Post #3782398

I've been considering Argo Workflows for my CI/CD jobs lately. It feels better than Forgejo Actions in the following ways: - I can create workflows with some privileges (like creating user namespaces) without going "--privileged". It is not as "on/off" as it can be with Forgejo Actions, because you can express complex securityContexts; - the workflows manifests may not be part of the code repository, which squelch a whole world of possible attach vectors; - secrets can be mounted on the need-to-know basis, per container instead of having all secrets possibly exposed as soon as you have write permissions on the repository and the right to run a pipeline. Am I missing something? #devops #ci #argoCD