Today we're sitting down with my old friend Eli Schleifer
On the day of his first product's launch.
If you're writing code with a big team you need Trunk
Today's video is mainly for software engineers so it's ok to skip this week if you're not one of those. Let's get started.
- Eli congrats on your launch today of Trunk.
You're one of the best engineers I ever worked with,
way back in the day,
when we were starting our careers at Microsoft.
So, what is Trunk?
- We are like DevEx in a box,
So what we're announcing today is the launch of Trunk Check.
It's our first product.
This is the meta linter,
and it's basically what we call like
'the one linter to rule them all.'
You know, Trunk Check is all about making sure that,
in your repository, every single tool,
your static analyzers, your linters, your formatters ,
are all being run on all the technologies whenever you go.
Even the most basic repository today
tends to have five to 10 technologies in play.
So you might have your core Python code,
and your core rust code.
The truth is you also have Docker files
and Terraform formation files, and you have bash scripts.
All of these things have formatters,
linters, analyzers have to be run,
and you do not want to have someone on your team
maintaining that, because if it's someone maintaining it,
that means they're forgetting to maintain it.
What you want is basically a tool
to take care of all this for you.
So that's what Trunk Check is.
You install a trunk into your repository.
Every single one of your engineers
has automatically downloaded and installed versions
of every single tool in your repository that is being run.
We can do a demo for that today
on the open source repository,
a repository is called yaml-cpp.
It's a very popular C++ yaml parser.
Let's take a look.
So the first thing we do is we run the trunk in it.
So I already have a curl down trunk onto my machine.
I run trunk in it.
And what you'll see quickly is the first step we do
is we analyze the repository.
In this case, we say, analyze all your files
we've found 402 files in your repo.
And we actually turned on 11 different linters.
And this included stuff for clang format,
which is your C++ formatter, actionlint.
'cause this repository uses GitHub actions,
black, which is an awesome Python formatter,
buildifier for the Bazel tools,
flake8, gitleaks, isort, prettier, all these tools,
they're commonly turned on, kind of one-offs by individuals,
but here we've done that all for you
and literally in seconds.
So we've turned on the 11 linters.
We're kind of telling you,
here are the things we've turned on,
for some of them we put in, you know,
reasonable defaults for those linters.
But beyond that, you know,
it's up to you to go and tweak them to your heart's desire.
All of these tend to be open source tools
that people are running one off.
But what we're saying is,
this should all be managed by a meta tool
that's going to make sure it's all being run.
And the big value here is that it's being run for you
on your box locally.
This is not a job that's happening in CI.
Traditionally,
if I'm running like a superlint or at a GitHub,
what happens is I do a bunch of code,
that I send that off to GitHub, right?
Well, now GitHub has now become
like a 10 minute asynchronous process,
to tell me that I have like a spellcheck problem
or that my files are not sorted correctly.
That's ridiculous.
Like you wouldn't tolerate that from Google docs,
to wait 10 minutes to tell you misspelled something.
You shouldn't wait 10 minutes for your linter to tell you,
you have a linting problem.
Not only that it's expensive,
it means cause not only are you running your linters
in the cloud, but also you're running all your unit tests
and integration tests suites, those costs money.
And they also burden machines.
And while that's happening,
you're just like twiddling your thumbs.
And we kind of think that a lot of engineers get stuck
in like rinse-wash-repeat cycles.
So we're going to solve that for you with trunk check.
So as soon as I've installed this, I've initialized it.
I'm going to run trunk check.
And what we'll do, is we'll call it here sample five,
which is going to say,
find me five files for each launcher you've turned on,
run it and make, show me kind of what my results are,
because we've just turned this thing on.
And quickly you can see here, a bunch of issues popped up.
I have Python issues, I have formatting issues.
I have problems with my markdown.
So when you run trunk in it
you actually regenerated this trunk.yaml file
inside the trunk yaml file,
we believe everything should be configuration as code.
So you can see here in the enabled list,
here are all the linters that have been turned on,
along with the versions for each of those linters.
So as new versions of linters come out,
you can change that version
that is pegged inside your trunk, that yaml file.
And now that's the new version that's going to be used.
As new versions of tools come out.
Often those new versions actually represent security fixes
or better rules that could be enforced on that repository,
with one run, trunk check base upgrade, you'll get,
we'll go check the internet,
find all the latest versions of those tools.
And we'll tag those back into your yaml file.
And you permit that,
now everyone is running those new versions of the tools.
- You know, linting is static analysis and security checks.
And it sounds like,
you can actually find really high severity bugs.
And it's somewhat normal for you to do that,
when you, you know,
drop trunk into pretty much any code base out there.
So not using this as like driving drunk then.
- Yeah, absolutely,
just last week I came across a very popular open source
security tool, installed this,
installed trunk onto that repository, ran it,
instantly picked up to high severity security issues
in Golang in this project.
Now, if you looked at the commit history of this repository,
two years ago, someone ran Golang sealant on it.
Very popular go formatter on linter.
What we've turned out is, well,
no one has run it since then.
And that's what Trunk is all about.
Make sure that you're always running the latest versions
of these tools.
If you are running the old stuff,
you're susceptible to security problems.
We want to make sure that you're always running the best
and latest of everything.
- So, Eli, where can people get trunk?
It sounds like it's available today.
It's open-source and it's free.
- Absolutely.
So it's open source.
It's free for open source projects,
free for small teams to use
through promoted for commercial uses, go to trunk.io.
You can get the link right there, download it.
I'd love for people to try it out
and take it for a spin.
- That sounds great.
Thanks man. Congrats on the launch today.
- Thanks for talking Garry.