Bypassing GitHub Actions policies in the dumbest way possible

Re:Bypassing GitHub Actions policies in the dumbest way poss... by zmgsabst on Wednesday June 11, 2025 @11:55PM (#44254193)

Developers are generally given specific environments to run code, which aren’t their laptops — eg, VMs in a development environment.

The goal isn’t to stop a developer from doing something malicious, but to add a step to the chain for hackers to do something malicious: they need to pwn the developer laptop from the devbox before they can pivot to, eg, internal data systems.

[ Parent | on HN ]

Re:Bypassing GitHub Actions policies in the dumbest way poss... by kstrauser on Thursday June 12, 2025 @12:44PM (#44259816)

In my experience, that’s rare. Everywhere I’ve worked had devs working on code directly on their laptops.

[ Parent | on HN ]

Re:Bypassing GitHub Actions policies in the dumbest way poss... by zmgsabst on Thursday June 12, 2025 @07:57PM (#44264451)

My experience is the opposite:

I haven’t worked somewhere we ran code locally in a long, long time. Your IDE is local, but the testing is remote — typically in an environment where you can match the runtime environment more closely (eg, ensuring the same dependencies, access to cloud resources, etc).

[ Parent | on HN ]

Re:Bypassing GitHub Actions policies in the dumbest way poss... by tough on Thursday June 12, 2025 @09:39PM (#44264971)

isn't that just CI?

does that mean you will never compile it or build it locally?

don't 99% of people just use docker nowadays to have all that environment matches?

[ Parent | on HN ]