Dependencies: Resources vs links

When adding an asset, you should consider whether you want to track it in the catalog. If so, then you'll add the asset/artifact as a Resource. If you only need to reference the asset, we recommend using links.

For example, let's say we have the ability to see which services are using a certain version of an internal node module, and that version needs to be updated:

• If the packages are in their respective package file (e.g. package-lock.json or requirements.txt), pull those in as packages and use SemVer queries. The package-lock and yarn.lock files are automatically parsed whenever they're updated in your default branch. As long as you have a Git integration set up with Cortex, they're already available in Scorecards by default.
• Otherwise, we recommend using custom data with a CQL query in a Scorecard looking for a minimum version.