Caupain

repository·main·Indexed 41 days ago

https://github.com/deezer/caupain

A lightweight tool for managing and updating Gradle version catalogs. Caupain provides fast, non-intrusive dependency update reports without the overhead of full Gradle dependency resolution. It is available as a CLI, a Gradle plugin, and a core library (caupain-core), supporting custom update policies, TOML configuration, and in-place version updates.

Tokens
17.9K
Snippets
48
Records
61
Agent score
48%

What's inside Caupain

  1. Overview of Caupain

    main

    Caupain is a tool designed to help keep Gradle version catalogs up to date. Unlike other dependency update tools, it focuses on being fast and simple by using the version catalog as the single source of truth and only handling Maven repositories.

    Key characteristics:

    • Fast: It does not plug into Gradle, avoiding the long runtimes associated with Gradle dependency resolution.
    • Non-intrusive: It does not change your files automatically; it only reports available updates and where to find information.
    • Maven-focused: It specifically targets Maven repositories within your version catalogs.
  2. Use predefined or custom policies to filter updates

    main

    Policies determine if an available version is considered an acceptable update.

    Predefined Policies

    • stability-level (Default): Only suggests updates with a stability level greater than or equal to the current version (e.g., if you use a beta, it won't suggest an alpha).
    • guava-android: Specifically for Android users to prevent -jre versions from being suggested as updates for -android versions.
    • always: Accepts all available updates.

    Custom Policies

    Custom policies can be implemented by extending the Policy interface and implementing the select method.

    1. Create a JAR containing your class.
    2. Include a META-INF/services/com.deezer.caupain.model.Policy file in the JAR containing the fully qualified name of your class.
    3. Place the JAR in the directory specified by policyPluginDir in your configuration.

    Note: Custom policies are only available when launching via the JVM launch script. If using the Gradle plugin, custom policy usage is simplified.

  3. Apply update policies

    main

    Policies filter available updates based on specific criteria. You can use predefined policies or define a custom logic block via tasks.withType<DependenciesUpdateTask>.

    Predefined Policies:

    • StabilityLevelPolicy: Only suggests updates with stability $\ge$ current version (e.g., won't suggest alpha if you use beta). This is the default.
    • GuavaAndroidPolicy: Specifically for Guava, ensures updates match the suffix (e.g., -android vs -jre) to avoid incorrect version jumps.
    • AlwaysPolicy: Accepts all updates.

    Custom Policies: Use selectIf to define custom logic. Inside the block, you have access to dependency, currentVersion, and updatedVersion.

    tasks.withType<DependenciesUpdateTask> {
        // Use a predefined policy
        selectIf(StabilityLevelPolicy)
    
        // Define a custom policy
        selectIf {
            updatedVersion.text == "1.0.0"
        }
    }
  4. Configure repository component filtering

    main

    By default, Caupain searches all repositories in order. You can optimize this by defining component filtering using an array of tables in your TOML configuration. This allows you to specify which includes or excludes apply to specific repositories.

    Note: The [[ repositories ]] array of tables must be at the very end of the configuration file to be parsed correctly.

    # Repository block in array of tables must be at the end
    [[ repositories ]]
    default = "mavenCentral"
    includes = [
        { group = "com.example", name = "example-lib" },
        { group = "com.example2.**" }
    ]
    excludes = [
        { group = "com.other" }
    ]
    
    [[ repositories ]] 
    url = "http://www.example.com/repo"
    includes = [
        { group = "com.example", name = "example-lib" }
    ]
  5. Exclude updates in-line in TOML files

    main

    You can prevent specific dependencies or versions from being suggested for updates directly within your libs.versions.toml file using the #ignoreUpdates comment. This can be placed on the same line as the definition or as a full-line comment immediately preceding it. You can also use #noinspection NewerVersionAvailable for compatibility with IntelliJ IDEA.

