I Hate GitHub Actions with Passion

Re:I Hate GitHub Actions with Passion by pamcake on Wednesday January 14, 2026 @12:54PM (#46619460)

Shell and bash are easy to write insecurely and open your CI runners or dev machines up for exploitation by shell injection. Non-enthusiasts writing complex CI pipelines pulling and piping remote assets in bash without ShellCheck is a risky business.

Python is a lot easier to write safely.

[ Parent | on HN ]

Re:I Hate GitHub Actions with Passion by snovv_crash on Wednesday January 14, 2026 @01:41PM (#46620509)

You shouldn't be pulling untrusted assets in CI regardless. Hacking your bash runner is the hardest approach anyways, just patch some subroutine in a dependency that you'll call during your build or tests.

[ Parent | on HN ]