Renovate: Support extra tasks to execute per repository

[KnisterPeter]

What would you like Renovate to be able to do?

We are using patch-package to fix things in our dependencies until upstream packages keep up.

patch-package puts version numbers into the patch files and warns if you update dependencies with patches but do not update the patches.
This is normally just a simple call to npx patch-package <package-name>.

Describe the solution you'd like

The above is just one case where running a script after renovating a dependency might by useful.
So I would propose to add the ability to configure a script to run after renovating.
That might be a simple npm script name.

Describe alternatives you've considered

None.

[rarkins]

If you're self-hosting then postUpdateTasks are available already.

[KnisterPeter]

@rarkins Didn't know about postUpdateTasks, thats nice.
A solution for the public app would be nice as well, but that could be some security involved topic.

[rarkins]

I think patch-package could be whitelisted. Do you know what happens if it’s run on a package that doesn’t have a patch configured?

[KnisterPeter]

It exits with 1 and prints some info:

markusw@x:~/source/xxx (master)$ npx patch-package react
patch-package 6.2.2
• Creating temporary folder
• Installing [email protected] with yarn
• Diffing your files with clean files
⁉️  Not creating patch file for package 'react'
⁉️  There don't appear to be any changes.
markusw@x:~/source/xxx (master)$ echo $?
1

[rarkins]

Would you expect Renovate to automatically detect and run patch-package if a patch is available, or be happy to configure a package rule per-package?

[KnisterPeter]

It would be awesome if that happy automatically :smile:

[rarkins]

Can you write out a description of exactly how that could be done?

[KnisterPeter]

Sure, I'd be glad to do that. Is a shell script okay or do you prefer some node.js script?

[rarkins]

I was more thinking pseudo-code is fine. Just making sure someone describes exactly how it could be done and thinks of edge cases

[rarkins]

Actually, I'm a little confused. Isn't patch-package operating on the node_modules content, which isn't committed to the repo? What exactly would it be patching?

[KnisterPeter]

patch-packages does this:

If one changes files in node_modules and run patch-package then a file is created in the patches folder.
After installing/updating node_modules (postinstall) patch-package applies the patches found in the patches folder.

[KnisterPeter]

Assumes we have a folder patches.
E.g. patches/webpack+4.1.0.patch

foreach file in `./patches` do
  extract {name, version} from file.name
  if the version of that package is different from one in `package.json`
     run patch-package with package-name
  endif
done

[rarkins]

ok, can you create a reproduction repo to demonstrate? e.g. have a dependency that's out of date and that will require some patch-package with the PR of the new version.

[KnisterPeter]

This is the repo: https://github.com/KnisterPeter/renovate-with-patch-package

If renovate is executed on it, there should be an update for react.
And with the execution of yarn then (after renovate) a big warning is output by patch-package that the patch is outdated.