bumping the version doesn't execute npm preversion hook

[karfau]

This is a:

• Bug report (non-security related)
• Feature request
• I'm not sure which of those it is

I'm using:

• The Renovate GitHub App
• Self-hosted GitHub
• Self-hosted GitLab
• Self-hosted VSTS

Please describe the issue:

I have configured a preversion script in my package.json to run (tests and generate files) when bumping my version, so that generate files are updated and can be part of the same commit.

In my renovate.json I have configured "bumpVersion": "patch" since a check for a PR fails if the version has not been changed compared to master.

When the bot creates a PR the version is correctly bumped, but the generated files (they can change when a dependency is updated) didn't change.

What would be the correct way to ensure that the preversion hook is executed when Renovate files a PR?

[rarkins]

The bot updates the package.json version manually, rather than calling npm version. But more importantly, we cannot allow arbitrary scripts to run on a shared infrastructure like the hosted app you are using - you could potentially scan the network, delete files, install a daemon, etc. Also, right now we don't clone/download a complete copy of each repository either, we only download the package files we need. So if the script was needing to update other files, then that would be a second challenge.

I will leave this open as a feature request because I have some ideas about how to one day achieve this (basically having an option of cloning and isolating repositories like a CI system does), but it's definitely not a short term thing. The earliest it could be available to you in the medium term is if you run your own bot, because then obviously the security concerns go away.