    [versions]
    my-excluded-version-ref = "1.0.0" #ignoreUpdates
    #ignoreUpdates
    my-regular-ref = "1.0.0"
    
    [libraries]
    my-excluded-lib = { module = "com.example:example", version.ref = "my-excluded-version-ref" } #ignoreUpdates
    my-regular-lib = { module = "com.example:example", version.ref = "my-regular-ref" }
    
    [plugins]
    my-excluded-plugin = { id = "com.example.plugin", version.ref = "my-excluded-version-ref" } #ignoreUpdates
  6. Perform in-place version catalog updates

    main

    To automatically update your version catalog and the Gradle wrapper with the latest versions found by Caupain, use the replaceOutdatedDependencies task.

    Requirements and Constraints:

    • This task only works if there is exactly one version catalog provided in the project.
    • The onlyCheckStaticVersions parameter must be set to true (which is the default behavior).
    • This task also triggers the Gradle wrapper task to update your Gradle wrapper to the latest version.

    Warning: Use this task with care as it performs automated writes to your configuration files.

    ./gradlew replaceOutdatedDependencies
  7. How to use Caupain

    main

    Caupain can be integrated into your workflow in two ways:

    1. Command Line Tool (CLI): Use it as a standalone binary. Refer to cli/README.md for installation and command usage.
    2. Gradle Plugin: Integrate it directly into your Gradle builds. Refer to gradle-plugin/README.md for setup instructions.

    Choose the method that best fits your CI/CD pipeline or local development environment.

  8. Filter or exclude updates in the version catalog

    main

    You can control which updates Caupain suggests using three methods:

    1. Global Configuration (TOML)

    Use includedKeys, excludedKeys, includedLibraries, excludedLibraries, includedPlugins, or excludedPlugins in your config file.

    • Libraries: Can be filtered by group and name. If name is omitted, the group is treated as a glob.
    • Plugins: Filtered by id.

    2. In-line Exclusions (Comments)

    In your Gradle version catalog TOML file, you can ignore specific updates by adding a #ignoreUpdates comment on the same line as the version reference or dependency definition, or as a full-line comment immediately preceding it.

    You can also use #noinspection NewerVersionAvailable for IntelliJ compatibility.

    3. Version Filters

    Use the filters key in the main configuration to restrict updates to specific version patterns (e.g., prefix 1.+ or ranges (1.2, 1.5]).

    # In-line exclusion in your version catalog
    [versions]
    my-excluded-version-ref = "1.0.0" #ignoreUpdates
    #ignoreUpdates
    my-regular-ref = "1.0.0"
    
    [libraries]
    my-excluded-lib = { module = "com.example:example", version.ref = "my-excluded-version-ref" } #ignoreUpdates
  9. Update version catalogs in-place with --in-place

    main

    Use the --in-place option to automatically update your version catalog with the latest versions found by Caupain. This replaces existing versions in the catalog and will also update the Gradle wrapper properties file if a Gradle version update is detected.

    Requirements for in-place updates:

    1. There must be exactly one version catalog provided.
    2. The onlyCheckStaticVersions parameter must be set to true (which is the default behavior).

    Note: This option is intended for careful use and cannot be configured via a permanent configuration setting to prevent accidental updates.

    caupain --in-place
  10. Install the Caupain CLI

    main

    Caupain is available as a single executable for Linux, macOS, and Windows, or as a JAR file. Use the following commands based on your operating system:

    macOS

    Install via Homebrew:

    brew install deezer/repo/caupain

    Linux

    For Debian-based distributions, add the Deezer repository first:

    sudo mkdir -p /usr/local/share/keyrings
    sudo curl -sfLo /usr/local/share/keyrings/deezer.gpg https://research.deezer.com/debian-repo/gpg.key
    echo "deb [signed-by=/usr/share/local/keyrings/deezer.gpg] https://research.deezer.com/debian-repo/ stable main" | sudo tee -a /etc/apt/sources.list.d/deezer.list
    sudo apt update

    Then install Caupain:

    sudo apt install caupain

    Windows

    Install via Chocolatey:

    choco install caupain

    Manual Installation / Build

    • Download the latest release from the GitHub releases page.
    • Build from source by cloning the repository and running ./gradlew :cli:buildCurrentArchBinary in the root directory.
    brew install deezer/repo/caupain