Article URL: https://www.wsj.com/business/airlines/the-single-router-in-southern-arkansas-that-ground-air-travel-to-a-halt-eedc326c Comments URL: https://news.ycombinator.com/item?id=50503588 Points: 6 # Comments: 0
This is an AI-generated summary. ShortSingh links to the original source for the complete article.
GitHub Actions can replace a stored cloud access key with OIDC, where GitHub signs a short-lived token for each job that AWS, Google Cloud or Azure exchange for temporary credentials. The security depends entirely on the trust conditions written on the cloud side, since every GitHub repository can obtain a token from the same issuer. Conditions should bind to stable identifiers such as repository ID, a protected environment with required reviewers, or a reusable workflow, rather than a wildcard organization name. The default subject claim format has a weakness: recycled repository or organization names could let a new owner mint matching tokens, so newer repositories use an immutable format that includes numeric IDs. Older repositories must opt into that format through their OIDC settings or the REST API.
The article explains how to migrate Declarative Jenkinsfile pipelines to GitHub Actions by translating directives one by one, such as agent becoming runs-on and when becoming if. It notes that plugin steps, shared libraries and Groovy script blocks cannot be converted automatically and must be rebuilt by hand. It recommends moving simple build-and-test pipelines first and deploy pipelines last, keeping the Jenkins job running until the new workflow produces matching results. A key warning is that each GitHub Actions job runs on its own fresh machine without a shared workspace, which changes behavior more than the syntax does. The piece presents a mapping table of sixteen constructs, flagging which convert cleanly and which change how the pipeline behaves.
The article recommends keeping every original image in private storage and serving only compressed, resized, or watermarked derivatives to public portfolio visitors. Each completed purchase should be checked against a durable purchase-to-asset record before the application issues an expiring URL for the original. The design relies on random internal asset identifiers rather than filenames or client-supplied keys to determine entitlement. It also specifies that transformation failures must fail closed instead of falling back to the original file. The author suggests a single REST-based service could cover both image processing and private object access, though the evaluation rests on the author's own judgment.
GitHub-hosted Actions runners provide different CPU and memory depending on whether a repository is public or private, even when the workflow YAML is identical. For example, a standard Linux runner gets 4 vCPU and 16 GB RAM on a public repo but only 2 vCPU and 8 GB on a private one. Standard runners all come with 14 GB of disk regardless of size, while larger paid runners offer between 75 GB and 2 TB. Larger runners are billed per minute and draw on plan compute on Team and Enterprise Cloud, and they can also be given static IP addresses. The article's specification tables were read on 2026-09-20 and the runner tiers and deprecation dates it references may change.
Discussion (0)
Log in to join the discussion and vote.
Log in