bramblerose

hace 5 mesesdiscuss

While that is true, "Drivers consistently ignoring rules" is also a systems issue, which can be mitigated through e.g. better road design (narrower roads reduce speeding, for example).

bramblerose

hace 6 mesesdiscuss

Unless the design of the object is copyrightable (which it often is!) in which case the photo is a derivative work.

bramblerose

hace 7 mesesdiscuss

- Using the commit SHA of a released action version is the safest for stability and security.

This is not true for stability in practice: the action often depends on a specific Node version (which may not be supported by the runner at some point) and/or a versioned API that becomes unsupported. I've had better luck with @main.

bramblerose

hace 10 mesesdiscuss

The solution to the "interface/tooling to translate" problem, at least for open source applications, is https://translatewiki.net/ , with the additional benefit that it comes with a team of experts that can help you understand how to deal with stuff you might be unfamiliar with, such as RTL languages and plural forms.

bramblerose

hace 10 mesesdiscuss

   uses: actions/checkout@v4

That uses the Node that is provided by GitHub, and that will break in the future.

bramblerose

hace 10 mesesdiscuss

I find the repeated deprecations on GitHub Actions frustrating to work with. One of the key goals of a build system is to be able to come back to a project after several years and just having the build work out of the box.

Yet with GHA I need to update actions/checkout@v2 to actions/checkout@vwhatever (or, what I'm doing now, actions/checkout@main because the actual API haven't actually changed) because... some Node version is "out of maintenance"?!

GHA is literally code execution as a service. Why would I care whether the Node runner has a security vulnerability?

comments