3 ms·
More a case for something like this from Show HN three months ago https://github.com/artifact-keeper https://github.com/artifact-keeper An artifact manager. O
by edoceo 6mo ago
More a case for something like this from Show HN three months ago
https://github.com/artifact-keeper https://github.com/artifact-keeper
An artifact manager. Only get what you approve. So you can get fast updates when needed and consistently known stable when you need it. Does need a little config override - easy work.
I had my own janky tooling for something like it. This is a good project.
- Johnny555 6mo agoDoes that really scale well? Thanks to cascading dependencies, even a medium sized project can import hundreds of dependencies. Can a developer really review them all to figure out if they are safe and that there's not security fix that was fixed in a newer version of the package?
- deleted 6mo ago[deleted]
- jpollock 6mo agoYes, that is what is required. Every dependency needs an internal owner and reviewer. Every change needs to be reviewed and brought into the internal repository. If no one is willing to stand up and say "yes this is safe and of acceptable quality", why use it? It's a software engineering version of the professional engineering stamp.
- edoceo 6mo agoI love the sibling response from @jp... Also, IME we don't deep dive everything (should we?) For most stuff we make sure the latest is not-shit and passed test cases. We do have ceremony around version bumps.