As part of future changes, we'll introduce additional constraints that
may take priority, so we should ensure we have coverage of the existing
logic.
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* feat(manager): add proto manager for .prototools files
Add a new manager for moonrepo's proto tool version manager.
Proto uses .prototools (TOML) files to pin tool versions at the
directory level. The manager extracts top-level version entries
and maps them to the appropriate Renovate datasources.
Supported built-in tools: bun, deno, go, moon, node, npm, pnpm,
yarn, python, ruby, rust, proto, gh, poetry, uv.
Non-version sections ([settings], [plugins], [tools], [env],
[shell], [backends]) are correctly ignored. Version aliases
(latest, stable, canary, nightly) are skipped with appropriate
skipReason. Unknown tools are reported as unsupported-datasource.
* fix(manager): address proto manager PR review feedback
- Remove deduplicateArray/sort from supportedDatasources, sort manually
- Sort protoTooling entries alphabetically
- Inline createDependency call into deps.push()
- Inline fixture content into test, remove fixture file
As noted in #42519, the preivous commit/PR title wasn't quite as clear
with what was actually changing.
To make this more explicit, we can override `commitMessageTopic`.
* feat(datasource/npm): extract defaultRegistryUrl constant
* Fix some other places
* Remove useless defaultRegistryUrls export
* Fix another place
* Undo rules.spec.ts changes, which are not related
* Fix npm presets
* Restore line removed by mistake
* Fix another test file
* Restore changes to a file which is not relevant
* Fix another small place
* fix(manager/flux): extract both tag and digest for OCIRepository
Signed-off-by: Robin Schneider <mail@robinschneider.dev>
* Use record instead of map
Signed-off-by: Robin Schneider <mail@robinschneider.dev>
* Avoid state duplication
Signed-off-by: Robin Schneider <mail@robinschneider.dev>
* Adjust regex
Signed-off-by: Robin Schneider <mail@robinschneider.dev>
* Adjust fallback
Signed-off-by: Robin Schneider <mail@robinschneider.dev>
* test(manager/flux): cover missing-header system manifest branch in extractAllPackageFiles
* fix(manager/flux): update both tag and digest for OCIRepository refs without regex
* test(manager/flux): cover extractOCIRefRange guard branches
* test(manager/flux): cover remaining extractOCIRefRange branches
---------
Signed-off-by: Robin Schneider <mail@robinschneider.dev>
As noted in #42899, some Actions use a version such as `v2.2-rc.1` which
we weren't handling or updating.
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* chore(workers/repository): provide more detail when rolling back
To help debug the case where rollbacks are being initiated, we can:
- add slightly more information to the `Filtered out ...` log line
- add `prBodyNotes` to the resulting PR
This requires we expose the `prBodyNotes` field to `LookupUpdate`, and
the `packageName` and `datasource` to `RollbackConfig`, so we can log
them.
* chore(modules/datasource): log `datasource` and `packageName` when filtering
For more context when reviewing the logs.
* fix(homebrew): allow subdirectories for Homebrew Formulas
* fix(homebrew): only allow up to 1 subdirectory
* fix(homebrew): double escape w (word character)
Co-authored-by: Michael Kriese <michael.kriese@gmx.de>
---------
Co-authored-by: Michael Kriese <michael.kriese@gmx.de>
* chore(types): correct JSDoc
* chore(types): add missing `ConstraintName` enforcement
* fixup! chore(types): add missing `ConstraintName` enforcement
By simplifying this case, which should never happen, as the types
wouldn't allow it.
* chore: reorder for typechecking simplicity
* fixup! chore(types): add missing `ConstraintName` enforcement
* fix(versioning/github-actions): correctly handle `major.minor` and `major`
As part of the final set of changes needed to support Immutable Releases
with GitHub Actions and the `github-actions` versioning, we need to
modify how our versioning works to handle correctly surfacing the
shortest version available.
To make this more resilient, and help us test-drive the change, we'll
also add an integration test that:
- extracts from a GitHub Actions workflow
- performs a lookup (with mocked data)
- determines the available updates that would be proposed
This provides more confidence in the change itself, as well as
validates the intended changes.
This also moves `prefix` and `minLevel` to a single definition.
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* fixup! fix(versioning/github-actions): correctly handle `major.minor` and `major`
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* fixup! fix(versioning/github-actions): correctly handle `major.minor` and `major`
---------
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
fix(nuget): update lock files when Directory.Build.props is changed
Directory.Build.props is a standard MSBuild import file that can contain
PackageReference elements. When Renovate updates packages in this file,
lock file regeneration was skipped because updateArtifacts only handled
.csproj/.vbproj/.fsproj, Directory.Packages.props/Packages.props, and
global.json.
This extends the existing logic to treat Directory.Build.props the same
way as central management files — all project files under its parent
directory are restored to regenerate their lock files.
Also renames the isCentralManagement parameter to isPropsFile for
clarity, since it now covers both central management and
Directory.Build.props files.
Relates to #15696, #8010
* Take nuget.config into account for registryUrls of nuget packages
* Remove 'afterEach' in tests
* Fix PR remarks
* Remove 'any' as suggested in code review
Co-authored-by: Michael Kriese <michael.kriese@gmx.de>
* Update lib/modules/manager/cake/index.ts
Co-authored-by: Michael Kriese <michael.kriese@gmx.de>
* Verify mock parameters in cake manager tests
---------
Co-authored-by: Michael Kriese <michael.kriese@gmx.de>
The changes in da04b8edac mostly worked,
but given `astral-sh/setup-uv` is now using Immutable Tags it _must_ be
resolved as `versioning=semver`, to make sure that version updates are
correctly raised.
