Support for maven_install.json in Bazel Maven Manager

[avarun42]

Type of discussion.

Bug report, the issue template states to create a discussion first

Tell us more.

Hey folks at Renovate,

The new support for Maven dependencies managed by Bazel in Renovatebot is awesome, and our Github repo is now actively receiving PRs from Renovatebot with updates to JVM dependencies.

There's just one problem though that's unfortunately making it not very useful right now: it seems that Renovatebot doesn't support updating maven_install.json, meaning it doesn't work correctly on any project where Maven artifacts are pinned (you can think of this file as similar to package-lock.json). Renovatebot simply updates just the artifact declaration in WORKSPACE and doesn't actually re-pin artifacts, which means that dependencies don't actually get updated — as mentioned in the docs, updating the list of artifacts won't affect the build if a maven_install.json file is present:

Without re-pinning, maven_install will not pick up the changes made to the WORKSPACE, as maven_install.json is now the source of truth.

Luckily the solution is straightforward, as it just requires running REPIN=1 bazel run @unpinned_maven//:pin in the workspace after updating the list of artifacts, which should automatically update maven_install.json.

I hope it'll be possible for the team to take a look at this! Seems like @zharinov and @rarkins are the experts on this area.

[rarkins]

This would require bazel to be first added to containerbase so that it can be installed: https://github.com/containerbase/base

Before that, do projects define a specific version of bazel they support, or should Renovate just install the latest version every time?

[avarun42]

Projects often define a version of bazel in a .bazeliskrc in the root directory of the project, setting a USE_BAZEL_VERSION variable to the desired version. Usually, Bazelisk would be installed (the latest version), which will automatically read from the config and use the correct version of bazel. Github Actions, for example, runs on an image that already comes with Bazelisk installed (actions/runner-images#490).

[avarun42]

Using Bazelisk the command to run would actually be REPIN=1 bazelisk run @unpinned_maven//:pin

[rarkins]

Blocked by containerbase/base#20

[rarkins]

Once this is complete, the next step would be to have a feature request issue in this repo linking to a reproduction repo

[jasonschroeder-sfdc]

The above blocker is resolved. Can http://github.com/buildfarm/buildfarm be the reproduction repo? (it's actively developed) If so, I'll open a GH issue in this repo?

[rarkins]

No, see below

[tacascer]

Hey! Not sure of this the best channel but I've made a reproduction:
#20721 (comment)

[github-actions[bot]]

Hi there,

Please help this Discussion progress by creating a minimal reproduction. This means a repository dedicated to reproducing this issue with the minimal dependencies and config possible.

Before we start working on your issue we need to know exactly what's causing the current behavior. A minimal reproduction helps us with this. Discussions without reproductions are less likely to be converted to Issues.

Please follow these steps:

1. Read our guide on creating a minimal reproduction.
2. Go to our minimal reproduction template repository.
3. Select the Use this template button to create a new repository based on the template.
4. Work on the minimal reproduction in your own repository.
5. Fill out the information in your repository's README.md.
6. Add the link to your reproduction to the first post of your Discussion. If you are not the original author, you can post a new comment with the link.

If you need help with running renovate on your minimal reproduction repository, please refer to our Running Renovate guide.
Good luck,

The Renovate team

[tacascer]

Hi there,
I've made a repoduction at https://github.com/tacascer/renovate-20721-repro