Node.js Release WG Session  ## Metadata - Author: [[OpenJS Foundation]] - Full Title: Node.js Release WG Session - Category: #articles - Document Note: --- tags: [#nodejs, #releases, #automation] - #nodejs - #releases - #automation Author: Node.js Release Working Group Source: YouTube – Node.js Release WG Session Reference: [Transcript & Video](https://www.youtube.com/watch?v=rHCKb-WUBGs) date created: 2025-08-23 22:35 --- # Title: Node.js Release WG Session – Community, Automation, and Process Challenges ## Table of Contents: - [📝 Summary](#-summary) - [📖 Main Content](#-main-content) - [🗒️ Notes](#️-notes) - [📖 References](#-references) - [🗣️ Paraphrase](#-paraphrase) - [📰 Newsletter](#-newsletter) - [✅ Action Items](#-action-items) - [🧪 Hypotheses](#-hypotheses) - [📊 Methodology](#-methodology) - [❓ Questions](#-questions) - [🔮 Future Research](#-future-research) - [💡 Implications](#-implications) - [🧠 Learning Styles Assessment](#-learning-styles-assessment) - [📊 Accessibility Assessment](#-accessibility-assessment) - [🌍 DEIB Assessment](#-deib-assessment) - [✅ Logical Validity](#-logical-validity) - [🔍 DARVO Analysis](#-darvo-analysis) - [🔍 SEO Evaluation](#-seo-evaluation) - [🎯 Conclusion](#-conclusion) --- ## 📝 Summary: The Node.js Release Working Group (WG) reviewed their processes for scheduling, tagging, and publishing new releases. The meeting emphasized **community participation**, **improved documentation**, and opportunities for **automation** to reduce manual backporting and release key management. Participants discussed challenges with **monorepo tooling**, **lock file integrity**, and the need for **standardized schemas** to ensure reproducibility. The group is stable, with ~8 active contributors, and focused on balancing automation with human review to ensure quality releases. --- ## 📖 Main Content: The WG session highlights: - How **releases are coordinated** via GitHub issues, sign-ups, and release schedules. - The **release process**: gathering commits, reviewing PRs, CI validation, tagging, artifact signing, and publishing. - **Improved documentation** that reduces reliance on “tribal knowledge,” helping onboard new releasers. - **Automation prospects**: GitHub actions for backport management, automated key updates, and bots to pre-flag conflicts. - **Challenges with tooling**: Turbo Repo’s cluttered output, NX usability, and CI reproducibility issues tied to lock files. - **Proposals**: standardizing dependency schemas across tools, improving npm query, and centralizing configurations. - **Community spirit**: joy of announcing new releases and mentoring newcomers to the WG. ### 🗒️ Notes - [00:04](https://www.youtube.com/watch?v=rHCKb-WUBGs&t=4) – First-time facilitation, call for more community involvement. - [03:01](https://www.youtube.com/watch?v=rHCKb-WUBGs&t=181) – Release lines scheduled every 2 weeks, sign-ups for 18.x, 20.x. - [07:44](https://www.youtube.com/watch?v=rHCKb-WUBGs&t=464) – Release process: PR backports, CI, tagging, blog post. - [10:12](https://www.youtube.com/watch?v=rHCKb-WUBGs&t=612) – Documentation improved → more contributors onboarded. - [15:12](https://www.youtube.com/watch?v=rHCKb-WUBGs&t=912) – Automation opportunities, but human review vital. - [20:56](https://www.youtube.com/watch?v=rHCKb-WUBGs&t=1256) – Key management issues, need automation/shared keys. - [29:57](https://www.youtube.com/watch?v=rHCKb-WUBGs&t=1797) – Turbo Repo console output too noisy, UI needed. - [42:34](https://www.youtube.com/watch?v=rHCKb-WUBGs&t=2554) – npm query RFC → interoperable schemas for tooling. - [46:34](https://www.youtube.com/watch?v=rHCKb-WUBGs&t=2794) – Lock file integrity tied to developer configs. - [52:57](https://www.youtube.com/watch?v=rHCKb-WUBGs&t=3177) – Closing acknowledgments, prep for next session. --- ## 📖 References: - Node.js Release Documentation - npm Dependency Selector RFC - Turbo Repo / NX docs - Temporal.io --- ## 🗣️ Paraphrase: 1. **Original**: “The most time-consuming task is manual backporting when PRs conflict across release lines.” **Paraphrase**: One of the biggest drains on release work is reconciling conflicting PRs across different Node.js versions. 2. **Original**: “If something doesn’t work, everyone’s trained to delete the lock file.” **Paraphrase**: Developers often resort to deleting lock files as a default troubleshooting step, highlighting systemic reproducibility issues. --- ## 📰 Newsletter: 🚀 **Node.js Release WG: Automation, Docs & Developer Pain Points** The Node.js Release Working Group shared updates on how releases are coordinated and what’s next: - **Better docs = more contributors** 🎉 - **Automation ideas**: GitHub bots for backporting, shared key solutions. - **Tooling friction**: Turbo Repo’s clutter, NX complexity, lock file headaches. - **Future vision**: standardized dependency schemas, reproducible builds, and friendlier UIs. 📺 Watch full session → [YouTube](https://www.youtube.com/watch?v=rHCKb-WUBGs) --- ## ✅ Action Items: - Apply **release automation lessons** to WordPress: bots for backport labeling, CI-driven conflict detection. - Emphasize **documentation-first onboarding** in OSS contributor programs. - Advocate for **standardized schemas** across package managers in FAIR and WP ecosystems. - Use **lock file reproducibility issues** as case studies in sustainable OSS governance talks. - Frame **automation vs human oversight** as an OSPO principle for balancing efficiency with trust. --- ## 🧪 Hypotheses: - Standardized schemas increase ecosystem interoperability. - Automating backports reduces release delays by 20%. - Centralized configs lower CI failures across teams. ### 📊 Methodology: - Compare release cycle lengths before vs. after automation. - Survey contributors on reproducibility frustrations. - Run controlled trials on schema adoption across different tools. ### ❓ Questions: - How can lock file reproducibility improve contributor trust? - What balance of automation vs. human review is optimal? - Can npm query evolve into a cross-ecosystem tool? ### 🔮 Future Research: - Exploring AI-assisted backport automation. - Standardized key management across ecosystems. - Developer UX improvements in large mono repos. ### 💡 Implications: - Improves OSS sustainability. - Enhances contributor experience. - Reduces friction in CI/CD pipelines. --- ## 🧠 Learning Styles Assessment: - **Visual**: