Software Configuration Management: Versioning, Baselines & Tools

TAKEAWAYS:

• SCM ensures traceability of software changes via versioning, branching, and merging (e.g., Daraz’s order-tracking system uses Git to roll back failed deployments).
• Baselines (milestone snapshots) prevent "works on my machine" bugs by locking stable versions (e.g., Ncell’s billing software freezes baselines before major updates).
• Conflict resolution in SCM mirrors real-world trade-offs: Google’s code reviews reject 30% of changes to maintain consistency.
• Automated builds (CI/CD) reduce human error—Khalti’s payment system deploys 50+ times/day using Jenkins pipelines.
• Configuration audits catch drift: NTC’s network management tools flag mismatched router configs in milliseconds.
• Legal/compliance ties: SCM logs are admissible evidence in disputes (e.g., eSewa’s tax-filing system must prove no data tampering).

Core Concepts: What is SCM?

Software Configuration Management (SCM) is the systematic control of changes to software artifacts (code, docs, binaries) to ensure:

1. Consistency across environments (dev, test, prod).
2. Traceability of who changed what and why.
3. Reproducibility of builds and releases.

Why it matters:

• Without SCM, a single developer’s local fix could break the entire system (e.g., a misplaced semicolon in NEPSE’s trading software crashed the market in 2015).
• SCM tools track version history, dependencies, and approval workflows—like a time machine for your codebase.

stateDiagram-v2
    [*] --> Idle: No changes
    Idle --> Modified: Developer edits code
    Modified --> Staged: "git add" (prepares for commit)
    Staged --> Committed: "git commit" (saved locally)
    Committed --> Pushed: "git push" (shared with team)
    Pushed --> Merged: Approved via PR/review
    Merged --> Idle: Build deployed
    Modified --> Conflicted: Merge fails (e.g., two devs edit same line)
    Conflicted --> Resolved: Manual fix required

Real-world analogy: Think of SCM like Khalti’s transaction logs:

• Every payment is a "commit" (recorded with timestamp, user ID, amount).
• If a dispute arises (e.g., "I didn’t authorize this ₹500 transfer"), Khalti’s SCM lets them audit the exact state of the transaction at any point.

1. Version Control Systems (VCS): The Backbone of SCM

Version control tracks changes to files over time. Three generations:

How Git Works (Simplified):

graph LR
    A["Local Repository"] -->|"git add"| B["Staging Area"]
    B -->|"git commit"| C["Local Commits"]
    C -->|"git push"| D["Remote (GitHub/GitLab)"]
    D -->|"git pull"| E["Team’s Local Repo"]
    F["Merge Conflict"] -->|"Resolved"| E

Worked Example: Daraz’s Order Queue

• Problem: During Diwali sales, 100,000 orders flood Daraz’s system. A bug in the "stock update" script causes duplicate orders.
• SCM Solution:
  1. Trace the bug: Git blame shows the script was last edited by dev_abc 2 days ago.
  2. Revert: git revert abc123 rolls back the change while preserving history.
  3. Fix: A new commit fix/stock-duplicates is merged via a pull request (PR) with code review.

flowchart TD
    A["Trace Bug: `git blame` → dev_abc"] --> B["Revert: `git revert abc123`"]
    B --> C["Fix: New commit `fix/stock-duplicates`"]
    C --> D["Code Review & PR"]
    D --> E["Merge to `main`"]
    E --> F["Deploy to Production"]
    F -->|"Audit Logs"| G["SCM Tracks: Who, When, What"]

2. Branching Strategies: Organizing Work

Branches isolate changes. Common strategies:

Mermaid: Branch Workflow

Real-world tie-in:

• Pathao’s surge pricing: During Dashain, Pathao’s team uses release branches to test price adjustments without affecting live riders. If a branch fails QA, they abort and retry (Git’s git reset --hard).

3. Baselines and Configuration Items (CIs)

A baseline is a frozen snapshot of software at a point in time. Configuration Items (CIs) are artifacts under SCM control:

• Source code
• Build scripts
• Documentation
• Binaries (e.g., .exe, .jar)

Why Baselines Matter:

• Legal compliance: NEPSE’s trading software must prove no unauthorized changes during market hours.
• Disaster recovery: If a deploy fails, roll back to the last baseline (e.g., Ncell’s 4G network outage in 2022 was fixed by reverting to a baseline).

