Manager for pre-commit additional_dependencies
#30914
WilliamDEdwards
started this conversation in
Suggest an Idea
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
-
Problem
Renovate supports bumping pre-commit hook versions (https://docs.renovatebot.com/modules/manager/pre-commit/).
But oftentimes, not only hooks are pinned to specific versions.
pre-commit also supports dependencies of hooks themselves (
additional_dependencies
, https://pre-commit.com/#config-additional_dependencies). Such dependencies are installed to the environment in which the hook is run.In many circumstances,
additional_dependencies
ends up the same as out-of-config requirements files.For example, here's the
flake8
hook from a random internal repository:... and here's the dev requirements file of that repository:
You will notice two things:
Point two is the core of the issue: versions deviate between the pre-commit config and other requirements files. After all, there's nothing keeping them in sync.
Possible solutions
Below is all possible solutions to keep versions in sync between the pre-commit config and other requirements files.
Drop dev dependencies
Drop the dev dependencies outside the pre-commit config.
Disadvantage: not installing dev dependencies outside of pre-commit loses IDE support for e.g. mypy.
Use
sync-pre-commit-deps
Use https://github.com/pre-commit/sync-pre-commit-deps.
Disadvantage:
sync-pre-commit-deps
is limited toblack
andflake8
. It doesn't even support extras (such asflake8-bugbear
), while such packages are common in the ecosystem. Not to mention that we install type stubs for mypy.sync-pre-commit-deps
won't be expanded (see https://github.com/pre-commit/sync-pre-commit-deps).Get dependencies from file
Don't duplicate dependencies, but let the pre-commit config get them from a general-purpose requirements file.
pre-commit doesn't and won't support this, at least not natively or without hacks (see pre-commit/pre-commit#730).
Bot
Write our own bot to keep
additional_dependencies
in sync.The question is: in sync with what? A requirements file would have to be configured.
Request
If the only feasible solution is to write a bot, one could wonder if Renovate is the right place for a pre-commit
additional_dependencies
manager.Judging by the activity in the aforementioned pre-commit issues, keeping dependencies in sync is quite a common problem, especially in the Python ecosystem.
Despite the commonness of this problem, @asottile has good architectural (and perhaps philosophical) reasons not to implement this in pre-commit (see pre-commit/pre-commit#1351 (comment)). I believe that Renovate isn't afflicted by the same.
Although Renovate's purpose isn't keeping dependencies in sync, its configurability would allow one to achieve this.
The same feature request exists for Dependabot: dependabot/dependabot-core#2040. Someone also 'abused' Renovate's flexibility to let it update the pre-commit config (dependabot/dependabot-core#2040 (comment)), but in a professional environment, it's not an option to rely on implementation details (at best, and hacks at worst).
Beta Was this translation helpful? Give feedback.
All reactions