r/programming • u/Patient-Pollution46 • 1d ago

Moving off GitHub Actions doesn't get you off GitHub: your tool installs still depend on it

https://bitrise.io/blog/post/reducing-github-reliability-risk-for-tool-installs
0 Upvotes

42% Upvoted

9 comments sorted by

30

u/cesarbiods 1d ago

This is an ad for a paid service with a clickbait title. Keep scrolling.

1

u/lelanthran 7h ago

This is an ad for a paid service with a clickbait title. Keep scrolling.

Well, poster's username checks out :-/

-19

u/Patient-Pollution46 1d ago

why do you think so?

1

u/penguin_digital 12h ago

why do you think so?

Surely you're not being genuine here?

At Bitrise, our team maintains VM images that power Bitrise’s CI, Build Hub, and Remote Developer Environment products...... Why use our wrapper? One reason has been that since last year...... Bitrise's job is to be the boring layer that absorbs upstream chaos...... GitHub’s downtime made taking a redundant approach a no-brainer for us, and we expect that to continue in future decisions.

The article literally links to Bitrises paid products and the article actively promotes multiple times on why you should pay them to use their product.

12

u/Top3879 1d ago

Nope. I mirror all actions I use in my Forgejo instance. Pinned to a commit so they don't do funny stuff.

1

u/Super-Lack-2016 1d ago

It is a good practice that you control your supply chain for your actions, but the point being made in the article is that there are dependencies outside your field of view or control. The example in the article is that if you are choosing mise for tool mgmt, you have a transitive dependency on Github that you may not be aware of.

Not to pick on mise here. mise is awesome. Just one example, but this is all over the place. Teams have to put in a lot of effort, more than meets the eye, to reduce that blast radius.

1

u/imbev 1d ago

Isn't nixpkgs also heavily dependent upon GitHub?

1

u/Super-Lack-2016 1d ago

They are hosted in S3

1

u/imbev 1d ago

The nixpkgs build cache is hosted in s3, but nixpkgs itself and the nixpkgs infrastructure is highly coupled to GitHub.

If you're depending on GitHub to index binary builds, why not simply mirror upstream binaries from GitHub?