Disable non-dev-dependency update MR creation for libraries

[jhoffland]

What would you like help with?

I would like help with my configuration

How are you running Renovate?

Self-hosted

If you're self-hosting Renovate, tell us which platform (GitHub, GitLab, etc) and which version of Renovate.

Platform: GitLab (self-managed), Renovate version: 38.87.1

Please tell us more about your question or problem

Hello!

We are using self-hosted Renovate and a self-managed GitLab instance. Autodiscovery is enabled with an global file config, containing some shared package rules. Our repositories contain PHP libraries (packages), Symfony bundles and projects (applications).

In the composer.json of all repositories (libraries/projects) is a type specified. It would be nice if this type could be used in a Renovate package rule. With that, we could add a pacakge rule in our global config, disabling the creation of update MR's for non-dev-dependencies for our library & Symfony bundle repositories.

Is something like this possible?

Looking forward to a reply,

Kind regards, Joep

Logs (if relevant)

Logs

Replace this text with your logs, between the starting and ending triple backticks

[rarkins]

Yes, write a package rule and use matchDepTypes to match and disable any types you don't like

[jhoffland]

matchDepTypes is a restriction based on the type of the dependency that will be updated, which indeed needs to be part of the packageRule. But another restriction should also be something that checks the type in composer.json of the repository where the dependency will be updated for. Is this available?

[rarkins]

Sorry, I may have misunderstood. Please check if the below is correct:

In Composer, like quite a few other package managers such as npm, you can group your dependencies in the package file (e.g. composer.json) based on dev vs product vs build vs peer, etc. In Renovate this is known as the "depType" and is known as soon as you scan a repository and prior to doing any lookups. You can use this to group or disable dev dependency updates, for example.

I think you're referring to a "type" field in the composer.json which defines the type of that project/library. "type" can be found not only in your repository composer.json which Renovate scans, but also in each library on Packagist which Renovate looks up?

If this is correct, as you interested in changing behavior based on the local (repo) type value, or the remote (registry) type value?

[jhoffland]

I'm interested in the local type value. The type in our repository composer.json which Renovate scans.

[rarkins]

This would require a new feature. Something like adding a new field packageFileType and then a matcher matchPackageFileTypes. Using projectType would be shorter but probably less intuitive and easier to get mixed up with other things.

Please create a "Suggest an Idea" discussion proposing packageFileType and matchPackageFileTypes. If you're interested in implementing it yourself, you can go ahead. Otherwise it will likely stay in idea/discussion form unless it turns out to have wider applicability to other users too

[jhoffland]

Thanks for your help and thoughts!