diff --git a/lib/manager/buildkite/readme.md b/lib/manager/buildkite/readme.md deleted file mode 100644 index 7103cf41e90035cc1b61ff8098d6104b8bae86c2..0000000000000000000000000000000000000000 --- a/lib/manager/buildkite/readme.md +++ /dev/null @@ -1,187 +0,0 @@ -## Overview - -#### Name of package manager - -[Buildkite](https://buildkite.com/docs/pipelines/plugins) - ---- - -#### Implementation status - -Implemented - ---- - -#### What language does this support? - -N/A - ---- - -#### Does that language have other (competing?) package managers? - -N/A - -## Package File Detection - -#### What type of package files and names does it use? - -> Filenames can be custom, but the tool automatically looks in: -> -> - buildkite.yml -> - buildkite.yaml -> - buildkite.json -> - .buildkite/pipeline.yml -> - .buildkite/pipeline.yaml -> - .buildkite/pipeline.json - ---- - -#### What [fileMatch](https://docs.renovatebot.com/configuration-options/#filematch) pattern(s) should be used? - -`['buildkite\\.ya?ml', '\\.buildkite/.+\\.ya?ml$']` - ---- - -#### Is it likely that many users would need to extend this pattern for custom file names? - -Only a small percentage of Buildkite users should need to add additional `fileMatch` patterns. - ---- - -#### Is the fileMatch pattern likely to get many "false hits" for files that have nothing to do with package management? - -Unlikely - -## Parsing and Extraction - -#### Can package files have "local" links to each other that need to be resolved? - -No - -#### Is there reason why package files need to be parsed together (in serial) instead of independently? - -No - ---- - -#### What format/syntax is the package file in? e.g. JSON, TOML, custom? - -YAML is recommended. JSON is possible but won't be supported. - ---- - -#### How do you suggest parsing the file? Using an off-the-shelf parser, using regex, or can it be custom-parsed line by line? - -Parsing YAML line-by-line, looking only for the lines that interest us. - ---- - -#### Does the package file structure distinguish between different "types" of dependencies? e.g. production dependencies, dev dependencies, etc? - -No - ---- - -#### List all the sources/syntaxes of dependencies that can be extracted: - -From https://buildkite.com/docs/pipelines/plugins#plugin-sources: - -> If you refer to a plugin just by name, it defaults to `https://github.com/buildkite-plugins/<name>-buildkite-plugin`. For example, a plugin name of `docker` would resolve to `https://github.com/buildkite-plugins/docker-buildkite-plugin`. -> -> To refer to a plugin in your own GitHub organization, prefix the name with the organization. For example, a plugin name of `my-org/docker` would resolve to `https://github.com/my-org/docker-buildkite-plugin`. -> -> The following are not supported and skipped over: - -> You can also use fully qualified Git URLs instead of names, to refer to plugins that aren’t on GitHub, or live in private Git repositories only accessible to your agents. For example: - -``` -https://github.com/my-org/my-plugin.git#v1.0.0 -ssh://git@github.com/my-org/my-plugin.git#v1.0.0 -file:///a-local-path/my-plugin.git#v1.0.0 -Branches, tags and commits are all valid after the #. -``` - ---- - -#### Describe which types of dependencies above are supported and which will be implemented in future: - -The two short forms of GitHub dependencies described above are supported, but fully qualified Git URLs are not. - -## Versioning - -#### What versioning scheme do the package files use? - -Semver - ---- - -#### Does this versioning scheme support range constraints, e.g. `^1.0.0` or `1.x`? - -No - ---- - -#### Is this package manager used for applications, libraries, or both? If both, is there a way to tell which is which? - -Everything can be thought of as an application. - ---- - -#### If ranges are supported, are there any cases when Renovate should pin ranges to exact versions if rangeStrategy=auto? - -N/A because syntax doesn't support ranges. - -## Lookup - -#### Is a new datasource required? Provide details - -No, it can use existing GitHub datasource (tags). - ---- - -#### Will users need the capability to specify a custom host/registry to look up? Can it be found within the package files, or within other files inside the repository, or would it require Renovate configuration? - -No. - ---- - -#### Do the package files contain any "constraints" on the parent language (e.g. supports only v3.x of Python) or platform (Linux, Windows, etc) that should be used in the lookup procedure? - -No - ---- - -#### Will users need the ability to configure language or other constraints using Renovate config? - -No - -## Artifacts - -#### Are lock files or checksum files used? Mandatory? - -Not in use - ---- - -#### If so, what tool and exact commands should be used if updating 1 or more package versions in a dependency file? - -N/A - ---- - -#### If applicable, describe how the tool maintains a cache and if it can be controlled via CLI or env? Do you recommend the cache be kept or disabled/ignored? - -N/A - ---- - -#### If applicable, what command should be used to generate a lock file from scratch if you already have a package file? This will be used for "lock file maintenance". - -N/A - -## Other - -#### Is there anything else to know about this package manager? - -Buildkite is a great service and the company uses Renovate! diff --git a/lib/manager/bundler/readme.md b/lib/manager/bundler/readme.md deleted file mode 100644 index 8b945b10afdd07430b1121a8d4b2ab951f85a38e..0000000000000000000000000000000000000000 --- a/lib/manager/bundler/readme.md +++ /dev/null @@ -1,177 +0,0 @@ -## Overview - -#### Name of package manager - -[Bundler](https://bundler.io/) - ---- - -#### Implementation status - -Alpha - ---- - -#### What language does this support? - -Ruby - ---- - -#### Does that language have other (competing?) package managers? - -No - -## Package File Detection - -#### What type of package files and names does it use? - -Gemfile or gemspec - ---- - -#### What [fileMatch](https://docs.renovatebot.com/configuration-options/#filematch) pattern(s) should be used? - -['(^|/)(Gemfile|.gemspec)$'] - ---- - -#### Is it likely that many users would need to extend this pattern for custom file names? - -Not likely - ---- - -#### Is the fileMatch pattern likely to get many "false hits" for files that have nothing to do with package management? - -No - -## Parsing and Extraction - -#### Can package files have "local" links to each other that need to be resolved? - -No local/file references - only to hosted sources like RubyGems - ---- - -#### Is there reason why package files need to be parsed together (in serial) instead of independently? - -No, if a project has more than one Bundler file then they can be parsed and processed independently. - ---- - -#### What format/syntax is the package file in? e.g. JSON, TOML, custom? - -Ruby syntax - ---- - -#### How do you suggest parsing the file? Using an off-the-shelf parser, using regex, or can it be custom-parsed line by line? - -It would be quite challenging to parse all the allowable