[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: RFS: Security patch for GitHub CLI client gh



On 31/12/24 3:29 pm, Otto Kekäläinen wrote:
You bypassed now both code reviews and uploaded despite failing CI.

As far as I know, there's no hard-bound team policy to upload only when
the pipeline passes.

No, there isn't a policy, but the pipeline here isn't the main point
here. Do you notice the culture aspect of hero behavior vs
collaboration?

OK, so your point is something different for this upload.

If there is a true emergency then sure, go ahead an upload a package
without coordination. But this wasn't so urgent, Santiago could have
easily waited one or two days instead of the 2h he did now. Just
waiting a bit longer isn't that much extra work, it is just a matter
of taking a break and context switching back a couple of days later.

I understand your point, but there are a few considerations here. There aren't many active uploaders in the Go team, as you may have noticed from the activity on the mailing list. Many of us are contributing in our free time, which can be unpredictable. For example, if I know that I won't have availability in the next few days, I might choose to complete the task now while I have the chance.

Even if the upload had been delayed, I’m not sure it would have been picked up by anyone else much sooner. As you may have observed from the response times on your own threads, it often takes longer to get a reply, especially when people are working on different schedules.

Granted this is holiday season and a CVE reported, I felt it was OK to upload. The commit picked up in question is an upstream patch here, so I don't see a need for a second review unless we don't trust upstream to do their job properly.

Your point does make a lot of sense in teams where there's a very high amount of activity (like python for instance) but this is not one of those.

-n


Reply to: