How to get started with GitHub? I just merged in a pull request from dependabot that bumps the versions of some npm modules. And then five more emerged, as if this bot is a hydra. And I’ve merged in all of them.
This, most likely, is a good thing by itself. But I can smell a lot of possible bad things coming out of this. I mean, this approach is not security through obscurity. But it is creating a lot of room for such in the future.
Just imagine developers all over the world learning to blindly click “merge” on three-lines pull requests to their package-lock.json files. What if a package becomes hijacked. And updating it results in running malicious code on your production box, or on your home+work laptop? What if a zero-day vulnerability, in node or in npm, or elsewhere, is found, and this kind of automatic pull request is [ab]used to trigger an avalanche of people updating, by accident or through second-order malicious intent?
Finally, what percentage of people would blindly accept a +3 lines change from a user. One that is not @dependabot, but some seemingly unnoticeable alteration of the name? I’d bet at least a few percent. And how many bad things squeeze into three lines? An unbounded number of them. And what are a few percent of developers? 10K+ repositories? 100K+?
If anything, this human factor of potential (and real) over-reliance on semi-automated “improvers” of our code is the strongest argument I have today in favor of using several repositories. Monorepo FTW is my motto in many situations. But, at least from a purely damage control perspective, multiple repos help keep some boundaries tight.
Yesterday I could argue that if some TypeScript code and some C++ code are sharing the same data schema. Then it is quite beneficial to keep this code, and the relevant schema, in the same repository.
Today I would think twice before allowing package[-lock].json anywhere in a repository where the main language is C++, and where various pre-submit scripts and post-merge actions do build and run this code on the servers that I care for security-wise.
Or maybe this post just signifies that I’ve bought into the religion of GitHub actions at scale. Yes, they are quite wasteful, true that. Yes, they often introduce extra complexity. But in our unstable world they do seem to be the safest technique of loose coupling in environments. Where zero trust is quickly becoming the norm. Especially when it comes to popular, widely depended upon, and somewhat fragile open source projects.
