DevOps.js Conf 2022

Slow CI has a negative impact on productivity and finances. Debugging CI workflows and tool slowness is even worse. Dependencies impact CI and waiting for NPM or YARN is frustrating. The ideal CI job involves native programs for static jobs and lightweight environments for dynamic jobs. Improving formatter performance and linting is a priority. Performance optimization and fast tools are essential for CI and developers using slower hardware.

This Talk introduces the concept of CleanCode in DevOps workflows, highlighting the benefits of efficient and maintainable code. The use of SonarCloud and the Sonar Solution is showcased as an easy way to add clean code to the workflow, providing valuable insights and metrics. Analyzing pull requests and triaging issues is emphasized as a proactive approach to catching and correcting code issues before they reach the main branch.

Today's presentation discusses the role of dependencies in software development, including different types of dependencies and their impact on development and maintenance. The talk also highlights incidents related to software dependencies, such as naming disputes and compromised credentials, which have led to system failures and security breaches. Efforts are being made to address these issues with tools like X-Ray and scorecards that provide analysis and insights for improvement.

StackHawk is a dynamic application security testing tool that helps you find and fix security bugs in your running applications. It runs active security tests on your REST API, GraphQL API, SOAP API, server-side application, and single-page applications. StackHawk ensures that your application handles user input and output safely and follows OWASP top 10 best practices for application security. We make dynamic testing fast by placing the scanner close to the application and using open standards to inform the scanner. The scanner is configured via YAML, and findings are triaged to provide simple descriptions and examples for issue identification and resolution. You can push the identified issues to a JIRA ticket for prioritization and resolution. Once triaged, the scanner will remember the issues and stop notifying you. Start a free trial at stackhawk.com to experience its benefits.

Sentry is an error monitoring platform that helps developers optimize the customer experience by alerting them of errors and slowdowns. It supports all major languages and frameworks, with a focus on error monitoring, performance monitoring, and release health. The Talk explores how Sentry organizes and represents error data, analyzes error details and tags, and investigates backend issues, performance problems, and release health. Collaboration with backend teams is emphasized to resolve issues and optimize transaction time. The Talk also highlights the importance of analyzing graphs, issues, and regressions to identify areas for improvement in release health.

Vulture is a powerful and flexible cloud platform that offers an easy-to-use control panel, custom ISOs, and automatic backups. The Vultr Marketplace provides a wide range of applications for easy deployment and provisioning. Vultr also offers enterprise-grade networking options and has 23 locations available. Users can start with Vultr using a coupon code to get $150 of free credit.

AWS CDK is a concept that allows you to use coding languages to create infrastructure as code, making it more flexible and powerful than traditional config languages. CDK offers benefits such as improved developer experience, multi-regional deployments, and a programmatic approach to infrastructure as code. It is a suitable choice for AWS users, particularly those familiar with CloudFormation. CDK can be used to migrate from CloudFormation to a more efficient and user-friendly infrastructure management tool. CDK also provides drift detection and supports multi-region deployment, making it a popular choice for managing infrastructure on AWS.

The Talk discusses the recent compromise of the UA parser.js package and the need for supply chain security in the open source community. It explores the reasons for security risks in open source and the need for a new approach to detect and block malicious dependencies. The different attack vectors and maintainer vulnerabilities are also discussed. The speaker emphasizes the importance of evaluating packages and protecting your app, as well as the need for a mindset shift in how we view open source. The Talk concludes with an introduction to Socket.dev, a tool focused on supply chain attack detection.

pnpm is a fast and efficient package manager that gained popularity in 2021 and is used by big tech companies like Microsoft and TikTok. It has a unique isolated node module structure that prevents package conflicts and ensures each project only has access to its own dependencies. pnpm also offers superior monorepo support with its node module structure. It solves the disk space usage issue by using a content addressable storage, reducing disk space consumption. pnpm is incredibly fast due to its installation process and deterministic node module structure. It also allows file linking using hardlinks instead of symlinks.

