miskander

All great points and I think you're onto something with the idea of using GitHub Packages. Definitely something we're considering, stay tuned.

My team and I work on Actions at GitHub and I just wanted to stop by and add a bit more context. We definitely understand the concerns the article brings up and it's actually why we recommend in our documentation using SHA references when consuming third-party Actions. We also introduced the concept of verified Actions that extend an Organization's verification to Actions in the marketplace. We know there's more to do here to help prevent any malicious Actions and we're planning to continue to iterate. Thanks so much for the feedback and keep it coming.

Once you’re in the beta, you’ll be able to get started by picking from a varying list of templates. In the meantime, those templates are actually hosted here: https://github.com/actions/starter-workflows. Depending on what you’re interested in setting up, this page might be helpful in getting started. https://help.github.com/en/categories/automating-your-workfl...

Hey there, I’m the Director of Engineering at GitHub with the team working on Actions. We really wanted to get an extremely flexible and powerful SDLC automation platform into our users hands as fast as possible. To do that we borrowed some code and infra from Pipelines to be able to offer a rock-solid CI/CD to every developer on GitHub sooner, and to be able to scale out to 40 million developers. With hosted runners, you’ll be able to run your Actions builds in any cloud, or even on your own hardware; if you don’t want to set that up, builds run on VMs and containers in Azure by default. You can use Actions to deploy anywhere and we have AWS, Azure, and Google Cloud actions to enable you to get started right away. If you want to read up a bit more about our virtual environments as well as what powers our runners check, we have some of that info in our docs here: https://help.github.com/en/articles/virtual-environments-for....