alt Hacker NewsSorry, the snark was meant to be more general. Your comment was one of ~5 of people that apparently didn't pick up on the transitive locking, and repeatin now-outdated information. I do think the author did a bad job of highlighting it, so I see how it can be missed.
> Lockfiles don’t solve the complexity and trust problem.
They don't solve it on their own, but they are an important building block, and allow GHA to take the same shape that other package ecosystems have (e.g. npm, Cargo), where trust issues can be worked around to some degree with a combination of consumption-delay + automated security review. Of course, going with a smaller surface area is always preferrable.
> Sorry, the snark was meant to be more general.
Fair. I know what it’s like to be frustrated with a general trend, and unfortunately we have to pick one comment to reply to.
> They don't solve it on their own, but they are an important building block
Agreed, it is a good step and I understand why people would want to do it. But I also stand by saying “not a trade-off I want to make (but you do you)”. I mean it in every sense: I still don’t want to do it for myself, but in no way am I claiming my preference is right for everyone.