Hacker News Reader

Comment by elpakal | Hacker News Reader

Build engineer at a large Fortune 500 shop here - the largest impediment to us even enabling GitHub Actions is that you either disable them entirely for your org or allow repo admins to enable them _per repo_. We have several hundred repos in one org alone and we cannot simply enable them for everyone with admin access (for us if you create a repo, you get admin access).

View on HN

You can run actions on your existing Jenkins infra https://github.com/DontShaveTheYak/jenkins-std-lib

You can go to your organization settings / Actions and choose the specific repos that can use Actions. Repo admins can’t override that.

TIL

> cannot simply enable them for everyone with admin access

why not? is that a cost issue, perceived security, administration overhead?

Not OP, but in our case allowing essentially the entire company to start to use GHA would result in a huge load increase on our GHE deployment. Even with self-hosted runners per org, there is a lot of overhead that is ran on the github servers themselves. We are working towards rolling it out, but there are definitely some scalability issues.

We are running dedicated agents per repo, anytime someone creates a repo an agent pool is created for him.

Everything is running on AKS. We dont even pay for it THAT much, because container-agents are spinned up when needed. (Also few hundred repos)

If off-premise is an option for you I’d like to suggest a service I run called SurplusCI (surplusci.com). It’s cheaper than self hosting most of the time and is SHOULD be roughly zero toil for you.

I'm guessing since @athorax mentioned "our GHE deployment" that they're running GHE on-prem instead of using hosted GHE.

I'd be surprised if they were amenable to off-prem Actions runner hosting if they chose to run github on-prem

Ah you're absolutely right -- I mistook the "overhead" as running some actions on regular GHA but they were talking about overhead on the on-prem runners that already exist.

Yeah it's pretty unlikely that they're running GHE for any other reason than needing to keep everything on prem.

perceived security unfortunately. not my call

Reply on news.ycombinator.com