Ruby syntax without using Ruby itself, unless you decide to support only a subset of allowable syntax. - ---- - -#### Does the package file structure distinguish between different "types" of dependencies? e.g. production dependencies, dev dependencies, etc? - -Yes, Bundler allows "groups" but these are only for the convenience of users and should not affect the results that Renovate produces. - ---- - -#### List all the sources/syntaxes of dependencies that can be extracted: - -Most are regular gem sources. - -> Git repositories are also valid gem sources, as long as the repo contains one or more valid gems. Specify what to check out with `:tag`, `:branch`, or `:ref`. The default is the `master` branch. - -Example: - -``` -gem 'nokogiri', :git => 'https://github.com/tenderlove/nokogiri.git', :branch => '1.4' -``` - -More information: https://bundler.io/v1.5/gemfile.html - ---- - -#### Describe which types of dependencies above are supported and which will be implemented in future: - -Skip git dependencies initially. Then support git tags, and then add a github branch datasource and support git branch-based after. - -## Versioning - -#### What versioning scheme do the package files use? - -Semantic version scheme - ---- - -#### Does this versioning scheme support range constraints, e.g. `^1.0.0` or `1.x`? - -Yes, but different syntax to npm's semver. - ---- - -#### Is this package manager used for applications, libraries, or both? If both, is there a way to tell which is which? - -Used for both. - ---- - -#### If ranges are supported, are there any cases when Renovate should pin ranges to exact versions if rangeStrategy=auto? - -Application pinning to be determined later. - -## Lookup - -#### Is a new datasource required? Provide details - -Yes, a RubyGems datasource is required to be added. - ---- - -#### Will users need the capability to specify a custom host/registry to look up? Can it be found within the package files, or within other files inside the repository, or would it require Renovate configuration? - -Yes, to be specified from within Gemfile (there are multiple ways to define source, e.g. file-wide or per-dependency). - ---- - -#### Do the package files contain any "constraints" on the parent language (e.g. supports only v3.x of Python) or platform (Linux, Windows, etc) that should be used in the lookup procedure? - -Yes, Ruby version. - ---- - -#### Will users need the ability to configure language or other constraints using Renovate config? - -No - -## Artifacts - -#### Are lock files or checksum files used? Mandatory? - -File - Gemfile.lock. Mandatory - Yes - ---- - -#### If so, what tool and exact commands should be used if updating 1 or more package versions in a dependency file? - -bundle update - ---- - -#### If applicable, describe how the tool maintains a cache and if it can be controlled via CLI or env? Do you recommend the cache be kept or disabled/ignored? - -Bundler has own cache wich can be specified via --local or --no-cache flags. To be determined which works best for Renovate. - ---- - -#### If applicable, what command should be used to generate a lock file from scratch if you already have a package file? This will be used for "lock file maintenance". - -If Gemfile.lock missing than bundle check can be used. - -## Other - -#### Is there anything else to know about this package manager? - -No diff --git a/lib/manager/cargo/readme.md b/lib/manager/cargo/readme.md deleted file mode 100644 index 17cb185cf624815682e419a41b642e14a0b8edaf..0000000000000000000000000000000000000000 --- a/lib/manager/cargo/readme.md +++ /dev/null @@ -1,225 +0,0 @@ -## Overview - -#### Name of package manager - -[Cargo](https://doc.rust-lang.org/cargo/index.html) - ---- - -#### Implementation status - -Beta - ---- - -#### What language does this support? - -Rust - ---- - -#### Does that language have other (competing?) package managers? - -No - -## Package File Detection - -#### What type of package files and names does it use? - -It uses exclusively `Cargo.toml` files. - ---- - -#### What [fileMatch](https://docs.renovatebot.com/configuration-options/#filematch) pattern(s) should be used? - -Cargo.toml - ---- - -#### Is it likely that many users would need to extend this pattern for custom file names? - -No. - ---- - -#### Is the fileMatch pattern likely to get many "false hits" for files that have nothing to do with package management? - -No. - -## Parsing and Extraction - -#### Can package files have "local" links to each other that need to be resolved? - -It is possible to have local dependencies, by specifying a file path. - ---- - -#### Is there reason why package files need to be parsed together (in serial) instead of independently? - -No a single Cargo.toml file specifies a single package. - ---- - -#### What format/syntax is the package file in? e.g. JSON, TOML, custom? - -TOML - ---- - -#### How do you suggest parsing the file? Using an off-the-shelf parser, using regex, or can it be custom-parsed line by line? - -Cargo.toml files are custom-parsed line by line. - ---- - -#### Does the package file structure distinguish between different "types" of dependencies? e.g. production dependencies, dev dependencies, etc? - -There are [build-dependencies], [dev-dependencies], and [dependencies] sections. -Build dependencies are only required at compile time by the -build script see [reference](https://doc.rust-lang.org/cargo/reference/build-scripts.html). -Dev dependencies are only required by package's tests and examples -see [reference](https://doc.rust-lang.org/cargo/reference/specifying-dependencies.html#development-dependencies). -All these dependency types are treated similarly. - ---- - -#### List all the sources/syntaxes of dependencies that can be extracted: - -Normal dependencies of the format: - -```toml -[dependencies] -dep1 = "1.2.3" -dep2 = "=2.3.4" -``` - -Inline table dependencies: - -```toml -[dependencies] -dep1 = { version = "1.2.3", path = "./foo/bar/" } -dep2 = { default-features = false, version = "=2.3.4" } -``` - -Standard table dependencies: - -```toml -[dependencies.dep1] -version = "5.2.8" -default-features = false # Comment -features = ["feat1", "feat2"] -``` - ---- - -#### Describe which types of dependencies above are supported and which will be implemented in future: - -All 3 possible syntaxes of dependencies are supported by the existing `extractPackageFile` function. -Different types of dependencies [dev-dependencies], [build-dependencies], and [dependencies] are treated the same. - -## Versioning - -#### What versioning scheme do the package files use? - -Semantic versioning. - ---- - -#### Does this versioning scheme support range constraints, e.g. `^1.0.0` or `1.x`? - -Yes. - ---- - -#### Is this package manager used for applications, libraries, or both? If both, is there a way to tell which is which? - -Both. Libraries have a `lib.rs` file in `src` directory and no `main.rs`, binaries must have a `main.rs` file in `src`. - ---- - -#### If ranges are supported, are there any cases when Renovate should pin ranges to