Ask HN: Anyone Replace Jira with GitHub Issues?

https://news.ycombinator.com/item?id=35280338

by samieljabali • 3 years ago

20 24 3 years ago

news.ycombinator.com

I'm wanting to centralize tickets & documentation in Github, and in the process eliminate Jira & Notion.

Question: Is it possible to create tickets for a repo without granting read access to code?

If not, is the work around to create a repo just for tickets that everyone has access to? Is it even practical at this point?

Has anyone successfully pulled this off at their org?

genmud2• 3 years ago

I guess one question is, why don't you want people to have read access to the code? IMHO if they aren't trustworthy to view code, they probably aren't trustworthy to be submitting tickets (or employed in any other roles in the org as well).

To actually answer your question, you can have projects that span multiple repos, but you can't have repos that only have permissions for issues.

In my org, we have a few different repos for documentation + issues related to specific groups and utilize those repos heavily. We also have a couple code repos and anything specific to that codebase is stored there. We use zenhub though as well to help organize / track stuff.

ozim• 3 years ago

I might be security LARPing but if someone doesn’t need to read the code to be able to do his job he just shouldn’t have access to do it.

Person might have been trustworthy when they were hired and they might change their mind at some point.

Even better - they still might be trustworthy but their computer got compromised and someone might be using them.

Maybe some other employee has problems with them and since they have access malicious employee can indicate trustworthy one in some way. Like posting copy of code somewhere online with nickname used by that one.

I know such things don’t happen often but even for mundane things like phone numbers you just don’t give phone number of your friend to a person you both know without asking that friend in first place.

dzhiurgis4• 3 years ago

Kinda get your sentiment, but you missed parents point. Whoever creates tickets SHOULD be able to at least skim code, do basic PR reviews, test a build. "I create tickets only" sounds like a toxic role.

genmud2• 3 years ago

I’m an actual security guy, been doing it for nearly 20 years (before it was a thing). I’m of the opinion that if I can’t trust people to look at code, they shouldn’t be at the company. Period.

There are very few use cases where I believe read only access to code from people in product, engineering or support should be restricted. Generally the net benefit is well worth the potential risk introduced.

If you are worried about people stealing source code, invest in a DLP or CASB solution. If you are worried about ransom, don’t allow changes without PRs, implement a backup program and harden your endpoints. Not allowing people to do things that helps them understand the systems they work with is a recipe for shadow IT and promotes organizational silos.

Aperocky2• 3 years ago

Exactly, the best software products are open source, of course many bad ones are also open sourced, but proprietary software that must be kept secret -- even within the company -- are usually not the best. Even for the hypothetical scenario where they are leaked - they would only make sense in the context of your business, as such should be mostly worthless to anyone else (but it may expose the degree of competence, and potential attempts at security via obscurity, so could still be very bad news).

systemvoltage• 3 years ago

Intellectual property?

shoo• 3 years ago

what's your underlying motivation to eliminate jira & notion?

addisonl• 3 years ago

Not the OP here, but I think anyone who has used Jira understands the want to get rid of it—it is simply trash.

s1k3s• 3 years ago

Not saying that it isn't, but I'm curious, what's your reason for saying Jira is trash?

isopede• 3 years ago

Among others, regulatory reasons can mean Jira is not an option (medical, financial, export controls etc). They removed their self-hosted version a while ago, and their "data center" version is a $42,000 _minimum_.

Aperocky2• 3 years ago

Atlassian IBM speedrun.

There should be plenty of open source alternatives, and the times are really bad now to justify expenses like this.

jlawer• 3 years ago

Yes, we have a single tickets repo seperate from the code, and use GitHub projects collect tickets from multiple repos into one board.

Team of 8 devs + other supporting roles. Devs are happy with it, PM and portfolio management not so much, as you loose a lot and GitHub projects is still fairly new.

Why did we do this? We were acquired and the new corporate has different ideas and we lost Jira. Project managers end up manually syncing status of epic tickets between GitHub and their project management tools. We make it work, but much more labour intensive the Jira+Jira Portfolio

bobx11• 3 years ago

I have ticket only repos where people can create tickets. They get pulled into a project and mentions across repos are still shown with status. We create issues from a user form too! It’s nice to get away from using multiple systems and get conversations so close to the pull requests.

samieljabali2• 3 years ago

I have ticket only repos where people can create tickets.

Nice thinking.

We create issues from a user form too!

This is where the money's at. I'm assuming this was done via Github API + Generated Token. I was thinking of something similar to this, however using a Slackbot.

dzhiurgis4• 3 years ago

What's your plan with documentation - wiki or markdown files in source?

Google seems to document everything in repo - which is brilliant since it can be reviewed, you can ask PR author to update doc and hence less likely to go out of sync.

samieljabali2• 3 years ago

wiki or markdown files in source

Exactly.

rurban• 3 years ago

We are in the process to replace Jira, Bitbucket, Jenkins, MediaWiki with Gitlab. Looks good so far, but I don't know any details. We didn't have to write any code for the transformation.

Ask HN: Anyone Replace Jira with GitHub Issues?

Related Stories