Live data from Hacker News

Modern CI is too complex and misdirected

gregoryszorc.com

11–20 of 184 posts

Re: Modern CI is too complex and misdirected

#11
It's weird that people keep building DSLs or YAML based languages for build systems. It's not a new thing, either - I remember using whoops-we-made-it-turing complete ANT XML many years ago.

Build systems inevitably evolve into something turing complete. It makes much more sense to implement build functionality as a library or set of libraries and piggyback off a well designed scripting language.

Re: Modern CI is too complex and misdirected

#12
post #2

Ding ding ding. We have a winner. All a CI pipeline is is an artifact generator. All a CD pipeline is is an artifact shuffler that can kick off dependent CI jobs. The rest is just as the author mentions. Remote Code Execution as a service.

But what we have is CI tools with integrations to a million things they shouldn't probably have integrations to.

Most of the build should be handled by your build scripts. Most of the deploy should be handled by deploy scripts. What's left for a CI that 'stays in its lane' is fetching, scheduling, and reporting, and auth. Most of them could stand to be doing a lot more scheduling and reporting, but all evidence points to them being too busy being distracted by integrating more addons. There are plenty of addons that one could write that relate to reporting (eg, linking commit messages to systems of record), without trying to get into orchestration that should ultimately be the domain of the scripts.

Otherwise, how do you expect people to debug them?

I've been thinking lately I could make a lot of good things happen with a Trac-like tool that also handled CI and stats as first class citizens.

Re: Modern CI is too complex and misdirected

#13
post #11

It's weird that people keep building DSLs or YAML based languages for build systems. It's not a new thing, either - I remember using whoops-we-made-it-turing complete ANT XML many years ago. Build systems inevitably evolve into something turing complete. It makes much more sense to implement build functionality as a library or set of libraries and piggyback off a well designed scripting language.

Joe Beda (k8s/Heptio) made this same point in one of his TGI Kubernetes videos: https://youtu.be/M_rxPPLG8pU?t=2936

I agree 100%. Every time I see "nindent" in yaml code, a part of my soul turns to dust.

Re: Modern CI is too complex and misdirected

#15
post #14

I was really disappointed when GitHub Actions didn't more closely resemble Drone CI. Drone's configuration largely comes down to a Docker container and a script to run in said Docker container.

Not familiar with Drone but just pointing out Github Actions can be used for lots of stuff besides CICD. That's just the most popular and obvious usage.

I actually prefer being able to grab some existing actions plugins rather than having to write every single build step into a shell script like with eg. Aws codePipeline for every app. You don't have to use them, though. You could have every step be just shell commands with Github Actions.

Re: Modern CI is too complex and misdirected

#16
post #11

It's weird that people keep building DSLs or YAML based languages for build systems. It's not a new thing, either - I remember using whoops-we-made-it-turing complete ANT XML many years ago. Build systems inevitably evolve into something turing complete. It makes much more sense to implement build functionality as a library or set of libraries and piggyback off a well designed scripting language.

[deleted]

Re: Modern CI is too complex and misdirected

#17
I think that modern CI is actually too simple. They all boil down to "get me a Linux box and run a shell script". You can do anything with that, and there are a million different ways to do everything you could possibly want. But, it's easy to implement, and every feature request can be answered with "oh, well just apt-get install foobarbaz3 and run quuxblob to do that."

A "too complex" system, would deeply integrate with every part of your application, the build system, the test runner, the dependencies would all be aware of CI and integrate. That system is what people actually want ("run these browser tests against my Go backend and Postgres database, and if they pass, send the exact binaries that passed the tests to production"), but have to cobble together with shell-scripts, third-party addons, blood, sweat, and tears.

I think we're still in the dark ages, which is where the pain comes from.

Re: Modern CI is too complex and misdirected

#18

What is the name for this phenomenon: Observation: X is too complex/too time-consuming/too error-prone. Reaction: Create X' to automate/simplify X. Later: X' is too complex.

The alternative to this seems even worse. To deal with the overcomplexity we get things like Boot and Webpack, which aren't even really build tools, but tools for building build tools.

Re: Modern CI is too complex and misdirected

#19
post #11

It's weird that people keep building DSLs or YAML based languages for build systems. It's not a new thing, either - I remember using whoops-we-made-it-turing complete ANT XML many years ago. Build systems inevitably evolve into something turing complete. It makes much more sense to implement build functionality as a library or set of libraries and piggyback off a well designed scripting language.

Things like rake always made more sense to me - have your build process defined in a real programming language that you were actually using for your real product.

Then again, grunt/gulp was a horrible, horrible shitshow, so it's not a silver bullet either...

Re: Modern CI is too complex and misdirected

#20

One big difference in my opinion is that a CI system can (and should) allow for guarantees about provenance. Ideally code signing can only be done for your app from the CI server. This allows users/services to guarantee that the code they are running has gone through whatever workflows are necessary to be built on the build server (most importantly that all code has been reviewed). As a principle, I consider any code…

It is something we're definitely concerned about: https://www.datadoghq.com/blog/engineering/secure-publicatio...
Post reply on HN