npm-update

#!/usr/bin/env python3

# This file is part of Cockpit.
#
# Copyright (C) 2017 Red Hat, Inc.
#
# Cockpit is free software; you can redistribute it and/or modify it
# under the terms of the GNU Lesser General Public License as published by
# the Free Software Foundation; either version 2.1 of the License, or
# (at your option) any later version.
#
# Cockpit is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
# Lesser General Public License for more details.
#
# You should have received a copy of the GNU Lesser General Public License
# along with Cockpit; If not, see <http:https://www.gnu.org/licenses/>.

# To use this example add a line to an issue with the "bot" label
#
#  * [ ] npm-update @patternfly
#
# To ignore specific package you can use `~` in front of context
#
# * [ ] npm-update ~@patternfly
#

import collections
import json
import os
import subprocess
import sys
import tempfile

import task
from lib.constants import BASE_DIR, BOTS_DIR

# Dependencies which have to be updated in lockstep, not individually
GROUP = [
    "@patternfly"
]

sys.dont_write_bytecode = True


def read_package_json(package_json_path):
    with open(package_json_path) as f:
        return json.load(f, object_pairs_hook=collections.OrderedDict)


def write_package_json(package_json_path, data):
    with open(package_json_path, "w") as f:
        json.dump(data, f, indent=2, separators=(',', ': '))
        f.write("\n")


def prefix(name, version):
    if not version[0].isdigit():
        return version
    return "~" + version


def output(*args):
    if task.verbose:
        sys.stderr.write("+ " + " ".join(args) + "\n")
    return subprocess.check_output(args, cwd=BASE_DIR, text=True)


def run(context, verbose=False, **kwargs):
    pending_updates = []

    ignore_context = None
    if context and context.startswith("~"):
        ignore_context = context[1:]
        context = None

    if not kwargs["dry"]:
        api = task.github.GitHub()

        # List pending updates
        for issue in api.issues(state="open"):
            title = issue["title"]
            if title.startswith("package.json: Update "):
                packages = title.split(" ", 2)[2]
                for pkg in packages.split(", "):
                    pending_updates.append(pkg)
                    if task.verbose:
                        sys.stderr.write(f"Ignoring '{pkg}' as there is pending PR #{issue['number']}\n")

    package_json_path = os.path.join(BASE_DIR, "package.json")
    old = read_package_json(package_json_path)
    old_deps = old['dependencies']

    # write out a temporary package.json with fuzzy versions and run npm outdated
    with tempfile.TemporaryDirectory() as tmpdir:
        prefixed = {name: prefix(name, version) for name, version in old_deps.items()}
        write_package_json(f'{tmpdir}/package.json', {**old, 'dependencies': prefixed})

        if task.verbose:
            sys.stderr.write(f"+ {BOTS_DIR}/npm outdated --json")
        result = subprocess.run([f'{BOTS_DIR}/npm', 'outdated', '--json'], cwd=tmpdir, stdout=subprocess.PIPE)

    # Check which upgrades we could do
    group = None
    updates = {}
    for package, versions in json.loads(result.stdout).items():
        # In some circumstances, possibly due to a bug, `npm outdated` also
        # returns development dependencies.  In any case, it seems like the
        # behaviour may change at some future point, so make sure the returned
        # results are among those we expect.
        if package in pending_updates or package not in old_deps:
            continue

        # once we updated the first member of a group, only consider other group members
        if group and group not in package:
            if task.verbose:
                sys.stderr.write(f"Ignoring '{package}' as it does not belong to current update group {group}\n"
                                 )
            continue

        # Ignore if context is specified and does not match
        if context and not package.startswith(context):
            continue
        if ignore_context and package.startswith(ignore_context):
            continue

        # Check if we got an upgrade
        wanted = versions['wanted']

        if wanted != old_deps[package] and 'git' not in wanted:
            updates[package] = wanted

            # part of a group?
            if not group:
                for g in GROUP:
                    if g in package:
                        group = g
                        if task.verbose:
                            sys.stderr.write(f"Updated package '{package}' is in group {group}\n")
                        break

            if not group:
                # only update one dep, so that updates can be tested one by one
                break

    write_package_json(package_json_path, {**old, 'dependencies': {**old_deps, **updates}})
    updated_packages = sorted(updates)

    if updated_packages and not kwargs["dry"]:
        # If node_modules/ is a gitlink, run the script to update it
        if os.path.exists('tools/node-modules'):
            subprocess.check_call(['tools/node-modules', 'install'])
            subprocess.check_call(['tools/node-modules', 'push'])
            subprocess.check_call(['git', 'add', 'node_modules'])

        # Create a pull request from these changes
        title = "package.json: Update " + ', '.join(updated_packages)
        branch = task.branch(updated_packages[0], title, pathspec="package.json", **kwargs)

        kwargs["title"] = title
        pull = task.pull(branch, **kwargs)

        # List of files that probably touch this package
        lines = output("git", "grep", "-Ew", '|'.join(updated_packages))
        comment = f"Please manually check features related to these files:\n\n```\n{lines}```"
        task.comment(pull, comment)


if __name__ == '__main__':
    task.main(function=run, title="Upgrade a node dependency")