limonkufu
Joined 9 years ago
Joined 9 years ago
- SLSA and Provenance or SBOM data in the supply chain security that uses commit hash. All the previous images are now pointing to a non-existing commit
- All the documentation and tooling as the article calls out
- All your traceability links from your project tool to your git repo, they will lose all the past data as it will be dead links
So I hope there IS NOT a migration path for in-place replacement!
The main advantage for us is it's same everywhere and it's agnostic to underlying technologies. (we are only supporting unix based environments and have guidelines to setup gnumake in macos). By using this way, we ensure that the general SDLC is same across different repositories and underlying tooling can change anytime without inducing a lot of refactoring
We are also using make targets to document themselves. How to use, what are other targets, variables you need to define etc. This makes it a powerful CLI app for us that can run and support many things.
For anyone interested: https://gitlab.com/ska-telescope/sdi/ska-cicd-makefile and the similar parsing method for self documenting makefiles: https://gitlab.com/ska-telescope/sdi/ska-cicd-makefile/-/blo.... We didn't know about magicmake that's linked here that does the similar thing