Andrew Nesbitt personal blog
GitHub Actions has a package manager, and it might be the worst
GitHub Actions has a package manager that ignores decades of supply chain security best practices: no lockfile, no integrity verification, no transitive pinning
- Points
- 444
- HN comments
- 262
- Submissions
- 1
- Cited by
- 4 commenters
Infrastructure & DevOpsSoftware Engineering2025
On Hacker News
| Submitted | Title on HN | Points | Comments |
|---|---|---|---|
| Dec 8, 2025 | GitHub Actions has a package manager, and it might be the worst by robin_reala | 444 | 262 |
Cited in comments
Linked from 4 Hacker News comments by 4 different people, from Dec 2025 to Mar 2026.
Most recent:
- hobofan · Mar 23, 2026
- Arbortheus · Feb 6, 2026
- ashishb · Jan 6, 2026
- Sytten · Dec 16, 2025
