WinGet Configuration File Support

[commiterate]

Tell us more.

WinGet lets users concisely define dependency software (fetched with WinGet) and system settings (set with PowerShell DSC) with a WinGet configuration file.

• https://learn.microsoft.com/en-us/windows/package-manager/configuration
• https://learn.microsoft.com/en-us/windows/package-manager/configuration/create

configuration.dsc.yaml

# yaml-language-server: $schema=https://aka.ms/configuration-dsc-schema/0.2
properties:
  assertions:
    - resource: Microsoft.Windows.Developer/OsVersion
      directives:
        description: Verify minimum OS version.
        allowPrerelease: true
      settings:
        MinVersion: 10.0.22000
  resources:
    - resource: Microsoft.Windows.Developer/DeveloperMode
      directives:
        description: Enable developer mode.
        allowPrerelease: true
      settings:
        Ensure: Present
    - resource: Microsoft.WinGet.DSC/WinGetPackage
      id: netRuntimePackage
      directives:
        description: Install ASP.NET Core Runtime 9.0.
        allowPrerelease: true
      settings:
        id: Microsoft.DotNet.AspNetCore.9
        version: 9.0.1
        source: winget
  configurationVersion: 0.2.0

This is useful for local development with Windows containers/VMs (so WinGet doesn't mess with the host) and ephemeral Windows CI/CD containers/VMs.

---

The Microsoft.WinGet.DSC/WinGetPackage resource supports a version setting for WinGet packages to lock package versions.

https://github.com/microsoft/winget-cli/blob/fd8f4977376607110469371038d780923ffac0df/src/PowerShell/Microsoft.WinGet.DSC/Microsoft.WinGet.DSC.psm1#L449-L459

Ideally, Renovate would be able to update WinGet package versions in the WinGet configuration.

The microsoft/winget-pkgs Git repository is the package index (likely will be the Renovate data source).

[github-actions[bot]]

Hi there,

You're asking us to support a new package manager. We need to know some basic information about this package manager first. Please copy/paste the new package manager questionnaire, and fill it out in full.

Once the questionnaire is filled out we'll decide if we want to support this new manager.

Good luck,

The Renovate team

[commiterate]

New package manager questionnaire

Did you read our documentation on adding a package manager?

• I've read the adding a package manager documentation.

Basics

What's the name of the package manager?

Windows Package Manager (i.e. WinGet)

What language(s) does this package manager support?

Manages Windows packages and system settings.

How popular is this package manager?

Windows built-in.

Does this language have other (competing?) package managers?

• Yes (give names).
• No.

Competing package managers:

• Chocolatey

What are the big selling points for this package manager?

• Built into Windows.
• Works with PowerShell DSC which Microsoft uses for Azure Machine Configuration.
  • Chocolatey's DSC integration (cChoco) seems abandoned and only lets users invoke Chocolatey from DSC, not vice versa. WinGet configurations unify DSC and WinGet.
• Can be used with Windows containers/VMs for isolated and (generally) reproducible dev/build environments.

Detecting package files

What kind of package files, and names, does this package manager use?

*.dsc.yaml files.

Which fileMatch pattern(s) should Renovate use?

^*\\.dsc\\.yaml$

References:

• https://learn.microsoft.com/en-us/windows/package-manager/configuration/create#file-naming-convention
  • configuration.dsc.yaml
• https://learn.microsoft.com/en-us/windows/package-manager/winget/configure
  • config-file-name.dsc.yaml

Do many users need to extend the fileMatch pattern for custom file names?

• Yes, provide details.
• No.

Is the fileMatch pattern going to get many "false hits" for files that have nothing to do with package management?

Unlikely due to the extra .dsc.

Vanilla PowerShell DSC configuration files (not WinGet configuration files) use *.dsc.config.yaml instead (docs).

Parsing and Extraction

Can package files have "local" links to each other that need to be resolved?

No.

Package file parsing method

The package files should be:

• Parsed together (in serial).
• Parsed independently.

