GitHub Actions update: Helping maintainers combat bad actors

Re:GitHub Actions update: Helping maintainers combat bad actors by Arnavion on Thursday April 22, 2021 @09:34PM (#26910120)

If you're making a PR to my repository, I would like to be in control of whether my repository's resources are used for your PR or not. It doesn't matter whether you've had your account for 10 minutes or 10 years.

(And they certainly are "my repository's resources", since the build machines pool is shared between workflow runs for branches and PRs.)

They're codifying what a lot of repositories do with bots today anyway, where a maintainer triggers the CI to run on a PR by posting a comment.

Also I'm confused how you can simultaneously berate them for not building a user reputation system, and then berate them for hypothetically building a user reputation system.

[ Parent | on HN ]

Re:GitHub Actions update: Helping maintainers combat bad actors by arcatek on Friday April 23, 2021 @05:01AM (#26912600)

I've contributed to a lot of repositories, and I've yet to see a single one where tests aren't automatically run. I can only think of a single one where some benchmarks are run on-demand.

[ Parent | on HN ]

Re:GitHub Actions update: Helping maintainers combat bad actors by hashhar on Friday April 23, 2021 @06:45AM (#26913271)

Most of the repositories under orgs. like ASF or CNCF are default-deny. They require action from maintainers before a build gets triggered. Mozilla is the same way.

[ Parent | on HN ]