GitHub Actions has a package manager that ignores decades of supply chain security best practices: no lockfile, no integrity verification, no transitive pinning
  • killeronthecorner@lemmy.worldEnglish
    21·
    3 days ago

    Every run re-resolves from your workflow file, and the results can change without any modification to your code.

    Sounds expensive too.

    Ahhh, I get it now.