As noted in #40608, we're currently showing an outdated list of possible
configuration filenames.
We can instead automate this by using the known configuration files we
know.
As we don't yet support the Platform-specific filenames, we shouldn't
include them, but add a TODO so we don't miss it.
* feat(managers/npm): allow specifying `toolSettings.nodeMaxMemory`
As noted in #40942, we're seeing an increase in memory usage across
`pnpm` and `yarn` users in Mend-hosted apps.
To allow limiting the maximum memory that any `node` child processes
will use, we can add a new `toolSettings.nodeMaxMemory` to (hopefully)
mitigate this.
Similar to the `toolSettings.jvmMaxMemory`, the self-hosted
administrator can set a maximum, which cannot be exceeded by repo-level
configuration.
* fixup! feat(managers/npm): allow specifying `toolSettings.nodeMaxMemory`
As we've had a few Discussions about it (bugs and feature requests), and
it'd be good to clarify how they work together, as well as future work
planned to integrate better.
* docs/41127-parents-may-want-to-split-over-multiples-lines
* refactor(docs): sort parents alphabetically in table and add unit tests
* refactor(docs): table - use expect instead of assert
* refacto(docs) : remove unnecessary vitest import
Co-authored-by: Michael Kriese <michael.kriese@gmx.de>
* refactor(docs): table - rename index so there are rowIndex and colIndex
* refactor(docs): rename config.test.ts to utils.test.ts
---------
Co-authored-by: Michael Kriese <michael.kriese@gmx.de>
* feat(postUpgradeTasks): allow specifying `installTools`
As noted in #8111 and #41569, it is possible that when using
`binarySource=install`, you can execute a `postUpgradeTasks`' given
command without Renovate having the right tools installed, dependent on
the Manager used for the update.
To make it possible for users to indicate that they explicitly need
given tools (at a given `constraint`), we can introduce a new
`installTools` option which will allow specifying which tools +
constraints to use when invoking the `postUpgradeTasks`'s command.
Right now, we're not defining what the `installTools'` interior type is,
but leaving it open to extension.
Co-authored-by: gpt-4.1 <jamie.tanna+github-copilot@mend.io>
* docs: add examples for `toolVersions`
---------
Co-authored-by: gpt-4.1 <jamie.tanna+github-copilot@mend.io>
* fix(gitlab): skip branch status when no pipeline found, retry after PR creation
On GitLab with MR pipelines, posting a commit status without a
pipeline_id causes GitLab to create an unwanted branch pipeline.
Skip posting the status in setBranchStatus() when no pipeline is found
after retries. Retry setting branch statuses after ensurePr() in the
with-pr block so that the MR pipeline created by GitLab can be found.
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
* fix(gitlab): gate skip-status-without-pipeline behind experimental flag
Move the behavior that skips setting a branch status check when no
pipeline is found behind the RENOVATE_X_GITLAB_SKIP_STATUS_WITHOUT_PIPELINE
experimental environment variable. Without the flag, the original
behavior of always posting the status is preserved.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* test(gitlab): restore original 'sets branch status' test case
Keep the original test that verifies branch status is set without
the experimental flag alongside the new skip-behavior test.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix(docs): sort experimental env var headers alphabetically
Move RENOVATE_X_GITLAB_SKIP_STATUS_WITHOUT_PIPELINE after
RENOVATE_X_GITLAB_MERGE_REQUEST_DELAY to satisfy alphabetical
ordering requirement in self-hosted-experimental.md.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix(gitlab): address PR review comments for skip-status-without-pipeline
Use strict `=== 'true'` check for env var, update docs wording, and
add test coverage for the new experimental flag behavior.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
As noted in #39559, we should also make it possible to use Renovate's
`toolSettings` to tune the Java Virtual Machine that's used to spawn
Gradle, via the Gradle Wrapper.
This will affect any `gradle` manager invocations, but will not apply to
`postUpgradeTasks`, as this is passed in as a parameter.
