Support Cue language modules

[sprat]

Tell us more.

I am currently learning about the Cue language and I like it very much. It's a "configuration" language and I think it's a very powerful language to describe (and validate) infrastructure. I plan to use it for my personal projects involving Docker, Kubernetes and Terraform.

However, as far as I know, Renovate does not support this language. It has a module management very similar to Golang: see here for details.

Can this language be supported?

[jamietanna]

This sounds reasonable!

As I understand it - as you say - there's a number of things that are similar to how Go modules work, so we can likely re-use some of the things and/or wire in github-tags/git-tags as a datasource

Do you have an example project you can point me to that has a dependency on another Cue module? So we can see how it would work?

[sprat]

Here is an example. I think the datasources are OCI registries, but I must learn a bit more. I'm trying to fill out the questionnaire, but it's a bit difficult for me as I don't know the langage very much for now.

[github-actions[bot]]

Hi there,

You're asking us to support a new package manager. We need to know some basic information about this package manager first. Please copy/paste the new package manager questionnaire, and fill it out in full.

Once the questionnaire is filled out we'll decide if we want to support this new manager.

Good luck,

The Renovate team

[sprat]

New package manager questionnaire

Did you read our documentation on adding a package manager?

• I've read the adding a package manager documentation.

Basics

What's the name of the package manager?

I don't know if it has a particular name, I would say "Cue" or "cue.mod". It's the built-in package manager provided in the Cue CLI. See this ticket for details.

What language(s) does this package manager support?

Cue (also called Cuelang)

How popular is this package manager?

As popular as Cue since it's built into it

Does this language have other (competing?) package managers?

• Yes (give names).
• No.

What are the big selling points for this package manager?

It's integrated in the Cue CLI. It's very similar to the Golang builtin package manager, so it's familiar to Golang programmers.

Detecting package files

What kind of package files, and names, does this package manager use?

A package should contain a cue.mod directory containing a module.cue file. Here is an example:

module: "foo.example/my/thing"

language: {
    version: "v0.12.0"
}

deps: {
    "cue.dev/x/dockercompose@v0": {
        v:       "v0.1.0"
        default: true
    }
}

This file is created with cue mod init and is updated whenever cue get <package> is called (like the Golang CLI)

Some more details are provided here

Which managerFilePatterns pattern(s) should Renovate use?

This pattern: /cue\\.mod/module\\.cue$

There were old-style modules, but I don't think it's worth supporting.

Do many users need to extend the managerFilePatterns pattern for custom file names?

• Yes, provide details.
• No.

Is the managerFilePatterns pattern going to get many "false hits" for files that have nothing to do with package management?

No

Parsing and Extraction

Can package files have "local" links to each other that need to be resolved?

I am not sure if I understand the question correctly, but I would say no

Package file parsing method

The package files should be:

• Parsed together (in serial).
• Parsed independently.

Which format/syntax does the package file use?

• JSON
• TOML
• YAML
• Custom (explain below)

It uses the Cue language

How should we parse the package files?

• Off the shelf parser.
• Using regex.
• Custom-parsed line by line.
• Other.

I guess the Cue CLI can be used to render the module.cue file as JSON or YAML, then parse the result using a regular JSON or YAML parser.

Does the package file have different "types" of dependencies?

• Yes, production and development dependencies.
• No, all dependencies are treated the same.

List all the sources/syntaxes of dependencies that can be extracted

In a module.cue file, deps is a struct containing the dependencies. Each key in this struct is a dependency name, and their v attribute express the version.

deps: {
    "cue.dev/x/dockercompose@v0": {
        v:       "v0.1.0"
        default: true
    }
}

Describe which types of dependencies above are supported and which will be implemented in future

N/A

Versioning

What versioning scheme does the package file(s) use?

Semver 2.0.0

Does this versioning scheme support range constraints, like ^1.0.0 or 1.x?

• Supports range constraints (for example: ^1.0.0 or 1.x), provide details.
• No.

Lookup

Is a new datasource required?

• Yes, provide details.
• No.

I am not sure. Cue packages are stored in standard OCI registries but with some specific artifact or media types: see here for details

Will users want (or need to) set a custom host or custom registry for Renovate's lookup?

• Yes, provide details.
• No.

The first part of a dependency name express the OCI registry from where the dependency can be downloaded.

The registry credentials used by the Cue CLI are retrieved from ~/.docker/config.json.

The user can also provide a list of registries in the CUE_REGISTRY environment variable: see here

Where can Renovate find the custom host/registry?

• No custom host or registry is needed.
• In the package file(s), provide details.
• In some other file inside the repository, provide details.
• User needs to configure Renovate where to find the information, provide details.

I guess both case could occur, as explained above.

Are there any constraints in the package files that Renovate should use in the lookup procedure?

• Yes, there are constraints on the parent language (for example: supports only Python v3.x), provide details.
• Yes, there are constraints on the parent platform (for example: only supports Linux, Windows, etc.), provide details.
• Yes, some other kind of constraint, provide details.
• No constraints.

The module file contain a language version constraint in the language.version field.

Will users need the ability to configure language or other constraints using Renovate config?

• Yes, provide details.
• No.

Artifacts

Does the package manager use a lock file or checksum file?

• Yes, uses lock file.
• Yes, uses checksum file.
• Yes, uses lock file and checksum file.
• No lock file or checksum.

Is the locksum or checksum mandatory?

• Yes, locksum is mandatory.
• Yes, checksum is mandatory.
• Yes, lock file and checksum are mandatory.
• No mandatory locksum or checksum.
• Package manager does not use locksums or checksums.

If lockfiles or checksums are used: what tool and exact commands should Renovate use to update one (or more) package versions in a dependency file?

N/A

Package manager cache

Does the package manager use a cache?

• Yes, provide details.
• No.

Yes, modules are cached locally like Golang modules. See here for details.

If the package manager uses a cache, how can Renovate control the cache?

• Package manager does not use a cache.
• Controlled via command line interface, provide details.
• Controlled via environment variables, provide details.

Should Renovate keep a cache?

• Yes, ignore/disable the cache.
• No.

Generating a lockfile from scratch

Renovate can perform "lock file maintenance" by getting the package manager to generate a lockfile from scratch.
Can the package manager generate a lockfile from scratch?

• Yes, explain which command Renovate should use to generate the lockfile.
• No, the package manager does not generate a lockfile from scratch.
• No, the package manager does not use lockfiles.

Other

What else should we know about this package manager?

It's very similar to Golang except that modules are downloaded from OCI registries instead of Git repositories.

[mxey]

The tricky part is resolving the extracted dependencies to how they are stored on OCI registries. That's dependent on the CUE_REGISTRY configuration. Maybe it could be converted to JSON and put into the Renovate configuration?

[sprat]

I probably agree. I don't know how this problem is handled in the other managers (e.g. with docker images) as I never used private repositories in renovate, and thus I don't have any opinion on the implementation. Feel free to choose whatever method you see fit.