Consider improving theme packaging

[akhmerov]

Proposal

The compatibility issues between mystmd <1.7.0, and myst-theme >1.0.0 suggest the need for more explicit versioning.

I believe this is typically solved by package repositories and placing version constraints on dependencies or peer dependencies (e.g. sphinx/mkdocs).

An alternative would be to implement explicit versioning of themes in myst.yml and implement version validation in mystmd talking to a theme server.

[choldgraf]

Would this PR be a step in the right direction?

• publish themes through GH releases myst-theme#659

[akhmerov]

That PR is useful, but it seems to only be loosely related to the issue here:

• I believe that one only changes where the artifacts are located, not how they are versioned.
• It only applies to myst-theme itself, and doesn't provide other possible themes a way to declare their requirements.

[akhmerov]

Ah, I realize that I didn't specify the more concrete proposal. I would be strongly in favor of publishing themes/templates on npm/pypi, and using environment management tools as a way to ensure that the template version is fixed and compatible.

[parmentelat]

Just wanted to chime in and outline that jupyter-book/myst-theme#659 is one piece in a wider reflexion

for the record there was also this piece
#2317
but that needs a big update after all the discussions, also in
#2344

So it seems the discussion needs a reboot and to restart from a clean slate
Just earlier I was proposing on discord to use the MEP mechanism to discuss that topic, would that make sense ?
or otherwise where ?

[agoose77]

I agree that we do need to come up with a plan for tightening up the deployment strategy for themes. I think this connects with the conversation around #2490, too. We should think about aiding external packagers like conda-forge and nixpkgs when we do this.

To that effect, supporting package-manager driven provisioning would be a nice way to do this. There are good examples from JupyterLab in terms of its extension management that we can look at for prior art.

[akhmerov]

Thanks, yes, I was just thinking about security as well.

While npm has clear deficiencies, the current security model of "download and execute the latest file if cache isn't available" seems worse. Of course, I am not sold on npm, but anything with versioning and locking would be great.

[rowanc1]

Related issue on theme versioning:

• Theme versioning improvements! #854