Evaluate risks of the way we build using plugins and skins

[wincent]

Haven't done a release in the while, but while cutting v4.14.1-liferay.19 today I noticed that we have quite a few changes in the build output beyond what you would expect based on the only PR that we (this one) merged since the last release.

Some examples: note how both skins and plugins change with almost every release.

I am not sure about why the skins change every time, but at least for plugins, you can see we download whatever the latest version is during ./ck.sh setup. This is kind of necessary: people do have to "freshen" their repo before running ./ck.sh build, but it definitely increases our risk profile — we might want to ship a one-line patch, but we actually ship that patch plus whatever-changed-in-plugins-and-skins-since-last-time as well.

So this ticket is just to flag the risk here and note that we might want to do something about it (like "freezing" these resources inside the repo instead of downloading them). I am pretty sure we can for those plugins, but the skins might be harder (if I had to guess, I'd bet that is happening as part of CKEditor's own build process, and that could be harder to change).

Labeling as "rfc" because it's not yet clear what we will or should do about this.

[julien]

Just adding some notes here.

I noticed that the scayt and wsc plugins are downloaded each time we run: ./ck.sh setup and ./ck.sh update.

The wsc plugin, will reach its end of life at the end of the year:

This plugin has an End-of-Life date set to December 31st, 2021. This means it will not be supported any longer and may stop working after this date. We strongly encourage everyone to choose one of the other available spellchecking solutions - Spell Check As You Type (SCAYT) or WProofreader.

I know that we download them because they aren't in ckeditor4's plugin directory, but it might be a good time to think about an alternative: I'm no expert in U.X., but since Web Browsers have built-in spell checking (and it's pretty decent), I'm wondering if we use that (even though CKEditor disables it by default)

In any case, for those two plugins, I agree that a good option would be to do what @wincent suggested which is "freezing" them inside the repo.

Concerning the skins, I'll to investigate a bit more, but I'm open to suggestions (cc @carloslancha)