Product Increment Description
Originally the devcontainer had a version.yml per devcontainer feature and no version definition was duplicated. This approach already carries the drawback, that we have to bump OpenJDK versions from time to time, when Ubuntu ships a new security update and removes the old packages.
Then came the run-tool script with its own lockfiles: https://github.com/eclipse-score/devcontainer/tree/main/tools/lockfiles
This is now partly another place defining versions. You can then see in pull requests like #153 that versions are defined / set multiple times.
This creates a higher maintenance burden that we should have.
IMHO the hand written versions.yml just did not cause too much frustration because we never switched the Ubuntu version and the only package getting constant updates is OpenJDK. For packages installed via apt I would prefer that we create a lockfile automatically. The current approach ignores all transitive dependencies.
For the Python packages I would remove their version definition from versions.yml and just use what is in their lockfiles.
And we have to reconsider if tool versions need to be written down in a markdown file. Maybe referencing lockfiles is good enough.
Acceptance Criteria (DoD)
Version mess is improved
Product Increment Description
Originally the devcontainer had a
version.ymlper devcontainer feature and no version definition was duplicated. This approach already carries the drawback, that we have to bump OpenJDK versions from time to time, when Ubuntu ships a new security update and removes the old packages.Then came the
run-toolscript with its own lockfiles: https://github.com/eclipse-score/devcontainer/tree/main/tools/lockfilesThis is now partly another place defining versions. You can then see in pull requests like #153 that versions are defined / set multiple times.
This creates a higher maintenance burden that we should have.
IMHO the hand written
versions.ymljust did not cause too much frustration because we never switched the Ubuntu version and the only package getting constant updates is OpenJDK. For packages installed viaaptI would prefer that we create a lockfile automatically. The current approach ignores all transitive dependencies.For the Python packages I would remove their version definition from
versions.ymland just use what is in their lockfiles.And we have to reconsider if tool versions need to be written down in a markdown file. Maybe referencing lockfiles is good enough.
Acceptance Criteria (DoD)
Version mess is improved