-
-
Notifications
You must be signed in to change notification settings - Fork 9.5k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Remove third-party actions (where possible) #17378
Comments
Strong +1 from me! Removing external dependencies in favor of |
Octokit.js is better for testing over What actions do you have in mind? We could make a |
Mainly the ones that simple and/or are attached to a single user rather than a reputable organisation e.g. github/actions/ruby/etc. Looking at the list of approved ones the ones that probably should be investigated for replacing are:
and removing:
|
Ah misread this for writing new actions. In that case yeah if we're just replacing workflow steps then for most of the above |
This is used in the Homebrew/install for testing the install on a Windows runner. Do we not need that anymore? Or can we hack something together ourselves. |
We might be able to do something that uses WSL2 (GitHub runners use WSL1 by default, which we technically have dropped support for) now that nested virtualisation is now supported on Windows runners. |
Not enough to warrant the security implications. Either hack it ourselves or, more likely, just not bother testing WSL. |
I've handled WSL given I've had plenty experience using it and running the various commands: Homebrew/install#859 |
I'd say this is pretty much done now, thanks all. |
Verification
brew install wget
. If they do, open an issue at https://github.com/Homebrew/homebrew-core/issues/new/choose instead.Provide a detailed description of the proposed feature
We should avoid third-party, unofficial GitHub Actions where possible, particularly those that do simple things like
gh
can do in a one-liner (e.g. opening a pull request)What is the motivation for the feature?
Improving the security profile of Homebrew
How will the feature be relevant to at least 90% of Homebrew users?
It won't be.
What alternatives to the feature have been considered?
CC @Homebrew/security folks for thoughts here too.
The text was updated successfully, but these errors were encountered: