Re^7: "When code reuse turns ugly"

[soonix]

Ideally, you'd have that "Continous Whatever" in your development, but somewhere between there and production, you want tests and/or other kind of auditing anyway. Wanting "up-to-date, all the time" in production is asking for free lunch.

Of course, security issues have to be fixed, but usually, in production we have a different notion of "continuous", don't we?

[BrowserUk]

in production we have a different notion of "continuous", don't we?

If you look again at my scenario, nowhere did it mention production; at least not at the top level (or bottom level; depending on what you see as up and down!).

Changes do not have to make it into your production, for them to have had an immediate and potentially costly affect upon your project.

It is enough for them to have made it into your dependency's production for them to be integrated at your development level, and thus cause your development to stall pending a fix.

Ditto, for those dependencies of your dependencies; and so on back down the line.

At the bottom level, the change may eventually be determined erroneous; but if it passes the tests -- which if they are written by the same developer that wrote the erroneous code per TTD, they will -- then that change will pass into that bottom level's production.

Then its dependee's have no choice -- by the dictates of CI -- but to accommodate that change into their development and once it passes tests, pass it though to their production; and so on up (down; sideways; along) the chain until it reaches you.

With hourly builds and automated promotion; a 3 or 4 level dependency chain is affecting you within half a day. Throw in a post Friday-lunchtime-celebration coding session, followed by a Bank Holiday Monday in the country of that dependency; and it could be 4 or 5 days before they discover their error. Meanwhile, its knock-on effects and (wasted) development efforts have proceeded through the chain to you. And when they discover it and back it out; the chain repeats.

Basically, automated inclusion of dependency changes is a nightmare waiting to happen.

Incorporating changes from dependencies into your development cycle should only be done when they are known to be needed.

Or when a stable product has been moved to production and you started a new cycle; but even then, only if the dependency's changes are seen to be either critical or beneficial.

Anything else is madness. (One man's opinion; history will be the judge :)