Amphtml: Keep versions of AMP build tools and dev dependencies up to date

[rsimha]

In addition, set up an automated means of periodically rolling forward the versions in package.json and yarn.lock

/cc @cramforce

[rsimha]

After the PRs linked above are merged, all dependencies in the AMP toolchain will be at their latest versions.

We can then look into using https://github.com/integration/greenkeeper and https://github.com/greenkeeperio/greenkeeper-lockfile to keep the dependencies rolling forward.

[rsimha]

@cramforce @erwinmombay The final task before I can close out this issue is to install greenkeeper and greenkeeper-lockfile for github.com/ampproject/amphtml. Since I lack the access rights to do so, could I bug one of you to help with the install / setup, or ask you to (temporarily) give me access?

Edit: Installation links:
https://github.com/integration/greenkeeper
https://github.com/greenkeeperio/greenkeeper-lockfile

[erwinmombay]

I can't seem to install it to "ampproject/amphtml" and only allows me to install greenkeeper on my personal projects (i might not have enough access on the parent org)

[rsimha]

Thanks. Let's wait for @cramforce to help with this.

[cramforce]

The new integration now needs write access to code. We need to check whether that is OK security wise.

[rsimha]

@cramforce @erwinmombay See the section titled "Github Integrations" at https://blog.greenkeeper.io/greenkeeper-2-0-release-da8f8f476c88

It appears that Greenkeeper only needs access to our metadata files (package.json, .travis.yml, and likely yarn.lock). I wonder if we can restrict access to just those files via the Github Integrations API (https://github.com/blog/2226-build-an-integration-for-github)

[cramforce]

I checked and they are whitelisted. Should now be configured.

[rsimha]

@cramforce Thanks.

For Travis CI integration of greenkeeper-lockfile, we'll need to add a token called GH_TOKEN, either to https://travis-ci.org/ampproject/amphtml/settings, or to .travis.yml after encrypting it.

See https://github.com/greenkeeperio/greenkeeper-lockfile#setup

If you can generate and send me the GH_TOKEN internally, I can encrypt it and add it to .travis.yml.

[rsimha]

For posterity, here are the installation steps for greenkeeper:

https://greenkeeper.io/docs.html#installation

[rsimha]

@cramforce @erwinmombay greenkeeper and greenkeeper-lockfile are now enabled and active for ampproject/amphtml. See https://account.greenkeeper.io/account/ampproject

We're currently using a GH_TOKEN with only public_repo access. Now, it's wait and watch until the next dependency gets updated, at which point we should expect an automatically generated PR that updates package.json and yarn.lock.

We can close this bug once that happens, and we're satisfied that all went well.

[rsimha]

Update: We now use Renovate to keep our dependencies up to date.