> After you finish apologizing to all your users for the recent breakages, you decide to make some performance improvements. Everyone loves faster code, right? This is a safe thing to do and surely nothing could go wrong.

> The new app now calculates the yearly tax summary almost instantaneously. It’s a huge improvement over the previous version, which used to take several seconds. You ship it.

> …and oops, one of your biggest partners has called you to complain. You’ve broken their website, which embeds your app as part of their business management suite. It turns out their code expected your calculation to take at least 5 seconds. Now that it’s faster, users encounter lots of errors and results that don’t make any sense.

> In frustration, you quit your job and return to the construction industry. At least here, no one expects a house upgrade without disruption.

Huge https://xkcd.com/1172/ vibes

How do you prevent exposing yourself to supply chain attacks like the tj-actions/changed-files one [0] if you don't?

I get your question regarding scaling, but that's the job: you can choose to outsource code to 3rd-party libraries, and eternal vigilance is the trade-off.

Assume your 3rd-party dependencies will try to attack you at some point: they could be malicious; they could be hacked; they could be issued a secret court order; they could be corrupted; they could be beaten up until they pushed a change.

Unless you have some sort of contract or other legal protection and feel comfortable enforcing them, behave accordingly.

0: https://www.wiz.io/blog/github-action-tj-actions-changed-fil...

It's not a huge part of the job to read every item. Looking at code changes in deps though is a whole other thing.

That's a judgement call. It would be too much to review all code change of all dependencies unfortunately.

The corollary of reviewing all code on all dependency updates is you should review all code or the new deps you add, including the transformation by build processes that might mean what is in the package manager might be different and same for all transitive dependencies.

Same with the language and runtime tooling.

It is too hard to be perfect!