exact versions if rangeStrategy=auto? - -It isn't clear yet. -NOTE: A `cargo` version like 1.3.4 is equivalent to npm version of ^1.3.4, so pinning to an exact version would require -setting version to =1.3.4 - -## Lookup - -#### Is a new datasource required? Provide details - -New crate versions can be fetched from [crates.io](https://crates.io). - ---- - -#### Will users need the capability to specify a custom host/registry to look up? Can it be found within the package files, or within other files inside the repository, or would it require Renovate configuration? - -Cargo supports dependencies hosted as git repositories at custom URL, the url is specified like: - -```toml -[dependencies] -rand = { git = "https://github.com/rust-lang-nursery/rand" } -``` - -see [reference](https://doc.rust-lang.org/cargo/reference/specifying-dependencies.html#specifying-dependencies-from-git-repositories) - ---- - -#### Do the package files contain any "constraints" on the parent language (e.g. supports only v3.x of Python) or platform (Linux, Windows, etc) that should be used in the lookup procedure? - -It is possible to have platform specific dependencies, but it doesn't affect the lookup procedure. - -see [reference](https://doc.rust-lang.org/cargo/reference/specifying-dependencies.html#platform-specific-dependencies) - ---- - -#### Will users need the ability to configure language or other constraints using Renovate config? - -Cargo only deals with Rust projects. - -## Artifacts - -#### Are lock files or checksum files used? Mandatory? - -Yes, lock files are used, and checksums are recorded in lock files. -When a crate is built a `Cargo.lock` file is always generated. - -see [reference](https://doc.rust-lang.org/cargo/guide/cargo-toml-vs-cargo-lock.html) - ---- - -#### If so, what tool and exact commands should be used if updating 1 or more package versions in a dependency file? - -Update dep1: - -```sh -cargo update -p dep1 -``` - -Update all dependencies: - -```sh -cargo update -``` - ---- - -#### If applicable, describe how the tool maintains a cache and if it can be controlled via CLI or env? Do you recommend the cache be kept or disabled/ignored? - -Cargo shares build artifacts among all the packages of a single workspace. -Today, Cargo does not share build results across different workspaces, -but a similar result can be achieved by using a third party tool, [sccache](https://github.com/mozilla/sccache). -see [reference](https://doc.rust-lang.org/cargo/guide/build-cache.html) - ---- - -#### If applicable, what command should be used to generate a lock file from scratch if you already have a package file? This will be used for "lock file maintenance". - -```sh -cargo update -``` - -## Other - -#### Is there anything else to know about this package manager? - -`cargo update` or a `cargo update -p dep1` command updates Cargo.lock file in current crate inplace. diff --git a/lib/manager/composer/readme.md b/lib/manager/composer/readme.md deleted file mode 100644 index 14a82a24c07d530ed918093447199dff39e9cf1b..0000000000000000000000000000000000000000 --- a/lib/manager/composer/readme.md +++ /dev/null @@ -1,202 +0,0 @@ -## Overview - -#### Name of package manager - -[Composer](https://getcomposer.org/) - ---- - -#### Implementation status - -Implemented - ---- - -#### What language does this support? - -PHP - ---- - -#### Does that language have other (competing?) package managers? - -No, everyone uses Composer - -## Package File Detection - -#### What type of package files and names does it use? - -`composer.json` is used in most cases, but [Composer allows alternative `.json` file names](https://getcomposer.org/doc/03-cli.md#composer). - ---- - -#### What [fileMatch](https://docs.renovatebot.com/configuration-options/#filematch) pattern(s) should be used? - -`['(^|/)([\\w-]*)composer.json$']` - ---- - -#### Is it likely that many users would need to extend this pattern for custom file names? - -Unlikely - nearly everybody would include the string "composer" in the JSON file name. - ---- - -#### Is the fileMatch pattern likely to get many "false hits" for files that have nothing to do with package management? - -There are unlikely to be too many JSON files with "composer" in the name that aren't Composer package files. - -## Parsing and Extraction - -#### Can package files have "local" links to each other that need to be resolved? - -If a repository has more than one Composer package file then they can be parsed independently. However, one composer file may point to another using a relative path, so they should all be written to disk first before any are extracted. - -#### Is there reason why package files need to be parsed together (in serial) instead of independently? - -Only if they are not written to disk first before parsing. - ---- - -#### What format/syntax is the package file in? e.g. JSON, TOML, custom? - -JSON - ---- - -#### How do you suggest parsing the file? Using an off-the-shelf parser, using regex, or can it be custom-parsed line by line? - -Parse the file using `JSON.parse`. - ---- - -#### Does the package file structure distinguish between different "types" of dependencies? e.g. production dependencies, dev dependencies, etc? - -Composer files split dependencies into `requires` and `requires-dev`. Both are optional. - ---- - -#### List all the sources/syntaxes of dependencies that can be extracted: - -In Composer the syntax for dependencies is always `"scope/package"` regardless of its source. The lookup approach is then determined by the values in `repositories`, if present. - ---- - -#### Describe which types of dependencies above are supported and which will be implemented in future: - -- Packagist.org dependencies: Supported -- "composer" hosts with plain `packages.json`: Supported -- "composer" hosts with [`provider-includes` and `providers-url`](https://getcomposer.org/doc/05-repositories.md#provider-includes-and-providers-url): Supported -- Satis hosts: Supported -- Repositories of type "path": Not supported yet -- Repositories of type "package": Not supported yet -- Repositories of type "vcs": Not supported yet -- Dependencies with value `"*"`: Skipped - -## Versioning - -#### What versioning scheme do the package files use? - -Composer files use semver 2.0. ([details](https://getcomposer.org/doc/articles/versions.md)) - -[online checker](https://semver.mwl.be) - ---- - -#### Does this versioning scheme support range constraints, e.g. `^1.0.0` or `1.x`? - -Yes, it has support for many range types, documented in the link above. - ---- - -#### Is this package manager used for applications, libraries, or both? If both, is there a way to tell which is which? - -Both. The `type` field is often included at the root of a composer file and can be used to infer which type, although it's not possible to always be 100% sure. - -The following types should be considered as library: 'library', 'metapackage', 'composer-plugin'. - ---- - -#### If ranges are supported, are there any cases when Renovate should pin ranges to exact versions if rangeStrategy=auto? - -TODO - -## Lookup - -#### Is a new datasource required? Provide details - -Yes, for Packagist and composer-compatible lookups. - -Details: https://getcomposer.org/doc/05-repositories.md#hosting-your-own - ---- - -#### Will users need the capability to specify a custom host/registry to look up? Can it be found within the package files, or within other files inside the repository, or would it require Renovate configuration? - -Yes. There is an optional [`repositories`](https://getcomposer.org/doc/05-repositories.md#repository) field allowed at the root of any composer file. There should usually be no need to override this by config. - ---- - -#### Do the package files contain any "constraints" on the parent language (e.g. supports only v3.x of Python) or platform (Linux, Windows, etc) that should be used in the lookup procedure? - -`require` and `require-dev` support references to specific PHP versions and PHP extensions a project needs to run successfully. - -Example: - -``` -{ - "require" : { - "php" : "^5.5 || ^7.0", - "ext-mbstring": "*" - } -} -``` - -[(ref)](https://getcomposer.org/doc/04-schema.md#package-links) - -This `php` constraint needs to be compared against the `php` field (if present) in the package's metadata on Packagist/etc. - ---- - -#### Will users need the ability to configure language or other constraints using Renovate config? - -It should be a rare case. - -## Artifacts - -#### Are lock files or checksum files used? Mandatory? - -Yes, they will be named the same as the package file, e.g. `composer.lock`. - -The are optional but heavily used. - ---- - -#### If so, what tool and exact commands should be used if updating 1 or more package versions in a dependency file? - -The CLI tool `composer` needs to be used. - -To update a specific dependency, you can: - -1. Update the dependency version(s) in `composer.json` -2. Run `composer update dep1 dep2` where `dep1` and `dep2` are the two dependencies having been updated in `composer.json` - -This will unfortunately result in all dependencies being downloaded, but at least only the specified dependencies will be updated in the lock file. - ---- - -#### If applicable, describe how the tool maintains a cache and if it can be controlled via CLI or env? Do you recommend the cache be kept or disabled/ignored? - -As described above, `composer update` will download all packages in the package file. The env variable `COMPOSER_CACHE_DIR` can be used to control where the cache is kept. It is recommended to keep the cache between Renovate runs. - ---- - -#### If applicable, what command should be used to generate a lock file from scratch if you already have a package file? This will be used for "lock file maintenance". - -`composer install` - -## Other - -#### Is there anything else to know about this package manager? - -No diff --git a/lib/manager/manager-docs.spec.ts b/lib/manager/manager-docs.spec.ts deleted file mode 100644 index 5adc4a66319de333a5cd82de71454daa7e469e94..0000000000000000000000000000000000000000 --- a/lib/manager/manager-docs.spec.ts +++ /dev/null @@ -1,28 +0,0 @@ -import { readdir, readFile } from 'fs-extra'; - -describe('manager readmes', () => { - it('has same questions for all managers', async () => { - const managers = (await readdir('lib/manager')).filter( - item => !item.includes('.') - ); - let expectedHeaders: string[]; - for (const manager of managers) { - let readme: string; - try { - readme = await readFile( - 'lib/manager/' + manager + '/readme.md', - 'utf8' - ); - } catch (err) { - // ignore missing file - } - if (readme) { - const headers = readme - .match(/\n#### (.*?)\n/g) - .map(match => match.substring(6, match.length - 1)); - expectedHeaders = expectedHeaders || headers; - expect(headers).toEqual(expectedHeaders); - } - } - }); -}); diff --git a/lib/manager/maven/readme.md b/lib/manager/maven/readme.md deleted file mode 100644 index adaeee5421aad02bcc9c72fea1bdd1ce303ca641..0000000000000000000000000000000000000000 --- a/lib/manager/maven/readme.md +++ /dev/null @@ -1,171 +0,0 @@ -## Overview - -#### Name of package manager - -Maven - ---- - -#### Implementation status - -Beta - ---- - -#### What language does this support? - -Java - ---- - -#### Does that language have other (competing?) package managers? - -Gradle - -## Package File Detection - -#### What type of package files and names does it use? - -"pomfile" usually named pom.xml. It is possible to override default pom.xml with any filename - -`mvn -f <path>/custom_pom.xml <command>` - ---- - -#### What [fileMatch](https://docs.renovatebot.com/configuration-options/#filematch) pattern(s) should be used? - -`['(^|/)([\\w-]*)pom.xml$']` - ---- - -#### Is it likely that many users would need to extend this pattern for custom file names? - -Not many but some user might use custom filenames. - ---- - -#### Is the fileMatch pattern likely to get many "false hits" for files that have nothing to do with package management? - -Usually "pomfile" is in the root of the project and it is not likely that it will be many other xml files in the same directory. But we can search for all pomfiles in a repository and process them all independently. - -## Parsing and Extraction - -#### Can package files have "local" links to each other that need to be resolved? - -No. All references are to Maven Central or some other source host. - ---- - -#### Is there reason why package files need to be parsed together (in serial) instead of independently? - -No - ---- - -#### What format/syntax is the package file in? e.g. JSON, TOML, custom? - -XML - ---- - -#### How do you suggest parsing the file? Using an off-the-shelf parser, using regex, or can it be custom-parsed line by line? - -Any XML reader. - ---- - -#### Does the package file structure distinguish between different "types" of dependencies? e.g. production dependencies, dev dependencies, etc? - -No - ---- - -#### List all the sources/syntaxes of dependencies that can be extracted: - -All dependencies are similar to this example: - -```xml -<dependency> - <groupId>org.springframework.integration</groupId> - <artifactId>spring-integration-aws</artifactId> - <version>1.2.3</version> -</dependency> -``` - -A range can be used instead of the exact version too. - ---- - -#### Describe which types of dependencies above are supported and which will be implemented in future: - -All to be supported. - -## Versioning - -#### What versioning scheme do the package files use? - -Custom (Maven): https://maven.apache.org/pom.html#Dependency_Version_Requirement_Specification - ---- - -#### Does this versioning scheme support range constraints, e.g. `^1.0.0` or `1.x`? - -Yes, it has its own syntax for supporting [version ranges](https://maven.apache.org/enforcer/enforcer-rules/versionRanges.html). - ---- - -#### Is this package manager used for applications, libraries, or both? If both, is there a way to tell which is which? - -It is used for both applications and libraries. - ---- - -#### If ranges are supported, are there any cases when Renovate should pin ranges to exact versions if