I've been considering Argo Workflows for my CI/CD jobs lately. It feels better than Forgejo Actions in the following ways:
- I can create workflows with some privileges (like creating user namespaces) without going "--privileged". It is not as "on/off" as it can be with Forgejo Actions, because you can express complex securityContexts;
- the workflows manifests may not be part of the code repository, which squelch a whole world of possible attach vectors;
- secrets can be mounted on the need-to-know basis, per container instead of having all secrets possibly exposed as soon as you have write permissions on the repository and the right to run a pipeline.
Am I missing something?
