+1 on having shrinkwrap on git repos, only because that's what the majority of committers/contributors use for testing. Find a way that shrinkwrap is always update in git by automation bot or something similar. In theory it should be transparent to contributors only one that cares is "npm install" command, and if it fails is good to know why.
Mark, I want to understand better your statement "resulted in a great deal of confusion for contributors". Can you give more details about that. On Thu, Sep 18, 2014 at 1:32 PM, Parashuram Narasimhan (MS OPEN TECH) < panar...@microsoft.com> wrote: > If we do have shrinkwrap in git at all times, who would be responsible for > updating not only the versions of our dependencies, but also the > dependencies of these dependencies? > > Why should cordova-lib and cordova-plugman not have shrinkwraps? Not all > tools use cordova-cli as a way to build cordova apps. There were also > discussions about using cordova-lib being the public API to build apps. If > that is the case, judging by our shrinkwrap philosophy, we need that file > on all repos that we say are public API. > > -----Original Message----- > From: Mark Koudritsky [mailto:kam...@google.com] > Sent: Thursday, September 18, 2014 7:21 AM > To: dev@cordova.apache.org > Subject: Re: [DISCUSS] shrinkwrap > > > > > I suggest that: > > - The shrinkwrap exist in git at all times, not just during the > > release process. > > > -1 for that. Having shrinkwrap at all times will result in postponed > discovery of incompatibilities with newer versions (which are usually > trickier than shrinkwrap problems) until you nuke node_modules during > release. From my experience for repos that had it, it also resulted in a > great deal of confusion for contributors. > > - At the beginning of a new dev/test cycle in a project that has a > > shrinkwrap, developers should not only "git pull", but should also "rm > > -r node_modules ; npm install". > > > +1, no need to use shrinkwrap in cordova-lib, only cordova-cli and > cordova-plugman (they don't depend on each other now, both contain > executables calling into cordova-lib). > -- Carlos Santana <csantan...@gmail.com>
