{"action":"created","issue":{"url":"https://api.github.com/repos/heiseonline/shariff-backend-php/issues/102","repository_url":"https://api.github.com/repos/heiseonline/shariff-backend-php","labels_url":"https://api.github.com/repos/heiseonline/shariff-backend-php/issues/102/labels{/name}","comments_url":"https://api.github.com/repos/heiseonline/shariff-backend-php/issues/102/comments","events_url":"https://api.github.com/repos/heiseonline/shariff-backend-php/issues/102/events","html_url":"https://github.com/heiseonline/shariff-backend-php/issues/102","id":166855095,"number":102,"title":"Testing low and high dependencies","user":{"login":"core23","id":3440437,"avatar_url":"https://avatars.githubusercontent.com/u/3440437?v=3","gravatar_id":"","url":"https://api.github.com/users/core23","html_url":"https://github.com/core23","followers_url":"https://api.github.com/users/core23/followers","following_url":"https://api.github.com/users/core23/following{/other_user}","gists_url":"https://api.github.com/users/core23/gists{/gist_id}","starred_url":"https://api.github.com/users/core23/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/core23/subscriptions","organizations_url":"https://api.github.com/users/core23/orgs","repos_url":"https://api.github.com/users/core23/repos","events_url":"https://api.github.com/users/core23/events{/privacy}","received_events_url":"https://api.github.com/users/core23/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2016-07-21T15:54:40Z","updated_at":"2016-07-21T16:30:42Z","closed_at":null,"body":"Sadly, the my PR was reverted :( So I wanted to start a general discussion.\r\n\r\nIMHO only testing the composer config of the last contributor (specified in the `composer.lock` file) is a bad idea. Instead we should test the latest and lowest stable version that is currently available. This is the only way we could find bugs introduced by internal changes in external libraries we use.\r\n\r\nI know, that there is no way to test ALL possible version, but testing the locked version wouldn't help either.\r\n\r\n- What if the contributor didn't update his vendor libraries for a long time? We would stuck on old deps and wouldn't find bugs in newer version\r\n- What if the contributor used a new method of an external library and didn't update the `composer.json` file? Someone who used the lowest possible version would get exceptions.\r\n\r\nOther popular projects test the lowest and highest version too, such as symfony (https://github.com/symfony/symfony/blob/master/.travis.yml#L94)"},"comment":{"url":"https://api.github.com/repos/heiseonline/shariff-backend-php/issues/comments/234308990","html_url":"https://github.com/heiseonline/shariff-backend-php/issues/102#issuecomment-234308990","issue_url":"https://api.github.com/repos/heiseonline/shariff-backend-php/issues/102","id":234308990,"user":{"login":"liayn","id":222377,"avatar_url":"https://avatars.githubusercontent.com/u/222377?v=3","gravatar_id":"","url":"https://api.github.com/users/liayn","html_url":"https://github.com/liayn","followers_url":"https://api.github.com/users/liayn/followers","following_url":"https://api.github.com/users/liayn/following{/other_user}","gists_url":"https://api.github.com/users/liayn/gists{/gist_id}","starred_url":"https://api.github.com/users/liayn/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/liayn/subscriptions","organizations_url":"https://api.github.com/users/liayn/orgs","repos_url":"https://api.github.com/users/liayn/repos","events_url":"https://api.github.com/users/liayn/events{/privacy}","received_events_url":"https://api.github.com/users/liayn/received_events","type":"User","site_admin":false},"created_at":"2016-07-21T16:30:42Z","updated_at":"2016-07-21T16:30:42Z","body":"> What if the contributor didn't update his vendor libraries for a long time? \r\nThen things would fail on his machine until he does a `composer install`\r\n\r\n> What if the contributor used a new method of an external library...\r\nThen he must have updated the dependency with `composer require vendor/package <version>` to have the code available. This automatically also updates the lock file, hence the commit is consistent again.\r\nIf he ommits to commit the lock file, CI will fatal because of the wrong dependency.\r\n\r\nTesting the remote libs is simply not our job. We either have to trust those that semver is followed and no breaking changes are made, then we we can specify version ranges in the composer.json file. If we can't trust them we have to nail the specific version down to the last character.\r\nTesting lowest and latest version still does not save us from intermediate bugs of libs.\r\nConsider a lib we require with `^1.1` and the latest version is `1.1.9`. Our code might perfectly work with `1.1.0` and `1.1.9`, but might fail hard in versions `1.1.3 to 1.1.6` due to a bug in the lib that has been fixed meanwhile.\r\n\r\nSo my 2 cents are still. Test on CI what a dev confirmed to work locally, which usually is a single version."}}
{"actor":{"display_login":"liayn"}}