UpdatedTL;DR; summary Updated: 31.01.2020TL;DR; summary: If you are a Committer/PMC member of a ASF project and you think about migrating to GitHub Actions this is the current status. - You should hold-off with switching to GitHub Actions until performance and security problems that we are currently experiencing are solved at the ASF level.
- If you want to use the GitHub Actions, you can consider using your own self-hosted runner, but only if you can afford to build and maintain your own self-hosted infrastructure (this is not an easy task due to security limitations of the official GitHub Actions runners).
- If you decide to use GitHub Actions, you need to be very careful to mitigate some of the security problems you might have if you follow GA setup using examples. There is an extra hardening required in your workflows if you want to protect your project from 3rd-party dependencies having WRITE access to your project.
| 