News for hackers. Stuff that matters.

A comment on GitHub Actions update: Helping maintainers combat bad actors. Parent comment

Re:GitHub Actions update: Helping maintainers combat bad actors by hashhar on Friday April 23, 2021 @12:43AM (#26911055)
Running CI on their repo doesn't work when you use self-hosted runners.

Same for when you have secrets defined in the workflow that are necessary for a build.

There are more cases to cover than the ones visible during a knee-jerk reaction.

[ Parent | on HN ]
Re:GitHub Actions update: Helping maintainers combat bad actors by remram on Friday April 23, 2021 @10:39AM (#26915205)
Obviously I don't consider self-hosted runners to be "GitHub's resources". However those are not widely used by open-source projects and are not mentioned in the blog post, so I don't think that's what the concern is about. I don't think ignoring this minor use-case makes this a "knee-jerk reaction", but name-calling is always appreciated...

I don't see how secrets help with mining cryptocurrency either.

Thanks for your comment I guess?

[ Parent | on HN ]