Limited, could add flowcharts of release process. - **Aural**: Strong (live discussion). - **Verbal**: Solid explanations, but jargon-heavy. - **Kinesthetic**: Weak; could include “try a mock release” exercise. - **Logical**: Strong; step-by-step CI and backporting. - **Social**: High (collaborative discussion). - **Solitary**: Reflection limited, could include journaling prompts. - **Naturalistic**: Absent. --- ## 📊 Accessibility Assessment: - Transcript available → good. - Needs better **alt-text** for technical diagrams. - CLI-heavy → harder for screen readers. - Improvements: structured transcripts, annotated examples, visual aids. --- ## 🌍 DEIB Assessment: - Inclusive tone, collaborative atmosphere. - Neurodiversity: documentation improvements support clarity. - Gaps: lacks global context or diverse case studies. - Improvements: add perspectives from underrepresented contributors. --- ## ✅ Logical Validity: - **Strengths**: - Inductive reasoning on docs → more contributors. - Causal clarity on lock file configs → CI breakage. - **Weaknesses**: - Occasional **hasty generalization** (“everyone deletes lock files”). - Some **appeal to authority** when citing past releasers. Tone: Conversational, pragmatic, slightly humorous. --- ## 🔍 DARVO Analysis: - **Deny**: None. - **Attack**: None. - **Reverse Victim**: None. The session focused on problem-solving, not deflection or blame. --- ## 🔍 SEO Evaluation: - **Keywords**: Node.js release, automation, lock files, backporting. - **Meta**: Needs short summary like “Node.js Release WG tackles automation and reproducibility.” - **Headers**: Well-structured. - **Links**: Add references to npm RFCs, GitHub repos - Summary: The Node.js Release WG Session discussed the workings of the Release Working Group. The facilitator explained that the release process aims to organize releases by getting release signups on specific release lines. The group collaborates on creating proposal branches that eventually become pull requests, which are revealed by releasers. They also work on getting feature backboards shipped and building release artifacts, eventually tagging them for release. Though the process is well-documented, it is time-intensive and requires human review and collaboration. The group also discussed the increasing participation in Release WG and how mentorship has helped increase the number of releasers. - URL: https://www.youtube.com/watch?v=rHCKb-WUBGs&list=PLyspMSh4XhLO15jJD9Sj069fN18j12AbQ&index=6&ab_channel=OpenJSFoundation greatall right everyone welcome to therelease working groupyayI believe this is the first time I'mactually in a really his working groupmeeting that I'm the only releaseraroundso bear with me but uh but yeah I wasalso thinking maybe it's a goodopportunity to get more people likeinvolved right like you can understandhow it worked a little right I can maybesome of you will want to participate in the future who knows right so yeah sobut basically the the whole idea likehow it worked in the last collaboratorSummit we just had a normal agenda rightand then we we kind of like we can gointo tangents that have conversationsbut uh is the regular release I say onthe right so folks from the communitycan participate right we can be inperson like doing it so yeah so theso we do have a small agenda here and Ithink I mean I'm reusing the the issue from the last meeting because we endedup not having it because it was justlast week there was this one coming upwe said okay let's not have it so weeven have uh some uh minutes documenthereand we can use it if if someone hastheir laptop open they can actually wanttolastwould you kindly offer yourself to takenotes oh my God yeah okay I'm not gonna Forceanyone to do that but uhthat that that's usually something we doright like weokayI'll take notes Roy I willall right all right all right so yeahokay so Darcy you can go to the node.js release repoand then to the issuesis it kind of yeah it's readable rightand then you're gonna see that that lastmeeting issue you can click on thatscroll down find the meetinglink the the minutes note link thereyeah coolokay yeah no but honestly like uh youcan all go and add your name here to theto the list of uh attendees like let me do itsee it's fun and then people will seethat you actuallyyou were there and you participated[Laughter]Okay soyeah sowell this is a I think this is a verylight agenda we have here so yeah so the regular meetings is kindofyeah so it's usually we try to organizethe releases right like so the releaserscan like sign up for a specific releaseline and and they can commit to likeokay I'm gonna do the 18 release andin the next week or whatever is coming up right soyeahso we can we can go over the releaseplan here let's clickwhat does it look like okay so we havean issue like this so you can see we tryto keep an up-to-date table here withthe dates that we're planning and socurrent release lines like this is uhevery two weeks right so you can seelike we're missing the next one likewait someone uh no we actually have uhtargos is signed up for three that that's probably already outyes and then there's another one comingup on the 16th yeahso you can see like people can sign uplike so so the release team like we canall come to these issues and like signup for an upcoming one and uhand and we can also you see there'sconversations uh going on in theseissues so that's basically how it worksfor the releasers to kind of organizethe the flow of uh releasing and and from time to timeusually we have way more discussionslike we we used to have a lot in the endof last year but like this is prettylight now souh there is this one about the releaseKeys okay yeah which is like it lookslike there's a key that is missing fromthe kind of publicthing that they use to validate thosekeysso from time to time someone will bringup a conversation like this that releasegroup needs to be involved and those conversations will happen and uhand the release uh working group meetingtoo so that's uh another thing we doso yeahso while we're here given that theagenda is super light and I don't haveany of my friends with me I thought wecould maybe also just go over uh alittle of the how the releaseprocess works and that's great because I also don't know what I do every timeis that I come to the node repo andluckily we have it super well documentedheresobasically this is the node.js