3 ms·
Not sure if I get it. If you are using a product like Github Enterprise, you are already quite aware of what other people are doing. You have a lot of visibilit
by lenkite 1y ago
Not sure if I get it. If you are using a product like Github Enterprise, you are already quite aware of what other people are doing. You have a lot of visibility, source-code search, etc. If you have a CICD that auto-creates issues you already can detect breakages, incompatibilities, etc.
State of the "code universe" being atomic seems like a single point of failure.
- jeffbee 1y agoGitHub search is insanely bad and it cannot do things like navigating to definitions between repos in an org.
- lenkite 1y agoIf you want code search and navigation over a closed subgraph of projects that build into an artifact - opengrok does the job reasonably well.
- eddd-ddde 1y agoImagine team A vendors into their repo team B's code and starts adding their own little patches. Team B has no idea this is happening, as they only review code in repo B. Soon enough team A stops updating their dependency, and now you have two completely different libraries doing the "same" thing. Alternatively, team A simple pins their dependency to team B's repo at hash 12345, then just, never updates... How is team B going to catch bugs that their HEAD introduces on team A's repo?
- lenkite 1y agoThis is already caught by multi-repo tooling like Github today. If you vendor in an outdated version with security vulnerabilities, issues are automatically raised on your repo. Team B doesn't need to do anything. It is Team-A's responsibility to adopt to latest changes.
- eddd-ddde 1y agoCurious because I haven't seen this myself. Do you mean, GitHub detects outdated submodule references? Or, GitHub detects copy of code existing in another repo, and said code has had some patches upstream?
- lenkite 1y agoGithub has dependabot https://docs.github.com/en/code-security/dependabot/dependabot-alerts https://docs.github.com/en/code-security/dependabot/dependab... which can also raises PR's, though your mileage may greatly vary here depending on your language. You can also configure update of dependencies https://docs.github.com/en/code-security/dependabot/dependabot-version-updates https://docs.github.com/en/code-security/dependabot/dependab... These work with vendored dependencies too. (In our org, we have our own custom Go tool that handles more sophisticated cases like analyzing our divergent forks and upstream commits and raising PR's not just for dependencies, but for features. Only works when upstream refactoring is moderate though)