Ask HN: Why do tests run in production repos? In light of the recent xz backdoor, I was wondering what the potential use, if any, there is in shipping test folders in release/production branches? Wouldn't it seem more reasonable to have a separate "dev" branch to have the tests of folders? |
I have always shipped test automation in production with my personal software. It allows users to independently validate the health of the product in their own operating conditions and write better more precise defects.
Wait... I may be misunderstanding but in the xz backdoor we just had, had the tests not be ran in prod, the attacker would have had no way to ever ship its mandatory evil binary payload and the attack would have been stopped dead in its track.
I'm very surprised to see this dismissed as "unrelated" when not including the test files in the prod environment would have prevented that exploit.
At least as I understand it.