u/Aki59

​

In our company, there is a custom tool managed by the support team. Its job is to perform HC, tracing, and deployment data collection. I would also mention that New Relic and OpenTelemetry are already available at the enterprise level, but production support insists that integration with this tool is mandatory.

They recently introduced a change where a deployment component should also send all the packages it is using as part of the deployment data. The thing is, getting dependencies post-deployment is slow because we are using mvn dependency. As an engineer, I was concerned about the additional time this would take. So, in a meeting with the tool team, I asked why we need to send the dependencies in the first place when we already have that data in the Sonatype report. Why duplicate the information?

One of the team members responded rather sharply: "Do you think that during a production issue, someone will log in to the report UI and get the details? Do you even know why we are putting it here? This is needed for auditing."

I told him that I understood the requirement, but my concern was with the process that one of the teams had implemented using mvn dependency and that they were asking us to implement in the same way. It is slow, and even if I run it as an asynchronous job, it would still be a waste of resources.

At this point, he said that this was mandatory and that if I thought otherwise, I should send an email and CC my manager, architect, and director. I didn't say anything after that.

What should I have done, or what should I do now?

Implement whatever they asked for—it's a job, after all. Who cares?

Implement it using a different approach. It will take some time, but it might be possible.

Or something else?

Since it is an internal tool, there is no proper documentation—just a few references here and there.

This doesn't break out pipeline as their api doesn't say it is mandatory.