How to automatically keep up with latest version of htmx?

[cedric-appdirect]

People might be familiar with tools like dependabot that automatically generate PR when one of your dependencies is updated. This make life keeping up with latest version easy.

In the case of HTMX, as it is only just a line in some text file somewhere that dependabot and similar tool can not locate, there is no such possibility at the moment. For my own project, I am considering writing a small Go package (as that's the language I use), that will return the latest htmx version and its sha384 integrity hash. A github action running on schedule would check the content of https://htmx.org/docs/ and automatically update the content of such package.

Now, I am thinking this might be useful for a lot of language and for more people than just me. So what do people think should be the right approach to this problem and is there an interest to provide a solution to it? I could spend some time implementing it, I think.

[wburningham]

Renovate supports custom rated managers that let you target any string in any file. I’m not familiar with dependabot, but I would guess it could do something similar. If it can’t I would say implementing it there instead of a separate tool is the best approach. Thoughts?

[cedric-appdirect]

I guess there is two problem to solve. First one how to get the latest version number of htmx and its sha384 integrity hash and second how that is then used. I see your point with renovate, and that solve the use case for the second point, not the first point. I am not sure if the same approach would solve it for dependabot, but might be wrong. So what do you think is the right solution for getting the latest version/sha384 of htmx?

[wburningham]

The first problem should also be solved. GitHub already has a releases API with the latest version and sha. https://api.github.com/repos/bigskysoftware/htmx/releases

Renovate and dependabot should already use that as a data source in detecting if there is an update.

[cedric-appdirect]

As far as I can see, it is currently not there. I don't know if it is a configuration settings for the repository that is missing or something else, but if you look up for sha or the checksum itself, you will not find them in any node.

[wburningham]

I missed that. Looks like GitHub doesn't automatically calculate the SHA of release assets. The HTMX owner would have to publish that as part of a release asset.