DevOps is a journey that varies for each company, and remote work makes transformation challenging. Pull requests can be frustrating and slow, but success stories like Mateo Colia's company show the benefits of deploying every day. Challenges with tools and vulnerabilities require careful consideration and prioritization. Investing in documentation and people is important for efficient workflows and team growth. Trust is more important than excessive control when deploying to production.

NPM workspaces help manage multiple nested packages within a single top-level package, improving since the release of NPM CLI 7.0. You can easily add dependencies to workspaces and handle duplications. Running scripts and orchestration in a monorepo is made easier with NPM workspaces. The npm pkg command is useful for setting and retrieving keys and values from package.json files. NPM workspaces offer benefits compared to Lerna and future plans include better workspace linking and adding missing features.

Welcome to vidBuild, a tool that optimizes your application for production by offering fast hodgemodule replacement and support for various technologies. The build process in vidBuild involves optimizing and minifying assets, bundling JS and CSS, and generating chunks for dynamic imports. The pipeline in vidBuild includes plugins for alias, resolution, CSS modules, and asset handling. Vid is a complete build tool with a flexible plugin system and support from a vibrant community. Vite's plugin API is compatible with Rollup, and Vite aims for simplicity while pushing complexity to the plugin system.

This Talk discusses strategies for managing monorepos, including release strategies, building strategies, development processes, and linking packages. The speaker highlights the challenges and complexities of monorepos, such as large codebases and potential coupling of software parts. They also mention the importance of suitable tooling for successful monorepo management and the potential for standardization in the future. Additionally, the speaker shares their personal journey in programming, starting at a young age and expressing their love for the field.

Welcome to the Releasing React Apps Faster with Feature Flags talk. Feature flags alleviate problems in the development process by allowing for the creation of feature flags instead of branches. By using feature flags, incomplete versions can be deployed, reviewed, approved, merged, and deployed without errors for customers. Feature flags also enable low-risk deployments, testing in production, gradual release processes, and the ability to quickly turn off features if issues arise.

Lucan de Muela discusses how to optimize Node.js development workflows in Kubernetes using Scaffold and Rancher Desktop. He highlights the developer experience, cluster management simplification with Rancher Desktop, and build/release workflow optimization with Scaffold. He also mentions the ability to update Kubernetes versions and choose a container runtime, as well as the option to reset the cluster for a safe development environment.

Today's Talk explores the lessons that video games can teach us about building virtual teams. The impact of communication on software development is discussed, highlighting the importance of understanding software for successful deployment. The concept of collective intelligence is introduced, emphasizing the role of social perceptiveness, cognitive diversity, and equal distribution of communication. The Talk also emphasizes the need to optimize team performance with key metrics and suggests keeping teams small and cross-functional to enable easy communication and lower cognitive loads.

Welcome to my session on Serverless for Front-ends. Serverless functions eliminate the need for a runtime and handle orchestration for you. Microfrontends require a runtime and orchestration, but side-less UIs provide a runtime-free solution. In the demo, a new team adds functionality to an application and publishes it easily. Building and deploying applications is quick and easy with micro apps and PowerCLI, offering true loose coupling and instant availability without a runtime.

The Talk discusses using Dino and TypeScript to simplify writing and managing Kubernetes YAML configurations. It explores the challenges of working with large YAML files and introduces a unique solution. The Talk also highlights the features and benefits of Deno, such as its secure runtime and powerful typing capabilities. It demonstrates how Deno can be used to create and modify Kubernetes objects, and emphasizes the advantages of using a general-purpose language for configuration. The Talk concludes by discussing the potential applications of this approach beyond Kubernetes deployments.

Microfrontends follow the microservices paradigm and observability is crucial for debugging runtime production issues. Error boundaries and tracking errors help identify and resolve issues. Automation of alerts improves incident response. Observability can help minimize the time it takes to understand and resolve production issues. Catching errors from the client and implementing boundaries can be done with tools like OpenTelemetry.

Code automations can save time and effort in development tasks. There are tools and examples available for automating tasks like updating dependencies and code formatting. Automation allows teams to focus on valuable work and improves overall performance. Deciding when to automate depends on the impact and type of code. The last automated task discussed was applying translation updates to multiple projects.