Make it easy to vendor a component project in my own namespace

Problem

When using components/templates from a public catalog, the user project keeps referencing the SSoT path to include the configuration.

trigger:
  include:
    - component: docker/docker-build@1.0.0

If the docker/ group or the docker/docker-build project is deleted, it can break all pipelines using this component.

The same problem has been in the Javascript world with left-pad issue where a missing popular dependency broke many other packages.

How can we protect components from being broken?

Ideas

Here below are some ideas that can be also combined together. We need to evaluate pros/cons of each of those and add any alternatives.

  1. Allow a dependecy to be vendored within a private catalog. If a project myorg/project wants to rely on docker/docker-build component, they can fork the component within myorg's catalog. Then myorg/project can use myorg/docker-build instead.
    • If docker/docker-build disappears or introduces breaking changes, it doesn't affect myorg/project.
    • periodically myorg/docker-build fork can be upgraded from the upstream SSoT docker/docker-build and newer versions can be used by myorg/project
  2. Allow a dependency to be vendored within the same component project. If a new component awesome/component wants to reuse docker/docker-build they could include the whole docker/docker-build content within vendor/docker/docker-build path inside awesome/component. Then use include:local: instead of include:component:
    • 👎 it doesn't promote the same level of collaboration and contributions on components.
    • 👍 self contained component. Consistent behavior.
  3. Cache automatically used components within a project (e.g. ObjectStorage, package registry or in the form of artifacts maybe?). This would be like installing Go modules, Ruby gems or NPM modules locally. If you keep using the same version we will pull it from the vendored space. If the components version or entire project is removed, you'll keep using the vendored version and are not impacted. If you empty the vendored space then you may be exposed to missing dependencies.
  4. Other...
Edited by Fabio Pitino