[GitHub] [incubator-pekko] mdedetrich commented on issue #342: Set git tag protection rules on github.

["mdedetrich (via GitHub)" <gi...@apache.org>]

mdedetrich commented on issue #342:
URL: https://github.com/apache/incubator-pekko/issues/342#issuecomment-1562459403

   My counter argument to this is that it does impact/break a lot of the sbt dynamic version from git tag tooling that has been built in various pekko modules. For example pekko-grpc had an issue with publishing/releasing because of git tag existing that doesn't follow the `v*.*.*` format and iirc I actually had to delete this tag to get things working.
   
   Additionally, at least until git tag protection rules are setup it can be argued that using a git tag is not enough because they are mutable.
   
   > If a malicious actor manages to interfere with the git tags, then maybe we can reconsider.
   To me if we do setup a git tag protection rule its not going to cover `forked-from-akka`, it will just cover `v*.*.*`.
   
   > And tags avoid us having to add a documentation page that people may not be able to find.
   There is plenty of much higher stakes information in the documentation (i.e. legal/security/commercial related) and people being lazy to read documentation is to me quite a weak argument. Also tbh, the vast majority of people won't care about when exactly Pekko forked from Akka, the only people that will care about such a thing are the ones that care about legal/security/commercial matters and as mentioned before other info on this topic is in the docs.
   
   @sam-byng Are you able to commend on this? Would it be enough for us to just document the exact git hash in pekko documentation (just like other legal/security/commercial related is documented) indicating when the fork happened rather than using a git tag?


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@pekko.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@pekko.apache.org
For additional commands, e-mail: notifications-help@pekko.apache.org