If It Quacks Like a Package Manager
Summary
Andrew Nesbitt argues that many automation and DevOps tools evolve into true package managers once they develop transitive dependencies, bringing with them classic package-manager risks like reproducibility, supply-chain amplification, and mutable references. The piece surveys GitHub Actions, Ansible Galaxy, Terraform, and Helm charts, highlighting lockfiles, immutability, and integrity checks as mitigations, and underscores the security lessons from recent supply-chain incidents.