definitelytyped including all dependencies

[jfairley]

cloned from renovatebot/app-support#119

---

Recently, I've noticed that my repos have a renovate PR seeming to be grouped as definitelytyped, but the PR seems to include every dependency update that my app needs.

I'm not sure whether this is an issue with the shareable configs or one of my configs, but I'll share some of my configs so we can figure it out...

This worked fine for a long time until recently, and we don't change our config often, which is why I'm suspicious of a shareable config.

---

First, the pull request... 😱

The title here is fix(deps): update definitelytyped.

(Sorry for the low res. Github limits uploaded files to 10MB. It still gets the point across.)

---

Next, an excerpt from my config:

{
  "extends": [
    "config:base",
    "docker:pinDigests",
    "group:recommended",
    "group:reactMonorepo",
    "schedule:weekly"
  ],


  "packageRules": [


    {
      "automerge": true,
      "excludePackageNames": ["@types/react-table"],
      "extends": ["group:definitelyTyped"]
    },


  ]
}

Full config

{
  "extends": [
    "config:base",
    "docker:pinDigests",
    "group:recommended",
    "group:reactMonorepo",
    "schedule:weekly"
  ],
  "encrypted": {
    "npmToken": "-- redacted --"
  },
  "npmrc": "@adcellerant:registry=https://npm.pkg.github.com/\n//npm.pkg.github.com/:_authToken=${NPM_TOKEN}\nalways-auth=true",
  "commitBody": "[skip release]",
  "labels": ["dependencies"],
  "packageRules": [
    {
      "automerge": true,
      "datasources": ["docker", "orb"],
      "groupName": "containers"
    },
    {
      "automerge": true,
      "depTypeList": ["devDependencies"],
      "updateTypes": ["minor", "patch", "pin", "digest"]
    },
    {
      "groupName": "dev-tools",
      "packageNames": [
        "check-node-version",
        "concurrently",
        "create-ts-index",
        "fixpack",
        "husky",
        "is-ci",
        "lint-staged",
        "nodemon",
        "prettier",
        "rimraf",
        "semantic-release",
        "ts-node",
        "wait-on"
      ],
      "packagePatterns": ["^@commitlint/", "^@semantic-release/", "webpack"]
    },
    {
      "automerge": true,
      "groupName": "cypress",
      "packageNames": ["cypress"],
      "packagePatterns": ["^@cypress/", "^cypress-"]
    },
    {
      "automerge": true,
      "excludePackageNames": ["@types/react-table"],
      "extends": ["group:definitelyTyped"]
    },
    {
      "automerge": true,
      "groupName": "enzyme",
      "packageNames": ["enzyme"],
      "packagePatterns": ["^enzyme-"]
    },
    {
      "automerge": true,
      "extends": ["group:fortawesome"]
    },
    {
      "automerge": true,
      "groupName": "graphql",
      "packagePatterns": ["apollo", "graphql"]
    },
    {
      "automerge": true,
      "groupName": "jest",
      "packageNames": ["@types/jest", "jest", "ts-jest"],
      "packagePatterns": ["^jest-"]
    },
    {
      "automerge": true,
      "extends": ["group:linters"]
    },
    {
      "automerge": true,
      "groupName": "styled-components",
      "packagePatterns": ["styled-components"]
    },
    {
      "automerge": true,
      "groupName": "supertest",
      "packageNames": ["supertest"]
    },
    {
      "automerge": true,
      "excludePackageNames": ["react-table"],
      "packageNames": [
        "@welldone-software/why-did-you-render",
        "fast-memoize",
        "formik",
        "lodash",
        "micro-memoize",
        "moment",
        "tslib",
        "typescript",
        "uuid",
        "validator",
        "victory",
        "w3c-keys",
        "winston"
      ],
      "packagePatterns": ["react"]
    }
  ],
  "separateMultipleMajor": true,
  "timezone": "America/Denver",
  "updateNotScheduled": false
}

---

🤔

[rarkins]

As mentioned in the other repo, this is actually an invalid config, however I've worked out a better way to migrate it: #9814

[jfairley]

@rarkins I've created the repo https://github.com/jfairley/renovate-test-repo. Initially, with some basic updates, I wasn't able to reproduce the issue.

With my last commit, I've copied my entire private config minus the github packages auth. The following issue was opened:

There is an error with this repository's Renovate configuration that needs to be fixed. As a precaution, Renovate will stop PRs until it is resolved.

Location: renovate.json
Error type: The renovate configuration file contains some invalid settings
Message: packageRules[6]: Each packageRule must contain at least one match* or exclude* selector. Rule: {"automerge":true,"extends":["group:fortawesome"]}, packageRules[9]: Each packageRule must contain at least one match* or exclude* selector. Rule: {"automerge":true,"extends":["group:linters"]}

1. Why is this issue was not opened in my private repos?
2. Does a package rule missing "match*" and "exclude*" fallback to "match all"?
3. If this is the issue, how would it manifest as a bunch of PRs titled definitelytyped since I do (as of Friday) have a "match*" and "exclude*" statement on my only "definitelyTyped" package rule.

[rarkins]

As a result of this discussion, this commit was put live in the app about 12 hours ago: a25eca7

So that possibly explains (1). Another explanation for (1) can be that if the config problem is nested within a preset then it might not be picked up the same way (we do try to though).

(2) No, it should not fall back to that. A package rule which never matches should end up having no effect at all.

(3) I can't say for sure yet. But if you're extending group:definitelyTyped within a package rule then it's definitely related.

[jfairley]

1. Looking at that test case for nested package rules, when I have something like "extends": "group:definitelyTyped" in a package rule, is that what I end up with after the config is parsed (a nested package rule)?

2. Does this process run every time renovate parses my config? In other words, do I need to do anything to my config to pick up the change you referenced, or will it apply the next time renovate goes to run?

I'm going to request a rebase on one of those PRs and see if anything changes.

[rarkins]

1. Yes, that's what causes the nesting.
2. Yes, every time

The best thing to do would be to rewrite the affected packageRules so that you don't have any "extends": ["group:x"] inside packageRules. I can help you here with any you're not sure of. Sometimes the groups have a corresponding monorepo:x which you can extend.

[jfairley]

One that would be somewhat painful to not use is

    {
      "automerge": true,
      "extends": ["group:linters"]
    },

group:linters that you have is really valuable to me, and all I want to add (clearly) is allowing it to automerge.

Trying to think of different ways to pull this off, what if I pulled these automerge-able groups out to a separate config like so:

# automerge-groups.json
{
  "extends": [
    "group:fontawesome",
    "group:linters",
  ],
  "automerge": true
}

And secondly, what would happen if my default.json extends that? More pointedly, would having "automerge": true at the root of automerge-groups.json implicitly enable automerge for default.json?

# default.json
{
  "extends": [
    "github>AdCellerant/renovate-config:automerge-groups",
    "group:recommended",   # <--- things I don't intend to automerge
  ],
}