Enforce restrictions on dependency relationships between packages - #8284
Open
zjs wants to merge 8 commits into
Open
Enforce restrictions on dependency relationships between packages#8284zjs wants to merge 8 commits into
zjs wants to merge 8 commits into
Conversation
Address warnings from shellcheck (e.g., properly quoting expressions and combining conditionals) to better follow bash best practices. Additionally, introduce our standard set line to catch errors earlier and conditionally provide debugging output.
Introduce a script to enforce rules about dependency relationships between packages in the project. This script leverages the existing go-deps.sh script, including its caching logic (enabled by setting VIC_CACHE_DEPS).
hickeng
reviewed
Sep 20, 2018
hickeng
left a comment
hickeng
left a comment
Contributor
There was a problem hiding this comment.
I've reviewed the mechanism and changes - I've not reviewed all of the deps files. I assume they are both sufficient and minimal at this time and I do not want to get distracted trying to track down why some of the odd dependencies exist in this PR.
Define an initial set of dependency enforcement rules based on the current state of the codebase. Some problematic relationships were identified and annotated.
Add dependency relationship enforcement to the checks stage of the build process so that it runs as a part of CI.
Add TODOs to track bad dependencies
hickeng
approved these changes
Dec 11, 2018
renmaosheng
approved these changes
Jan 2, 2019
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Enforce whitelist-based restrictions on the dependency relationship between packages. This allows us to ensure that undesirable dependency relationships are not introduced.
The enforcement works by enumerating the go packages, finding the applicable
.godeps_rulesfile (looking first in the package's directory, then looking recursively in parent directories, and finally falling back to/dev/null— essentially "default deny"). Each rules file is a list of regular expressions to be evaluated bygrep(with support for full-line#-prefixed comments).The enforcement script leverages the existing
go-deps.shscript, including its caching logic (enabled by settingVIC_CACHE_DEPS, purged viamake cleandeps).Careful review of PRs that introduce or modify rule files will be necessary for this enforcement to be as effective as possible.
Fixes #8203
I've created #8294 to track resolution of existing undesirable dependency relationships.
Please review both the enforcement script itself and the initial dependency rules, which are written by hand based on my understanding of the codebase and may have errors as a result.