News for hackers. Stuff that matters.
Re:GitHub Actions Has a Package Manager, and It Might Be the... by miohtama on Monday December 08, 2025 @04:43AM (#46190332)
Everyone is free to use alternative CI/CD workflow pipelines. These are often better than Github Actions.

These include

- https://circleci.com/

- https://www.travis-ci.com/

- Gitlab

Open source:

- https://concourse-ci.org/ (discussed in the context of Radicle here https://news.ycombinator.com/item?id=44658820 )

- Jenkins

-etc.

Anyone can complain as much as they want, but unless they put the money where their mouth is, it's just noise from lazy people.

Re:GitHub Actions Has a Package Manager, and It Might Be the... by XCabbage on Monday December 08, 2025 @07:40AM (#46191557)
Well, actually, no, not everyone is free to use alternatives. Anyone using CI for "Trusted Publishing" of packages to PyPI or npm needs to use GitHub Actions or GitLab CI/CD. CircleCI and Travis CI are not supported. So many big open source projects for the two most popular languages in the world are now locked out of the alternatives you propose.

(I find it extremely sketchy from a competition law perspective that Microsoft, as the owner of npm, has implemented a policy banning npm publishers from publishing via competitors to GitHub Actions - a product that Microsoft also owns. But they have; that is the reality right now, whether it's legal or not.)

Re:GitHub Actions Has a Package Manager, and It Might Be the... by LtWorf on Monday December 08, 2025 @07:47AM (#46191605)
I was never convinced that trusted publishing solves any security problem, other than letting pypi eventually solve the problem of banning russian/iranian/whatever people just by relying on github doing it for them.
Re:GitHub Actions Has a Package Manager, and It Might Be the... by woodruffw on Monday December 08, 2025 @11:09AM (#46193998)
Trusted Publishing on PyPI supports Google Cloud and ActiveState as well. It’s not tied to GitHub or GitLab. To my recollection I looked at CircleCI support a while back, and ran into limitations on the claims they exposed.

(It can also be extended to arbitrary third party IdPs, although the benefit of that is dependent on usage. But if you have another CI/CD provider that you’d like to integrate into PyPI, you should definitely flag it on the issue tracker.)

Re:GitHub Actions Has a Package Manager, and It Might Be the... by saagarjha on Monday December 08, 2025 @05:07AM (#46190532)
I’d appreciate not being called lazy for mentioning a lack of investment on Microsoft’s side to secure their paid and fairly lucrative service that they bought a popular code hosting platform to integrate with.
Re:GitHub Actions Has a Package Manager, and It Might Be the... by rjzzleep on Monday December 08, 2025 @05:50AM (#46190837)
Can someone explain what this somewhat recent phenomenon is where people feel the need to defend the worlds biggest billion dollar businesses, that are also often subsidized by tax payer money in weird ways?

How did we go in 20 years from holding these companies to account when they'd misbehave to acting as if they are poor damsels in distress whenever someone points out a flaw?

Re:GitHub Actions Has a Package Manager, and It Might Be the... by nsoqm on Monday December 08, 2025 @05:56AM (#46190882)
The original comment said to stop giving money to these companies if they are not giving you a satisfactory service.

The opposite, to be lazy and to continue giving them money whilst being unhappy with what you get in return, would actually be more like defending the companies.

Re:GitHub Actions Has a Package Manager, and It Might Be the... by ImPostingOnHN on Monday December 08, 2025 @09:32AM (#46192644)
The original comment actually criticized Microsoft for a lack of investment to secure their paid and fairly lucrative service that they bought a popular code hosting platform to integrate with.

The opposite we see here: to not criticize them; to blame Microsoft's failure on the critics; and even to discourage any such criticism, are actually more like defending large companies.

Re:GitHub Actions Has a Package Manager, and It Might Be the... by miohtama on Monday December 08, 2025 @10:14AM (#46193149)
It is a lucrative service just because people are lazy and keep buying from Microsoft. Otherwise, they would migrate to better alternatives.

This especially includes governments and other institutional buyers.

Re:GitHub Actions Has a Package Manager, and It Might Be the... by drdec on Monday December 08, 2025 @07:46AM (#46191601)
> How did we go in 20 years from holding these companies to account when they'd misbehave to acting as if they are poor damsels in distress whenever someone points out a flaw?

Honestly I think the problem is more a rosy view of the past versus any actual change in behavior. There have always been defenders of such companies.

