Detect outdated recipes

[Pierstoval]

@weaverryan asked me something about Flex since #439 has been merged.

The proposal is to find a way to tell the user something like "Hey, some recipes on your project are not up to date, would you like to reconfigure them?". ?
I think it's a very cool idea.

I first thought we could plug into the composer outdated command to check all project installed recipes via symfony.lock and check on the Flex server if a new version exists, and then warn the user, but I have no clue of how we could achieve this for now (it might impact the Flex server, or not, I don't know).

WDYT?

[stof]

I suggest creating a separate command if we do that, rather than altering what composer outdated does. Checking whether recipes have changed is not the same than checking whether your packages need an update (and the action you would take is not the same).

[weaverryan]

I'd like to render it after a composer update. I was just talking with a user today on Slack: they upgraded to Symfony 4.2, but couldn't figure out why their env.local file wasn't being loaded. They also weren't aware (and they shouldn't need to be) that this feature was made available via a recipe change. So, they would not really know that they should run the new command.

Displaying it after a composer update is a nice balance between showing it too often (after composer install) and hiding it in a new command (we could of course have the new command - that's a nice idea, but also display it automatically after an update).

[Pierstoval]

Something that comes into my mind:

1. When Flex detects that packages must be updated during a composer update, retrieve the list of the packages and the ref that's stored in symfony.lock for each package.
2. This is sent to the Flex server with a simple payload like {"vendor/package": "{ref}", ...}
3. Flex returns a boolean (0 = nothing to do, 1 = at least one has a new recipe)
4. If the Flex server returns 1, a message like Some packages need upgrade, use "composer sync-recipes --force" (...)

I'm not sure about 3., maybe it should return the list of packages that must be updated
I also think that sync-recipes --force should accept a [<packages>]... array argument to only reconfigure some recipes, instead of everything (makes it simpler to reconfigure only flex+fwbundle for bigger projects). This way, the warning message can just be You can run "composer sync-recipes --force package1 package2" to reconfigure the recipes, only showing the list of packages that are the object of a recipe upgrade since the last time the recipe was configured.

WDYT?

[nicolas-grekas]

As I told @weaverryan yesterday, I'm not convinced we need that for now:

The issue with the reminder might be that it might be too noisy/annoying, like false positives. I'm not 100% confident this won't happen, eg:
-- "Hey, please sync recipes!"
-- "Thank you but no. That's my config and it works fine today, I'm not willing to potentially break my app."

Instead we could remind to run sync-recipes regularly on the blog, when we do major changes. Which we won't do often. Having all recipes for all libs say something to me daily is going to be noisy/annoying.

Another reason is also that sync:recipes --force is not ready for prime time (see eg #457 and #456).

We don't have any experience with it. It's too early to know if we need that reminder and in which format to me.

[nicolas-grekas]

Closing for now as explained.