Questions on the mutliverse of versions

[v1gnesh]

Hello, our paths cross again :)

I'm pretty new to this proj (only saw it yesterday), and as I try to understand it... it will be super helpful if you can show some examples of how to use this to keep references to tarball sources updated.

My use case is to keep ports up-to-date at https://github.com/ZOSOpenTools/.
Git covers a fair chunk of sources, but there are GNU sources and such, where we need to fetch from tar.gz and so on.
Example: https://github.com/ZOSOpenTools/gitport/blob/main/buildenv or https://github.com/ZOSOpenTools/opensshport/blob/main/buildenv

Any guidance will be of huge help, as I'm sure the tool will be.

✌️

[wader]

Hello, our paths cross again :)

Hey! 👋

I'm pretty new to this proj (only saw it yesterday), and as I try to understand it... it will be super helpful if you can show some examples of how to use this to keep references to tarball sources updated.

My use case is to keep ports up-to-date at https://github.com/ZOSOpenTools/. Git covers a fair chunk of sources, but there are GNU sources and such, where we need to fetch from tar.gz and so on. Example: https://github.com/ZOSOpenTools/gitport/blob/main/buildenv or https://github.com/ZOSOpenTools/opensshport/blob/main/buildenv

Any guidance will be of huge help, as I'm sure the tool will be.

Sure, for example the gitport could do something like this:

diff --git a/buildenv b/buildenv
index ebfc813..ab5dc91 100644
--- a/buildenv
+++ b/buildenv
@@ -3,6 +3,7 @@
 #
 export ZOPEN_TYPE="TARBALL"

+# bump: git /GIT_VERSION="(.*)"/ https://github.com/git/git.git|*
 GIT_VERSION="2.41.0"

 export ZOPEN_GIT_URL="https://github.com/git/git"

Here "git" is the name of the thing tracked, GIT_VERSION="(.*)" a regex to find current version and https://github.com/git/git.git|* a "pipeline" to fetch versions from some source and filter them to get a latest suitable one, this uses git tags from https://github.com/git/git.git and then * is short for semver:* (higest semver version), could be ^2 etc also.

Add a new file Bumpfile with a list of files (or bump config) that bump should concider, so just buildenv is this case. You can also skip the Bumpfile and provide a path as CLI argument or github action option.

There are some instructions in the README.md how to setup github action https://github.com/wader/bump#github-action

Will be out on bike vacation the next week (but will bring laptop :)) so might be a bit slow to answer.

[v1gnesh]

Thank you, I'll give it a go.
Have fun!

[wader]

👍 let me know how it goes! looking at the project it should be a good fit i think

[v1gnesh]

Hey, it's actually for the whole lot under https://github.com/ZOSOpenTools.
I'm pretty slow, so will take a bit for me to get my head around it lol.
But will report back here for sure.

EDIT: How would I look for https://ftp.gnu.org/gnu/autoconf/autoconf-2.71.tar.gz for example.
At this link, there's autoconf-latest.tar.gz. However, it doesn't say which version that points to.
The GNU Savannah news site doesn't say anything about 2.71 at all; the last post is about 2.70.
That means I can't use fetch: on that site.

[wader]

Ok no worries! just ask if you have any questions.

Nicest is usually do use a source repo as source of versions, ex in this case you could use:

# bump pipeline is a command to run pipelines, add -v if you want to see more verbose output
$ bump pipeline 'https://git.savannah.gnu.org/git/autoconf.git|*'
2.71

Note that from time to time developers tag versions very early which might trigger bump to find a versions that has not been released yet. But it's quiet rare.

If that was not the case in these was only list listing i guess you would have to use "fetch" and then some regexp magic to match for versions which is not nice... but works. So advice is try use git, svn, depsdev etc as versions source.

[v1gnesh]

@wader, editing this comment to say it works 👍
Will try for the different variety of URLs I have.

[v1gnesh]

Hey, how would I look up v3r17 from git tags for example?
https://github.com/zigi/zigi/tags

[wader]

@wader, editing this comment to say it works 👍 Will try for the different variety of URLs I have.

👍 great, saw in notification email :) problem with the regex and the "v"? was the error message confusing or something that could be improved to make it clearer?

[wader]

Hey, how would I look up v3r17 from git tags for example? https://github.com/zigi/zigi/tags

Interesting, so v3r17 could be seen as 3.17? something like this:

$ bump pipeline 'gitrefs:https://github.com/zigi/zigi.git|re:/v(\d+)r(\d+)/$1.$2/|*'
3.17

This uses gitrefs source which is like git but i does not have any magic to find versions, you just get the raw refs, then uses a regex to match out the to numbers and construct at number1.number2 string and last semver latest.

[wader]

btw if you just want to try things there is a "static" source so you can do:

$ bump pipeline 'static:v3r17,v2r23|/v(.*)r(.*)/$1.$2/'
3.17

[v1gnesh]

problem with the regex and the "v"? was the error message confusing or something that could be improved to make it clearer?

User error 😛 I put quotes in the bump text when the line of interest didn't have any.

bump: zstd-tar-version /TARBALL_VERSION=v"(.*)"/ https://github.com/facebook/zstd.git|*
TARBALL_VERSION=v1.5.2

[v1gnesh]

Hey, I wonder... do you think there's value in there being a bumperbot?
An alternative to dependabot that runs bump with all the power of bump 🦾

[wader]

Benefit would be that it could run for a whole organisation or user etc without much setup? i haven't looked into how github apps work (i think that is what dependabot is?) so no idea how much work it would be.

I guess one "problem" would be that is has to run somewhere if i understand how i works? looks like it's hooks and API:s compare to github action which runs code? maybe one can mix somehow?

[v1gnesh]

Benefit would be that it could run for a whole organisation or user etc without much setup?

Yup..

I haven't looked into how github apps work (i think that is what dependabot is?)

Probably..

I guess one "problem" would be that is has to run somewhere if i understand how i works? looks like it's hooks and API:s compare to github action which runs code? maybe one can mix somehow?

Earlier today, I saw that Dependabot can be setup to trigger GitHub Actions, so there's a place for both.
I'm no expert in either, so just thinking out loud, to find the simplest way to bump version that are in buildenv files, across 100+ repositories.