Re:GitHub Actions update: Helping maintainers combat bad actors
by hashhar on Friday April 23, 2021 @12:43AM
(#26911055)
Running CI on their repo doesn't work when you use self-hosted runners.
Same for when you have secrets defined in the workflow that are necessary for a build.
There are more cases to cover than the ones visible during a knee-jerk reaction.
Re:GitHub Actions update: Helping maintainers combat bad actors
by remram on Friday April 23, 2021 @10:39AM
(#26915205)
Obviously I don't consider self-hosted runners to be "GitHub's resources". However those are not widely used by open-source projects and are not mentioned in the blog post, so I don't think that's what the concern is about. I don't think ignoring this minor use-case makes this a "knee-jerk reaction", but name-calling is always appreciated...
I don't see how secrets help with mining cryptocurrency either.
Thanks for your comment I guess?
Now instead of counting this CI usage in a way more favorable to project maintainers, they give us a way to manually approve runs before they use our CI. That's good, but still a solution to an artificial problem. I think I would have welcomed more openness about why this way of accounting is necessary, instead of this extra work put on me and labeled as a "help" that I never thought I needed.