Which format/syntax does the package file use?

• JSON
• TOML
• YAML
• Custom (explain below)

How should we parse the package files?

• Off the shelf parser.
• Using regex.
• Custom-parsed line by line.
• Other.

Does the package file have different "types" of dependencies?

• Yes, production and development dependencies.
• No, all dependencies are treated the same.

List all the sources/syntaxes of dependencies that can be extracted

Microsoft.WinGet.DSC/WinGetPackage resource statements.

For example:

configuration.dsc.yaml

# yaml-language-server: $schema=https://aka.ms/configuration-dsc-schema/0.2
properties:
  resources:
    - resource: Microsoft.WinGet.DSC/WinGetPackage
      id: netRuntimePackage
      directives:
        description: Install ASP.NET Core Runtime 9.0.
        allowPrerelease: true
      settings:
        id: Microsoft.DotNet.AspNetCore.9
        version: 9.0.1
        source: winget
  configurationVersion: 0.2.0

Describe which types of dependencies above are supported and which will be implemented in future

Microsoft.WinGet.DSC/WinGetPackage resource only.

Versioning

What versioning scheme does the package file(s) use?

Semantic versioning (semver).

Does this versioning scheme support range constraints, like ^1.0.0 or 1.x?

• Supports range constraints (for example: ^1.0.0 or 1.x), provide details.
• No.

Lookup

Is a new datasource required?

• Yes, provide details.
• No.

Data sources:

• Windows Package Manager Community Repository (winget-pkgs GitHub repository)
  • High priority.
• REST package registries
  • Medium priority.
  • Private registry services list.
• Windows Store
  • Low priority.

Will users want (or need to) set a custom host or custom registry for Renovate's lookup?

• Yes, provide details.
• No.

The Microsoft.WinGet.DSC/WinGetPackage resource has a source option for indicating the package source, with winget referring to the winget-pkgs registry.

Where can Renovate find the custom host/registry?

• No custom host or registry is needed.
• In the package file(s), provide details.
• In some other file inside the repository, provide details.
• User needs to configure Renovate where to find the information, provide details.

Are there any constraints in the package files that Renovate should use in the lookup procedure?

• Yes, there are constraints on the parent language (for example: supports only Python v3.x), provide details.
• Yes, there are constraints on the parent platform (for example: only supports Linux, Windows, etc.), provide details.
• Yes, some other kind of constraint, provide details.
• No constraints.

There doesn't seem to be a minimum OS enforcement in WinGet packages.

Will users need the ability to configure language or other constraints using Renovate config?

• Yes, provide details.
• No.

Artifacts

Does the package manager use a lock file or checksum file?

• Yes, uses lock file.
• Yes, uses checksum file.
• Yes, uses lock file and checksum file.
• No lock file or checksum.

Is the locksum or checksum mandatory?

• Yes, locksum is mandatory.
• Yes, checksum is mandatory.
• Yes, lock file and checksum are mandatory.
• No mandatory locksum or checksum.
• Package manager does not use locksums or checksums.

If lockfiles or checksums are used: what tool and exact commands should Renovate use to update one (or more) package versions in a dependency file?

N/A

Package manager cache

Does the package manager use a cache?

• Yes, provide details.
• No.

If the package manager uses a cache, how can Renovate control the cache?

• Package manager does not use a cache.
• Controlled via command line interface, provide details.
• Controlled via environment variables, provide details.

Should Renovate keep a cache?

• Yes, ignore/disable the cache.
• No.

Generating a lockfile from scratch

Renovate can perform "lock file maintenance" by getting the package manager to generate a lockfile from scratch.
Can the package manager generate a lockfile from scratch?

• Yes, explain which command Renovate should use to generate the lockfile.
• No, the package manager does not generate a lockfile from scratch.
• No, the package manager does not use lockfiles.

Other

What else should we know about this package manager?

N/A.

[rarkins]

Converted to issue: #33818