Re:GitHub Actions Has a Package Manager, and It Might Be the... by hexbin010 on Monday December 08, 2025 @05:56AM (#46190880)
> How did we go in 20 years from holding these companies to account when they'd misbehave to acting as if they are poor damsels in distress whenever someone points out a flaw?

They hired a ton of people on very very good salaries

Re:GitHub Actions Has a Package Manager, and It Might Be the... by tonyhart7 on Monday December 08, 2025 @07:27AM (#46191476)
I think big tech being so big now that these "issue" is too small for their priority is saying something

You better thank god for MS for being lazy and incompetent, the last thing we want for big tech is being innovative and have a stronger monopoly

Re:GitHub Actions Has a Package Manager, and It Might Be the... by thrdbndndn on Monday December 08, 2025 @06:34AM (#46191107)
I won't "defend" Microsoft in this case, but I am always annoyed by phrases like "world's biggest billion-dollar businesses... bablah".

Their size or past misbehaviors shouldn't be relevant to this discussion. Bringing those up feels a bit like an ad hominem. Whether criticism is valid should depend entirely on how GitHub Actions actually works and how it compares to similar services.

Re:GitHub Actions Has a Package Manager, and It Might Be the... by gcr on Monday December 08, 2025 @07:41AM (#46191568)
Ad hominem applies to people. Corporations aren’t people, and ICs aren’t corporations.
Re:GitHub Actions Has a Package Manager, and It Might Be the... by Sl1mb0 on Monday December 08, 2025 @07:38AM (#46191545)
Microsoft's past behavior _may_ explain *why* there is a lack of investment in Github Actions; so yes, TheFeelz are relevant.
Re:GitHub Actions Has a Package Manager, and It Might Be the... by thrdbndndn on Monday December 08, 2025 @08:31AM (#46192020)
Then I agree with this. But still feel their size is irrelevant.
Re:GitHub Actions Has a Package Manager, and It Might Be the... by Tostino on Monday December 08, 2025 @09:08AM (#46192367)
Their size is relevant in so far as it allows them to make really any investment they want to in GHA without it causing a cash flow problem.
Re:GitHub Actions Has a Package Manager, and It Might Be the... by wizzwizz4 on Monday December 08, 2025 @07:46AM (#46191602)
> Their size or past misbehaviors shouldn't be relevant to this discussion.

If the past misbehaviours are exactly the same shape, there's not all that much point re-hashing the same discussion with the nouns renamed.

Re:GitHub Actions Has a Package Manager, and It Might Be the... by ironmagma on Monday December 08, 2025 @05:44AM (#46190802)
There is a massive problem in open source where some people equate pointing out a problem with being too lazy to solve it — when in reality this just stifles the conversation. Especially when a prerequisite to any group project accomplishing anything is to first discuss the problem to be solved.
Re:GitHub Actions Has a Package Manager, and It Might Be the... by rjzzleep on Monday December 08, 2025 @05:53AM (#46190859)
No that's actually a completely different issue. You're talking about volunteers working on side projects that are sometimes foundational to the way the internet works and then people feel entitled to tell them what to do without contributing.

Here we are talking about one of the worlds most valuable companies that gets all sorts of perks, benefits and preferential treatment from various entities and governments on the globe and somehow we have to be grateful when they deliver garbage while milking the business they bought.

Re:GitHub Actions Has a Package Manager, and It Might Be the... by ironmagma on Monday December 08, 2025 @12:14PM (#46194878)
No, that's actually the same issue. "Entitled to tell them what to do without contributing" is not a problem. Let them tell whoever what to do, the response is always the same: "patches welcome," or if that isn't even true (which it doesn't have to be), "feel free to fork."
Re:GitHub Actions Has a Package Manager, and It Might Be the... by baq on Monday December 08, 2025 @12:31PM (#46195080)
OTOH if you didn't pay for support you shouldn't expect support. 'patches welcome' is a very valid response.
Re:GitHub Actions Has a Package Manager, and It Might Be the... by ironmagma on Monday December 08, 2025 @01:01PM (#46195510)
Is not the whole FOSS movement about receiving something you did not pay for? Going as far as to say that’s even what users deserve?
Re:GitHub Actions Has a Package Manager, and It Might Be the... by baq on Monday December 08, 2025 @01:25PM (#46195802)
don't confuse 'receiving something you did not pay for' with 'being allowed to feel entitled to anything' is all. 'open source' is just that, nothing more. if you want a service with your source, be prepared to sponsor it.
Re:GitHub Actions Has a Package Manager, and It Might Be the... by ironmagma on Monday December 08, 2025 @02:53PM (#46196778)
I still think people should want things and be vocal about what they want. This is the natural way for people to know what needs to be built. It is different from demanding something.

