Post B5tjUlt0iEIqEy0k5I by pwithnall@mastodon.social
 (DIR) More posts by pwithnall@mastodon.social
 (DIR) Post #B5tjUlt0iEIqEy0k5I by pwithnall@mastodon.social
       0 likes, 0 repeats
       
       CI systems should not silently upgrade their components in the background. A CI system should be a reproducible function: for the same CI image and project code, the build results should always be the same.Tools should be predictable, or one job turns into multiple when you least want it to.
       
 (DIR) Post #B5tjUm4M23NQo9JnlY by wolf480pl@mstdn.io
       0 likes, 0 repeats
       
       @pwithnall hmm so using containers (docker or similar) for CI has an issue here: it shares the kernel with the host, which means the kernel can change without the image changing.What's worse, the kernel may have to change since it's on the other side of a security boundary (wants to protect from malicious CI jobs), and thus may need security updates.I wonder how often kernel upgrades actually affect CI in a meaningful way...