3 ms·
Our CI systems have read access to the data definition store (which is a sql database right now), because we don't store interop data definitions in code. So fu
by tremon 5y ago
Our CI systems have read access to the data definition store (which is a sql database right now), because we don't store interop data definitions in code. So fully hermetic no, because our code (repository) is not fully self-contained. The definition store has its own audits and change tracking, but it's separate from the interface code.
- derefr 5y agoThat seems fine, in the same way that e.g. an XML library fetching DTDs from a known public URL is fine. However, it'd probably be better if you could have the CI framework collect and inject that information into the build using some hard-coded deterministic logic, rather than giving the build itself (developer-driven Arbitrary Code Execution) access to that capability. Same idea as e.g. injecting Kubernetes Secrets into Pods as env-vars at the controller level, rather than giving the Pod itself the permission to query Secrets out of the controller through its API.