Co-authored-by: Claude Sonnet 4.5 <jamie.tanna+github-copilot@mend.io>
* - Added Renovate support for the [SCM-Manager](https://scm-manager.org/)
- SCM-Manager is a repository management tool like GitHub
- It is maintained as an open source project by the company [Cloudogu](https://cloudogu.com/en/)
- The SCM-Manager support is not feature complete yet, features like auto merging are still missing
- The SCM-Manager also got added to the documentation as another platform
author Thomas Zerr <thomas.zerr@cloudogu.com> 1690877165 +0200
committer Eduard Heimbuch <eduard.heimbuch@cloudogu.com> 1706264263 +0100
* Reverted numbering change in markdown docs
* Changed from type to interface, if possible
* Removed axios dependency and using the http layer of renovate instead
* Fixed not using scmm specific mime types for accept header
* Use git from test/util instead
* Add dummy tests for no ops
* Fix some phrasing and spelling issues
* Change scmm to scm-manager and fix SCM-Manager specific content type
* Add supported major versions, review plugin requirement, write permissions is needed
* Change using actual host rules instead of mocking it
* Change use http mocks for testing
* Update docs/usage/getting-started/running.md
Co-authored-by: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com>
* Update lib/modules/platform/scm-manager/index.ts
Co-authored-by: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com>
* Update lib/modules/platform/scm-manager/mapper.spec.ts
Co-authored-by: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com>
* Update lib/modules/platform/scm-manager/readme.md
Co-authored-by: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com>
* Update lib/modules/platform/scm-manager/readme.md
Co-authored-by: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com>
* Update lib/modules/platform/scm-manager/readme.md
Co-authored-by: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com>
* Update lib/modules/platform/scm-manager/readme.md
Co-authored-by: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com>
* Update lib/modules/platform/scm-manager/readme.md
Co-authored-by: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com>
* Fix scm-manager docs link
* Fix linting
* Fix linting
* Throw errors if username or token is not provided by the host rules
* Replace NO-OP with Not implemented
* Remove objects from log messages
* Fix linting
* Fix path to platform config options
* Fix link to self-host-configuration docs
* Fix link to self-host-configuration docs
* Remove the link to the platform config option, because the tests keep failing
* Fix link to self-host-configuration docs
* Remove not needed type cast
Co-authored-by: Michael Kriese <michael.kriese@visualon.de>
* Fix type check of protocol links
* Move scm-manager into util http folder
* Apply linting
* Add maxBodyLength function and its test
* Add test case if protocol links are not an array of links
* Use zod schema for pagination
* Apply linting
* Refactor typing with zod schema
* Fix test description
Co-authored-by: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com>
* Fix test description
Co-authored-by: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com>
* Fix test description
Co-authored-by: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com>
* Fix test description
Co-authored-by: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com>
* Update readme
Co-authored-by: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com>
* Add try catch around fetching the current user
* Switch log statement from info to debug
Co-authored-by: Michael Kriese <michael.kriese@visualon.de>
* Switch log statement from info to trace
Co-authored-by: Michael Kriese <michael.kriese@visualon.de>
* Switch log statement from debug to trace
Co-authored-by: Michael Kriese <michael.kriese@visualon.de>
* Switch log statement from info to trace
Co-authored-by: Michael Kriese <michael.kriese@visualon.de>
* Switch log statement from info to trace
Co-authored-by: Michael Kriese <michael.kriese@visualon.de>
* Switch log statement from info to trace
Co-authored-by: Michael Kriese <michael.kriese@visualon.de>
* Fix linting errors
* Remove credentials check in initRepo
* Fix imports
* Fix zod schema for repositories
* Fix zod schema for pull requests
* Fix 500 error after attempting to update an pr
* Fix wrong typing
* Refactor parameterized tests for better readability
* Refactor SCM HTTP API
* Add setToken functionality
* Remove not needed type definition
Co-authored-by: Michael Kriese <michael.kriese@gmx.de>
* Fix assertion
* Fix istanbul comment
* Change log statement
* Remove type rename
* Move inferred types close to corresponding schemas
* Add platform is experimental
* Remove type renaming
* Fix type imports
* Fix test suite description
* Remove debug log statement
Co-authored-by: Michael Kriese <michael.kriese@gmx.de>
* Fix warning
* Fix paremeterized unit tests with string templates
* Fix spelling
Co-authored-by: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com>
* Fix eslint error
* Convert trace logs to debug logs
* Convert info logs to debug