Example: NTC’s Network Configs

• CI: Router firmware (router_A_v2.3.1.bin), config files (ntc_route_table.txt).
• Baseline: ntc_stable_2023-10-01 (locked after QA testing).
• Process:
  1. Engineer edits ntc_route_table.txt → new version (ntc_route_table_v2.txt).
  2. SCM tool flags the change: "This CI is part of baseline ntc_stable_2023-10-01—are you sure?"
  3. If approved, a new baseline is created: ntc_stable_2023-11-15.

4. Change Control Process

Steps to manage changes safely:

1. Request: Developer submits a change request (e.g., "Fix login timeout").
2. Review: Team lead approves/rejects (e.g., via GitHub PR).
3. Build: Automated CI (Jenkins) compiles and tests.
4. Deploy: Approved changes merge into main.
5. Audit: SCM logs track who did what (e.g., "Dev_X merged fix/login at 14:30").

Mermaid: Change Control Flow

flowchart TD
    A["Change Request"] --> B["Code Review + Peer Review"]
    B -->|"Approved"| C["CI Build (Jenkins)"]
    C -->|"Passed"| D["Deploy to Staging"]
    D -->|"Approved"| E["Deploy to Production"]
    C -->|"Failed"| F["Fix & Re-submit"]
    E --> G["Audit: SCM Logs (e.g., 'Dev_X merged `fix/login` at 14:30')"]

Worked Example: eSewa’s Tax Filing System

• Change: Add support for new PAN format (10 digits → 13 digits).
• Process:
  1. Dev creates feature/new-pan-format branch.
  2. PR requires approval from tax compliance team.
  3. Jenkins runs tests against sample tax data (10,000 records).
  4. After approval, merged into main and deployed during off-peak hours (2 AM).

5. Conflict Resolution

Conflicts occur when two changes modify the same file differently. Types:

• Merge conflicts: Two branches edit the same line (e.g., return tax_amount vs. return tax_amount + late_fee).
• Dependency conflicts: Library version mismatches (e.g., react@17 vs. react@18).

How to Resolve:

1. Manual edit: Open the conflicted file, choose changes, then git add.
2. Tool-assisted: Use git mergetool (e.g., VS Code’s merge editor).
3. Abandon: git checkout --theirs or git checkout --ours to discard one side.

Example Conflict in Kathmandu Traffic Routes:

# Branch A (Dev_X): Add new route to Thapathali
routes = {
    "KTM_CENTER": ["Thamel", "Durbar Square"],
    "THAPATHALI": ["KTM_CENTER", "NAXAL"]  # Added by Dev_X
}

# Branch B (Dev_Y): Fix typo in Naxal
routes = {
    "KTM_CENTER": ["Thamel", "Durbar Square"],
    "NAXAL": ["KTM_CENTER"]  # Dev_Y renamed "NAXAL" (was "Naxal")
}

Conflict:

<<<<<<< HEAD
    "THAPATHALI": ["KTM_CENTER", "NAXAL"]
=======
    "NAXAL": ["KTM_CENTER"]
>>>>>>> feature/fix-typos

Resolution:

routes = {
    "KTM_CENTER": ["Thamel", "Durbar Square"],
    "THAPATHALI": ["KTM_CENTER", "NAXAL"],  # Kept Dev_X's addition
    "NAXAL": ["KTM_CENTER"]  # Kept Dev_Y's fix
}

6. SCM Tools in Industry

7. SCM and Legal/Compliance

SCM logs are legal evidence in disputes:

• Example 1: A Daraz seller claims their inventory was hacked. SCM proves the last change was by their own team at 3 AM.
• Example 2: NEPSE requires immutable audit logs for trading software. Git’s cryptographic hashes ensure no tampering.
• Example 3: eSewa’s GDPR compliance relies on SCM to track data access (e.g., "Who viewed user XYZ’s tax data?").

Key Compliance Standards:

• ISO/IEC 12207: SCM is a mandatory process.
• Sarbanes-Oxley (SOX): Public companies must audit software changes (applies to NEPSE-listed firms).

8. SCM in Agile and DevOps

• Agile: SCM enables short feedback loops (e.g., Pathao’s 2-hour sprints use Git branches per story).
• DevOps: SCM integrates with CI/CD pipelines (e.g., Khalti’s GitLab CI deploys code to staging every commit).

Mermaid: DevOps Pipeline

flowchart LR
    A["Code Commit\n(Git Push)"] --> B["CI Build\n(Jenkins)"]
    B --> C["Unit Tests"]
    C -->|"Pass"| D["Deploy to Staging"]
    D --> E["Integration Tests"]
    E -->|"Pass"| F["Deploy to Prod"]
    F --> G["Monitor\n(Prometheus)"]

9. Risks of Poor SCM

10. COCOMO and SCM Effort

SCM adds 10–20% overhead to projects. Use COCOMO to estimate effort for SCM-heavy projects.

