51–60 of 65 posts
Earlier quoted context omitted.
I mean, the PR limit is like a million characters. I would also reject a PR of a million characters. That’s bananas.
Not sure about that "million characters", but we've been bitten by it in our production systems. :( Thus, we're moving off GitLab.
Earlier quoted context omitted.
More seriously, keeping a local cache of external npm packages, and a local artifact storage for internal npm packages looks like a wise thing to have done long ago. Might be cheaper in the long run. Ironically, both Nandu and Verdaccio are implemented in Tyepscript and install via npm. (Same logic obviously applies to Python packages, Docker images, etc.)
Caching NPM was easier when you could pull the Couchbase replicate API. Afaik that's gone and now you just have to send a bazillion http requests instead.
Both yarn and pnpm support http/2 which speeds up the bazillion requests quite a bit.
Keep up the good work Microsoft.
Let's shoot for 100% downtime though. Thanks.
With all the github instability, I wonder if Cloudflare or some other provider is going to look into providing a similar service.
Cloudflare artifacts?? https://developers.cloudflare.com/artifacts/
Earlier quoted context omitted.
Only if we had a turn key distributed cache, like IPFS
Does IPFS support content eviction now? If not, that could go wrong really fast. You get a compromised package out there and then, I think, literally every node needs to unpin it or it remains.
That's one way to fix supply chain vulnerabilities.
More seriously, keeping a local cache of external npm packages, and a local artifact storage for internal npm packages looks like a wise thing to have done long ago. Might be cheaper in the long run. Ironically, both Nandu and Verdaccio are implemented in Tyepscript and install via npm. (Same logic obviously applies to Python packages, Docker images, etc.)
Deno already does this invisibly by default.
All packages are stored in the global cache.
No need to store multiple versions of the same dependencies across projects.
To the code in your projects: there is no such thing as a global cache. Just import your dependencies like normal and deno maps them to the global cache.
Earlier quoted context omitted.
I mean, the PR limit is like a million characters. I would also reject a PR of a million characters. That’s bananas.
Not sure about that "million characters", but we've been bitten by it in our production systems. :( Thus, we're moving off GitLab.
Earlier quoted context omitted.
More seriously, keeping a local cache of external npm packages, and a local artifact storage for internal npm packages looks like a wise thing to have done long ago. Might be cheaper in the long run. Ironically, both Nandu and Verdaccio are implemented in Tyepscript and install via npm. (Same logic obviously applies to Python packages, Docker images, etc.)
At my former job we had a private registry that was a mirror of npm’s with an approval gate for packages devs would request and it would always pin versions I took that for granted back then and just assumed it was standard enterprise policy
Earlier quoted context omitted.
GitLab is right there . And overall provides a better product than GitHub, if nothing else on these two points: * You can actually have an organisational structure (folders/namespaces), and projects can be moved around with automatic redirects. Also, inheritance of access controls, variables between the namespaces * GitLabCI is organised in a way that makes supply chain attacks less of a risk. GitHub Actions takes th…
All of those features are supported by GitHub in some form, e.g: Organizations can now belong to Enterprises.
SSO, access tokens, secrets are all bound to the Organization level - if you work on multiple Organizations you have to log in separately... You also cannot have nested Organizations.