bazel central registry lacks releaseTimestamp

[jkanywhere]

Tell us more.

I use renovate to maintain in my MODULE.bazel

My renovate config contains "minimumReleaseAge": "7 days",

It appears that renovate cannot determine when modules are released to Bazel Central Registry, but that information is available on github.

I get the following in logs

DEBUG: Marking 4 release(s) as pending, as they do not have a releaseTimestamp and we're running with minimumReleaseAgeBehaviour=timestamp-required (repository=spirl/spirl)
       "depName": "aspect_bazel_lib",
       "versions": ["2.22.5", "2.22.4", "2.22.2", "2.22.0"],
       "check": "minimumReleaseAge"

DEBUG: Marking 1 release(s) as pending, as they do not have a releaseTimestamp and we're running with minimumReleaseAgeBehaviour=timestamp-required (repository=spirl/spirl)
       "depName": "gazelle",
       "versions": ["0.48.0"],
       "check": "minimumReleaseAge"

DEBUG: Marking 1 release(s) as pending, as they do not have a releaseTimestamp and we're running with minimumReleaseAgeBehaviour=timestamp-required (repository=spirl/spirl)
       "depName": "bazel_skylib",
       "versions": ["1.9.0"],
       "check": "minimumReleaseAge"

More details from the logs:

               {
                 "datasource": "bazel",
                 "depType": "bazel_dep",
                 "depName": "aspect_bazel_lib",
                 "currentValue": "2.21.2",
                 "updates": [
                   {
                     "bucket": "non-major",
                     "newVersion": "2.22.5",
                     "newValue": "2.22.5",
                     "newMajor": 2,
                     "newMinor": 22,
                     "newPatch": 5,
                     "updateType": "minor",
                     "isBreaking": false,
                     "pendingChecks": true,
                     "branchName": "renovate/aspect_bazel_lib-2.x"
                   }
                 ],
                 "packageName": "aspect_bazel_lib",
                 "versioning": "bazel-module",
                 "warnings": [],
                 "registryUrl": "https://raw.githubusercontent.com/bazelbuild/bazel-central-registry/main",
                 "homepage": "https://docs.aspect.build/rules/aspect_bazel_lib",
                 "currentVersion": "2.21.2",
                 "isSingleVersion": true,
                 "fixedVersion": "2.21.2"
               },

               {
                 "datasource": "bazel",
                 "depType": "bazel_dep",
                 "depName": "gazelle",
                 "currentValue": "0.47.0",
                 "updates": [
                   {
                     "bucket": "non-major",
                     "newVersion": "0.48.0",
                     "newValue": "0.48.0",
                     "newMajor": 0,
                     "newMinor": 48,
                     "newPatch": 0,
                     "updateType": "minor",
                     "isBreaking": false,
                     "pendingChecks": true,
                     "branchName": "renovate/gazelle"
                   }
                 ],
                 "packageName": "gazelle",
                 "versioning": "bazel-module",
                 "warnings": [],
                 "sourceUrl": "https://github.com/bazel-contrib/bazel-gazelle",
                 "registryUrl": "https://raw.githubusercontent.com/bazelbuild/bazel-central-registry/main",
                 "currentVersion": "0.47.0",
                 "isSingleVersion": true,
                 "fixedVersion": "0.47.0"
               },

               {
                 "datasource": "bazel",
                 "depType": "bazel_dep",
                 "depName": "bazel_skylib",
                 "currentValue": "1.8.2",
                 "updates": [
                   {
                     "bucket": "non-major",
                     "newVersion": "1.9.0",
                     "newValue": "1.9.0",
                     "newMajor": 1,
                     "newMinor": 9,
                     "newPatch": 0,
                     "updateType": "minor",
                     "isBreaking": false,
                     "pendingChecks": true,
                     "branchName": "renovate/bazel_skylib-1.x"
                   }
                 ],
                 "packageName": "bazel_skylib",
                 "versioning": "bazel-module",
                 "warnings": [],
                 "sourceUrl": "https://github.com/bazelbuild/bazel-skylib",
                 "registryUrl": "https://raw.githubusercontent.com/bazelbuild/bazel-central-registry/main",
                 "currentVersion": "1.8.2",
                 "isSingleVersion": true,
                 "fixedVersion": "1.8.2"
               },

However, for each component there is a published date available.

aspect_bazel_lib: https://registry.bazel.build/modules/aspect_bazel_lib 2.22.5 "published 3 months ago" -> bazelbuild/bazel-central-registry@a92a650

On registry.bazel.build it only shows "days ago", but clicking on the link navigates to a specific commit with a full timestamp
gazelle: https://registry.bazel.build/modules/gazelle version 0.48.0 -> bazelbuild/bazel-central-registry@87560db

bazel_skylib https://registry.bazel.build/modules/bazel_skylib 1.9.0 "published 3 months ago" -> bazelbuild/bazel-central-registry@e42de35

[jamietanna]

Looking into this in more depth:

• For a package such as aspect_bazel_lib, we'll look up https://github.com/bazelbuild/bazel-central-registry/blob/main/modules/aspect_bazel_lib/metadata.json
  • In there we can see no releaseTimestamp information
• If we look at the version's metadata (https://github.com/bazelbuild/bazel-central-registry/blob/main/modules/aspect_bazel_lib/2.22.5/source.json) we can't see any other information

I guess that the timestamp is based on the commit that introduced those files?

If so, that may be a slightly expensive lookup for us to make (as we'll need to do an additional API call per release, per package) - thoughts @viceice ?

The "best case" I'd go for is that the metadata.json contains that metadata, so there's a single source-of-truth for all users, and it allows us to reduce API calls

[viceice]

agreed, it should be published into the metadata, otherwise it's too expensive.

is the commit digest inside the registry metadata? that would be unique and could be cached for long time

[jkanywhere]

I understand you are requesting a change to the bazel-central-registry. Do I understand properly?

I created a companion issue bazelbuild/bazel-central-registry#8245 to see if they would be OK adding release timestamp to the metadata.

[viceice]

yes