GitHub Actions has a package manager that ignores decades of supply chain security best practices: no lockfile, no integrity verification, no transitive pinning
  • killeronthecorner@lemmy.worldEnglish
    20·
    2 days ago

    Every run re-resolves from your workflow file, and the results can change without any modification to your code.

    Sounds expensive too.

    Ahhh, I get it now.

  • Piatro@programming.devEnglish
    7·
    2 days ago

    R has the same problems as far as I’m aware, though it doesn’t form the core of a lot of modern CI of course!

    • festus@lemmy.caEnglish
      3·
      12 hours ago

      R (largely and by default) relies on CRAN, and they are extremely selective about what packages they accept, including testing new package versions against downstream packages before publishing an update, etc. That largely mitigates many of the concerns of some random 10 layer deep dependency getting swapped for something malicious.