GeistHaus
log in · sign up

GitHub Actions Has a Package Manager, and It Might Be the Worst

nesbitt.io

GitHub Actions has a package manager that ignores decades of supply chain security best practices: no lockfile, no integrity verification, no transitive pinning

1 page links to this URL