bun: workspace support

[rarkins]

Describe the proposed change(s).

Use the workspaces field in package.json to detect workspace package.json files

The goal would be that a reproduction like renovate-reproductions/24459b#3 would show all three package files as "bun" and none as "npm".

Likely all work is contained to https://github.com/renovatebot/renovate/tree/main/lib/modules/manager/bun

Today Renovate's bun manager:

• is triggered by a lock file
• locates the adjacent package.json
• parses the package.json
• returns results for package.json + bun.lock(b)

What needs to be done is:

• After parsing the package.json adjacent to the lock file, look for "workspaces" config inside the package.json
• Locate any matching package.json deeper in the repo
• For each of those, parse them as package.json and put the results into the returned "packageFiles", ensuring that the lockFiles correctly points to the top level lock file

This alone may be enough for it to work.

[The-Code-Monkey]

https://github.com/The-Code-Monkey/bun-demo-monorepo

@rarkins this repo is a dummy repo for the bun mono repo support. I have setup renovate github bot on it too.

[rarkins]

Thanks, but unfortunately Renovate does not detect any dependencies to update according to the onboarding PR. If you replace ranges with fixed versions in the sub-package package.json then it should do it.

[The-Code-Monkey]

Ah ok, I have updated renovate to pin deps and will merge that PR once it does so. hope that helps.

[rarkins]

Well, it will pin them to the latest version, so still won't have any updates to make after that, but if we want a day or two after that..

[The-Code-Monkey]

@rarkins react has an open pr on the demo repo. Just so you are aware, I guess you can test now?

[rarkins]

Reproduction forked to https://github.com/renovate-reproductions/24459

[Hebilicious]

Not sure if you still need some live repositories to investigate, but here's an example of one :

https://github.com/Hebilicious/vue-query-nuxt/blob/main/package.json

Note that I'm using a pnpm-workspace.yaml file for publishing packages only, it is bun monorepo. Would really appreciate proper support, even though sometimes some of the renovate PR randomly passes the tests 🤷🏽

[simonknittel]

I've created the most simple repository for reproducing this: https://github.com/simonknittel/renovate-bun-workspaces

You'll see a package.json which uses workspaces. Each package (a and b) has dependencies which are outdated. Renovate successfully created pull requests for them, but they only update the corresponding package.json and not the bun.lockb of the root directory.

[wladpaiva]

Used the same repro from @simonknittel but only added internal dependency from the root package.
https://github.com/wladpaiva/renovate-bun-workspaces

In this case, Renovate doesn't create any PR and dashboard detects dependencies like this:

...
DEBUG: Using file match: (^|/)\.vela\.ya?ml$ for manager velaci
DEBUG: Using file match: ^\.woodpecker(?:/[^/]+)?\.ya?ml$ for manager woodpecker
DEBUG: Matched 1 file(s) for manager bun: bun.lockb
DEBUG: Matched 3 file(s) for manager npm: package.json, packages/a/package.json, packages/b/package.json
DEBUG: npm file package.json has name "renovate-bun-workspaces"
DEBUG: npm file package.json has name "renovate-bun-workspaces"
DEBUG: npm file packages/a/package.json has name "a"
DEBUG: npm file packages/b/package.json has name "b"
DEBUG: Detecting pnpm Workspaces
DEBUG: Detecting workspaces
DEBUG: Finding locked versions
DEBUG: manager extract durations (ms)
DEBUG: Found bun package files
DEBUG: Found npm package files
DEBUG: Found 3 package file(s)
INFO: Dependency extraction complete
DEBUG: hostRules: no authentication for registry.npmjs.org
DEBUG: PackageFiles.add() - Package file saved for base branch
DEBUG: Package releases lookups complete
DEBUG: branchifyUpgrades
DEBUG: detectSemanticCommits()
DEBUG: getCommitMessages
DEBUG: semanticCommits: detected "unknown"
DEBUG: semanticCommits: disabled
DEBUG: 2 flattened updates found: zod, vitest
DEBUG: Returning 2 branch(es)
DEBUG: config.repoIsOnboarded=true
DEBUG: packageFiles with updates
DEBUG: detectSemanticCommits()
DEBUG: semanticCommits: returning "disabled" from cache
DEBUG: Repository timing splits (milliseconds)
DEBUG: Package cache statistics
DEBUG: http statistics
DEBUG: Package lookup durations
DEBUG: dns cache
INFO: Repository finished

[rarkins]

Latest reproduction forked to https://github.com/renovate-reproductions/24459b

[mstuercke]

Is there a workaround? Is it possible to force Renovate through the configuration to use bun instead of npm?

[rarkins]

No

[Punie]

Bun now supports a text-based lockfile starting as of version 1.39.0

https://bun.sh/blog/bun-lock-text-lockfile

[sebastianbuechler]

Available in https://github.com/renovatebot/renovate/releases/tag/39.74.0: #33189

[rarkins]

@sebastianbuechler are you sure that PR adds any workspace specific logic?

[sebastianbuechler]

@sebastianbuechler are you sure that PR adds any workspace specific logic?

I think you misunderstood. I'm not claiming that it adds any workspace-specific logic, but it can be relevant for this feature as it's the implementation of the support for text-based lockfile mentioned previously by @Punie. This seems relevant as Renovate does not seem to be able to handle the binary bun.lockb file as mentioned by @simonknittel which would be the basis for workspace support.

[nicksrandall]

Is there anything currently blocking this issue from being addressed? I'd be happy to help.

[rarkins]

I've written most of the logic for this and pushed into this WIP branch: https://github.com/renovatebot/renovate/compare/feat/24459-bun-workspaces-wip?expand=1

@nicksrandall please feel free to take over and submit a PR based on this work

Remaining to be done:

• Any more manual testing or advanced use cases (e.g. do we care about internal relationships? There is some logic for that in the npm manager)
• Unit test coverage

I've tested only against the reproduction here: https://github.com/renovate-reproductions/24459b/pulls?q=sort%3Aupdated-desc+is%3Apr+is%3Aopen