releaseprocess like and honestly likeeverything we do when we when we areabout to to run a new release is justkind of following the script to theladder right so it's kind of It kind ofdescribes everythingyou would need like or even like three steps like okay who can make a releaseright like uh how do you get access toto all the services you're going to needin the process right so all of this isdocumented like in the node repo so it'sa yeah it's public there you can go seedoc contributing releasesand there's all the steps solikeone of the bigwhat if the good kind of about like there's probably that gives a lot moreof work when working on the releases islike getting thethings that we want to ship right likeokay so there's PRS that are open tobackboard let's say uh features thatlanded on 20 but maybe you want abackboard that to 218 so sometimes therelease are even likewe can even go and like back write thebackboard ourselves right like but thatthat's usually also something weappreciate from the community right like if you see a feature that okay justlanded on current like maybe the authorof that feature is busy with other stuffand can't work on a backboard right awayit can also be something you cancoordinate oh yeah I can help with thatthen you can write a backboard for adifferent release line so that'ssomething that like takes a lot a lot ofuh time to work on it's kind of likejustbuilding the brains that is eventuallygoing to be the that release right likeso you kind of start out for from a proposal Branch like this and then youkind of like Get It Get uh all thecommits you wanna and that really is inthere andthat eventually becomes a pull requestand that pull request can be revealed byotherumother releasers and other collaboratorsand and then we run all the CI stuff onit too right like so we want to makesure everything is green and then youwant to be sure you're also able tobuild all the release artifacts that you could need andyeahand then and then eventually like onceall that is done like you can tag andthat that's basically like when once youtag you push it to the repo that's kindof when the when the release goes out sothere's a small script that automatesthe the promotion of all the artifactsthat were built so that they'reavailable to everyone right and we puttogether the blog post and yay we can go to the rest of the world and say yay youknow I do know JS release is availablesothat's a little that's the kind of fiveminutes overview of how uh node.jsrelease works and you can see likethere's details like okay set up for thenext release like there's a small committhat goes to and you push that out tothe to the main branch afterwardsso yeahwith that said because that's kind of like all I had for a you know quickpresentation I was I wasn't expecting tohave a presentation I was expecting tohave a you know collaboration sooh let's let's get the the microphoneyeah come on come on come on come onwas there reading that right thatthere's some extras in the process ifit's a security release compared to justyes okay yeahabout that because I mean there isn't some extra step forboth the security releases and also whenit's LDS and LTS there's a bunch ofthings you've got to be kind of aware ofand like there's some other extra stepsdocumented here uh I know it was likeRaphael did the last two uh major uhmajor uh Breaking Chains right like therecent 18 and 20 like No 19 and 20 yeahwe're the ones that Rafael worked on and likeI know like he also documented a lot ofthe missing parts because it takes a lotof time actually to actually build thisdatabase with all the you know a lotcomes from just like ancient knowledgeright like and people and someone whowas doing that before transferring thatknowledge to the next releaser that'sbeen on boarded so we're doing more andmore of this uh good work of trying todocument every single thing like everyyeah and on that that like that kind of um leads to a question that I was goingto ask you all like which is that thedocumentation of the release process islike way better than it was the lasttime I looked at itum I'm curious ifum you guys have noticed an increase inpeople participating in the release WGsince because that was a little bit of aI think a few years ago was it not justa huge kind of problem yeah so yeah Ithink it's a much better State now that it used to be you right like because afew years ago it was but yeah yeahI don't know I don't I don't think we'rewe're in a but at the same time I don'twant to say too much because I kind ofmiss the last two meetings maybe someoneraised something that I'm not aware ofbut uh I don't think we're in a statewhere we're looking because we'redesperate and we need more contributorsnow but I know that he's yeah that thatdidn't used to be the case before right like there yeah so now now I think we'reabout eight like activemaybe maybe a little less so trying tocount from the top of my head here but Ithink we're about like eight people likeuhand we're all rotating right like it'sjust that like major releases are morecomplicated that's a bigger commitmentright like so someone like Raphael whohas more time like that that's that'susually like someone who step in writerto take care of a bigger release like that but for the small releases we tendto rotate within the team right so yeahthat's kind of how it works but yeah Ithink we're still you know still workinggroup always open like for people whowant to join to participate but I don'tthink we're in a critical state rightnow yeah to answer the question yeah so just two little things from slackactually ohI forgot yeah I forgot about slack thankyou yeah we have slack and it justcrashed oh noum so both are from Danny Danny Adamsokayum so the first one should be updated toshow the future v20x releases the theissue showing the releases because rightnow oh oh great okay wait when you gotupdatedlike like three seconds agoit was not no yeah yeah yeah thank youDanielle she just literally edited yeah[Laughter]awesome she's fast yeah this the secondthing isregarding to uh Jerry's question uh shewas mentioned the she thinks thatthere's a really good mentorship from the release working group that has grownthe releasers group in addition to thedocs so awesome yeah I also have no ideawhat it is[Music]but yeah you're the MVP yes thank youokay so yeah at least yeah you see someof my releaser friends