* Replace manual null and undefinded check with is util
* Rephrase instruction in readme
* Use ensureTrailingSlash instead
* Fix linting
* Keep type and schema together
* Simplify hasAssignees check
* Simplify reviewer mapping
* Remove istanbul comments
* Replace custom scmm header option with renovate native http headers option
* Let the token be passed in initPlatform
* Add description which permissions are needed
* Add support for ignorePrAuthor filter
* Add notes about automerge feature within platform readme
* Add support for fast_forward_only
* Change supported versions due to merge strategy change
* Remove commented code
* Fix import
* Use email schema
* Heed review advice
* Fix import and empty array assertions
* Fix linting issue
* Fix import errors
* Fix removed ignorePrAuthor parameter from initRepo function
* Fix failing unit tests by setting/reseting the global config
* Mark scm-manager as experimental
* Fix zod import path
* Change endpoint configuration, so that user only needs to define origin, but not also the path
* Fix warning of redundant backslash
---------
Co-authored-by: Eduard Heimbuch <eduard.heimbuch@cloudogu.com>
Co-authored-by: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com>
Co-authored-by: Michael Kriese <michael.kriese@visualon.de>
Co-authored-by: René Pfeuffer <rene@pfeuffer-web.de>
Co-authored-by: Michael Kriese <michael.kriese@gmx.de>
Co-authored-by: René Pfeuffer <rene.pfeuffer@cloudogu.com>
We've been happily using this with Mend Renovate Self-Hosted customers
since introduction in 2024, and so we're happy making this
non-experimental now.
This follows other changes where we've promoted an experimental option
to non-experimental, and heavily driven by Claude Sonnet 4.5.
We can also rename config item to use the same `repositoryCache` prefix.
Co-authored-by: Claude Sonnet 4.5 <jamie.tanna+github-copilot@mend.io>
* feat(nuget): add supportsLockFileMaintenance flag
The NuGet manager supports lock file maintenance via `packages.lock.json`
but was missing the `supportsLockFileMaintenance` export.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat(manager): add lockFileNames metadata to all lock file managers
Add `lockFileNames` field to `ManagerApi` interface and export it from
all 24 managers that support lock file maintenance. This metadata will
be used to auto-generate the lock file support table in docs.
Also adds a validation test ensuring managers with
`supportsLockFileMaintenance` always provide `lockFileNames`.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat(docs): auto-generate lockFileMaintenance lock files table
Replace the hardcoded lock file support table in configuration-options.md
with autogenerate markers and generate it from manager metadata during
docs build. This ensures the table stays in sync with manager code
automatically.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
This change introduces a heap size limitation for the Gradle daemon used
when updating the Gradle wrapper, defaults to 512m.
The heap size is limited to the globally configured limit, which
defaults to 512m. It can be configured on the repository level, but not
exceed the globally configured limit. A hard coded mimiumum heap size of
512m is enforced.
The configuration option is named `toolSettings`, which has two
properties for the maximum and initial heap size. See
`docs/usage/configuration-options#toolSettings` for more details.
As noted in #40126, after recent investment in OpenTelemetry support in
Renovate, we should update our documentation to provide a more visible
example of what this looks like, some of the different data that may be
present now, and clarify the stability status.
We can also point to npm packages, rather than the source GitHub repo,
for OpenTelemetry libraries.
As noted in #40747, we have now explicitly deprecated
`binarySource=docker`.
This has been not recommended since 2023-07, and now we're noting that
it shouldn't be used any more.
We can make sure to mark any Docker-related self-hosted configuration as
deprecated, and add a custom deprecation warning (and URL for feedback)
to usages of `binarySource=docker`, so config validation flags these
deprecated usages.
As noted in #38604, future changes to `useCloudMetadataServices` will
need to refer to this configuration before we've fully initialised
Renovate.
To simplify this, we can nudge users to only specify it through the
environment.
As a safety measure for self-hosted administrators, we can make sure
that we set `allowedUnsafeExecutions` to not allow any commands by
default.
This closes off a significant risk of executing Gradle Wrapper
commands, which use the repository's copy of the wrapper, and any
Gradle buildscript, when executing, which can lead to significant remote
code execution, even before you take into account malicious dependencies.
As this is now off-by-default, we can enable it by default in our tests
to make sure that there are minimal changes required.
To make sure that we're using secure defaults, we can make sure that
this is off-by-default.
Self-hosted administrators will be able to turn this back in if they
wish.
Jamie Tanna