Productivity Weekly (Issue 2022-04-20)

Hello. I'm Hirakiwa from the Productivity Improvement Team at Cybozu Inc.

Our Productivity Improvement Team holds an internal meeting every Wednesday called "Productivity Weekly," where we share topics related to improving developer productivity discovered over the past week.
This article is a compilation of the topics from that session.

This is the 71st issue. You can find past articles here.

news 📺

Dependabot alerts now surface if your code is calling a vulnerability | The GitHub Blog

https://github.blog/2022-04-14-dependabot-alerts-now-surface-if-code-is-calling-vulnerability/

GitHub is adding a feature to Dependabot that identifies where your code is calling functions from libraries with vulnerabilities. It is currently in beta testing for Python only.

Dependabot Alert is a feature that notifies you whether a dependency contains a vulnerability, but developers must manually check if the code paths containing those vulnerabilities are actually being reached. This new feature aims to make that verification easier and reduce the triage cost of vulnerability response.

Currently, it only supports direct calls to vulnerable functions, but support for indirect calls is planned for the future. Although it's a beta feature, it's available for all public repositories and private repositories with Advanced Security enabled.

This is quite an interesting feature. Investigating whether a dependency vulnerability actually affects the final product is a tough task. It could be very convenient once it supports indirect calls. I'm looking forward to the official release.

A Brand New Convenience Image is Coming, cimg/deploy - now in beta - Ecosystem / CircleCI Images - CircleCI Discuss

https://discuss.circleci.com/t/a-brand-new-convenience-image-is-coming-cimg-deploy-now-in-beta/43674

A new image pre-installed with deployment tools such as terraform and kubectl has been added to CircleCI's Convenience Images (cimg/*) (beta). Apparently, there wasn't a dedicated image for deployment until now.

It is still in beta, and feedback is being requested in the discussion mentioned above—for instance, regarding what other tools should be included.

I'm curious to see how much demand there is for an image packed with various deployment tools, but it might be useful if the image size isn't too large or if the specific versions of the tools don't matter much. If you have any feedback, be sure to send it in.

Node.js 18 is now available! | Node.js

https://nodejs.org/en/blog/announcements/v18-release-announce/

Node.js 18 has been released. It is not yet the LTS (Long Term Support) version; LTS is scheduled for October 2022. By the way, the code name is Hydrogen.

The blog "Betsu ni Shindokunai Blog" has provided a great introductory article on the main changes in Node.js 18^[1].

https://shisama.hatenablog.com/entry/2022/04/20/011103

Personally, I'm happy that fetch() can now be executed without a flag (though it's still experimental). Previously, we had to include things like node-fetch.

Another thing that caught my eye was the addition of the node:test module. You can use a test runner without installing 3rd-party test frameworks like Jest. That said, I think it will be a while before we start using it for serious projects.

Since Node.js 18 LTS is planned for six months from now, we might not use it immediately, but I think it's good to be aware of it now to prepare for LTS (apparently, the default value of requestTimeout will change).

tool 🔨

dagger.io | Introducing Dagger: a new way to create CI/CD pipelines

https://dagger.io/blog/public-launch-announcement

Dagger, a portable CI/CD tool, has been introduced (it was in closed beta until recently). Since Dagger works the same way wherever a Docker-compatible runtime is available, it is introduced as a way to reduce Dev/CI drift^[2] and CI lock-in^[3].

It also features something like Orbs in CircleCI or Actions in GitHub Actions. Additionally, the CUE language is used for describing pipelines (Reference: Introduction to CUE language (cuelang)).

I also tried the Getting Started guide. After that, I tried to create a pipeline to run some test code I had made previously, but since I had no knowledge of the CUE language and the specifications? were too different from previous CI services^[4], I decided it would take too much time to master and gave up. I felt the learning cost was quite high. I hope someone will release a tutorial-like article on how to write pipelines.

Also, in the end, I think there are many cases where you want to use unique features of various CI tools, such as caching or saving test results, so those parts seem likely to result in lock-in anyway. I couldn't find how to combine Dagger with such CI-specific features in the official documentation, so it seems necessary to put in some individual effort. (Of course, it would be extremely useful if you don't use any CI-specific features at all.)

