Add support for the Alire package manager

[JeremyGrosser]

What would you like Renovate to be able to do?

Alire is a package manager for the Ada programming language, similar to cargo and pip.

I'd like to use Renovate to track dependencies for Alire crates on GitHub.

If you have any ideas on how this should be implemented, please tell us here.

Alire projects have an alire.toml file at the root of each repository, with a format very similar to Cargo.toml. The Alire package index is available as a public GitHub repository.

Is this a feature you are interested in implementing yourself?

Maybe

[github-actions[bot]]

Hi there,

You're requesting support for a new package manager. We need to know some basic information about this package manager first. Please copy/paste the new package manager questionnaire, and fill it out in full.

Once the questionnaire is filled out we will evaluate if adding support for this manager is something we want to do.

Good luck,

The Renovate team

[JeremyGrosser]

New package manager questionnaire

Did you read our documentation on adding a package manager?

• [X] I've read the adding a package manager documentation.

Basics

Name of package manager

Alire

What language does this support?

Ada

How popular is this package manager?

There are 258 crates in the public index, there have been 40 commits (new or updated versions) to the index in the last month, according to github.

Does this language have other (competing?) package managers?

• [ ] Yes (give names)
• [X] No

---

Package File Detection

What type of package files and names does it use?

alire.toml may exist in the top level of a directory tree or any subdirectory. Each alire.toml file corresponds to a single crate.

What fileMatch pattern(s) should be used?

Repositories may

fileMatch: ["(^|/)alire.toml$"]

Is it likely that many users would need to extend this pattern for custom file names?

• [ ] Yes
• [X] No

Is the fileMatch pattern likely to get many "false hits" for files that have nothing to do with package management?

No

---

Parsing and Extraction

Can package files have "local" links to each other that need to be resolved?

Yes, see Using pins for crate testing for a common use case.

Is there a reason why package files need to be parsed together (in serial) instead of independently?

Pinned dependencies need to be resolved recursively.

What format/syntax is the package file in?

• [ ] JSON
• [X] TOML
• [ ] YAML
• [ ] Custom (explain below)

How do you suggest parsing the file?

• [X] Off the shelf parser
• [ ] Using regex
• [ ] Custom-parsed line by line
• [ ] Other

Does the package file structure distinguish between different "types" of dependencies? e.g. production dependencies, development dependencies, etc?

• [X] Yes, production and development dependencies
• [ ] No, all dependencies are treated the same

List all the sources/syntaxes of dependencies that can be extracted

I'm not sure I understand the question. See Release Information for information about the specific TOML entries that Alire uses.

Describe which types of dependencies above are supported and which will be implemented in future

All Alire crates are defined by TOML files. The community alire index, a github repository that contains published alire.toml files, may point to sources in remote git, hg, or svn repositories. Sources may also be distributed by tar or zip file served over http(s).

---

Versioning

What versioning scheme does the package file(s) use?

semver 2.0.0 is enforced by Alire's semantic_versioning library.

Does this versioning scheme support range constraints, e.g. ^1.0.0 or 1.x?

• [X] Supports range constraints (e.g ^1.0.0 or 1.x)
• [ ] No

Is this package manager used for applications, libraries, or both? If both, is there a way to tell which is which?

• [ ] Applications
• [ ] Libraries
• [X] Both Most binary projects will supply an executables list in alire.toml, though this is optional. Alire calls a tool called gprbuild (it's kinda like make) which parses one or more project files with a .gpr extension. The gpr grammar specifies a library project qualifier that will be used in any project file that builds a library.

If ranges are supported, are there any cases when Renovate should pin ranges to exact versions if rangeStrategy=auto?

No.

---

Lookup

Is a new datasource required? Provide details

• [x] Yes, the alire-index repository.
• [ ] No.

Will users need the capability to specify a custom host/registry to look up? Can it be found within the package files, or within other files inside the repository, or would it require Renovate configuration?

Alire does support custom indexes, which may be either a remote git repository or local directory. The community index does not contain any crates that depend on versions from other indexes.

Do the package files have any "constraints" on the parent language (e.g. supports only v3.x of Python) or platform (Linux, Windows, etc) that should be used in the lookup procedure?

Alire is tested on Linux, Mac, and Windows x86_64 GitHub Actions runners. No other host architecture is supported at this time. Alire will download a binary toolchain if needed to build a crate.

Will users need the ability to configure language or other constraints using Renovate config?

Users may wish to add local or private indexes to their config.

---

Artifacts

Are lock files or checksum files used? Are they mandatory?

alire.lock is generated at build time when dependencies are resolved and stored under the alire/ directory. This directory is ephemeral and not version controlled (it's added to .gitignore by default).

If so, what tool and exact commands should be used if updating one or more package versions in a dependency file?

The user can call alr update in a project directory to compare the dependency versions in alire.toml to the cached index and automatically update alire.toml to the latest versions that match the version constraints.

If applicable, describe how the tool maintains a cache and if it can be controlled via CLI or environment variables? Do you recommend the cache be kept or disabled/ignored?

The index is cached locally in $HOME/.config/alire (or similar on Windows/Mac) and not updated automatically. To receive new versions, a user needs to call alr index --update-all, which effectively does a git pull for each cached index. This cache should be updated before searching for new dependency versions.

If applicable, what command should be used to generate a lock file from scratch if you already have a package file? This will be used for "lock file maintenance"

alr show --solve

Other

Is there anything else to know about this package manager?

The maintainers can be reached via GitHub issues or Gitter.im.