Monorepo Madness: Dependencies, License Compliance, and Automation
summary
Automated dependency and license compliance focuses on four concrete steps: enumerate direct and transitive dependencies, classify how each is used, flag license or security risks, and define mitigations; automation reliably handles the first three but needs per-project mappings inside monorepos. Work on AOSP shows a real gap: a repository with 300,000 files and hybrid Android make/Soong/Ninja build layers requires stitching multiple build systems, so teams build tooling like Fossa scans and migrate toward Bazel to make static analysis feasible and reusable.
AI-written summary · about
chapters (6)
related talks
42mBuilding Scalable Mobile Projects: Fast Builds, High Reusability and Clear Ownership
30mPoly Monorepos, the Best of the Two Worlds
29mMonorepos, are they right for you?
46mExploring the power of monorepos: When and why to use them
19mMonorepos: Any Size Fits All
31mMonoRepos for the Masses
24mBuilding your ideal codebase: monorepos & multirepos living in harmony
35mThe Gentle Monorepo - Ship Faster and Collaborate Better