Post #1825968

Looking at the diff between two minor versions of a GitHub Action for installing Node.js. Not many changes: Just a few dependency version updates and a few CI changes. The source of the action itself is unchanged. And yet, the files that run in CI have 95k additions and 124k deletions. Two hundred and nineteen thousand modified lines. There is no way anyone will ever look at and audit those changes. And all that in an action whose only task is to download and unpack Node.js. How have we become okay with running this much obfuscated code as part of our critical supply chain? #GitHubActions #NodeJS