However, we can't treat it as `versioning=semver`, as that will then
fail to parse the current version correctly.
Instead, we must use a `regex` versioning scheme, which allows us to
optionally parse the minor and patch versions.
This allows `newVersion` to be pinned accordingly to SemVer, but does
not require previous versions to be so.
We can do this - for now - with an explicit allowlist.
As per #42331, we should migrate to using `semver-partial` for GitHub
Actions' tags versions, instead of `docker`.
This mirrors actual usage of the way that the ecosystem tags Action
versions, and also has the benefit of automagically migrating users of
Actions that have enabled Immutable Tags, which now must be a full
SemVer tagged version.
As we're now specifying the `versioning: semver-partial`, we don't need
to specify it in `pinGitHubActionDigestsToSemver`.
* feat: add XcodeGen manager for Swift package dependencies in project.yml files
* chore(xcodegen): inline project.yml fixture
* fix(xcodegen): use semver instead of swift versioning
* fix(xcodegen): use glob syntax for manager file pattern
* tests(xcodegen): expect logger is called on invalid packages
* tests(xcodegen): better assert extracted package contents
* chore(xcodegen): simplify regex usage
* chore(xcodegen): log projects without dependencies
* chore(xcodegen): simplify dependency resolving and remove regular expressions in favor of the `detectPlatform` helper function
* chore(xcodegen): use `coerceString` on package versions to simplify testing and improve coverage
* chore(xcodegen): address PR review comments.
---------
Co-authored-by: Michael Kriese <michael.kriese@visualon.de>
* feat(manager/ant): add registry URL discovery from settingsFile and remoteRepository
Read Maven registry URLs from settingsFile attribute on dependency
blocks (parsed via Maven's extractRegistries) and from inline
<remoteRepository url="..." /> elements. Registries are merged,
deduplicated, and scoped to their dependency block.
* update java docs
* fix coverage
* apply suggestions
* fix ci issues
* feat(manager/ant): add coords= attribute syntax support
Support Maven coords attribute format (group:artifact:version and
group:artifact:version:scope) as an alternative to separate
groupId/artifactId/version attributes.
* add trace logs
* fix coverage
Support <import file="..."/> elements in Ant build files to follow
cross-file dependencies. Properties defined before the import are
available in the imported file. Cycle detection via visited-file
tracking prevents infinite loops.
* feat(bitbucket-pipelines):update file patterns to support shared configs
Signed-off-by: Adam Setch <adam.setch@outlook.com>
* feat(bitbucket-pipelines):update file patterns to support shared configs
Signed-off-by: Adam Setch <adam.setch@outlook.com>
* feat(bitbucket-pipelines):update file patterns to support shared configs
Signed-off-by: Adam Setch <adam.setch@outlook.com>
---------
Signed-off-by: Adam Setch <adam.setch@outlook.com>
Co-authored-by: Michael Kriese <michael.kriese@visualon.de>
* chore(types): add a strong type for `ToolName`s
Until #41849, we can use our local definitions of the tool names that
Containerbase supports by extracting out a `ToolName` type.
* fixup! chore(types): add a strong type for `ToolName`s
Co-authored-by: Claude Opus 4.6 <jamie.tanna+claude-code@mend.io>
Co-authored-by: gpt-4.1 <jamie.tanna+github-copilot@mend.io>
* fixup! fixup! chore(types): add a strong type for `ToolName`s
* no-never
* simplify
* coverage
* sq
* warn
* sq
* fixup! sq
* sq
* fixup! sq
---------
Co-authored-by: Claude Opus 4.6 <jamie.tanna+claude-code@mend.io>
Co-authored-by: gpt-4.1 <jamie.tanna+github-copilot@mend.io>
* refactor(lint): extract custom oxlint rules into separate files
Split `tools/lint/rules.js` into one file per rule under
`tools/lint/rules/`. Also simplify `test-root-describe` with
early-exit guard clauses.
* feat(lint): add `enforce-ts-extension` oxlint rule
Add a custom JS-based oxlint rule that enforces `.ts` extensions on
local imports. The rule catches two problems:
- `.js` extension used instead of `.ts` (auto-fixable)
- missing file extension entirely (report only)
Checked locations:
- static import/export declarations
- dynamic `import()` expressions
- vitest module APIs: `vi.mock`, `vi.doMock`, `vi.unmock`,
`vi.doUnmock`, `vi.importActual`, `vi.importMock`
Both relative paths (`./`, `../`) and path aliases (`~test/`)
are treated as local. Package imports are ignored.
Also fixes 26 pre-existing violations across 18 spec files.
* Update tools/lint/rules/enforce-ts-extension.js
Co-authored-by: Anne Stellingwerf <1637358+astellingwerf@users.noreply.github.com>
---------
Co-authored-by: Anne Stellingwerf <1637358+astellingwerf@users.noreply.github.com>
* fix(manager/github-actions): disable updates for naked SHA pins without version comment
* docs(manager/github-actions): document disabled updates for bare SHA pins
* test(manager/github-actions): use single toEqual for version comment assertions
* docs(manager/github-actions): recommend version comment as primary fix for bare SHA pins
* fix(manager/github-actions): add skipReason for naked SHA pins
* docs(manager/github-actions): remove package rule example for re-enabling bare SHA updates
Co-authored-by: Jamie Tanna <github@jamietanna.co.uk>
---------
Co-authored-by: Jamie Tanna <github@jamietanna.co.uk>
Jamie Tanna