areWith Us online just not here that'sgreat yeah thank you yeah sure I'll Zoomwatching the Streamso yeah I think Wes had a comment beforego ahead go aheadit's a light session as not somebodywho's ever done a release I've been totwo of these now okay well I did thinkmiles did one was it last year rightmaybeI did add one in the blame too okay yeahokay that one was uh yeah that we've hada bunch of uh the releases there so it was more like a normal and I was notthere yeah well anyway what I wanted toask wasum and I'm assuming you've all thoughtabout this it seems from the outsideeven though it's well documented stillrather time intensive and complicatedI'm wondering like is thereopportunities for some automation to toreduce that so that it's notyeah yeah yeah you know Raphael isalways working on on some of theseautomation yeah I think he did work forI think recently he has been for the security releases specifically I thinkhe automated a lot of the steps theextra steps that that happened for thesecurity releases so I think I think yesbut the thing is that the low hangingfruit like that those are gone like themost yeah yeah so because there is a tonof these you know these tabs that we goover here that the the important part isthe human you know reviewing like theyou know the the maintenance and kind of likethis just making sure that you know theprevious steps like okay everything isall right all the commits that I want togo to this release do they make sensedid we like is there any December majorcomment that slipped in like somehowright you should not okay December rightlike it's probably not a good examplebutyou see what I mean right like theremaybe something shouldn't be there oryou want to change things around likethat's the human value that is addedright like it's kind of hard to just automate like everything all it wasright like soyeahyeah but but there might be still youknow like some somewhat not so lowhangry fruits anymore but some hangingfruits that can be automated there mightbe there's some opportunity but yeah Ithink I had one idea actually when I wasworking in the releases one one of thethings that that happens oftenis that uhso you want to you want to build to land all these comments right like but somesometimes things will conflict right sothat's when you need the more uh manualbackboarding right like becauseotherwise if everything's just like thisthe history is clean right like commitsare landing one on top of each other youdon't need to be manually back orbackboarding anything rightso one one opportunity to automatesomething that I really wanted to buildor motivate other folks to build it's maybe like a GitHub action or somethingor automated botthat goals and like kind ofwrites a comment in the pr that willeventually need a backboard right likeso kind of like aan actual or a bot that tries to kind ofland all this commit like in order likein the order that they wouldI don't know yeah I think it might bepossible for each kind of release lineto kind of like but it's kind of likeyeah it's there's a lot of moving Parts like maybe the Bots should be looking atonly the release line and try to lendthe commits from the the right placebecause that commits for the currentrelease they should be coming from themain branch right but releases for likev18 let's say right the LTS they shouldbe coming from uh versus immediate likeabove it right like so the 18 you shouldbe picking up from20 right yeahso yeah so I think there's anopportunity to automate that step maybe maybe Danielle has something to sayabout that Claudio if you want to justtake a look at this lack like let's seeif there's any commentsmaybe then yeahlet's get AI to do our backboarding yeahyeah becauseone of the most you know intensive likeworkyeah David attacking all that right it'sannoying like you're kind of likeputting everything and then oh shootokay this PR will land like so youcannot have like you know you kind ofhave the choice sometimes I remember one one uh it was an important one but whenthat landed it was a release that I wasworking on so I went ahead and I did theextra work to backboard that PR rightaway because I wanted to land fast rightso a releaser can do that but it's a lotof extra work so most of the time wewere just you know like we'll come onthe the original pull request okay okaythis this is backboarding like and thenwe we put a bunch of labels to kind ofsignal not only to other releases but but also the automation tooling that wealready have in place like it picks upfrom the labels is really like a way wecommunicate like and and the audioautomation read from the from the labelson the so they're very important so likewe can put okay so this is not landingon on 18 so I can put a label that saysokay needs backboarding V8 income rightand then other releasers will know ofthat for when the next release happenedright and also the original PR authorwe'll see and and the tooling we pick that up so that when I try to just runthe rest of the script to put all thecommits together it will skip thatcommitment right and then and then wecan continue like with the release withif we want right like so yeah I sort ofasked that question because some it wason my mind I think at one point so webuild our own like copies of nodeinternally and at some point like Ithink maybe some S3 cache of like keysor was broken I don't know if thatsounds familiar to y'all and like itbroke all of our internal rebuilds because we obviously verified the keysand I was thinking if there's likeautomation around it that if it was amachine doing the release we wouldn'thave this problem of like having toupdate the the list of valid keys fromthe releasers especially as you likestrive to onboard more people like we Ithink right now we might be doing thatmanually and so like every time you adda new releaser and they do their firstrelease like it breaks us and then wehave to go likeimportant I mean it's not a big deal butI was just thinking automation wise if it's if it's some CI process somewheredoing it with a key that was not tied toyou right if it was like a shared onefor the for that buildum that would sort of alleviate thatproblem I'm not sure how if this affectsa lot of yeah people I don't know howmany companies or whatever do you knowtheir own Rebuilders yeah whateverwhenever there's a something that messesup the keys like we hear from a lot ofpeople