packwerk VS RubyGems

gem "packwerk" - https://github.com/Shopify/packwerk | Allows modularising Ruby code, a must-have for growing projects.

Yep, that article is about very similar concepts but grounded in Spring as the framework.

I like what they do around package imports and it looks a lot like what we do at incident.io, with some rules about which packages can import what.

For people in the Ruby world who want a similar solution, Shopify provide an open-source framework called packwerk that is designed just for this:

https://github.com/Shopify/packwerk

I’d probably go with packwerk before rails engines these days

https://github.com/Shopify/packwerk allows you to make dependencies between components explicit

Packwerk – to enforce boundaries and modularize Rails applications

Take a look at Packwerk from some folks at Shopify - gets you the benefits of naming some components for organizing boundaries in your code, with each component having the usual rails folder structure, but without the hard isolation restrictions of doing so with Engines.

Nothing is stopping you from doing so except you (and maybe packwerk, but you very likely don't have that installed).

For me, the most important aspect of a growing Rails app is handling of complexity and interdependencies and turns out Shopify's packwerk is just what the doctor ordered - it leverages zeitwerk loader to improve on Rails' vanilla file structure, allowing to group files by business concept or sub-domain and control visibility and ownership.

Let's set the stage right quick. You happen to be in a large Rails application that follows along with something like Packwerk to clearly delineate different packages in your Rails monolith. Let's say you have 100 packs, which is not particularly unusual with larger applications.

However, let's examine a typical partial, such as the one from the . rubygems.org search show page

github.com/rubygems/rubygems.org (26k lines): Where Ruby gems are hosted.

If anyone is looking to do some open source contributions on a mature, production Ruby on Rails site, I highly recommend contributing to the rubygems.org project. The code is extremely clean and the repo is very, very well run.

https://github.com/rubygems/rubygems.org

RubyGems does have gem signing, but it's not widely used.

There's a proposal for a new "one button" approach using sigstore[0].

Other ecosystems are also looking at sigstore too, and a lot of us are cooperating in the OpenSSF Securing Software Repos WG [1]. Package signing is a regular topic of discussion and there are various efforts underway.

Disclosure: I am involved with both of these.

[0] https://github.com/rubygems/rubygems.org/pull/2944

[1] https://github.com/ossf/wg-securing-software-repos