I don't think this is production, this is for running your tests. Your code in the "tests haven't run yet" state probably leak all the secrets they have access to and destroy the machine they're running on, so you don't let them have any secrets and create a new machine each time. "curl | bash" here just injects potential flakiness (as does "npm install" when npm dies, etc.)
Obviously a lot of people treat their CI system as their CD system, and do things like letting tests have highly privileged access to their production k8s cluster. That's a terrible idea even if you aren't installing software with "curl | bash".
So overall, I don't think this is worth a HN comment to complain about. People are going to install software in non-auditable non-reproducible ways.
Obviously a lot of people treat their CI system as their CD system, and do things like letting tests have highly privileged access to their production k8s cluster. That's a terrible idea even if you aren't installing software with "curl | bash".
So overall, I don't think this is worth a HN comment to complain about. People are going to install software in non-auditable non-reproducible ways.