27 ms·
You need to have a CD system which takes equality pinned deps and bumps them when new versions come through and automatically runs the new versions through what
by lamontcg 5y ago
You need to have a CD system which takes equality pinned deps and bumps them when new versions come through and automatically runs the new versions through whatever your test/integration/production environments looks like. And you should have sufficient integration testing that you should have confidence that an automated process should be able to decide if the new version should get deployed to prod (being realistic you probably want to confine these deployments to some sort of reasonable business hours).
Then the tech debt gets addressed automatically without any work. The work is all up front to write the tests that give you confidence about deployment to production, but that is work that needs to happens and pays off. You shouldn't need to have human testing in the loop.
- crummy 5y agoDo people have automated tests to validate their SMSs are sent correctly (and received by a real phone)? Or that credit card payments are made correctly? These are things I use third party libraries for, and what I worry might break when I upgrade dependency versions.
- sbierwagen 5y agoMost payments vendors will have test CC numbers for integration testing. One of Paypal's test numbers is 5555555555554444, for example. https://developer.paypal.com/api/nvp-soap/payflow/integration-guide/test-transactions/ https://developer.paypal.com/api/nvp-soap/payflow/integratio...
- adenner 5y agoDepends, how big of a deal is it when they break?
- delusional 5y agoI guess the question becomes how far out you want to test. If your credit card processor is a third party they could technically break something, regardless of which version of their library you use. In that case, do you really care that a transaction goes through, or do you just care that you used your third parties interface correctly (be that rest or binary api calls). If your requirements aren't that sharp, like maybe you can take a day or two to process the credit card payments, you could get away with monitoring your application and configuring alarms for if no transactions go through. That way you'd catch errors originating from your third party as well.
- raybb 5y agoI haven't used it myself but I'm pretty sure Whitesource Renovate is free tool that tries to do just that. https://www.whitesourcesoftware.com/free-developer-tools/renovate/ https://www.whitesourcesoftware.com/free-developer-tools/ren...
- throwanem 5y agoWeird, I thought it was a tool for encouraging engineers to learn how to use Github PR search filters.
- badLiveware 5y agoI am a fan of using renovate, and with docker images in particular since I can define my remote as FROM mcr.microsoft.com/dotnet/sdk:6.0@sha256:15c22c170650b8db2f6250547a2dc5341978b0647c6b21ef67768e628de614f3 AS build and have renovate automatically merge digest updates, the sha256 hash, while having manually(or automatic) PRs for the tag target. So a when upstream updates their tag I get a PR(which is automerged) that looks like so, this allows me to know when upstream has changed while still being able to target a broader version range, 6.0 in this case - FROM mcr.microsoft.com/dotnet/sdk:6.0@sha256:15c22c170650b8db2f6250547a2dc5341978b0647c6b21ef67768e628de614f3 AS build + FROM mcr.microsoft.com/dotnet/sdk:6.0@sha256:70b890cd12f73f8ad80061d242081b61da666bda7ec2d729113855a8b9410e1e AS build
- humanrebar 5y agoAgreed. There are logical, version-flexible dependencies. And then there are rigid, version-specific dependencies. Robust systems need to model both so they can support reproducibility and automation needs.