metadata_json_deps 0.4.0 → 0.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 376a5a0f5181d0d6095b02fd5eb968c8acc887c8f85c1127c80d3fd622ed4a14
-  data.tar.gz: 2a8978e1c706f98b80a82c04e9bc4cb5721d72026ab7089b044d0981e1db16c7
+  metadata.gz: 6179bcf58c7d31443f14ee253a6138a39eb9cc5ee6522ad3ce90808af18b72c9
+  data.tar.gz: df68258de0fe2b4a056fd0bf71b00652f97ff127e5a925c99fc11cf0bb72ca82
 SHA512:
-  metadata.gz: d7a981df5b61c4ff15f7f016ce4f90ad5045f47c3556db8d686c6cd5ada2eff218daa240507f73c071f249c255bae1c39073ba04a675bb4426158ca3f9b56b68
-  data.tar.gz: 28fabc4c9c1cfe758875314d137117a7c7b437d39f15e94b160469f2a7fade2a3a59eba9eaa39e4d5f71e054d9aa1df9b760f3c1a7a63db860fbb27d9c0dcdb4
+  metadata.gz: 7386a095e6ae88bae37389863f813d07748bb8bd4a194f0d9a27b6156202670f2f93bd9b10b856d8d16f35f3e8be7da6386bc255d06d3f9cd31b7445d94ded0e
+  data.tar.gz: a02885daa2cae0fc442dbb92041a9db103a8fa72f10cf0bb3b46d75b1021198f9c24c40e7f563b119105f71b6eafccf4088ba55754daa58a0842754e3db12e25

data/README.md

@@ -28,6 +28,20 @@ On the command line, run `metadata-json-deps` with the path(s) of your `metadata
 metadata-json-deps /path/to/metadata.json
 ```
 
+Example output:
+
+```console
+$ metadata-json-deps modules/*/*/metadata.json
+Checking modules/theforeman/puppet-candlepin/metadata.json
+  puppetlabs/stdlib (>= 4.2.0 < 8.0.0) doesn't match 8.1.0
+  puppet/extlib (>= 3.0.0 < 6.0.0) doesn't match 6.0.0
+Checking modules/theforeman/puppet-certs/metadata.json
+  puppetlabs-stdlib (>= 4.25.0 < 8.0.0) doesn't match 8.1.0
+  puppet-extlib (>= 3.0.0 < 6.0.0) doesn't match 6.0.0
+Checking modules/theforeman/puppet-dhcp/metadata.json
+Checking modules/theforeman/puppet-dns/metadata.json
+```
+
 It can also be run verbosely to show valid dependencies:
 
 ```shell
@@ -47,3 +61,19 @@ task :metadata_deps do
   MetadataJsonDeps::run(files)
 end
 ```
+
+### Bumping dependency upper bounds
+
+After detecting outdated dependencies, it's important to do something about this. Taking the earlier example, you can see some modules should allow newer dependencies (candlepin and certs) while others are up to date (dhcp and dns).
+
+The next step is to look into the newer dependencies. In this case stdlib and extlib had a major version bump. It is then important to look at the changes and see if it does affect modules. Sometimes it doesn't, like when a module drops support for Puppet 5 but our modules already dropped Puppet 5. In that case, it's safe to raise the upper version bound.
+
+To update the upper bounds, [bump-dependency-upper-bound](https://github.com/voxpupuli/modulesync_config/blob/master/bin/bump-dependency-upper-bound) can be used. For example, to allow puppetlabs/stdlib 8.x, the new upper bound is 9.0.0:
+
+```console
+$ bump-dependency-upper-bound puppetlabs/stdlib 9.0.0 modules/*/*/metadata.json
+Updated modules/theforeman/puppet-candlepin/metadata.json: '>= 4.2.0 < 8.0.0' to '>= 4.2.0 < 9.0.0'
+Updated modules/theforeman/puppet-certs/metadata.json: '>= 4.25.0 < 8.0.0' to '>= 4.25.0 < 9.0.0'
+modules/theforeman/puppet-dhcp/metadata.json already matches 9.0.0
+modules/theforeman/puppet-dns/metadata.json already matches 9.0.0
+```

data/bin/bump-dependency-upper-bound

@@ -0,0 +1,32 @@
+#!/usr/bin/env ruby
+require 'optparse'
+require 'metadata_json_deps'
+
+def main
+  parser = OptionParser.new do |opts|
+    opts.banner = "Usage: #{opts.program_name} module_name new_upper_bound metadata"
+  end
+
+  parser.parse!
+  if ARGV.length < 3
+    STDERR.puts parser.help
+    exit 1
+  end
+
+  module_name, upper_bound, *paths = ARGV
+  module_name = PuppetForge::V3.normalize_name(module_name)
+  paths.each do |path|
+    begin
+      old, new = MetadataJsonDeps.bump_dependency(path, module_name, upper_bound)
+      if old != new
+        puts "Updated #{path}: '#{old}' to '#{new}'"
+      else
+        puts "#{path} already matches #{upper_bound}"
+      end
+    rescue Exception => e
+      puts "Failed to update #{path}: #{e}"
+    end
+  end
+end
+
+main

data/lib/metadata_json_deps.rb

@@ -35,6 +35,44 @@ module MetadataJsonDeps
     puts result.to_yaml
   end
 
+  # Bump a dependency in a filename
+  #
+  # @param [String] filename A path to a metadata file. An error is raised if
+  #   it's invalid metadata.
+  # @param [String] module_name The module name listed in dependencies. It must
+  #   be normalized to the forge style (using a dash). It can fall back to a
+  #   slash if metadata uses a slash.
+  # @param [String] upper_bound The new upper bound for the module name
+  # @return [Array<String>] An array with the old and new version. Can be used
+  #   to determine if a change was made.
+  # @see PuppetMetadata.read
+  def self.bump_dependency(filename, module_name, upper_bound)
+    metadata = PuppetMetadata.read(filename)
+
+    requirement = metadata.dependencies[module_name]
+    unless requirement
+      # TODO: normalize keys in puppet_metadata so we don't need 2 lookups?
+      module_name = module_name.tr('-', '/')
+      requirement = metadata.dependencies[module_name]
+      raise Exception.new("Dependency #{module_name} not found") unless requirement
+    end
+
+    return [requirement.to_s, requirement.to_s] if requirement.end == upper_bound
+
+    new = ">= #{requirement.begin} < #{upper_bound}"
+
+    new_metadata = metadata.metadata.clone
+    new_metadata['dependencies'].each do |dependency|
+      if dependency['name'] == module_name
+        dependency['version_requirement'] = new
+      end
+    end
+
+    File.write(filename, JSON.pretty_generate(new_metadata) + "\n")
+
+    [requirement.to_s, new]
+  end
+
   def self.run(filenames, verbose = false)
     forge = ForgeVersions.new
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: metadata_json_deps
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.5.0
 platform: ruby
 authors:
 - Ewoud Kohl van Wijngaarden
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2022-02-09 00:00:00.000000000 Z
+date: 2022-03-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: puppet_forge
@@ -81,6 +81,7 @@ dependencies:
 description: Verify all your dependencies allow the latest versions on Puppet Forge
 email: ewoud+rubygems@kohlvanwijngaarden.nl
 executables:
+- bump-dependency-upper-bound
 - generate-fixtures-yaml
 - metadata-json-deps
 extensions: []
@@ -89,6 +90,7 @@ extra_rdoc_files:
 files:
 - LICENSE
 - README.md
+- bin/bump-dependency-upper-bound
 - bin/generate-fixtures-yaml
 - bin/metadata-json-deps
 - lib/metadata_json_deps.rb