feat(bazel-modules): support single_version_override

[cgrindel]

Changes

• Add support for single_version_override in bazel-module manager.

Context

Related to #13658.
Related to cgrindel/renovate_bzlmod_support#19.

Documentation (please check one with an [x])

• I have updated the documentation, or
• No documentation update is required

How I've tested my work (please select one)

I have verified these changes via:

• Code inspection only, or
• Newly added/modified unit tests, or
• No unit tests but ran on a real repository, or
• Both unit tests + ran on a real repository

[viceice]

are we sure those should be fully ignored? a user can't override that via config. 🤔

[cgrindel]

are we sure those should be fully ignored? a user can't override that via config. 🤔

Sorry. I don't understand your question.

The single_version_override declaration is slightly different from the other overrides. Here is the top line from the documentation:

Specifies that a dependency should still come from a registry, but its version should be pinned, or its registry overridden, or a list of patches applied.

[cgrindel]

@viceice Gentle ping. Could you elaborate on your comment?

are we sure those should be fully ignored? a user can't override that via config.

[viceice]

@viceice Gentle ping. Could you elaborate on your comment?

are we sure those should be fully ignored? a user can't override that via config.

if you set a Skip reason, renovate will always ignore that dependency. there is no way for a user to override that. so renovate can never update that dependency. so a user always needs to manually do it.

if the override only changes the registry, we should simply add that to the original dep and ignore the override.

if the override defined a version, it should be updatable by renovate. we can return enabled=false, so they are disabled by default, but can be enabled by user via package rule.

[cgrindel]

if you set a Skip reason, renovate will always ignore that dependency. there is no way for a user to override that. so renovate can never update that dependency. so a user always needs to manually do it.

That is exactly the workflow that we want, in this case. If the client specifies a version in single_version_override, they are pinning the version. We do not want to update that value. There is no other reason to specify the version in single_version_override.

if the override only changes the registry, we should simply add that to the original dep and ignore the override.

Agreed. That is what this PR does. The test case for this scenario is here.

[viceice]

@rarkins @secustor @JamieMagee WDYT?

[secustor]

This seems like the same scenario as required_version of the Terraform manager.

Usually developers use that feature to limit Terraform version avaiable to module users, tough we still update them under a different depType to allow an easy way to disable that feature.

[rarkins]

Seems ok to leave it as-is for now, maybe in future users will want a way to have it updated

[cgrindel]

@viceice @rarkins I have not seen a comment from @JamieMagee. Is it possible to continue the review on this PR? My next PR adds documentation and enables the bazel-module manager. I would like to get this merged and in production before I disappear on vacation in July.

[renovate-release]

🎉 This PR is included in version 35.119.0 🎉

The release is available on:

• GitHub release
• 35.119.0

Your semantic-release bot 📦🚀