And besides that, a lot of people on here do pay for Github in the first place.

Re:GitHub Actions Has a Package Manager, and It Might Be the... by ChrisMarshallNY on Monday December 08, 2025 @05:27AM (#46190675)
> unless they put the money where their mouth is, it's just noise

I used to work for a Japanese company, and one of their core philosophies was “Don’t complain, unless you have a solution.” In my experience, this did not always have optimal outcomes: https://littlegreenviper.com/problems-and-solutions/

Re:GitHub Actions Has a Package Manager, and It Might Be the... by hrimfaxi on Monday December 08, 2025 @08:24AM (#46191938)
My favorite retort to that is, "I don't have to know how to fix it to know my arm is broken."
Re:GitHub Actions Has a Package Manager, and It Might Be the... by ChrisMarshallNY on Monday December 08, 2025 @08:28AM (#46191978)
Stealing it...
Re:GitHub Actions Has a Package Manager, and It Might Be the... by klausa on Monday December 08, 2025 @05:23AM (#46190641)
I don’t make the purchasing decision for my employer, but I certainly have to deal with their fallout, so I’ll keep complaining if that’s okay with you.
Re:GitHub Actions Has a Package Manager, and It Might Be the... by miohtama on Monday December 08, 2025 @10:11AM (#46193105)
If you are not part of the solution, then you are part of the problem.
Re:GitHub Actions Has a Package Manager, and It Might Be the... by weakfish on Monday December 08, 2025 @04:45PM (#46198072)
If you’re so lucky that your employer lets you use any $TOOL you want, great, but I _have_ to use GitHub actions.

So I’m part of the problem? Me specifically?

Re:GitHub Actions Has a Package Manager, and It Might Be the... by klausa on Monday December 08, 2025 @11:45PM (#46201307)
What is it that you actually want me to do here?

Just refuse to do my job because I think the tools suck?

Re:GitHub Actions Has a Package Manager, and It Might Be the... by gabrielgio on Monday December 08, 2025 @07:27AM (#46191478)
> Anyone can complain as much as they want, but unless they put the money where their mouth is, it's just noise from lazy people.

Once I'm encharged of budge decisions of my company I'll make sure that none will go to any MS and Atlassian product. Until then I'll keep complaining.

Re:GitHub Actions Has a Package Manager, and It Might Be the... by CamouflagedKiwi on Monday December 08, 2025 @05:08AM (#46190534)
I've used CircleCI quite a bit in the past; it was pretty good. Feels tough for them to compete with GHA though when you're getting GHA credits for free with your code hosting.

I used Travis rather longer ago, it was not great. Circle was a massive step forward. I don't know if they have improved it since but it only felt useful for very simplistic workflows, as soon as you needed anything complex (including any software that didn't come out of the box) you were in a really awkward place.

Re:GitHub Actions Has a Package Manager, and It Might Be the... by aprilnya on Monday December 08, 2025 @05:12AM (#46190573)
I mean, they do have a free plan with 6,000 minutes
Re:GitHub Actions Has a Package Manager, and It Might Be the... by olafmol on Monday December 08, 2025 @08:58AM (#46192281)
CircleCI made great steps the last few years, f.e. to better support proper DRY working, supporting OPA policies-as-code, VSCode extensions with "dry-run" options.

For some examples of more advanced usecases take a look: https://circleci.com/blog/platform-toolkit/

Disclaimer: i work for CircleCI.

Re:GitHub Actions Has a Package Manager, and It Might Be the... by CamouflagedKiwi on Wednesday December 10, 2025 @12:54AM (#46214542)
To be clear, I do think CircleCI is a better product than GHA. I just think there's a lot of air sucked out of the room by GHA being available 'for free' and out of the box.

Also, honestly, I don't care about any of those features. The main thing I want is a CI system that is fast and customisable and that I don't have to spend a lot of time debugging. I think CircleCI is pretty decent in that regard (the "rerun with SSH" thing is way better than anything else I've seen) but it doesn't seem to be getting any better over time (e.g. caching is still very primitive and coarse-grained).

