Do we encourage or discourage using `init-pants`? ...
# development
w
Do we encourage or discourage using
init-pants
? https://github.com/pantsbuild/actions (slightly discouraged with the support note) https://www.pantsbuild.org/stable/docs/using-pants/using-pants-in-ci#directories-to-cache (slightly encouraged) We should pick a lane. My personal thought is that 3rd party actions are a net negative to security posture, so when used they should be fully pinned (Github's actions are a weird middle ground, but I'm now leaning towards those being fully pinned too - since DepBot can update them). We're not yet at the spot where I can advocate for the alternative I would personally use, but we should be mostly there in 2.33 or 2.34
👍 1