Require users to be responsible for Vega and other dependencies

[0x2b3bfa0]

Context

• Remove vega related packages #8
• Installing unpinned vega-lite package breaks Node 12 support #40

Code

setup-cml/src/utils.js

Line 37 in a7b00a8

`${sudoPath} npm install -g canvas@2 vega@5 vega-cli@5 vega-lite@4 @dvcorg/cml${

Proposals

@DavidGOrtega suggested in #8 that “Vega should be installed as a separate action”

[DavidGOrtega]

No, we finally decided to not do that since many workflows were broken.

[0x2b3bfa0]

Alright, then should we keep them here or add them as optional dependencies on CML's package.json and install them only on GitHub Actions?

[casperdcl]

👍 optional deps + Docker using said optional deps directly (rather than hardcoding into the Dockerfile).

[0x2b3bfa0]

Given that the official Vega-Lite documentation recommends using npx directly,¹ managing the installation of dependencies behind the back of users is a bit of a footcannon.

Explicit is better than implicit — PEP 20

Footnotes

1. A bit fallacious; standalone usage would be rather lengthy: npx --yes --package canvas --package vega-lite {command} where {command} is vl2png or similar. ↩

[dacbd]

if we want to ditch this from the action I'd say...

Step 0:

• create a public timeline for following

Step 1:

• create a flag to additionally install vega-cli tools, default true
• use action's mechanism to warn users

Step 2:

• change the default for the flag to false

Optional step 3:

• remove from the codebase and create simpler bash/composite action to npx or npm -g install vega cli tools

[dacbd]

setup-cml@v2 implements step-1 of the above, going to close this issue and force step-2 if the npm install starts to fail for users.