Re:GitHub Actions update: Helping maintainers combat bad actors
by Arnavion on Thursday April 22, 2021 @09:34PM
(#26910120)
If you're making a PR to my repository, I would like to be in control of whether my repository's resources are used for your PR or not. It doesn't matter whether you've had your account for 10 minutes or 10 years.
(And they certainly are "my repository's resources", since the build machines pool is shared between workflow runs for branches and PRs.)
They're codifying what a lot of repositories do with bots today anyway, where a maintainer triggers the CI to run on a PR by posting a comment.
Also I'm confused how you can simultaneously berate them for not building a user reputation system, and then berate them for hypothetically building a user reputation system.
Re:GitHub Actions update: Helping maintainers combat bad actors
by arcatek on Friday April 23, 2021 @05:01AM
(#26912600)
I've contributed to a lot of repositories, and I've yet to see a single one where tests aren't automatically run. I can only think of a single one where some benchmarks are run on-demand.
Re:GitHub Actions update: Helping maintainers combat bad actors
by hashhar on Friday April 23, 2021 @06:45AM
(#26913271)
Most of the repositories under orgs. like ASF or CNCF are default-deny. They require action from maintainers before a build gets triggered. Mozilla is the same way.
Re:GitHub Actions update: Helping maintainers combat bad actors
by linkdd on Thursday April 22, 2021 @11:24PM
(#26910672)
Your decade of history means nothing to a maintainer, nor it means that you won't, one day, misuse the maintainer's resources.
> Why should my PR not run CI if I make a change to a new repository?
Because the maintainer doesn't know you and certainly doesn't have time to read through your 10 years of contribution.
I bet they invited a huge team of machine learning and "AI" experts to do those user assessments that will launch in fall of 2029. Those models will always fail in one of or two edge cases and will cause embarrassments.