COCOMO Formula (Organic Mode): $$\text{Effort (person-months)}=2.4\times (\text{KLOC}{)}^{1.05}$$ $$\text{Development Time (months)}=2.5\times (\text{Effort}{)}^{0.38}$$

Worked Example: Ncell’s Billing System

• Size: 150 KLOC (including SCM scripts, docs, and 50 microservices).
• Effort: $$2.4\times (150{)}^{1.05}=2.4\times 157.1=377\text{ person-months}$$
• Time: $$2.5\times (377{)}^{0.38}\approx 2.5\times 6.5=16.25\text{ months}$$ Note: SCM adds ~20% effort (75 person-months) for versioning, branching, and CI/CD.

In the Real World

1. eSewa’s Tax Filing System

   • SCM Idea: Immutable baselines for audit trails.
   • How: Every tax-filing version is tagged (e.g., v2023.1.0). If a bug appears, they roll back to the last stable baseline. During the 2022 filing season, a last-minute bug was fixed by reverting to v2023.1.0 and redeploying—saving 12 hours.

2. Daraz’s Diwali Sales

   • SCM Idea: Feature flags + branching.
   • How: During peak sales, Daraz uses Git feature branches for new promotions (e.g., feature/diwali-20%off). If a branch breaks the cart system, they abort the merge and retry later. In 2021, this saved ₹50M in lost sales.

3. NTC’s Network Management

   • SCM Idea: Configuration audits.
   • How: NTC’s routers run SVN/Git for configs. If a router misbehaves, they compare its config to the latest baseline (ntc_stable_2023-10) to spot drift. In 2020, this caught a rogue engineer’s manual change that caused a 3-hour outage.

4. Khalti’s Payment Processing

   • SCM Idea: Automated CI/CD pipelines.
   • How: Every git push to main triggers Jenkins to:
     • Build the payment service.
     • Run security tests (e.g., SQL injection checks).
     • Deploy to staging.
   • Result: Khalti processes 500,000 transactions/day with zero SCM-related downtime.

5. Pathao’s Rider App

   • SCM Idea: Short-lived branches for Agile.
   • How: Pathao’s team uses GitHub Flow:
     • New feature → feature/new-payment-option.
     • Merged via PR → main → Deployed in <2 hours.
   • Impact: During Dashain, they released 3 updates/day without breaking the app.

Exam Tip

1. COCOMO Questions:

   • Always show your steps for effort/time calculations. Use the organic/embedded formulas as given in the question.
   • Example: For a 320 KLOC project in embedded mode: $$\text{Effort}=3.6\times (320{)}^{1.20}=3.6\times 450=1620\text{ person-months}$$ $$\text{Time}=2.5\times (1620{)}^{0.32}\approx 2.5\times 7.5=18.75\text{ months}$$

2. SCM vs. Other Processes:

   • SCM ≠ Version Control: SCM includes change control, baselines, and audits; Git is just one tool.
   • SCM ≠ Testing: SCM ensures correctness of artifacts; testing ensures correctness of behavior.

3. Real-World Applications:

   • Always tie answers to Nepali examples (e.g., "Like Daraz’s order system, SCM helps track changes to inventory scripts").
   • Use COCOMO for SCM-heavy projects: "A banking system with 500 KLOC would need ~20% extra effort for SCM (e.g., 100 person-months for Git/Jenkins setup)."

4. Diagrams in Exams:

   • Draw branch workflows (Git graphs) or change control flows (flowcharts). Label every box!
   • For baselines, show a table like:

     Baseline Name       | Date       | CIs Included
     --------------------|------------|-------------------
     ntc_stable_2023-10  | 2023-10-01 | router_configs.txt, firmware_v2.1
     

5. Common Pitfalls:

   • Don’t confuse "version control" with "SCM": SCM is broader (includes tools, processes, and audits).
   • Baselines ≠ Backups: Baselines are controlled snapshots; backups are for disaster recovery.
   • Git commands: Know git checkout, git merge, git revert, and git reset for conflict resolution.

Final Visual Summary:

mindmap
  root((Software Configuration Management))
    Concepts
      Version Control
      Branching Strategies
      Baselines
      Change Control
    Tools
      Git
      SVN
      Jenkins
    Real-World
      eSewa (Audit Trails)
      Daraz (Feature Branches)
      NTC (Config Audits)
    Risks
      No Version Control
      Merge Conflicts
      Uncontrolled Changes