Since it's right after the closed beta ended, I felt that migrating to Dagger is still difficult or perhaps too early. I'd like to explore it again once more community knowledge has accumulated.

koneta 🍘

This is a section where I would like to introduce all the topics that came up in Productivity Weekly, but I either don't have the stamina to cover everything, or the topics don't have enough to say, so I'll just write a brief word about them.

• news 📺
  • Tritanopia Colorblind Theme Beta | GitHub Changelog
    • A color theme for people with tritanopia (blue-yellow color blindness) has been added to GitHub.
      • It seems that with tritanopia, blue and yellow appear as other colors.
• tool 🔨
  • tilfinltd/aws-extend-switch-roles: Extend your AWS IAM switching roles by Chrome extension, Firefox add-on, or Edge add-on
    • When switching roles on the AWS console, only up to 5 roles are saved. By managing roles with this browser extension, you can quickly switch among many roles.
    • It's easy to set up since you can essentially just provide your ~/.aws/config.
    • Classmethod is listed as a Large Supporter.
    • (I feel like I've introduced this before, so I'm putting it in "koneta".)
  • sqshq/sampler
    • A tool that can display command execution results in a rich, graphical way.
    • To use it, simply define the command you want to visualize in YAML and run it.
    • GitHub tweeted about it, but it's a bit concerning that the latest release version, v1.1.0, was three years ago.

Afterword

This week's issue had fewer topics. Recently, I've had so many things I want to do that I can't keep up with them all. I have no plans for Golden Week (😢), so I'd like to spend it doing various things I've wanted to do. For now, I want to see the ending of Elden Ring. Also, I want to work through my Gunpla backlog.

The Productivity Improvement Team will be holding an internship this summer, so if you're interested, please apply (Entry starts 4/22 → The Productivity Improvement course internship starts from 5/23. Sorry.).

• Productivity Improvement - Design & Research - Cybozu Internship & Events 2022 Engineer & Designer | Cybozu Inc.

Cybozu's Productivity Improvement Team is engaged in activities to improve the development productivity of internal engineers. If you are interested in our team, click the link below!
https://note.com/cybozu_dev/n/n1c1b44bf72f6

omake 🃏

This week's bonus.

Elsa, 15.6-inch Mobile Workstation with Ubuntu - PC Watch

https://pc.watch.impress.co.jp/docs/news/1401753.html

It's a laptop with Ubuntu pre-installed. As it's described as a mobile workstation, it seems to be for professional use and is quite pricey.

The reason I put this in the bonus section is that I've always thought it would be nice to have a Linux laptop. As someone who mainly works on the backend, if the server is Linux, I'd like the development environment to be Linux as well. Currently, I use a Mac, but since Mac is UNIX, it's still different from Linux.

Recently, there have been more ways for OSs to support Linux development, such as WSL on Windows or the fact that Linux can be used on Chromebooks. But even so, it would be easier if Linux were installed from the start (though Chromium OS is a Linux distribution).

Of course, you could wipe the pre-installed OS on a laptop yourself and install Ubuntu or something, but there are hardware compatibility issues^[5], and it's just a hassle. Come to think of it, Chrome OS Flex also appeared recently. That also seems quite good.

I think laptops with pre-installed Linux supported by the manufacturer, like the one in this article, probably handle hardware compatibility well and provide some kind of support, which is great. I hope more consumer laptops with Linux will be available in the world!

I wrote this section thinking there were few Linux-equipped laptops, but it seems there are quite a few if you look into it. I just didn't know.

• https://xblood.hatenablog.com/entry/dell-xps-13-developer-edition
• https://raylink.info/linux/

脚注

1. I was also indebted to your articles during Node.js 15 and 16 ‍♂️

2. Described as writing similar files (CI workflows, Dockerfiles, shell scripts, etc.) more than once.

3. Lock-in itself is recognized as a state where the cost of switching vendors or tools (switching cost) is high, making it difficult to switch. CI lock-in is presumably the CI service version of that (e.g., it is very difficult to rewrite workflows when moving from GitHub Actions to CircleCI).

4. For example, when GitHub Actions appeared, knowledge of CircleCI could still be reused, so I think the learning cost for migration was relatively low. Both use YAML, after all.

5. When I was a student, I installed Ubuntu on the Vaio I had at the time to set up a dual boot, but I remember it being quite difficult because of some bad hardware compatibility. Eventually, Ubuntu stopped booting, and I deleted the entire partition.