New package manager questionnaire

Did you read our documentation on adding a package manager?

• I've read the adding a package manager documentation.

Basics

Name of package manager

(Crystal) Shards

What language does this support?

Crystal

How popular is this package manager?

It's the only one for Crystal that I'm aware of. I would claim that every Crystal developer is using it.

Does this language have other (competing?) package managers?

• Yes (give names)
• No

---

Package File Detection

What type of package files and names does it use?

What fileMatch pattern(s) should be used?

A shard.yml for the user defined definitions and a shard.lock for the locked versions. I'm not quite sure whether renovate also looks at the locked version but if it does, it probably could look like this:

{
  "shardfile": {
    "fileMatch": ["^shard\\.yml$"]
  },
  "shardLockfile": {
    "fileMatch": ["^shard\\.lock$"]
  },
}

Is it likely that many users would need to extend this pattern for custom file names?

• Yes
• No (at least not that I'm aware of)

Is the fileMatch pattern likely to get many "false hits" for files that have nothing to do with package management?

You never know but I think this is very unlikely.

Parsing and Extraction

Can package files have "local" links to each other that need to be resolved?

yes

Is there a reason why package files need to be parsed together (in serial) instead of independently?

I don't know. 🤷

What format/syntax is the package file in?

• JSON
• TOML
• YAML
• Custom (explain below)

How do you suggest parsing the file?

• Off the shelf parser
• Using regex
• Custom-parsed line by line
• Other

Does the package file structure distinguish between different "types" of dependencies? e.g. production dependencies, dev dependencies, etc?

• Yes, production and development dependencies (the YAML keys are called dependencies and development_dependencies)
• No, all dependencies are treated the same

List all the sources/syntaxes of dependencies that can be extracted

I am not quite sure what this means. Everything is documented here.

A definition could look like this:

dependencies:
  openssl:
    github: datanoise/openssl.cr
    branch: master

development_dependencies:
  minitest:
    git: https://github.com/ysbaddaden/minitest.cr.git
    version: "~> 0.1.0"

Describe which types of dependencies above are supported and which will be implemented in future

Could you please elaborate on that?

---

Versioning

What versioning scheme does the package file(s) use?

Semver broadly used but not required.

Does this versioning scheme support range constraints, e.g. ^1.0.0 or 1.x?

• Supports range constraints (e.g ^1.0.0 or 1.x, details are in the documentation)
• No

Is this package manager used for applications, libraries, or both? If both, is there a way to tell which is which?

• Applications
• [] Libraries
• Both (explain how to tell which is which)

@bcardiff said, that it might be both:

I think the answer is both and not 100% but apps has target and lib might not.

If ranges are supported, are there any cases when Renovate should pin ranges to exact versions if rangeStrategy=auto?

I don't know.

---

Lookup

Is a new datasource required? Provide details

• Yes, provide details.
• No.

Will users need the capability to specify a custom host/registry to look up? Can it be found within the package files, or within other files inside the repository, or would it require Renovate configuration?

Sources can be path, git, github, gitlab, bitbucket. So it's either a local path or a git repository that need to be accessible.

Do the package files contain any "constraints" on the parent language (e.g. supports only v3.x of Python) or platform (Linux, Windows, etc) that should be used in the lookup procedure?

I don't think so.

Will users need the ability to configure language or other constraints using Renovate config?

I don't think so.

Artefacts

Are lock files or checksum files used? Are they mandatory?

Yes, they are often used and a lock file called shard.lock but they are not mandatory. Libs usually don't have a lock file.

If so, what tool and exact commands should be used if updating one or more package versions in a dependency file?

$ shards update [<shards>...]

If applicable, describe how the tool maintains a cache and if it can be controlled via CLI or env? Do you recommend the cache be kept or disabled/ignored?

shards uses a cache path which can be set via ENV variable SHARDS_CACHE_PATH.

If applicable, what command should be used to generate a lock file from scratch if you already have a package file? This will be used for "lock file maintenance"

If there is no shard.lock yet, you can use shards install to generate it.

Other

Is there anything else to know about this package manager?

Yes, you should try it. 😉 But seriously, thank you for your work and considering integration of Crystal Shards.