Self-Protecting Projects
amihaiemil.com
amihaiemil.com
But I guess that's the difference between a senior who knows lots of syntax, and a senior that that knows how to deliver quality.
The reality of most big corporations is that nobody actually cares about the company. Executives can't trust their engineers to run the tests manually and deliver something that works.
If you have a good hiring and promotion process and a fair compensation structure (which none of the big corporations have), then you can trust your employees and so you don't need to micromanage them with automated CI/CD pipelines. In addition, if people actually care, you get much higher quality, more succinct code.
No amount of automated checking can lead to improved code quality. It only ensures that the absolute minimum operational requirements are met at any given time.
I strongly disagree. It's not about caring or not, it's about making mistakes.
A human can easily forget to run some test, or generally one step out of many in a complicated procedure, especially if they're new to the project. A reviewer can miss a mis-formed identifier. The more is that automated, the fewer manual steps need to be remembered, and the more safety the project gets. Automated tools like CI/CD should not be considered supervisors to humans, but helpers and safety nets.
That being said, there are certainly cases where teams don't set such tools up because they come with an implementation cost. And depending on project complexity and their use case in general, it may be more economical to do things manually.
Programmers should work on interesting tasks: refine and revise the tool rules, add even more automatic checks, refactor and correct genuinely flagged code.
Refusing automatic check tools means lowering happiness, dignity and productivity, wasting attention and time with bad activities and priorities: following boring and error-prone procedures, finding ways to elude rules and take shortcuts, low-value and tedious detailed code reviews (e.g. discussing indentation instead of incorrect edge cases).
I've both worked with and implemented CI/CD pipelines, as in a Jenkins script that builds a number of build artefacts and then promotes them to run in a particular environment. As part of the build process, it runs automated tests and static analysis on things like type checking, code style.
What it doesn't do is tell us which tests we forgot to write so there's no 100% cast iron guarantee that everything is correct, and I think that's what you're referring to as "improved code quality". But by having that automated step, our human QAs can spend their time on manual exploratory testing (which humans are very good at) rather than manual regression testing (which is extremely slow and inefficient). And our devs can focus code reviews on questions like "is this code clear to me?" rather than "did you meet the in-house code style?" or "have you forgotten about potential nulls?". And we can bring in contractors (who might not care so much) or juniors with a fast onboarding time, since a lot of mistakes will get picked up automatically.
If you're working in a sufficiently large organisation, one where independent auditors look at development processes, then you must have a CI/CD pipeline - either a slow, manual one or a fast, automated one. I know which one I'd prefer.
There are actually techniques available that help with that.
Of course as senior I do want them if I care about project. It makes it less likely for me to forget. It eliminates one of the "procedural chores" that I have to remember to type on command line.
I care about the project and therefore I do not assume that I am unfailing perfection of never making mistake or never skipping a step.
IME the best approach is a "balanced" one. Let devs push their branches from local to the repo without passing tests or lint rules. (e.g. git push --no-verify). Try and keep your tests fast so devs want to run them locally. (Carrot, not stick). But prevent a merge request from being merged to your trunk branch until everything is green.
Personally I find "linters" horrible. They're like someone with OCD leaning over your shoulder while you code. I think VS Code actually runs a LOT slower when the linter is integrated, which can do more harm than good. How crazy is it that TypeScript can do all its advanced type checking faster than the linter?
You want to go even further: only merge feature branches were you know that they won't break master after the merge.
Some feature branches might pass tests by themselves, but something has changed with master since they were branched off.
Bors (https://bors.tech/) helps with that.
What bors does is essentially the same thing, but automated: after all the tests have run on your MR branch, and people have approved your changes, bors does a speculative merge into master, and runs the tests on that merge commit.
If the tests pass, bors declares that very same commit to be the new master.
The effect is the same as the Gitlab option you mention, but the busy work is done by the bot.
OCD & often wrong pretty much summarizes linters for me.
The only caveat I'd add is that it depends on the project and the team how many gates you want to add. A couple of super-senior devs building a small blog aren't going to need many gates. A team with 50 people, half of them juniors, working on a financial app already in production - they're going to need a lot of gates.
As with all these things, ask the team if they're adding value. If they are great, and is there anything else that would help? If they're not, and especially if they're unnecessarily slowing things down, then don't do them. Don't use a code style checker because somebody in a meetup said you should.
CI/CD should not be used to force developers to do things they don't want to do, but to automate some easily repeatable tasks they would still do anyway.
Pushing without verify and fix everything at the end is worse than not fixing at all imho. After all fixes you basically have a lightly refactored code that has been less tested.
Depends on the team: if the team is democratic, then they should reach an agreement beforehand and respect it. If it's a dictatorship, then just punish them for not respecting the rules.
If the devs just agree to break the rules and disable them, they should be punished somehow. "Punished" is a big word maybe, but that's the idea :)
My experience is that linters (that people like) saves you from having to constantly discuss formatting, minor problems at the PR stage which is otherwise a huge time sink.
If you didn't respect the Quality Gates, your branch wouldn't be merged => you wouldn't be paid.
It was one of the best experiences in my work life so far. Clear rules, no chaos, no meetings, no negotiation. Just tasks and money :)
But everything was upside down with that team, not just payment. They had a completely different philosophy when it came to software development.
For instance we were encouraged to just close tasks. It didn't matter what we did as long as the build and code reviewer were happy.
Part of the philosophy was that if developers can abuse and break the project, the project is not good enough and must be toughened. Then, developers were encouraged to find other loopholes.
This methodology worked wonders for small projects, libraries. It didn't go well for big projects, obviously.
It was fun work back in the day of Teamed.io. But nowadays, with Zerocracy, it's turned a bit too strange even for my taste, after having worked about 2 years with Teamed.
You don't want to spend the first half of every review going through and finding errant formatting mistakes. Automate what you can.
The rules to be used were negotiated among developers. In one team, the use of linter cut down on the uneven random unforcement of the unofficial rules that was going on rampant (and subsequent frustration of involved people).
This article also reminds me of a talk I saw from Neal Ford about architectural fitness functions: the idea being that if there is an architectural pattern that should be followed then the best place to put it is in an automated step as part of your CI/CD. I thought it was interesting to take the concept normally limited to linters and apply it to a more abstract principle
First one that comes to mind is, the Issue Tracker should have a limit on the number of tickets a certain User can open.
If the Issue Tracker doesn't have that, then the company can have a firewall rule to only allow a certain number of calls per day to the API.
I'm sure there are dozens of other possible scenarios :)
If you're going to do something like this, I suggest that these kinds of "code quality gateways" aren't as absolute as OP recommends. Be smart about it: You could probably measure how "sloppy" a developer is (relative to some mean of their own output and not compared to the team or really anyone else). Simply bringing it to a developer's attention (programmatically) will do far more for your project's code quality than trying to dumbly enforce some list of code conventions about whitespace or whatever. Also, this is a kind of tool that should absolutely be scoped strictly on the level of the individual developer, with no possibility of having externally-visible reports generated from it, and absolutely not exposed to management. You don't want to give management too many knobs to turn, especially knobs like this.
Great idea in theory. It will not fly in practice. If you tell to any enterprise company that your (or their) software is automatically doing this behind the scenes, the project will be shot down.
I mean, getting crash metrics is one thing, but opening automated issues from enterprise software is a completely different manner.
Good blog post. When I was programming Java, I also used Checkstyle. It's a long-running and reliable project.
I also noticed Grammarly sticking its nose in places it shouldn't have. Like private repos on Github.
You could even just copy and paste it into a word processor, if you also want to catch grammar issues.