This policy describes how K8gb maintainers consume third-party packages.
This policy applies to all K8gb maintainers and all third-party packages used in the K8gb project.
K8gb maintainers must follow these guidelines when consuming third-party packages:
- Only use third-party packages that are necessary for the functionality of K8gb.
- Use the latest version of all third-party packages whenever possible.
- Avoid using third-party packages that are known to have security vulnerabilities.
- Pin all third-party packages to specific versions in the K8gb codebase.
- Use a dependency management tool, such as Go modules, to manage third-party dependencies.
- Dependencies must pass all automated tests before being merged into the K8gb codebase.
When adding a new third-party package to K8gb, maintainers must follow these steps:
- Evaluate the need for the package. Is it necessary for the functionality of K8gb?
- Research the package. Is it well-maintained? Does it have a good reputation?
- Choose a version of the package. Use the latest version whenever possible.
- Pin the package to the specific version in the K8gb codebase.
- Update the K8gb documentation to reflect the new dependency.
When a third-party package is discontinued, the K8gb maintainers must fensure to replace the package with a suitable alternative.
This policy is enforced by the K8gb maintainers. Maintainers are expected to review each other's code changes to ensure that they comply with this policy.
Exceptions to this policy may be granted by the K8gb project lead on a case-by-case basis.
This policy was adapted from the Kubescape Community & Project Capsule