Automating "don't forget to update the version in..." comments

[andrewaylett]

I've seen a few places around the code-base that have comments along the lines of "don't forget to update this version in x, y, and z". For example, the msrv, and the version of uv.

In other projects, I've managed these kinds of versions either by adding consistency checks or (better when appropriate) by using Renovate to manage bumping versions in-place using the regex or jsonata managers.

I'll note particularly that not auto-bumping obscure dependencies means we're using quite an old version of uv.

Thoughts?

[PhilipMetzger]

@thoughtpolice has investigated such things in the past but it isn't currently possible because the project is owned by Google and this has some issues with the CLA.

[PhilipMetzger]

it'd be nice if you joined the Discord, so I can point you to previous discussions of this.

[thoughtpolice]

As far as I remember, there's nothing inherently wrong with automated bot updates, it's just that Google won't accept github[bot] as an exception to the CLA tool, meaning you need to do more work (note that dependabot works fine so there is presumably some exception listed somewhere for it.) That meant we couldn't use things like nix-flake-updater or whatever OOTB, because they rely on github[bot] doing the work.

What we need to do instead is just create a new actual GitHub account with a verified email that is on the CLA. That account can then submit automated patches in whatever way is needed.

[thoughtpolice]

FWIW I do also have a broad desire to do something like this anyway, because at some point this coming year I'd like to automate the release process and enable Trusted Publishing for crates.io; that will require some automated shenanigans and we could knock out some of these things too.

[andrewaylett]

@PhilipMetzger, I mean we could still validate that the versions match — if we can't get tooling to update all of the places a version number is referenced, we could at least have tooling (in the form of test cases) that tells us if we only updated some of the places.

(I wasn't particularly expecting a new tool to be appealing: it's one more thing for maintainers to manage, even if it's "useful". But I hadn't realised that the CLA would be an issue)

[PhilipMetzger]

@PhilipMetzger, I mean we could still validate that the versions match — if we can't get tooling to update all of the places a version number is referenced, we could at least have tooling (in the form of test cases) that tells us if we only updated some of the places.

I mean we can run something like a "if this then that" (https://fuchsia.dev/fuchsia-src/development/source_code/presubmit_checks#ifthisthenthat) tool in CI for all the mentioned places without doing the work of moving over to a bot yet.