GitHub Actions has a package manager that ignores decades of supply chain security best practices: no lockfile, no integrity verification, no transitive pinning
  • killeronthecorner@lemmy.worldEnglish
    16·
    21 hours ago

    Every run re-resolves from your workflow file, and the results can change without any modification to your code.

    Sounds expensive too.

    Ahhh, I get it now.

  • Piatro@programming.devEnglish
    5·
    1 day ago

    R has the same problems as far as I’m aware, though it doesn’t form the core of a lot of modern CI of course!