okay so probably a lot of peopledoing it yeah yeahso I bet you there's a lot of people outthere manually updating these list of keysinternally yeah yeah definitely I wonderif there's maybe a way to even just makethat automated automatable for peopleI've done this maybe once or twice and Ithink if I remember correctly alsothere's one list of keys somewherethat's not correct did that get fixedthere was like one list and then anotherone and people were updating one but notthe other so I just looked at them and Inoticed they were out of sync like maybeit's in the release yeah maybe it is something it rings a bell I think wekind of like yeah might have changedlike where they lived at some point butmaybe I'm pretty sure I copied in thewrong one I think is what happened yeahmaybe it has to do with thisin this key ring well I don't know butlike yeah there's a release Keys repolook at that so that's probably what youuse yeah this looks familiar now yeahyes yeah uh and from the slack uh Danielle says we have been discussingshared key solution I'd be interestedyeah yeah so yeah maybe this is probablyworth pursuing yeah just because if ifeverybody I didn't realize how common itwas then I guess if you hear about itthat much uh might be just a goodleverage point to yeah resolve that itmight be something yeah good to have uhget some help with I don't know yet butthat part of like because yeah maybethat's a little bit more into the buildworking group territory you knowautomatic to all the the infrastructure for those keys yeah but I mean managethe infrastructure to build that and Ithink it's the tag actually I think it'sthe tagging that that uses that thatthat release key okay this gpg key Ithink it goes into the GitHub tag likebecause all the all the art facts likethat's already all elsewhere right I'mnot shooting on my machine like rightlike there's there are machines outthere for from the working group likethey're maintaining it that builds forfor the window this throw right in thelearning Clinic everything right so I think that the key is the only for it toGitHub that but I'm not sure if it'syeah because if you could just move ashared key into the repo and have anaction that did the tag and like we'dnot have this maybe definitely updatingthis it's not even that constant buthere the Oto but if if you want to cometo one of these meetings like I thinkyou should definitely talk with Richardhe's the one who knows more understandsmore because he's also in the buildinggroup so he is the one who knows more about all these things yeahthank youyeah so something that I was going tosay about Danielle as we mentioned isthat we signed the binaries in the tankscomments with our keys which is what Iimagine probably just use the keys fromthe chat soon fives or something butyeah she mentioned that the binders aresigned so that that with the keys thatyou useI supposeyeah with the shots room yes exactly that's what I imagine the show some fileis used to then just get the embed onthe binary yearand I had no idea that was the case butI imaginedyeah no and that's that's one part ofthat it's more opaque because it's allthat that part that part of the build isfully automated like the or the buildingthe artifact stuff like that it's veryautomated now and yeah so that makessense yeah we do I have a custom setupsomehow like somewhat custom that like Ihave a specific key for node and that I actually have to specify it for thescript in order to build it so it makessenseso yeahso any more fun release topics you wantto bring on todayif not we can also call this a shortermeeting andDarcy has a comment here but what's the best thing about being areally sir why why should everybody inthis room be really soon what's the joyyou get about out of this workwell you you yeah I think the the momentof joy is telling the world oh a newrelease is out and then you can pokethings uh you can pull people pokepeople like Jordan who will post that toanother I don't know five others lackinstances and everybody will get hyped about it I think that's probably theand I mean I mean it's also exciting tohave like to you know to be running thethe latest release before the rest ofthe worldbut uh yeah but yeahbut it'sit's a lot of responsibility and workand then kind of like now that I'mthinking about it I don't knowno no it is exciting it's exciting andit lets everybody getsyeah no but yesdo you wanna you wannauh microphone just a couple conclusionnotes from from from Claudia excuse mewhat conclusion notes from the closingnotes from this sessionumI like chocolate same things uhuhhelp me out here Darcythe schedule okay so this was supposedto be a double session you know one hoursession but since you know uh rui islazy and doesn't want to talk anymorethen I guess we have a break now a halfan hour break or wowwhat is this 15 minutes well actually we didn't have a breakthat's a thing but well now we gotourselves a breakpackage we can go to the session that isin the other room which is let'sautomate no Jazz dependency updatesbecause it's crossed it out and then putthat go to the daughter room or you justopen Zoom and we watch from here becausewe're lazywelcome to the release no yeah or we canjust like start random topics that weall love to discuss about like you knowlike The Usual Suspects like the RC West can start complaining about packagemaintenance or or whateveryeahyeah[Laughter]all right sowait a secondyeahchocolate in all different kinds okaywhat oh yesthat's his chance[Laughter]let's see what Chattahoochee thinksabout doing your node.js release yes why notexactlyI don't know man I really actually thisone I had one where I actually went toit where I was having an issue withmicrophone microphone microphonemicrophone sorry so I was having anissue with NX uh the the monorepotooling not finding a package and stillto this moment cannot find it I actually went to chat gbt to ask it how do I findout why it's missing it literally gaveme all the reasons where I actually wentto the documentation they give younothing absolutely nothing about why apackage dollars an hour workers doamazing I'm pretty sure they wouldn'thave done that in about 12 an hour forthatno so like when you go and do likethere's a command on the COI to likelist out your projects it literally ismissing one but yet when I run it in like versus turbo it shows up fine wherelerna shows up just fine