Watching dependencies in generated project

[tpluscode]

I started building templates for node projects but similar issues could occur with any target.

Possibly, there will be a template for the file which defined dependencies, such as package.json.jinja. This prevents the usual tooling which integrates with GitHub from functioning. Dependabot, Greenkeeper or Renovate will not find the dependencies to upgrade

Does anyone have a strategy for automating how and when versions of dependencies are updated in the templates?

[pawamoy]

I've been using a somewhat dumb script that generates a project, goes into it, run some tool that updates the dependencies where they are specified (in my case pyproject.toml, in yours package.json), and outputs the new dependencies so I can paste them back in the template myself. This can probably be fully automated though. And I don't have the script anymore but you get the idea 🙂

The other solution is simply to use an empty suffix for templates in your projects. But Dependabot and friends will still likely choke on Jinja syntax if you use it in the file anyway.

[cjolowicz]

I wrote retrocookie to solve this problem in the Cookiecutter world. You can use it to copy commits or PRs from a generated project to its template. I'm using it to import Dependabot PRs for the Hypermodern Python template, from a special instance repository. It currently doesn't support copier syntax, but it shouldn't be hard to generalize if anybody wants to work on this.

[tpluscode]

Aha, that would be neat.

In fact, does it even have to concern itself with the syntax? I was not even thinking in jinja terms. In what I had in mind it would have simply taken to cherry-pick the changes to package.json back to the original file. Either named thusly, or a package.json.jinja

[cjolowicz]

You could set up a GitHub workflow that

1. exports the patch using git format-patch
2. rewrites the path for the template repository
3. imports the patch using git am into the template repository,
4. pushes to the template repository

It's quite a bit of work figuring out the details, but it can definitely be done.

[yajo]

I can think on various solutions. I will post them in different comments so they can get voted separately.

For example, you can use tasks to generate the file dynamically after copying.

[tpluscode]

Ideally, I would have the file as package.json so that dependant can update the dependency versions.

If I kept Jinja tags, would it be possible to run Jinja for that one file from a task? (I do not want to set an empty template extension)

[yajo]

I doubt that dependant would work fine with a json file full of Jinja expressions.

[tpluscode]

Might also remove expressions and patch the json in tasks entirely

[yajo]

Just using Jinja, with a smart combination of include, import, macro, set and the from_json filter, you could recover the package.json updated by dependabot. Then use that into your template.

[tpluscode]

Ok, I did eventually as mentioned in comment

1. package.json are not jinja templates (example)
2. I update them from command line in tasks using npx json

This makes dependabot's business as usual