Switch to GitHub Actions?

[klausenbusk]

Hi

I'm wondering if using GitHub Actions or a similar "CI" solutions was ever considered?

Doing a regular clone of https://github.com/cdnjs/cdnjs every X hour probably isn't feasible, but Git supports sparse-checkout and partial clone (improved greatly in 2.25.0)

$ time git clone --filter=blob:none --sparse git@github.com:cdnjs/cdnjs.git
[...]
real	1m18,731s
$ cd cdnjs
$ time git sparse-checkout add '**/package.json'
[..]
real	0m24,713s
$ find | head -n 10
.
./ajax
./ajax/libs
./ajax/libs/zxcvbn
./ajax/libs/zxcvbn/package.json
./ajax/libs/zurb-ink
./ajax/libs/zurb-ink/package.json
./ajax/libs/zumper-angular-payments
./ajax/libs/zumper-angular-payments/package.json
$ du -hs
1,1G	.

I had a quick look at the autoupdate and packages tool, and all the other files only seems to be required for SRI generation, but I think that is fixable.

Assuming it is doable, should we switch? The main argument, as I see it, is "fewer moving parts".

[MattIPv4]

Auto-update needs all existing versions to be able to determine what versions it needs to add currently, I'm not sure how we'd avoid that requirement for the whole repo.

Package.min.json all needs the full repo to correctly generate the JSON file that contains information on every library, and every version, and every file -- this is used to powered the data displayed on the website & the API.

[xtuc]

it sounds feasible, we would need to redesign some parts (which would be great!). However, the security implications are concerning

[xtuc]

what would be ideal to me is to store all our data into a database (instead of git) and serve them using the API. We can then have all sort of cron to update the search or the website in CI

[klausenbusk]

Auto-update needs all existing versions to be able to determine what versions it needs to add currently, I'm not sure how we'd avoid that requirement for the whole repo.

A simple way to fix that, is changing the code to use git ls-files instead of stating the filesystem, but then the code suddenly depends on Git, do we want that?

Package.min.json all needs the full repo to correctly generate the JSON file that contains information on every library, and every version, and every file -- this is used to powered the data displayed on the website & the API.

git ls-files + git sparse-checkout add

[klausenbusk]

How long does it takes for autoupdate to run currently?