hell npmworkspaces shows up just fine only inone thing will not show up in their listand like breaks or not breaks orautomation but like you get I get afailure on the check because it can'trun that package I'm like what theis thisso word to the wise don't use an X it's a fine tool don't get me wrong finetool it's just it drove me it's drivingme nuts because it cannot find this oneso that's that's the only problem I havewith it honestlypromise for that only one the only oneother opinionsturbo repo oh boy now hold on if we canonly get Turbo to clean up the the thethe console a little bit I'd be a littlebit more appreciative when it's in anon-ci state [Applause]good jobwhatright yeah yeah it's very clutteredoh dude that'd be beautifulwhy are we complaining about turbo reponow this session really went Southit is actually yeah we should we shouldhave hopefully they can get a recording this uhno and he's not on that team yeah yeahI think all the mono repo tooling hasthe same exact problem right if you havea really large oneoutput isin unintelligible right there's just noway for you to really have it all justspewed out on the CLI and have it beusable like what GitHub actions UI butfor a local runsomething where it's split out and you see just the command you can open ityeah you can open it you can see moreabout what's happening if you need tobut you really just see that it passedright is I think what you wantI know this is product research I knowit's good I'm happy to be your uh yeahfor example like when we do an actualGitHub action like when you for exampleif you're doing any form of linting oryou want to see those pop up in theconsole if I'm running it for Turbo theydon't show up at the bottom of the GitHub UI for me to go oh okay I need togo clean up all these packages with thisgarbage lens that's showing up that'snot necessary whereas if I ran with likeright now I with the NX it pops upbecause it's natively used likepopulating the the standard outwith you know the color range so it'sable to recognize that to populate tothat to the UI so it's you know you getyour bet you know Catch 22 with eitherway you go whatever you're looking to doyou know based on the tooling you wantto use it for but yeah for that like when you when you're having a 70 packagemono repo like you want to be able tosee all that so you know where your youroverhead is or where you need to cleanup from a package maintenance or like ayou know a uh owner of the pack of thethe whole code baseCerseiyeah wondering do you care about theoutput that much like to to not in realtime it's not talking about the end ofthe job like at the end of the job itdoes if it's it's not there for when I'm running in Turbo that's what I mean Idon't care about watching like I'msitting there watching paint dryhypotheticallyumso I'm just saying hypotheticallyI'm I know but if hypothetically someoneinbutI have I have a question I have aquestion uh about the you know the wholethe whole conversation about you knowlike because your idea about GitHubactions and like uh workspaces and and one thing I would like to kind of likejust gather the sentiment from other CLIfriends folks around here right likewhat is the overall sentiment these daysabout having the CLI launch like youknow let's say it launches us you knowseparate process for an electro app thatthat you can parse better for from thatUI right like it's not only in theterminal anymore and now we can havelike it speed out open pops up a newelectron we know that can render a nicerUI for that so we had this like setup that doesum mono it's not explicitly a mono repotool but it's about running multipleapps in your local Dev environment it'susing this like tmuk session thing rightwelluh cool in concept yes I think inpractice what happens is you end up withthis window and the if you add a bunchof libraries doing stuff to itespecially if you were to do and this issomething that I'm going to be hopefullyworking on under thisproof of concept that I built but it's like if you want to do like Matrixtesting for a mono repo where you testyour libraries against say threeversions or whatever all the LTS isrighta tmux session uh no right and so Ithinkthatthe web UI view so so we had a team thatuses turbo repo and also has experiencewith this product that we haveinternally and actually one of the teammembers wrote a web UI specifically to pull them into there because they had abig mono repo in the the the the the CLIexperience is really bad so I think it'snot so much that people really like theweb UI they just really don't like thethe like CLI dumping because the CLIlike the the that interface it's perfectit's brilliant for some kind of tasksright but that is very linear yeah likea very linear terrible it is fine rightit's like right but as we get to these big things yeah the linear theperformance of a linear run yeah isprohibitive right you get these thingswhere the npm install is 20 minutes thenthe like first unit tests run is likethree minutes and then you've got 40 ofthose so the whole thing like in CI inlinear in like a Jenkins job or whatevertakes like an hour right gosh yeah yeahyou've seen it what do you thinkyeahhas anybody used uhcalledumoh my gosh I just had it in my headtemporal temporal yeah yeah what do youthink of that okaytemporalyeah so love love I hate dates in periodin general like using it inthere you go the the current we'retalking about the data API I'm talkingabouttemporal.io it's a it's a tool for no uhhe even said literally you're talkingabout the temporal proposal like yousaid yes I mean we shifted from uh like hardshiping pipelines to like datesno no I'm talking uh yeah if you look itup uh yeah you might be temporal.io youmight be like oh I gotta go use thisthing nowsomebody uses it in your yeah so it'sbetter get on that Wes yeah find outfast so it is uh is pretty coolum yeah you're You're Gonna Wanna lookinto it in terms of like the interface it provides for tracking down async uhEventing and essentially retries andeverything like it's got some reallyinterestingum UI there and I think to to Roy'sOriginal Point like uh I think we cansometimes hita maximum threshold with what we can dowith CLI tools and I think that's whathappened with the Narwhal team with withNX and they're like okay like we want to visualize things as well like with likegraph like I think you can do ax graphand and show showcase