My team and I work on Actions at GitHub and I just wanted to stop by and add a bit more context. We definitely understand the concerns the article brings up and it's actually why we recommend in our documentation using SHA references when consuming third-party Actions. We also introduced the concept of verified Actions that extend an Organization's verification to Actions in the marketplace. We know there's more to do here to help prevent any malicious Actions and we're planning to continue to iterate. Thanks so much for the feedback and keep it coming.
Hey there, I’m the Director of Engineering at GitHub with the team working on Actions. We really wanted to get an extremely flexible and powerful SDLC automation platform into our users hands as fast as possible. To do that we borrowed some code and infra from Pipelines to be able to offer a rock-solid CI/CD to every developer on GitHub sooner, and to be able to scale out to 40 million developers. With hosted runners, you’ll be able to run your Actions builds in any cloud, or even on your own hardware; if you don’t want to set that up, builds run on VMs and containers in Azure by default. You can use Actions to deploy anywhere and we have AWS, Azure, and Google Cloud actions to enable you to get started right away. If you want to read up a bit more about our virtual environments as well as what powers our runners check, we have some of that info in our docs here: https://help.github.com/en/articles/virtual-environments-for....