This meme was brought to you by the PyPI Director of Infrastructure who accidentally hardcoded credentials - which could have resulted in compromissing the entire core Python ecosystem.

you are viewing a single comment's thread
view the rest of the comments

[–] dohpaz42@lemmy.world 18 points 3 months ago (1 children)

Yes kids, the only stuff in ANY repo (public or otherwise) should be source code.

If it is compiled, built, or otherwise modified by any process outside of you the developer typing in your source code editor, it needs to be excluded/ignored from being committed. No excuses. None. Nope, not even that one.

No. 👏 Excuses. 👏

[–] bleistift2@sopuli.xyz 4 points 3 months ago

Two choices: Either the production software isn’t in the exact state the repo was when the software was built. Or I can’t get build timestamps in the software.