rangeStrategy=auto? - -Recommended not to pin anything automatically initially. - -## Lookup - -#### Is a new datasource required? Provide details - -A Maven datasource is necessary, probably to be shared with the Gradle package manager. - ---- - -#### Will users need the capability to specify a custom host/registry to look up? Can it be found within the package files, or within other files inside the repository, or would it require Renovate configuration? - -Custom sources are possible with [settings.xml](https://maven.apache.org/settings.html) but this file is not normally stored within a repository. Users will need to configure custom sources in the Renovate config instead. - ---- - -#### Do the package files contain any "constraints" on the parent language (e.g. supports only v3.x of Python) or platform (Linux, Windows, etc) that should be used in the lookup procedure? - -Yes. It is possible to specify the version of target JVM. [example](https://maven.apache.org/plugins/maven-compiler-plugin/examples/set-compiler-source-and-target.html). This should influence which results (versions) that Renovate looks up. - ---- - -#### Will users need the ability to configure language or other constraints using Renovate config? - -It is recommended to make the JVM version configurable in Renovate config too. - -## Artifacts - -#### Are lock files or checksum files used? Mandatory? - -No - ---- - -#### If so, what tool and exact commands should be used if updating 1 or more package versions in a dependency file? - ---- - -#### If applicable, describe how the tool maintains a cache and if it can be controlled via CLI or env? Do you recommend the cache be kept or disabled/ignored? - ---- - -#### If applicable, what command should be used to generate a lock file from scratch if you already have a package file? This will be used for "lock file maintenance". - -## Other - -#### Is there anything else to know about this package manager? diff --git a/lib/manager/mix/readme.md b/lib/manager/mix/readme.md deleted file mode 100644 index 984268216814b8cc6c35787272ee1df66be9e275..0000000000000000000000000000000000000000 --- a/lib/manager/mix/readme.md +++ /dev/null @@ -1,140 +0,0 @@ -## Overview - -#### Name of package manager - -Mix - -#### Implementation status - -Implemented - -#### What language does this support? - -Elixir - -#### Does that language have other (competing?) package managers? - -Mix is main Elixir build tool - -## Package File Detection - -#### What type of package files and names does it use? - -mix.exs - -#### What [fileMatch](https://docs.renovatebot.com/configuration-options/#filematch) pattern(s) should be used? - -File names are static - -#### Is it likely that many users would need to extend this pattern for custom file names? - -No, file names are static - -#### Is the fileMatch pattern likely to get many "false hits" for files that have nothing to do with package management? - -No - -## Parsing and Extraction - -#### Can package files have "local" links to each other that need to be resolved? - -No - -#### Is there reason why package files need to be parsed together (in serial) instead of independently? - -No - -#### What format/syntax is the package file in? e.g. JSON, TOML, custom? - -Custom - -#### How do you suggest parsing the file? Using an off-the-shelf parser, using regex, or can it be custom-parsed line by line? - -RegExp - -#### Does the package file structure distinguish between different "types" of dependencies? e.g. production dependencies, dev dependencies, etc? - -No - -#### List all the sources/syntaxes of dependencies that can be extracted: - - ``` - defp deps() do - [ - {:ecto, "~> 2.0"}, - {:postgrex, "~> 0.8.1"}, - {:cowboy, github: "ninenines/cowboy"}, - ] - ``` - -#### Describe which types of dependencies above are supported and which will be implemented in future: - -All that are mentioned - -## Versioning - -#### What versioning scheme do the package files use? - -SemVer 2.0 schema - -#### Does this versioning scheme support range constraints, e.g. `^1.0.0` or `1.x`? - -Yes, ([doc link](https://hexdocs.pm/elixir/Version.html)) - -#### Is this package manager used for applications, libraries, or both? If both, is there a way to tell which is which? - -There are only modules that can be used as apps and libs - -#### If ranges are supported, are there any cases when Renovate should pin ranges to exact versions if rangeStrategy=auto? - -Supported following ranges of hex datasource: - -- ~> 1.0.0/ ~>1.0 -- and/or ranges - -## Lookup - -#### Is a new datasource required? Provide details - -Implemented ([here]https://github.com/renovatebot/renovate/issues/3043()) - -#### Will users need the capability to specify a custom host/registry to look up? Can it be found within the package files, or within other files inside the repository, or would it require Renovate configuration? - -Mix supports dependencies hosted as git repositories: - -``` - {:cowboy, github: "ninenines/cowboy"}, -``` - -#### Do the package files contain any "constraints" on the parent language (e.g. supports only v3.x of Python) or platform (Linux, Windows, etc) that should be used in the lookup procedure? - -No - -#### Will users need the ability to configure language or other constraints using Renovate config? - -No - -## Artifacts - -#### Are lock files or checksum files used? Mandatory? - -Lock files are mix.lock and they are mandatory - -#### If so, what tool and exact commands should be used if updating 1 or more package versions in a dependency file? - -([mix deps.update](https://hexdocs.pm/mix/master/Mix.Tasks.Deps.Update.html)) - -#### If applicable, describe how the tool maintains a cache and if it can be controlled via CLI or env? Do you recommend the cache be kept or disabled/ignored? - -Mix doesn't cache deps only put compiled files via mix deps.compile. Build files can be deleted via mix deps.clean --build - -#### If applicable, what command should be used to generate a lock file from scratch if you already have a package file? This will be used for "lock file maintenance". - -mix deps.get - gets dependencies and creates/updates .lock file -mix deps.uplock (--all) - deletes dependency in .lock file - -## Other - -Pm files can contain comments that can make a line with dep ignored - -#### Is there anything else to know about this package manager? diff --git a/lib/manager/poetry/readme.md b/lib/manager/poetry/readme.md deleted file mode 100644 index 22048a3ec223dbbd93acf27b8ea6912653b2d06f..0000000000000000000000000000000000000000 --- a/lib/manager/poetry/readme.md +++ /dev/null @@ -1,208 +0,0 @@ -## Overview - -#### Name of package manager - -[Poetry](https://poetry.eustace.io/) - ---- - -#### Implementation status - -Unimplemented - ---- - -#### What language does this support? - -Python - ---- - -#### Does that language have other (competing?) package managers? - -pip - -## Package File Detection - -#### What type of package files and names does it use? - -_pyproject.toml_ - ---- - -#### What [fileMatch](https://docs.renovatebot.com/configuration-options/#filematch) pattern(s) should