alt Hacker NewsI did read the blog post. More than once, in search for info on transitive dependencies. It doesn’t provide it. You’re right that I should’ve clicked through the official blog post, I got link blindness. I did find it strange that transitive dependencies weren’t included, which is why I repeatedly said it seemed it didn’t. Thank you for the correction.
Your snark is unwarranted, though, since the crux of the comment is not using any Action you haven’t built. Lockfiles don’t solve the complexity and trust problem.
Sorry, the snark was meant to be more general. Your comment was one of ~5 of people that apparently didn't pick up on the transitive locking, and repeatin now-outdated information. I do think the author did a bad job of highlighting it, so I see how it can be missed.
> Lockfiles don’t solve the complexity and trust problem.
They don't solve it on their own, but they are an important building block, and allow GHA to take the same shape that other package ecosystems have (e.g. npm, Cargo), where trust issues can be worked around to some degree with a combination of consumption-delay + automated security review. Of course, going with a smaller surface area is always preferrable.