RE: https://phpc.social/@supergarv/116291496556589191

What fuck GitHub. I have never enabled any of this. Fastest way of losing my trust is sneakily violating consent. Not that I had any trust left.

@janl do I need to blog about switching to forgejo?
@astraluma not on my behalf, my GH involvement is inertia in existing infra that will take years to untangle. Personally, I’m out.
@janl oh good, because the answer is mostly "it just works, there's a few things it has and a few things it's missing, some of which are being worked on. You should read my other post on runners."

@astraluma thanks :)

The one issue is deep integration between GH and ASF infra that took a few years to put together. I’d like the ASF to run its own Forgejo, but that’s another multi-year endeavour.

Another is actually the free CI and variety of runner configs. For PouchDB, we’d have to rebuild this and for CouchDB we run an elaborate Jenkins setup, so I know how mich work and expensive that is.

@janl multi platform support in the runners is the biggest hole right now; it's affecting me too

I wish someone like Cirrus would pick it up, but so far not.

@astraluma I’m immensely bullish on Forgejo/Codeberg (I’m a member), the issues ahead are all solvable with time and there are rolks working on or thinking about all of them. And I am not in a rush.
@astraluma And then for the company we have a lot of workflows set up that will need migrating and we don’t have the resources for that right now, but we’ll get there.
@janl thankfully Forgejo actions are pretty close to GitHub (and it mostly depends on the base image your runner uses). So far the differences have been things like "the install Python action assumes poetry is already installed"
@janl oh, and the fact that the builtin token has limited and non-configurable permissions. (There's an open issue for this.)

@astraluma @janl that is an incredibly annoying error but the poetry maintainer is great to collaborate with (i only mention this because uv refuses to do so while they directly take credit for my work). i attempted to propose a standard API for telemetry but was rebuffed and forgejo/codeberg did not respond when i tagged them on here. if you have any packaging workflows that are unclear or features that are nontrivial i would love to be a resource here, i have a pip fork that is much faster and writes metadata that can be queried.

i'm not sure this will be immediately useful or necessary to either of you but do just want to register that i've spent years on this subject and would be delighted for an excuse to solve problems

pre-PEP: User-Agent schema for HTTP requests against remote package indices

(This is my first attempt to propose a packaging standard in this forum. I am basing this off the instructions at PyPA Specifications — PyPA documentation. Those instructions seem to indicate that a PR against GitHub - pypa/packaging.python.org: Python Packaging User Guide should be provided at the same time, but I’m not seeing many examples of that being done for in-progress PEPs, so I am assuming this is the appropriate first stop for potential new PEPs. I also could not find a standard format...

Discussions on Python.org

@hipsterelectron @janl oh the problem was that https://github.com/actions/setup-python expected poetry but ghcr.io/catthehacker/ubuntu:act-latest (https://github.com/catthehacker/docker_images) doesn't include it.

Maybe the answer is use ghcr.io/catthehacker/ubuntu:full-latest instead

GitHub - actions/setup-python: Set up your GitHub Actions workflow with a specific version of Python

Set up your GitHub Actions workflow with a specific version of Python - actions/setup-python

GitHub
@hipsterelectron @janl I kinda consider there fact that poetry is expected to be a bug. It's called "install Python" maybe it should also install Python utils.
@hipsterelectron @janl godesses I wish I had the bandwidth to even consider working on https://codeberg.org/fundament/vs
vs

The vs python environment tool

Codeberg.org

@janl I got a mail today:

This approach aligns with established industry practices and will enable our models to deliver more context-aware AI coding assistance.

@supergarv no such mail for me yet
@janl I just got an email

@janl it was already disabled for me, so I think they're honouring the last time folks opted out, at least...

But I can't wait for more projects to get off GitHub. What a horrible way to continually destroy trust.

@janl i didn’t get the email either and I recall previously opting out of ai bullshit. I’m so sick of this
@fox yeah :( I take solace in the fact that there are viable alternatives now.
@janl I swear the ai people are consciously trying to tire the opposition out until we don’t resist anymore
@fox yeah, gotta stay strong, pick battles, the lot.
@janl
What's next? Do we need a Github action to keep resetting our settings to the state we actively set them to in the first place?
@schmidt_fu no we go to Codeberg.
@janl
Why, of course we do! But in the meantime, our security tools keep asking for Github tokens... 🤔
@janl At least, it looks like they are pretty upfront about it, as it's on every repo you visit. Though, that doesn't justify the action itself.
@marcoroth absolutely zilch in the mobile view.
@janl Lol, it was enabled for me even though I shut off Copilot as soon as I saw it.