Simplify the 'sources_locked' section

[jacebrowning]

Currently, the sources_locked section in the configuration file contains a full copy of the metadata from the corresponding sources section. The only metadata required to lock a sources version is name and rev. The rest of the information can be obtained from the base source.

[daniel-brosche]

The simplification could be done in scope of #170

[brandonaut]

Would it make sense to simply add an optional locked_rev field to each entry in sources and remove the sources_locked section entirely? That would be the most intuitive way to reduce duplication, IMO.

[jacebrowning]

@brandonaut Yeah, I think that could work. It would be good to see a proof-of-concept PR for that to see how much has to change.

[Erich-McMillan]

Would it make sense to simply add an optional locked_rev field to each entry in sources and remove the sources_locked section entirely? That would be the most intuitive way to reduce duplication, IMO.

I think I prefer to keep the sources_locked as a top level key since it makes grabbing the locked revisions easier rather than having them nested inside each source. In our recent experience with using yq to query the locked revision it may be easiest to have the following format for sources_locked.

sources:
  - name: source1
    type: git
    repo: ...
  - name: source2
    type: git
    repo: ...

sources_locked:
  source1: revSource1
  source2: revSource2
  ....

In my experiement this simplifies the yq query from:
yq e -v '.sources_locked[] | select(.name == \"*source1\")' gitman.yml
to:
yq e -v '.sources_locked[\"source1\"]' .\gitman.yml

Which to me is much easier to read and understand, particularly in the .yml file since it eliminate unnecessary name: and rev: fields and provides a 1 to 1 lookup.

[brandonaut]

I've run across a scenario where it would be very helpful to have sources and sources_locked combined so that each entry has both a rev and locked_rev: Using Renovate to automatically update Gitman dependencies.

Renovate doesn't have native Gitman support, but it does provide a way to add support for custom dependency managers by using regex matching and capture groups to help Renovate interpret a custom dependency file. For gitman.yml files, this almost works, as I can create most of the required capture groups, but I can't figure out a way to capture both sources[].rev and sources_locked[].rev for a dependency in the same regex. In other words, I can't correlate a dependency's rev in sources with its rev in sources_locked without using regex backreferences, which are intentionally disabled in Renovate's regex parser.

If sources and sources_locked could be combined as I proposed earlier, then I think it would be trivial to enable Renovate for Gitman. This could have broader appeal to other users. A sample regex could even be added in the Gitman docs to explain how to set it up.

Hope that makes sense.