Use different branches for security patches #483

New Issue

2023-08-25T15:39:29Z

moritz commented

2023-08-25 15:39:29 +00:00

I ask myself how to handle this situation:

An app recipe received a major update (i.e. 2.0.3->3.0.0) with breaking changes. After the recipe is updated the software releases critical security patches for both the previous (2.0.4) and the current release (3.0.1).
Performing a major update with breaking changes is nothing I just do by the way. I like to test major updates for a while before rolling them out on the production systems. For critical security patches you don't have the time, to wait for the right moment and to test it for a while.
Further the autoupdater kadabra should not perform major updates in the background.

Therefore I had the idea to release minor updates / security patches on a different branch. I think for abra this should not be a problem, as abra just reads the tags and checks out for it. But I'm not sure in what kind of new problems we'll run if we have recipe versions on different branches.

I ask myself how to handle this situation: An app recipe received a major update (i.e. `2.0.3->3.0.0`) with breaking changes. After the recipe is updated the software releases critical security patches for both the previous (`2.0.4`) and the current release (`3.0.1`). Performing a major update with breaking changes is nothing I just do by the way. I like to test major updates for a while before rolling them out on the production systems. For critical security patches you don't have the time, to wait for the right moment and to test it for a while. Further the autoupdater `kadabra` should not perform major updates in the background. Therefore I had the idea to release minor updates / security patches on a different branch. I think for abra this should not be a problem, as abra just reads the tags and checks out for it. But I'm not sure in what kind of new problems we'll run if we have recipe versions on different branches.

moritz added the enhancement label 2023-08-25 15:39:29 +00:00

decentral1se commented

2023-08-26 07:51:37 +00:00

Interesting, yeh! I think that's mostly an issue for recipe maintainers, if you want to work on separate branches, then go for it? I guess it would be a nice workflow but since most recipe maintenance is done very ad-hoc, this wouldn't be new 😆 No major issues come to mind...

decentral1se added the question label 2023-08-26 07:51:57 +00:00

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: toolshed/organising#483