5 ms·
It’s largely used for syncing external open source projects with the monorepo. Policy is to require source code imports over built artifacts. Though you can get
by ASinclair 3mo ago
It’s largely used for syncing external open source projects with the monorepo. Policy is to require source code imports over built artifacts. Though you can get exceptions.
Some projects are also developed in the monorepo and exported via Copybara.
My team also uses it to version Starlark rule sets internally.
- paulddraper 3mo agoSource code imports versus artifacts really neither here nor there. Go is source code imports too. The key part for Copybara is that Google will make changes to the OSS projects from within the internal repo and everyone else will make changes to the OSS projects.
- lwhi 3mo agoI suppose it mitigates the potential risk of libraries being poisoned?
- baliex 3mo agoWell kind of, or you just end up copying the poisoned version directly into your repo rather than having it as a dependency. Same outcome. I suppose if you're running some security analysis on code in your own repo, the fact that you've copied the code in means that it'll run on your third party dependencies too, since they no longer appear to be third party.
- Ferret7446 3mo agoIt's mostly to track licensing, at least initially. The supply chain angle is a happy coincidence.