like yeah the dagsand stuff like that pipelines it's okayit's okay let's let's just say 70packages my end was like this giant likejust I was all maxed out and I couldn'teven read anything I was like hold onhence constantly we can do better yeahfor sure yeahso one thingthat I'm interested with this tooling is how it like composes and layers togethertoo because I think that's one of thethings thatwhy the CLI is always been so powerfulright the whole design of the CLI isabout composability right and as soon aswe do these and I've looked at someother things and my biggest complaintwith when I read through the NX I Idon't use it butum was just that it looks like it's toomuch of a commitmentlike you're really having to buy inright and I think lerna was the same wayyou'd install lerna and then every single npm script in your package Jsonhas to ruin lerna or the whole thingfalls apart right and that to me is ispoor a poor design right likeum what you want is something thatcomposes better right and makes you haveless of a buy-in so that if it fails youcan you can turn it turn it around rightand that is what I have found so farwith turbo repo which is why I mentionedit is that it actually composes verywell yeah without a ton of buy-in if Iwant to rip it out I can rip it out rightyou can rip it out but on top of thatusing extra tooling around it so youwant to add something automate yourchange logs automate you know you don'tthere's not like with learner you had tocommit to the learn away of of thosethings whereas with turbo okay cool justrun turbo your command and go like badabing bada boom it takes care of you butthat that was that is a cool thing andthe reason I solely went with back youknow with NX was during this we upgradedto the latest of warnog we're like heywe need to get past these security warnings you know this this is alsoslowing us down in terms of developmentand delivery so we just stuck with whatwe had for now because we need to keepgoing but throughout that process nowwe're learning this tooling is cool andall but like it'sdefinitely got its pitfalls like withlike every the tooling you find when youspend so much time working in it sobut yeah turbo is nice I mean I'm nothating I I wish it was a cleaner UI butin terms of when I'm running because Ijust I don't like watching paint dry but but yeah no I agree like having theability to be much more composable likethat's why I actually do like working inworkspaces is you can script everythingup yourself you literally pop a teach tothe space you just pop the command andwhere you go similar methods that turbois providingit's called dog fooding and I thinkthough if we get into this term rightwith or right right Darcythat was a secret a secret all along this whole time I knewbut yeah I was just going to add on theI think the hard part about getting intothese more complicated uis is that it italmost always is a sacrifice ofcomposability right so likethis UI looks awesomebut like then I what if I wanted tocompose this with something that youknow something else I'd probably have alot of leg work to do right yeahlike what you're looking at there withtemple roll is like a very generalpurpose like Eventing or like softwareum what we're talking about with likerunning tasks and pipelines across yourdependencies let's say and yourworkspacesumI think that there is an opportunitystill for us to standardizeum to Pansy like representation of your defensive graph and we can get I hope alot of the folks in the same room orcome to the same table and say you knowif there'sthis kind of schema or representationthat we can all build towards this kindof like ASTthen we can build those composable toolsaround those that interoperableuh standard right and I think we can getthere and we were likea year ago when I wrote the dependency selector syntaxuh RFC for npm that was basically like Iwas thinking ahead like what does itlook like for you to pipe mpm in likenpm query a query of yourum of anything of your of your projectswhether it's workspaces or your you wantto run tests of your dependencies pipethat output to something else like anaudit right like so basically like likelook at jQuery right like it sounds crazy but like look at what jQuery coulddo in terms of like taking a selectorand then just like basicallyum yeah like just continuing to likeexecute on these things and alwaysreturning essentially the set or thesubset of of things you want to executesomething against so I think that if wecome up with like what that looks likewhether it's like always has to have apath it always has to have the name theversion whatever that the the minimumkeys are for the fancy graph then we can eventually build tooling around it andso like you know it doesn't matter ifit's turbo repo doesn't matter if it'sit's an X or whatever we could all haveinteroperable sort of like schemas thatwe could share and I think that wouldbenefit the ecosystem because then moretools could be built to add metadata tothat that schema and yeah is that notthe lock filethe that's not the lock file I mean the lock the lock file is a standard schemathat represents the dependency graph ohexcept whenexcept when the reference can be visibleand there's a magic value one of thepoints though I don't know I don't knowbut I think we we were the same boat butwe wanted to also make in people querymore powerful right like but ideally itshould also the npm query should be ableto read directly from the package blockand that's it right retrieve that info from just a single file read right Icould just have the package blockingmemory and you can figure out all ofthat but then you want to virtualize aswell yeah so like like no more imagineif Arbors didn't have the requirement tohave file system path right like that istruly you want to be able to walk andand build that up so yeah and what Royis saying is right what you're saying isright if you have a lock file then yesyou can also read from that and and youhave that representation there's not there's missing context inthe lock file todayuh in fact we've run we've and I say wenpm was running into bugs with mpmciespecially around Legacy peer depthswhere people were like oh crap Igenerated a lock file with this set ofconfiguration that configuration did notget stored in the log file and now weare basically saying oh you have tocontinue to use the exact sameconfiguration you did