As noted in #43761, we had recently set `CI=true` for the Renovate and
Containerbase orgs on Mend-hosted apps due to a pnpm v11 requirement:
ERR_PNPM_ABORTED_REMOVE_MODULES_DIR_NO_TTY Aborted removal of
modules directory due to no TTY
If you are running pnpm in CI, set the CI environment variable to
"true", or set "confirmModulesPurge" to "false".
Similarly in #43606, it was noted that we should do this for `mise lock`
to mark the workspace as "trusted".
Although we went with a different situation, there will be cases where
this is useful for tools being executed, for instance when we invoke `yarn`.
We also make sure to keep our documentation up-to-date as we add to the
specific overrides.
With help from Claude Sonnet and Opus to:
- perform some of the mechanical updates as part of this change
- ensure that the Docker sidecar always has `hardcodedProcessEnv` passed
into it
- catch a needed change to `exposeAllEnv` handling
Co-authored-by: Claude Opus 5 <jamie.tanna+claude-code@mend.io>
Co-authored-by: Claude Sonnet 5 <jamie.tanna+claude-code@mend.io>
When executing commands for `binarySource=docker`, we have two areas
that a command could have shell expansion/injection:
- on the host (when constructing the `bash -l -c`)
- in the container (when running a manager-specific command)
When constructing the host's command, we previously would escape the
`"`, which allows Bash syntax for `${VAR}` and `$(...)` syntax inside
it.
While managers use `quote()` to make the inputs safer, the use of `"`
around that would not provide any protection, and lead to cases where
the `quote()` could be expanded on the host, before `docker run`
executes.
After recent changes to each manager - and removal of `shell: true` -
this doesn't seem to be exploitable, but this hardens it further.
Additionally, we never escaped `\`, so a value containing `\"` produces
a command that `shlex.split` rejects, and the update fails rather than
running.
Instead, we can quote the whole `-c` argument with `quote()`, which
round-trips through both `shlex.split` - the default, no-shell path - and
a real shell.
This removes the `lgtm [js/incomplete-sanitization]` suppression as
we're now correctly sanitising this.
Note this doesn't remove the need for the managers to quote their own
values, as the second area above is still a real shell.
Co-authored-by: Claude Opus 5 <jamie.tanna+claude-code@mend.io>
To prevent the possibility of the `distributionType` in a given
repository including shell metacharacters, which could lead to command
execution, we can make sure they are quoted appropriately.
Co-authored-by: Claude Sonnet 5 <jamie.tanna+claude-code@mend.io>
* test: ensure we set `binarySource=global`
As part of future changes, we'll correctly return the default value from
`GlobalConfig.get`, instead of `undefined` if no default is provided in
the `get` call.
As `binarySource=install` is the default, this then leads to these tests
failing, as they're intended to run with `binarySource=global`.
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* fixup! test: ensure we set `binarySource=global`
* fixup! fixup! test: ensure we set `binarySource=global`
---------
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
As reported in #41994, in 49fbc8392e, we
assumed that `updateArtifacts` would only ever be called when updating
the `maven-wrapper.properties`.
As this isn't always the case, and we may be updating a `mvnw` file, we
should check what we're about to delete, before we do.
* feat(maven-wrapper): support checksum updates when updating versions
When updating Maven distribution or wrapper versions, Renovate now updates
the corresponding SHA-256 checksums (distributionSha256Sum, wrapperSha256Sum)
by downloading the new artifacts and computing their hashes.
- Add HTTP client to fetch artifacts and compute SHA-256 checksums
- Update checksums before running wrapper:wrapper command
- Delete old maven-wrapper.jar to prevent checksum validation failures
- Handle maven-only updates when distributionSha256Sum is present
- Preserve old checksums on network failures (PR still created)
Closes#33444
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Signed-off-by: Gasper Kojek <gkojek@gradle.com>
* fix(maven-wrapper): strip checksums before wrapper:wrapper to avoid validation failure
When wrapper:wrapper runs, mvnw downloads the new JAR and validates it
against checksums in the properties file. With old checksums still present,
this validation fails. Now checksums are stripped before running
wrapper:wrapper and recomputed afterward.
