5 ms·
How do you scale this besides keeping the dep list short? Are you reading every item or just scanning for words like "deprecated" or "breaking change"?
by robszumski 1y ago
How do you scale this besides keeping the dep list short? Are you reading every item or just scanning for words like "deprecated" or "breaking change"?
- ImPostingOnHN 1y agoHow do you prevent exposing yourself to supply chain attacks like the tj-actions/changed-files one [0] if you don't? I get your question regarding scaling, but that's the job: you can choose to outsource code to 3rd-party libraries, and eternal vigilance is the trade-off. Assume your 3rd-party dependencies will try to attack you at some point: they could be malicious; they could be hacked; they could be issued a secret court order; they could be corrupted; they could be beaten up until they pushed a change. Unless you have some sort of contract or other legal protection and feel comfortable enforcing them, behave accordingly. 0: https://www.wiz.io/blog/github-action-tj-actions-changed-files-supply-chain-attack-cve-2025-30066 https://www.wiz.io/blog/github-action-tj-actions-changed-fil...
- bravesoul2 1y agoIt's not a huge part of the job to read every item. Looking at code changes in deps though is a whole other thing.