4 ms·
That's an interesting approach. I'm not keen on the bureaucratic aspect, which leads to more friction than it's worth in my experience. I guess that's beside t
by NAHWheatCracker 5y ago
That's an interesting approach. I'm not keen on the bureaucratic aspect, which leads to more friction than it's worth in my experience.
I guess that's beside the point if your goal is only to reduce risk of compromised CI/CD.
- mulmen 5y agoYou can compromise and give the developers the ability to add dependencies as well. In a separate “dependency mirror” package. But those have to be code reviewed like anything else. So you have a paper trail but adding a dependency is lower friction. And you still can’t accidentally (or maliciously!) pull in an evil dependency without at least two people involved.