I must admit I haven’t looked deeply into the issue but I didn’t find an obvious solution, so hopefully, a solution will be posted here.
Problem: Our growing OCaml project has many opam files at the project root, and most of them are empty. This clutters the view in GitHub and elsewhere.
The opam files were created because dune requires such a file for any local library that’s declared as public. Having an empty file is sufficient for the project to build. Maybe we shouldn’t leave them empty, but this doesn’t solve the problem. We’d like to hide them from view in one way or another. Being able to keep them in an opam/ folder or similar would be great. Is there such a solution already? Is it more of an opam issue or a dune issue?
public libraries and executables need to be attached to a package
packages are declared either by the presence of a .opam file in the root, or by (package) in dune-project
(this does not apply if you’re not interested in opam) if you’re using the latter, you can in addition set (generate_opam_files) in dune-project and the opam files will be generated from the metadata in dune-project
In a nutshell, you can delete parser_rust.opam, add (package (name parser_rust)) in dune-project and you’ll be done.
To go further: you don’t have to map libraries 1:1 to packages. For example, if you set (public_name parser.rust), this will go in the parser package. If you do the same for parser.swift, this means you’ll have a parser package that contains the parser.rust and parser.swift libraries.
It can be a good idea or not depending on the situation.
The remaining issue is of installing the opam dependencies by extracting them from the package definitions. We’ve been using:
opam install --deps-only .
How to achieve the same effect without having semgrep.opam and other opam files in git? The documentation says dune build will create the opam files, but we don’t want and we can’t build the project before the dependencies are installed. Is there a dune subcommand that will only generate the opam files?
Eventually, we want to install specific versions of packages as produced by opam lock (creates foo.opam.locked from foo.opam, both being in the same format). According to @Khady 's post from 2018, it’s done with
opam install --deps-only --locked .
and it works nicely. The issue with lock files is that they must be kept under version control. Opam format, dune format, or something else doesn’t matter to me, of course, but we want either just one such lock file or have many lock files buried in a subfolder out of sight.
Ah nice Fabrice. We should have maybe used it instead of using tree-sitter-solidity.
We should join forced to check solidity! People have written a few semgrep rules for it: