Update the Contributing Guide

Oct 13, 2025 by wbrum.org 96 views

Introduction

As Bevy continues to grow and evolve, it's essential to address potential risks associated with direct dependencies. Direct dependencies can pose performance, reliability, and security risks to the project and its users. In this article, we'll explore the problem of direct dependency changes, propose a solution, and discuss alternative approaches.

The Problem: Direct Dependency Changes

As noted by Cart in #18263, it's currently quite easy to add new direct dependencies to Bevy. This ease of addition can lead to a performance, reliability, and security risk to the project and its users. Direct dependencies can introduce new vulnerabilities, slow down the project, and compromise the overall user experience.

The Need for a Solution

To mitigate these risks, we need a solution that ensures new direct dependencies are carefully considered and thoroughly reviewed. This requires a combination of human oversight and automated checks to prevent unintended changes to direct dependencies.

Proposed Solution: Label and CI Task

To address the problem of direct dependency changes, we propose the following solution:

Add a New Label

We suggest adding a new label, M-Deliberate-Dependency-Change, for PRs which intentionally add, remove, or update direct dependencies. This label will serve as a visual indicator that the PR has been thoroughly reviewed and approved.

Add a CI Task

We propose adding a CI task that catches and comments on PRs which modify direct dependencies without this label. This task will automatically review the PR and provide feedback to the developer, ensuring that any changes to direct dependencies are carefully considered.

Update the Contributing Guide

We recommend updating the contributing guide to indicate that new dependencies must be highly trustworthy, known actors with high traffic, high visibility, and high review. This will ensure that developers are aware of the importance of carefully selecting direct dependencies.

Alternative Approaches

While the proposed solution is a comprehensive approach to mitigating direct dependency risks, there are alternative approaches to consider:

Do Nothing

One alternative approach is to do nothing and continue to be careful. However, this approach relies on human oversight and may not be sufficient to prevent unintended changes to direct dependencies.

Additional Context

For a deeper understanding of the problem and proposed solution, we recommend reviewing the following thread on Discord:

Thread on Discord

Benefits of the Proposed Solution

The proposed solution offers several benefits, including:

Improved Security: By carefully reviewing and approving direct dependencies, we can reduce the risk of introducing new vulnerabilities.
Enhanced Performance: By selecting high-performance direct dependencies, we can improve the overall user experience.
Increased Reliability: By thoroughly reviewing and approving direct dependencies, we can ensure that the project is more reliable and less prone to errors.

Implementation Roadmap

To implement the proposed solution, we recommend the following roadmap:

Add New Label: Add the new label, M-Deliberate-Dependency-Change, to the PR template.
Add CI Task: Implement the CI task that catches and comments on PRs which modify direct dependencies without this label.
Update Contributing Guide: Update the contributing guide to indicate that new dependencies must be highly trustworthy, known actors with high traffic, high visibility, and high review.
Test and Review: Test and review the proposed solution to ensure that it meets the requirements and is effective in mitigating direct dependency risks.

Conclusion

Introduction

In our previous article, we proposed a solution to mitigate direct dependency risks in Bevy by adding a new label and CI task. In this article, we'll address some of the frequently asked questions (FAQs) related to the proposed solution.

Q: What is the purpose of the new label, `M-Deliberate-Dependency-Change`?

A: The new label, M-Deliberate-Dependency-Change, serves as a visual indicator that the PR has been thoroughly reviewed and approved. It ensures that any changes to direct dependencies are carefully considered and approved by the development team.

Q: How will the CI task catch and comment on PRs which modify direct dependencies without this label?

A: The CI task will automatically review the PR and provide feedback to the developer. It will check if the PR has the M-Deliberate-Dependency-Change label and if not, it will comment on the PR indicating that the dependency change has not been approved.

Q: What are the benefits of updating the contributing guide to indicate new dependencies must be highly trustworthy?

A: Updating the contributing guide to indicate new dependencies must be highly trustworthy will ensure that developers are aware of the importance of carefully selecting direct dependencies. This will lead to improved security, enhanced performance, and increased reliability.

Q: How will the proposed solution impact the development process?

A: The proposed solution will not significantly impact the development process. The new label and CI task will simply provide an additional layer of review and approval for direct dependency changes.

Q: Can the proposed solution be implemented in a way that is transparent to developers?

A: Yes, the proposed solution can be implemented in a way that is transparent to developers. The new label and CI task can be integrated into the existing development workflow, ensuring that developers are not impacted by the changes.

Q: What are the potential risks associated with implementing the proposed solution?

A: The potential risks associated with implementing the proposed solution include:

Additional overhead: Implementing the new label and CI task may require additional overhead, including development time and resources.
Complexity: The proposed solution may introduce additional complexity to the development process, which may require additional training and support.
Resistance to change: Some developers may resist the proposed solution, which may require additional communication and education.

Q: How can the proposed solution be tested and reviewed?

A: The proposed solution can be tested and reviewed through a combination of manual testing, automated testing, and code reviews. This will ensure that the solution is effective in mitigating direct dependency risks and does not introduce any unintended consequences.

Q: What is the expected timeline for implementing the proposed solution?

A: The expected timeline for implementing the proposed solution will depend on the complexity of the implementation and the resources available. However, we anticipate that the solution can be implemented within a few weeks to a few months.

Conclusion

In conclusion, the proposed solution of adding a new label and CI task is a comprehensive approach to mitigating direct dependency risks in Bevy. By carefully reviewing and approving direct dependencies, we can improve security, enhance performance, and increase reliability. We hope that this Q&A article has addressed some of the frequently asked questions related to the proposed solution and has provided a clearer understanding of the benefits and risks associated with implementing the solution.