimate use case which outweighs its unbounded risk.

pimeys 5mo ago

We just use GHA as a simple caller, and everything is coded in nix scripts. The best part of this is how you can call the CI run directly from your own machine and it works the same.

pss314 5mo ago

John Howard (one of the maintainers of Istio and currently with Solo.io) blogged about "Fast GitHub Actions with Blacksmith" [1]. The blog also contains a link to "GitHub Action Runner Alternatives" [2]. [1]: https://blog.howardjohn.info/posts/blacksmith-gha/ https://blog.howardjohn.info/posts/blacksmith-gha/ [2]: https://binhong.me/blog/github-action-runner-alternatives/ https://binhong.me/blog/github-action-runner-alternatives/

a1o 5mo ago

Question: could someone make a GitHub pages website that runs zismor in a dropped yml file and tells if it’s bad in some way?

woodruffw 5mo ago
You’d need to build zizmor for WASM. I’ve thought about doing that work, but I’d happily accept contributions from people towards that who understand WASM better than I do.

blinded 5mo ago

The crazy thing is there are sooo many good alternatives and things built on top of it that github / ms could purchase and integrate. Product is asleep at the wheel.

jpgvm 5mo ago

Github Actions is a decidedly unserious product, used largely by unserious people. It's always been poo, the YAML is bad, the reliability is bad and the cost is bad. So there is really no redeeming features because even if you tout forge integration it's UI is, you guessed it, also bad. Putting aside the anti-pattern of using vendor YAML for literally anything (please don't do that) you are distinctly better off with literally any other CI/orchestration service. Buildkite is good, dynamic pipeline = good, there are other good options. If you are a serious person you will find good things to use. Getting back to vendor YAML, please just use a real build system instead. Define all the actual logic there with entry points/targets the YAML hits. Also generally make sure that you don't need the actual CI system to be up to do releases, deployments etc. A sufficiently elevated local user should be able to run the appropriate target with the appropriate credentials to get the job done in absence of said CI system.

ttrahan2 5mo ago

[flagged]

poelzi 5mo ago

I'm building a fix since over half a year. Very sophisticated workflow engine for the paranoid with strong AI integration and fully decentralized and deterministic behavior. Nix, Rust, SUI, Walrus, SEAL, IKA and my engine/framework + many tools. One goal is to have multiple workflows by independent parties that not only check the compiler output, but do advanced source chain analysis. When enough parties report successful run, the IKA network signs the build digests. You can hold the second part of the key, so only you + successful pipeline will result in a release. No single point of failure, no single party that can be hacked.