So, does GH actions just let me execute code for free on Microsoft's servers...?

[giordano]

@maxkapur

But my question is, all of these processes have to run on a computer somewhere, and that computer isn’t mine, so is Microsoft (which owns GH) just giving me computer power for free?

Yes, but also hosting the git repository is a service they’re giving for free.

@maxkapur

What’s their interest in doing so—is it a loss leader to get me enmeshed in the GH ecosystem in the hopes that I later buy a premium account?

Not everyone ends up making paid for subscriptions, but yes, they make money that way. Especially organisations that want private repositories, without the hassle of maintaining an instance of a git server themselves.

@maxkapur

Or is Microsoft using my code to do train some fancy ML algorithm?

No need to use the code you run in github actions, they can already read the code hosted in repositories: https://copilot.github.com/

@maxkapur

And are there limits on what kinds of scripts I can run with Github actions? At first I reasoned that GitHub would only allow actions that are on a “whitelist,” but CompatHelper.jl is just a program and it seems like, in principle, I could write (say) a GitHub action that mines a bunch of cryptocurrency and deposits it in my wallet … and have the code executed, at no cost to me, on Microsoft’s servers. How does Microsoft “vet” GH actions against malicious or profit-seeking code?

GitHub Actions update: Helping maintainers combat bad actors

Looking at the /etc/hosts in the runners is also fun: they block dozens of cryptomining-related websites. They do take active actions to limit mining, and ban users caught doing so.