dev tool: update package-storage with integrations about integrations

[ruflin]

Looking forward to this tool. It would be nice to have 1 PR per package on the package-storage side.

[exekias]

At some point before packages are sent to the package-storage it would be interesting to bump versions and tag the package on this repo. This adds traceability and allows us to go back to a released package.

[jonathan-buttner]

I think it would also be useful to have some hash of the contents of the package that is released. The hash could be checked in the PR to the package-storage repo. This would guarantee that the package that is tagged/versioned in this repo matches with the package that is released in the package-storage repo.

[mtojek]

The current implementation (PR soon) compares changes in the version control system and if there are any updates that should be released. This model covers requirements of integrations, IMHO no need to introduce tags.
I'm happy to discuss the endpoint team use-case, let's first see how much does the tool satisfy your needs.

[ph]

I think it would also be useful to have some hash of the contents of the package that is released. The hash could be checked in the PR to the package-storage repo. This would guarantee that the package that is tagged/versioned in this repo matches with the package that is released in the package-storage repo.

Would adding commit hash do the trick?

[mtojek]

Next followups:

#46
#45

[jonathan-buttner]

I think it would also be useful to have some hash of the contents of the package that is released. The hash could be checked in the PR to the package-storage repo. This would guarantee that the package that is tagged/versioned in this repo matches with the package that is released in the package-storage repo.

Would adding commit hash do the trick?

hmm I don't think a commit hash would work. The hash would ideally protect against an unlikely edge case where if say the copy command or however the PR is being created against the package storage repo failed halfway through the CI for the package storage repo could calculate some hash across the entire contents of the files in the PR and verify it against a file with a hash or something to make sure the contents of the PR lines up with what it's supposed to have. I think the commit hash is going to be different in the PR.

[mtojek]

@jonathan-buttner

Once the PR #59 is merged, you can try to adopt the tool and see if you can release the endpoint. I'm happy to adjust the CLI to meet your expectations.

[jonathan-buttner]

Thanks @mtojek we're currently using https://github.com/github/hub to open the pull request against package-storage. I'll take a look at the CLI tool.

[mtojek]

Resolving