Personally I found the risk of running someone else’s GitHub Action in my repo to not be worth it. Even GitHub’s own Action to checkout repos is way more complex than I need it to be and last I checked had dependencies which could be targeted. I opt instead to not run any third-party Actions (not even GitHub’s official ones) in my repos.
This is a new first-party feature by Github to allow locking of transitive dependencies.
Your snark is unwarranted, though, since the crux of the comment is not using any Action you haven’t built. Lockfiles don’t solve the complexity and trust problem.
> Lockfiles don’t solve the complexity and trust problem.
They don't solve it on their own, but they are an important building block, and allow GHA to take the same shape that other package ecosystems have (e.g. npm, Cargo), where trust issues can be worked around to some degree with a combination of consumption-delay + automated security review. Of course, going with a smaller surface area is always preferrable.
Fair. I know what it’s like to be frustrated with a general trend, and unfortunately we have to pick one comment to reply to.
> They don't solve it on their own, but they are an important building block
Agreed, it is a good step and I understand why people would want to do it. But I also stand by saying “not a trade-off I want to make (but you do you)”. I mean it in every sense: I still don’t want to do it for myself, but in no way am I claiming my preference is right for everyone.
As I see it, TFA's only value is that link to a better article.
Lack of transitive pinning support was the biggest supply-chain security criticism against GHA and I'm glad they are finally tackling it!
So some of the extra steps are meaningful. Though I am still not convinced they could not have been implemented in a deliberately backwards-incompatible way to Github action in general, keeping the syntax and removing only the special case that is never both intentional and non-malicious at the same time.
They don't because they don't.
Anybody who's ever moved a git tag knows the ergonomics of doing so are so awful that you're obviously not supposed to be doing it.
/s
This is a step in the right direction, but it’s not even close to a complete solution. And what am I doing installing a plugin to use this? It should just be part of GH, so I can install that and not have yet another source of dependency management to lock down.