Consider adding renovate to pin and track dependencies

[Urigo]

Thank you for an amazing work!

Just a very random suggestion but it might be a good idea to add Renovate to automatically pin package.json dependencies to specific versions and PR for new ones once they are released.

I know that inside Google it works way better and you depend directly on master but outside of it it might be useful to know that all tests still pass even with the latest version of typescript for example or the latest version of rxjs the same day they are out

Feel free to brutally close this issue :)

[alexeagle]

Interesting, I do need something to tell me when upstream repos are working.
I also need to change WORKSPACE file to pick up rules_nodejs versions, so I think I'd have to write my own or maybe fork Renovate? but if they host that as a service, I don't want to have to own my own version of that.

[Urigo]

maybe @rarkins can help

[rarkins]

Hi @alexeagle, I'm the author of the Renovate tool/app. Are you referring to keeping syntax like the following up-to-date?

git_repository(
    name = "build_bazel_rules_nodejs",
    remote = "https://github.com/bazelbuild/rules_nodejs.git",
    tag = "0.1.0", # check for the latest tag when you install
)

[rarkins]

I've added bazel WORKSPACE awareness to a WIP branch and tested it on a fork of this repository. You can see the resulting Pull Requests here: https://github.com/renovate-tests/angular-bazel-example/pulls

Two are for bazel references and one is a regular package.json one for upgrading Typescript.

@alexeagle does this look ok?

[alexeagle]

That looks awesome, I would approve one of those right away. How do I set it up? Is this feature live on your service?

…

On Tue, Dec 5, 2017 at 1:46 AM Rhys Arkins ***@***.***> wrote: I've added bazel WORKSPACE awareness to a WIP branch and tested it on a fork of this repository. You can see the resulting Pull Requests here: https://github.com/renovate-tests/angular-bazel-example/pulls Two are for bazel references and one is a regular package.json one for upgrading Typescript. @alexeagle <https://github.com/alexeagle> does this look ok? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#17 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAC5I8orgb0BPwQAVjtTx0BiOB97odpcks5s9REIgaJpZM4QzZqX> .

[rarkins]

@alexeagle yes, it's now live on the hosted app. If you go to https://github.com/apps/renovate you can choose to "Install" it and then given the option of installing on all repositories or select individual repositories one by one. It should work well with this repository as I used it for my testing.

[alexeagle]

Awesome, I'll try it for my project. You can't request write permission to code for any project under the angular/ or google/ github orgs because we're not allowed to grant such a permission. Do you really require that just to make a PR? Maybe you have to request a pull from a branch you create on a fork rather than make a branch on the upstream repo? -Alex

…

On Fri, Dec 8, 2017 at 2:08 PM Rhys Arkins ***@***.***> wrote: @alexeagle <https://github.com/alexeagle> yes, it's now live on the hosted app. If you go to https://github.com/apps/renovate you can choose to "Install" it and then given the option of installing on all repositories or select individual repositories one by one. It should work well with this repository as I used it for my testing. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#17 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAC5IzbzG7g2fcYX6h4XKaFljAdRvA9xks5s-bNKgaJpZM4QzZqX> .

[rarkins]

@alexeagle thanks for the info regarding write permissions. As you suspected, Renovate currently works by creating branches within the repository itself. I will need to research if there's a way to implement using forks. GitHub Apps/bots are not "real" users so I'm not sure they can actually own their own fork of repos. On the other hand I'm not sure if they are able to submit PRs from a "real" user's repository.

[alexeagle]

GitHub has that"pencil" feature in the UI where I propose some edit in a repo I don't have write access to.
It creates a fork dynamically I guess
Maybe that has an API?

[rarkins]

“Create a fork” is definitely in the API. The problem is that apps can’t “own” forks so they can’t call it on their own behalf - only on behalf of users, which wouldn’t make sense here. The solution may be to actually run as an old fashioned bot user account instead. Anyway I’ll raise an issue in the Renovate repo for describing and planning this requirement.

[rarkins]

I think this issue can be closed now 🎉

@alexeagle FYI, adding a "fork mode" like you suggested turned out to be pretty easy. I will be creating a second Renovate app on github which requires less repository permissions and submits all PRs from its own forked repositories using this mode.

Another change you may notice is that the bot is now GPG signing all its commits, in case that's of interest to you.

[alexeagle]

Pretty awesome, I just approved the onboarding PR and I'll give you feedback. This is something all Angular users could benefit from!