-
Notifications
You must be signed in to change notification settings - Fork 22
Open
Description
Currently, when awslabs/amazon-ecr-containerd-resolver is used as a go module dependency, it uses the date/sha method to pull and query changes:
require (
github.com/awslabs/amazon-ecr-containerd-resolver v0.0.0-20230225154133-288898c0f318
)
This is scary and dangerous because any go module update will automatically consume the latest changes off the main branch. What if a maintainer is landing a breaking change on the main branch? That will automatically be consumed. Instead, it'd be advantageous to tag releases so there are well defined / stable code points to pull from.
Metadata
Metadata
Assignees
Labels
No labels