GitHub Actions has a package manager, and it might be the worst(nesbitt.io)
408 points by robin_reala | 236 comments
Andrew Nesbitt's blog post arguing GitHub Actions functions as a package manager lacking lockfiles, integrity hashes, and other supply chain safeguards.