-
Notifications
You must be signed in to change notification settings - Fork 61
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Generate Dist files automatically when there are changes #333
Comments
We actually do have this automation in place... but I think I'm not super familiar with fetch-metadata/.github/workflows/dependabot-build.yml Lines 34 to 35 in 173b40e
If I'm wrong let me know, otherwise please close if you agree. |
I don't think so, because We also have this other workflow to validate the same : https://github.com/dependabot/fetch-metadata/blob/main/.github/workflows/check-dist.yml But I might be overlooking something. I'll retest that and get back to you |
I reverted my changes to dist 808bc0f just to test, and that shows what I suspected: The dist file reflects the changes to the main code and if we don't regenerate it users won't see the features |
@jeffwidman One more annoyance is that small differences in the build lead to different dist files (understandable as the compiler changes) It also seems that there are small differences across platforms as well See this failure as an example https://github.com/dependabot/fetch-metadata/actions/runs/4652910733/jobs/8251802610?pr=336 |
👋🏻 @yeikel, as I recall, we set up the automation to build the The intent behind this was to avoid running |
Ah, so the code comment is incorrect then... |
I think that's fair. The concern is valid as dist files are minimized and difficult to read and it would be easy for a malicious user to inject malicious code there. Provided an automated way would secure it as well as removing that burden from the user
Yep, any source code change should re-generate the |
Updating the dist manually is a hassle. I'd be nice if we had some sort of automation to update the pull request Dist when there are new changes
The text was updated successfully, but these errors were encountered: