Package managers need to cool down(nesbitt.io)
44 points by zdw | 39 comments
44 points by zdw | 39 comments
73 points by exploraz | 11 comments
408 points by robin_reala | 236 comments
Andrew Nesbitt's blog post arguing GitHub Actions functions as a package manager lacking lockfiles, integrity hashes, and other supply chain safeguards.