Re:GitHub Actions Has a Package Manager, and It Might Be the... by olafmol on Tuesday December 16, 2025 @06:34PM (#46296227)
Agreed that caching needs (and can be, and will be) improved.
Re:GitHub Actions Has a Package Manager, and It Might Be the... by Griffinsauce on Tuesday December 09, 2025 @05:14PM (#46211468)
I had a considerably better time with CircleCI in the past than with Github Actions currently. It feels much more like a complete product rather than a tacked on mess, I hate how disproportionately we count running cost just because we have numbers for it (vs. DX and velocity which are hard to measure and impossible to predict)
Re:GitHub Actions Has a Package Manager, and It Might Be the... by dimgl on Monday December 08, 2025 @07:44AM (#46191585)
I tried to use CircleCI and I gotta say, it is absolutely not better than GitHub Actions…
Re:GitHub Actions Has a Package Manager, and It Might Be the... by IshKebab on Monday December 08, 2025 @07:51AM (#46191636)
I have also used Travis. Ditto.

Github Actions is actually one of the better CI options out there, even if on an absolute scale it is still pretty bad.

As far as I can tell nobody has made a CI system that is actually good.

Re:GitHub Actions Has a Package Manager, and It Might Be the... by no_wizard on Monday December 08, 2025 @08:27AM (#46191976)
JetBrains TeamCity is pretty good IMHO
Re:GitHub Actions Has a Package Manager, and It Might Be the... by kspacewalk2 on Monday December 08, 2025 @09:02AM (#46192308)
GitLab CI is pretty close to being actually good. Certainly less brittle than GitHub Actions from the looks of it...
Re:GitHub Actions Has a Package Manager, and It Might Be the... by IshKebab on Monday December 08, 2025 @04:06PM (#46197648)
It's really not. I've used Gitlab CI extensively and the number of issues we had...
Re:GitHub Actions Has a Package Manager, and It Might Be the... by rileymichael on Monday December 08, 2025 @10:27AM (#46193323)
buildkite is leaps and bounds above the others. especially if you need to really tailor your workloads to the change diff (say in a monorepo), the dynamic pipeline support is superb.

really surprised there are no others though. dagger.io was in the space but the level of complexity is an order of magnitude higher

Re:GitHub Actions Has a Package Manager, and It Might Be the... by Marsymars on Monday December 08, 2025 @01:09PM (#46195610)
I quite liked Bitrise for mobile apps when I used that.
Re:GitHub Actions Has a Package Manager, and It Might Be the... by c0balt on Monday December 08, 2025 @05:21AM (#46190631)
It should be highlighted that Gitlab CI/CD (self-hostable runner and GitLab itself) is also OSS.
Re:GitHub Actions Has a Package Manager, and It Might Be the... by Bombthecat on Monday December 08, 2025 @07:05AM (#46191301)
I'm a huge fan of: https://onedev.io/ it might not the best, but it's fast it and does it's job!
Re:GitHub Actions Has a Package Manager, and It Might Be the... by NamlchakKhandro on Monday December 08, 2025 @05:32AM (#46190715)
CircleCI is 100% trash.

Don't waste your time

Re:GitHub Actions Has a Package Manager, and It Might Be the... by koakuma-chan on Monday December 08, 2025 @05:05AM (#46190512)
Or roll your own
Re:GitHub Actions Has a Package Manager, and It Might Be the... by ramon156 on Monday December 08, 2025 @04:49AM (#46190380)
according to travis-ci, Microsoft uses that? Lol
Re:GitHub Actions Has a Package Manager, and It Might Be the... by input_sh on Monday December 08, 2025 @05:53AM (#46190858)
You're falling for a marketing trick.

What that type of section usually means is "there's someone from Microsoft that signed up for our service using his work account", sometimes it means "there's some tiny team within Microsoft that uses our product", but it very rarely (if ever) means "the entire company is completely reliant on our product".

Re:GitHub Actions Has a Package Manager, and It Might Be the... by SkyPuncher on Monday December 08, 2025 @08:59AM (#46192291)
Yes and no. Generally logo usage requires permission. While the usage isn’t the whole company, it’s enough to justify some sort of logo usage.
Re:GitHub Actions Has a Package Manager, and It Might Be the... by zulban on Monday December 08, 2025 @08:54AM (#46192238)
It sounds like you've never worked in a large org before.