Signed-off-by: Gasper Kojek <gkojek@gradle.com>
* fix(maven-wrapper): preserve distributionType when running wrapper:wrapper
Use existing distributionType from properties file or default to 'script'
when running wrapper:wrapper. This ensures JAR-based mode is preserved
for repos using checksums.
Signed-off-by: Gasper Kojek <gkojek@gradle.com>
* fix(maven-wrapper): Fix after merge
* test(maven-wrapper): cover checksum branches
* fix(maven-wrapper): preserve checksums on failures
* test(maven-wrapper): cover missing content branch
* Merge branch 'main' into gk/mavenWrapperChecksums-old
* main: (215 commits)
fix(deps): update ghcr.io/renovatebot/base-image docker tag to v13.1.15 (main) (#40929)
docs(terraform): clarify release timestamp and limitation (#40923)
feat(gradle): allow specifying Gradle daemon heap size (#40090)
fix(deps): update ghcr.io/renovatebot/base-image docker tag to v13.1.14 (main) (#40911)
docs(minimum-release-age): clarify lack of support for non-Docker Hub (#40910)
build(deps): update dependency re2 to v1.23.2 (main) (#40906)
fix(deps): update ghcr.io/renovatebot/base-image docker tag to v13.1.13 (main) (#40899)
fix(gitlab): skip automerge retry when merge_when_pipeline_succeeds already set (#39979)
chore(renovate): enable maintenance branch (#40871)
chore(deps): update dependency globals to v17.2.0 (main) (#40883)
chore(deps): update dependency type-fest to v5.4.2 (main) (#40882)
fix(deps): update ghcr.io/renovatebot/base-image docker tag to v13.1.12 (main) (#40880)
fix(workers): re-attempt platform automerge only in case of new commits (#40028)
build(deps): update dependency protobufjs to v8 (main) (#40878)
chore(deps): update github artifact actions (main) (major) (#40876)
chore(deps): update peter-evans/create-pull-request action to v8 (main) (#40877)
chore(deps): update dessant/lock-threads action to v6 (main) (#40874)
chore(deps): update dessant/label-actions action to v5 (main) (#40873)
chore(deps): update dependency vite-tsconfig-paths to v6 (main) (#40872)
chore(deps): update dependency @containerbase/semantic-release-pnpm to v1.3.18 (main) (#40669)
...
# Conflicts:
# lib/modules/manager/maven-wrapper/artifacts.spec.ts
# lib/modules/manager/maven-wrapper/artifacts.ts
* refactor(maven-wrapper): address PR review comments
(cherry picked from commit 9084d356496f6258dc0e846d926598f39b65cda3)
* fix: use named capture group in getChecksumValue
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Signed-off-by: Gasper Kojek <gkojek@gradle.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
As `fileName` makes more sense (as it's not always a lock file we're
updating).
Also, if you set `fileName`, it would never actually output the
filename.
This renames the usages of `lockFile` to `fileName`.
Co-authored-by: Claude Sonnet 4.5 <jamie.tanna+github-copilot@mend.io>
* fix(util/exec): migrate to `execa` for command execution
As part of a future change, we need to make sure that we have
cross-platform support for specific command executions.
By using `execa`'s functionality on top of `node:child_process`, we can
provide this functionality, as well as retain a consistent API with
internal users.
We need to make a couple of small tweaks to setting the `RawExecOptions`
as we're now bound by `readonly` properties.
As the `stdio` property's type is not exported, we can replace this with
an explicit setting of `stdin`, `stdout` and `stderr`.
This requires a number of test changes to make sure that the `stdin`,
`stdout` and `stderr` are set.
This doesn't migrate any calls under `tools`, as they can remain using
`node:child_process`.
* chore(util/exec): ignore floating promises `.on` calls
Since moving to use `execa`, we now have "floating promises" for the
`.on` method calls.
As we aren't handling them here, we can now mark them as `void` (as an
alternative to ignoring the ESLint rule).
This has been deprecated since 2022-07, and is unused as we only ever
use UTF-8.
In `tools/utils/exec.ts` we make sure to specify it explicitly, so we
don't get a Buffer returned.
Sidecar containers will now use `containerbase/` prefix instead of `renovate/` prefix.
BREAKING CHANGE: containerbase/ account used for sidecar containers instead of renovate/
Jamie Tanna