Hacker News Reader

Comment by dvh | Hacker News Reader

There's one thing I don't understand. Isn't GitHub action just "take a repo, do something with it, save something somewhere". So how is it different than writing a bash script that "clones the repo, do something with it, pushes the changes back"? If actions became paid feature, wouldn't that just generated myriads of show hn posts like "I recreated GitHub actions in xyz"?

View on HN

Yes, in theory any CI/CD (whether Github, Gitlab, Jenkins etc,) is just a shell script with some warpping. But this wrapping matters because it's convenience: how you integrate with the repo, how you deal with variables, secrets, caching, deployment security and so on. Some people roughly figured this out and proposed some ways which other people learned, so switching is always a bit of a pain in various ways. But it is definitely possible - I did quite a lot of pipeline migration in my life and this is definitely not a blocker for a project of small to medium to biggish-size.

Where does one get to suffer YAML hell then??

Hand roll something on k8s. Yaml seems unavoidable in that ecosystem. :)

Part of the advantage is a fully hosted service where you don't need to worry about a control plane managing and scheduling jobs.

There's some cost involved there--especially if you're offering hosted runners (you need some capital to buy infra to run jobs)

There's also advantage of limiting how many companies you share your code with. If you're using GitHub, you're already trusting them with your source code so GitHub Actions doesn't require more trust or an additional entity to manage/pay

This is likely the reason behind the recent push of "Trusted Publishing" from NPM. They are trying to make people consider GitHub (and GitLab) in its own higher tier with regards to supply-chain security by decree.

If you rely on "Trusted Publishing" you are assisting Microsoft in making a moat for their CI platform.

Use cryptographic signatures, not implicit trust in a hosted platform.

Yes, and there are several tools that do just that already. The thing Github Actions offers is logging and storage of artifacts.

This change is a very weird one. Because the teams that are capable of setting up their own runners have the means to easily jump ship to another CI platform and skip these fees altogether.

Yea but a bash script isn't declarative so thats somehow bad.

(DECLARATIVE CI WHY?????)

Straightforward statements with a few conditionals considered harmful. Here learn this grotesque vendor-specific DSL hamfisted into YAML instead.

It's like bash scripts, but with ability to debug them.

There are few things less debuggable than Github Actions. Bash scripts isn't one of them

Apologies, I realized I had a typo. It should be "It's like bash scripts but WITHOUT the ability to debug them". I am personally not a fan of GHA and I think unsuperwised claude code could have produced a better CI system.

Reply on news.ycombinator.com