be used? - -`(^|/)pyproject\\.toml$` - ---- - -#### Is it likely that many users would need to extend this pattern for custom file names? - -No - ---- - -#### Is the fileMatch pattern likely to get many "false hits" for files that have nothing to do with package management? - -There may be cases where a project has a `pyproject.toml` but no Poetry entries. - -## Parsing and Extraction - -#### Can package files have "local" links to each other that need to be resolved? - -Yes - -#### Is there reason why package files need to be parsed together (in serial) instead of independently? - -No - ---- - -#### What format/syntax is the package file in? e.g. JSON, TOML, custom? - -TOML - ---- - -#### How do you suggest parsing the file? Using an off-the-shelf parser, using regex, or can it be custom-parsed line by line? - -Use TOML parser like done for pipenv - ---- - -#### Does the package file structure distinguish between different "types" of dependencies? e.g. production dependencies, dev dependencies, etc? - -Yes, `dependencies`, `dev-dependencies`, and `optional dependencies` - -```toml -[tool.poetry.dependencies] -python = "~2.7 || ^3.2" # Compatible python versions must be declared here -toml = "^0.9" -# Dependencies with extras -requests = { version = "^2.13", extras = [ "security" ] } -# Python specific dependencies with prereleases allowed -pathlib2 = { version = "^2.2", python = "~2.7", allows-prereleases = true } -# Git dependencies -cleo = { git = "https://github.com/sdispater/cleo.git", branch = "master" } - -# Optional dependencies (extras) -pendulum = { version = "^1.4", optional = true } - -[tool.poetry.dev-dependencies] -pytest = "^3.0" -``` - ---- - -#### List all the sources/syntaxes of dependencies that can be extracted: - -- **classic** `numpy="1.16.1"` or `numpy={ version="1.16.1" }` -- **git** `cleo = { git = "https://github.com/sdispater/cleo.git", branch = "master" }` -- **path**, target can be directory or file _.py_ `docs = { path = "./packages/docs" }` -- **file**, target can be archive or wheel `docs = { file = "./my_wheel.whl" }` - ---- - -#### Describe which types of dependencies above are supported and which will be implemented in future: - -Support classic references only in initial development. - -## Versioning - -#### What versioning scheme do the package files use? - -<https://www.python.org/dev/peps/pep-0440> - ---- - -#### Does this versioning scheme support range constraints, e.g. `^1.0.0` or `1.x`? - -Yes - ---- - -#### Is this package manager used for applications, libraries, or both? If both, is there a way to tell which is which? - -Both, TODO - ---- - -#### If ranges are supported, are there any cases when Renovate should pin ranges to exact versions if rangeStrategy=auto? - -Dev dependencies can always be pinned. - -## Lookup - -#### Is a new datasource required? Provide details - -No, it can reuse the pypi data source. - ---- - -#### Will users need the capability to specify a custom host/registry to look up? Can it be found within the package files, or within other files inside the repository, or would it require Renovate configuration? - -Yes - -A registry can be specified in _pyproject.toml_ with: - -```toml -[[tool.poetry.source]] -name = 'private' -url = 'http://example.com/simple' -``` - ---- - -#### Do the package files contain any "constraints" on the parent language (e.g. supports only v3.x of Python) or platform (Linux, Windows, etc) that should be used in the lookup procedure? - -Yes, language version can be defined using - -```toml -[tool.poetry.dependencies] -python = "^3.6" -``` - -platform TODO - ---- - -#### Will users need the ability to configure language or other constraints using Renovate config? - -No - -## Artifacts - -#### Are lock files or checksum files used? Mandatory? - -Yes and yes, in _poetry.lock_ - ---- - -#### If so, what tool and exact commands should be used if updating 1 or more package versions in a dependency file? - -Update all dependencies - -`poetry update` - -Update 1 dependency - -`poetry update {dependency name}` - ---- - -#### If applicable, describe how the tool maintains a cache and if it can be controlled via CLI or env? Do you recommend the cache be kept or disabled/ignored? - -- poetry virtual env: https://poetry.eustace.io/docs/configuration/#settingsvirtualenvspath-string -- pip, used in background by poetry. Can be done with env variable `PIP_CACHE_DIR` - ---- - -#### If applicable, what command should be used to generate a lock file from scratch if you already have a package file? This will be used for "lock file maintenance". - -`poetry lock` - -## Other - -#### Is there anything else to know about this package manager? - -As more python package managers implement _pyproject.toml_ it may become necassary to parse the file to determine which build tools/managers are active. diff --git a/lib/manager/pub/readme.md b/lib/manager/pub/readme.md deleted file mode 100644 index 93ad0122311e5e419163c4d1e7074c919283d39d..0000000000000000000000000000000000000000 --- a/lib/manager/pub/readme.md +++ /dev/null @@ -1,292 +0,0 @@ -## Overview - -#### Name of package manager - -[pub](https://pub.dartlang.org/) - ---- - -#### Implementation status - -Beta - ---- - -#### What language does this support? - -Dart / Flutter SDK - ---- - -#### Does that language have other (competing?) package managers? - -No. - -## Package File Detection - -#### What type of package files and names does it use? - -_pubspec.yaml_ - ---- - -#### What [fileMatch](https://docs.renovatebot.com/configuration-options/#filematch) pattern(s) should be used? - -`(^|\/)pubspec\.yaml$` - ---- - -#### Is it likely that many users would need to extend this pattern for custom file names? - -No - ---- - -#### Is the fileMatch pattern likely to get many "false hits" for files that have nothing to do with package management? - -No - -## Parsing and Extraction - -#### Can package files have "local" links to each other that need to be resolved? - -Yes - -#### Is there reason why package files need to be parsed together (in serial) instead of independently? - -No - ---- - -#### What format/syntax is the package file in? e.g. JSON, TOML, custom? - -YAML - ---- - -#### How do you suggest parsing the file? Using an off-the-shelf parser, using regex, or can it be custom-parsed line by line? - -Use YAML parser like [JS-YAML](https://github.com/nodeca/js-yaml) - ---- - -#### Does the package file structure distinguish between different "types" of dependencies? e.g. production dependencies, dev dependencies, etc? - -Yes, `dependencies` and `dev-dependencies`. - -More details in: <https://www.dartlang.org/tools/pub/dependencies> - -Example from <https://github.com/brianegan/flutter_architecture_samples/blob/master/example/firestore_redux/pubspec.yaml>: - -```yaml -environment: - sdk: '>=2.0.0 <3.0.0' - -dependencies: - meta: '>=1.1.0 <2.0.0' - redux: ^3.0.0 - flutter_redux: ^0.5.0 - flutter: - sdk: flutter - flutter_architecture_samples: - path: ../../ - firebase_flutter_repository: - path: ../firebase_flutter_repository - -dev_dependencies: - test: ^1.3.0 - mockito: ^3.0.0 - flutter_driver: - sdk: flutter - flutter_test: - sdk: flutter - integration_tests: - path: ../integration_tests - todos_repository_flutter: - path: ../todos_repository_flutter -``` - ---- - -#### List all the sources/syntaxes of dependencies that can be extracted: - -- [**SDK**](https://www.dartlang.org/tools/pub/dependencies#sdk) - - ```yaml - dependencies: - flutter_driver: - sdk: flutter - version: ^0.0.1 - ``` - -- [**Version constraints**](https://www.dartlang.org/tools/pub/dependencies#version-constraints) - - ```yaml - dependencies: - meta: '>=1.1.0 <2.0.0' - flutter_redux: 0.5.0 - ``` - -- [**Caret syntax**](https://www.dartlang.org/tools/pub/dependencies#caret-syntax) - - ```yaml - dependencies: - redux: ^3.0.0 - ``` - -- [**Git packages**](https://www.dartlang.org/tools/pub/dependencies#git-packages) - - ```yaml - dependencies: - kittens: - git: git://github.com/munificent/kittens.git - ``` - - ```yaml - dependencies: - kittens: - git: git@github.com:munificent/kittens.git - ``` - - ```yaml - dependencies: - kittens: - git: - url: git://github.com/munificent/kittens.git - ref: some-branch - ``` - - ```yaml - dependencies: - kittens: - git: - url: git://github.com/munificent/cats.git - path: path/to/kittens - ``` - -- [**Path packages**](https://www.dartlang.org/tools/pub/dependencies#path-packages) - - ```yaml - dependencies: - transmogrify: - path: /Users/me/transmogrify - ``` - -- [**Hosted packages**](https://www.dartlang.org/tools/pub/dependencies#hosted-packages) - ```yaml - dependencies: - transmogrify: - hosted: - name: transmogrify - url: http://your-package-server.com - version: ^1.4.0 - ``` - ---- - -#### Describe which types of dependencies above are supported and which will be implemented in future: - -All - -## Versioning - -#### What versioning scheme do the package files use? - -<https://www.dartlang.org/tools/pub/dependencies> - ---- - -#### Does this versioning scheme support range constraints, e.g. `^1.0.0` or `1.x`? - -Yes - ---- - -#### Is this package manager used for applications, libraries, or both? If both, is there a way to tell which is which? - -Both. No. - ---- - -#### If ranges are supported, are there any cases when Renovate should pin ranges to exact versions if rangeStrategy=auto? - -Dev dependencies can always be pinned. - -## Lookup - -#### Is a new datasource required? Provide details - -We'll need to support the pub API as a new datasource. Example URL: `pub.dartlang.org/api/packages/url_launcher` - ---- - -#### Will users need the capability to specify a custom host/registry to look up? Can it be found within the package files, or within other files inside the repository, or would it require Renovate configuration? - -Yes - -A registry can be specified in _pubspec.yaml_ with: - -```yaml -dependencies: - transmogrify: - hosted: - name: transmogrify - url: http://your-package-server.com - version: ^1.4.0 -``` - ---- - -#### Do the package files contain any "constraints" on the parent language (e.g. supports only v3.x of Python) or platform (Linux, Windows, etc) that should be used in the lookup procedure? - -Yes, SDK version can be defined using: - -```yaml -environment: - sdk: '>=2.0.0 <3.0.0' -``` - ---- - -#### Will users need the ability to configure language or other constraints using Renovate config? - -No - -## Artifacts - -#### Are lock files or checksum files used? Mandatory? - -Yes and yes, in _pubspec.lock_. - ---- - -#### If so, what tool and exact commands should be used if updating 1 or more package versions in a dependency file? - -Update all dependencies: - -`flutter packages upgrade` - -Update 1 dependency is not supported by a command. The package needs to be changed with the version number in _pubspec.yaml_ and then run `flutter packages upgrade`. - ---- - -#### If applicable, describe how the tool maintains a cache and if it can be controlled via CLI or env? Do you recommend the cache be kept or disabled/ignored? - -- `PUB_CACHE` environment variable defines the cache's location: <https://www.dartlang.org/tools/pub/environment-variables> - ---- - -#### If applicable, what command should be used to generate a lock file from scratch if you already have a package file? This will be used for "lock file maintenance". - -`flutter packages get` - -## Other - -#### Is there anything else to know about this package manager? - -The information here refers to the Flutter SDK package manager, which is built on top of Dart's `pub` package manager but differs in some ways. - -More info: - -- https://www.dartlang.org/tools/pub -- https://flutter.dev/docs/development/packages-and-plugins/using-packages diff --git a/lib/manager/sbt/readme.md b/lib/manager/sbt/readme.md deleted file mode 100644 index 8aded890ad640ae7fb890c0090b6db36d3087edd..0000000000000000000000000000000000000000 --- a/lib/manager/sbt/readme.md +++ /dev/null @@ -1,268 +0,0 @@ -## Overview - -#### Name of package manager - -sbt - ---- - -#### Implementation status - -Unimplemented - -#### What language does this support? - -Scala - ---- - -#### Does that language have other (competing?) package managers? - -Maven - -## Package File Detection - -#### What type of package files and names does it use? - -As far as I know, there is 2 package files: - -- One for main dependencies and some configurations (https://www.scala-sbt.org/1.0/docs/Basic-Def.html) -- One for plugin dependencies and plugin configurations (https://www.scala-sbt.org/1.0/docs/Plugins.html) - ---- - -#### What [fileMatch](https://docs.renovatebot.com/configuration-options/#filematch) pattern(s) should be used? - -`['build\\.sbt', 'plugins\\.sbt']` - -Note that `plugins.sbt` file is usually in a `project/` subdirectory. - ---- - -#### Is it likely that many users would need to extend this pattern for custom file names? - -Not likely. - ---- - -#### Is the fileMatch pattern likely to get many "false hits" for files that have nothing to do with package management? - -Not likely. The extension `.sbt` should not be used for other files. - -## Parsing and Extraction - -#### Can package files have "local" links to each other that need to be resolved? - -No - -#### Is there reason why package files need to be parsed together (in serial) instead of independently? - -No - ---- - -#### What format/syntax is the package file in? e.g. JSON, TOML, custom? - -Scala syntax - ---- - -#### How do you suggest parsing the file? Using an off-the-shelf parser, using regex, or can it be custom-parsed line by line? - -I think reading the files with Scala would be the easier. Due to the fact that the files are plain Scala code, the -dependencies can be declared in multiple ways. - -But, I guess there is two most commonly used way to declare dependencies and using regex could work for these formats. - -Another option might be to use ScalaJS. I don't know it but it has same syntax as Scala and can be read/used within Javascript code. - -If we can use Scala or ScalaJS, the idea would be to execute the `build.sbt` or `plugins.sbt` file and work on the `libraryDependencies` or `dependencyOverrides` variables. - -_Update (thanks to @ChristianMurphy)_: https://github.com/scalameta/scalameta running on https://www.scala-js.org could be a way to parse Scala without depending on a JDK. -E.G. https://astexplorer.net/#/gist/027dce11e6927b4ad39ea097ce6289b9/ea4d1048f32063a71d727d01178ae6d01087a62f - ---- - -#### Does the package file structure distinguish between different "types" of dependencies? e.g. production dependencies, dev dependencies, etc? - -Dependencies can have a "scope" like `Test` or `Provided`. - -Renovate shouldn't care of scopes: they should be kept as is but they don't have any impact on the "new dependency resolution". - ---- - -#### List all the sources/syntaxes of dependencies that can be extracted: - -##### build.sbt - -Most common syntaxes: - -```scala -// For Scala dependency with Scala version inferred (notice the double %%) -libraryDependencies += "com.typesafe.play" %% "play-ws" % "2.6.10" -// For Scala dependency without Scala version (2.12) inferred (single %) -libraryDependencies += "com.typesafe.play" % "play-ws_2.12" % "2.6.10" -// For Java dependency -libraryDependencies += "org.mockito" % "mockito-all" % "1.10.18" - -// With a scope -libraryDependencies += "org.mockito" % "mockito-all" % "1.10.18" % Test - -// Multiple dependencies at the same time -libraryDependencies ++= Seq( - "com.typesafe.play" %% "play-ws" % "2.6.10", - "org.mockito" % "mockito-all" % "1.10.18" -) - -// Latest versions -libraryDependencies += "org.mockito" % "mockito-all" % "latest.integration" -libraryDependencies += "org.mockito" % "mockito-all" % "latest.milestone" -libraryDependencies += "org.mockito" % "mockito-all" % "latest.release" -libraryDependencies += "org.mockito" % "mockito-all" % "1.10.+" // Latest 1.10.x -// Range versions (mathemetical notation) -libraryDependencies += "org.mockito" % "mockito-all" % "[1.0,2.0]" -libraryDependencies += "org.mockito" % "mockito-all" % "[1.0,2.0[" -libraryDependencies += "org.mockito" % "mockito-all" % "]1.0,2.0]" -libraryDependencies += "org.mockito" % "mockito-all" % "]1.0,2.0[" -libraryDependencies += "org.mockito" % "mockito-all" % "[1.0,)" -libraryDependencies += "org.mockito" % "mockito-all" % "]1.0,)" -libraryDependencies += "org.mockito" % "mockito-all" % "(,2.0]" -libraryDependencies += "org.mockito" % "mockito-all" % "(,2.0[" - -// Defining some dependency overriding -dependencyOverrides += "com.google.guava" % "guava" % "23.0" -// Multiple at once -dependencyOverrides ++= Seq( - "org.scala-lang.modules" %% "scala-parser-combinators" % "1.1.0", - "com.google.guava" % "guava" % "23.0" -) -``` - -There is two variables to look for `libraryDependencies` and `dependencyOverrides` (https://www.scala-sbt.org/1.x/docs/Library-Management.html#Overriding+a+version). - -`dependencyOverrides` behaves like "Dependency Management" in Maven: if two dependencies declared in `libraryDependencies` depends on the same library (let's say 'C') but with different version, `dependencyOverrides` is a way to force a specific version of 'C' instead of letting sbt choose (it would choose the highest). - -More custom syntaxes with plain Scala code: - -```scala -val myDependencyVersion = "2.6.10" -val myDependencyGroupId = "com.typesafe.play" -val myDependencyArtifactId = "play-json" -val myDependency: ModuleID = myDependencyGroupId %% myDependencyArtifactId % myDependencyVersion - -libraryDependencies += myDependency -``` - -You could imagine some `if` statements as well as any other Scala syntax but I think it's pretty rare. - -##### plugins.sbt - -Most common syntaxes: - -```scala -// Declaring a plugin -addSbtPlugin("com.eed3si9n" % "sbt-buildinfo" % "0.9.0") - -// Defining some dependency overriding (same as for build.sbt) -dependencyOverrides += "org.webjars" % "webjars-locator-core" % "0.33" -// Multiple at once -dependencyOverrides ++= Seq( - "org.webjars" % "webjars-locator-core" % "0.33", - "org.codehaus.plexus" % "plexus-utils" % "3.0.17", - "com.google.guava" % "guava" % "23.0" -) -``` - ---- - -#### Describe which types of dependencies above are supported and which will be implemented in future: - -All to be supported. - -## Versioning - -#### What versioning scheme do the package files use? - -Ivy (https://ant.apache.org/ivy/history/2.3.0/ivyfile/dependency.html#revision). - ---- - -#### Does this versioning scheme support range constraints, e.g. `^1.0.0` or `1.x`? - -Yes. With syntax like `[1.0,2.0]`. See https://ant.apache.org/ivy/history/2.3.0/ivyfile/dependency.html#revision. - ---- - -#### Is this package manager used for applications, libraries, or both? If both, is there a way to tell which is which? - -Both. No distinction. - ---- - -#### If ranges are supported, are there any cases when Renovate should pin ranges to exact versions if rangeStrategy=auto? - -Don't know. Someone more experienced with sbt should answer to this. - -## Lookup - -#### Is a new datasource required? Provide details - -It could leverage the maven datasource. - ---- - -#### Will users need the capability to specify a custom host/registry to look up? Can it be found within the package files, or within other files inside the repository, or would it require Renovate configuration? - -Yes. Custom repositories can be defined with `resolvers` (https://www.scala-sbt.org/1.0/docs/Resolvers.html). - -Resolvers can be defined within the package files and/or in other files outside the project. Thus, a Renovate configuration would be better and easier. - ---- - -#### Do the package files contain any "constraints" on the parent language (e.g. supports only v3.x of Python) or platform (Linux, Windows, etc) that should be used in the lookup procedure? - -Yes. It's possible to specify the Scala language version to use. This should be used in the lookup procedure. - -```scala -// In build.sbt -scalaVersion := "2.12.7" -``` - ---- - -#### Will users need the ability to configure language or other constraints using Renovate config? - -Not sure. - -## Artifacts - -#### Are lock files or checksum files used? Mandatory? - -No. - ---- - -#### If so, what tool and exact commands should be used if updating 1 or more package versions in a dependency file? - -N/A. - ---- - -#### If applicable, describe how the tool maintains a cache and if it can be controlled via CLI or env? Do you recommend the cache be kept or disabled/ignored? - -sbt has a local cache in the `~/.ivy` folder. - -Some configuration are possible (https://www.scala-sbt.org/1.0/docs/Cached-Resolution.html) but I think cache can be ignored for RenovateBot purpose. - ---- - -#### If applicable, what command should be used to generate a lock file from scratch if you already have a package file? This will be used for "lock file maintenance". - -N/A. - -## Other - -#### Is there anything else to know about this package manager? - -It isn't supporting Scala version inference well (`%%` operator), just searching for package like `<artifactId>_<scalaVersion>` without any additional resolving. -In case of problems, please use explicit versions with `%` operator.