undefined

points

by latexr13 hours ago |

comments

by hobofan7 hours ago|

[-]

Does nobody read the blog post and liked Github release annoucment anymore?

This is a new first-party feature by Github to allow locking of transitive dependencies.

by latexr2 hours ago|

parent|

[-]

I did read the blog post. More than once, in search for info on transitive dependencies. It doesn’t provide it. You’re right that I should’ve clicked through the official blog post, I got link blindness. I did find it strange that transitive dependencies weren’t included, which is why I repeatedly said it seemed it didn’t. Thank you for the correction.

Your snark is unwarranted, though, since the crux of the comment is not using any Action you haven’t built. Lockfiles don’t solve the complexity and trust problem.

by hobofan1 hours ago|

parent|

[-]

Sorry, the snark was meant to be more general. Your comment was one of ~5 of people that apparently didn't pick up on the transitive locking, and repeatin now-outdated information. I do think the author did a bad job of highlighting it, so I see how it can be missed.

> Lockfiles don’t solve the complexity and trust problem.

They don't solve it on their own, but they are an important building block, and allow GHA to take the same shape that other package ecosystems have (e.g. npm, Cargo), where trust issues can be worked around to some degree with a combination of consumption-delay + automated security review. Of course, going with a smaller surface area is always preferrable.

by latexr53 minutes ago|

parent|

[-]

> Sorry, the snark was meant to be more general.

Fair. I know what it’s like to be frustrated with a general trend, and unfortunately we have to pick one comment to reply to.

> They don't solve it on their own, but they are an important building block

Agreed, it is a good step and I understand why people would want to do it. But I also stand by saying “not a trade-off I want to make (but you do you)”. I mean it in every sense: I still don’t want to do it for myself, but in no way am I claiming my preference is right for everyone.

by Bnjoroge6 hours ago|

parent|

prev|

[-]

Cosign. It’s the entire point of this article and would be obvious if someone read

by akoboldfrying13 minutes ago|

parent|

[-]

If that is really the "entire point" of the article, it's strange that the article doesn't mention it at all. It simply says you should do a thing differently than the way you used to do it, without explanation. It links to the official GitHub blog post, which, it turns out, does mention transitivity -- but again, TFA itself does not even hint that this "entire point" will be addressed in that linked article.

As I see it, TFA's only value is that link to a better article.