when you installedas you do with CEO yeah and you're likewait a second so actually it's not just the lock file that I need now I mean mylock file and the config has to be thesame image and everything yeah stufflike persist and uh if you opt in tolike ignore Legacy beer that thread thatshould be persistent to the package lockso when you npm installed again is thesame rightI was gonna say this is Bid us uh wehave projects that have lock files thatwere generated no longer my problem nolonger my problem heywe still have somebody here whoseproblem it is I know but we we havebasically like one team member will run with a global npm config that pointssomewhere that is it's correct itcorrectly resolves the package but wehave like a bunch of layers between adeveloper installing and the and publicregistry and so there's a bunch of URLsyou could use they're not what werecommend but so one team person pushesa change that's pointing to a hostand then that host is not something the team that runs those things wherethought was being usedremoved it or I think maybe an SSL certexpired or something but then it's inthe lock file right and uh so what wewant is the configfor that to actually be centralizedright we don't want the developermachine to be able to have it config atall that's going to break the entirerepo for the entire rest of the teamright if you've got 30 people working ona project and one person slips in aweird configand then that gets committed in the lock file rightand so that it breaks CI so this hasactually definitely happenedI've constantly seen that happen I saidnot not in terms of just like thatparticular generation but like they'llcommit something that isn't in the CIand it just breaks the dialogueis it possible foranyuh thinking about all the ways thedeveloper workstation specifics couldleak into um production artifacts there seems likethat's not necessarily the Avenue you'dwant to squash because there's to meseems like endless possibilities forthat but you would still to meum the fact that there would be churn uhvisual noticeable not ignored by defaultchurn in my lock file as a developer I'dbe like oh I did something wrong becausemy workstation definitely has a bunch ofopinions where maybe sometimes it'sgoing to try to put files in repos and I'm like don't don't do that like thosedon't belong there but it's not on Ishouldn't try to like remove all mydeveloper workstation opinions I shouldtry and just make it measurable and likereproducible where like you know if thelock file is going to churn someone'sgoing to review that PR and be like heyLuke uh you just you know committed yourdeveloper you know you basicallycommitted your uh dot files to you knowopinions into production don't don't do thatyeah but there's also the scenario whereyour lock file is a lielike I was talkingfrom the perspective of if if the lockfile is not a lie I want all of thoseum I want the state of the system to becommitted to the lock file I want thatto happen more so that developers willsee that happen and be like oh don'tcommit that or and in order to do it youcreate an npmrc file for the specifics of npm you create an mpf RC file in yourproject that's going to override youknow all the configs that you care aboutmaybe there's some you don't but likelet's say you always want to you knownever print a log level for stuff likethat should be in your npmrc instead ofallowing you know developers to changethat but it like or log levels are badbecause that doesn't affect your lockfile but like you know peer depths likethat should be always committed to thelock fileI say that as an npm CLI developer who has not fixed that but it's it should beyeah there's there's other issues alsowith like just obviously post installscripts installing other things that arenot in the lock file are not beingtracked other defenses and environmentspecificthings that happen and and specificallythe configuration the registryconfiguration with npm it treats thetarget reference the registry.npm js.org as the magic value so if you change theregistry configuration it changes thelocation of where the tarball is goingto be fetched from which means that thatthing is not like like it's notnecessarily reproducible and like hasall the information and contacts thatyou need like it sounds like most peoplereally want like a complete snapshot oflike their their project in time and andwant to be able to just likeyeah like have as much immutability asthey can like with CI like when you don't have those defenseslike already in the environment so Ithink part of the problem today thoughis that we have these recommendationslike that are very popularly promoted oflike put an npmrc file in your home repoor home directoryand that should just never be a thing itneeds to be in the project becauseotherwise nobody else can build yourthing if they clone it Down Rightwithout following this step with an outof boundsfile that that they have to you know theworks on my machine we've made it muchworse by recommending that to people like ideally we should work on this atsome point npm init creates an npmrcfile and puts your registry in it evenif it's the defaultyeah it's like almost like there shouldbe an initiative by a broader Communityto create some kind of standard way toscaffold packagesyou might even call it create packagesEKG to create PKG I think some people have tried to do that in the pastum you and I yeah I'd love to do thatum but but I think that's the thing islike what I'm what I'm more concernedabout is just making iteasier for people to be doing the rightthing and today I think the lock fileis still missing some guard rails likethere's obviously ways you can break itand we're never going to cover the youknow 100 or whatever but I think today we're covering likeunfortunately10 right or something of of these thingsand and the way people get around ittoday is delete the lock file everybodyhas been trained to delete through themyeah the thing you do right you deletethe log file delete it if somethingdoesn't work everybody's on your traindelete the lock file delete the nodemodulesright everybody right nowyou all do it every day all right sounder this tone I'd like to close thisfree form chat portion of the yeah andwe can get ready for the next session Ithink it's about to start oh thank youall, Node.js Release WG Session, OpenJS Foundation, 01h3j5yvndn2ykeekw02ne3cvp.