* ci(linter): add renovate/require-regex-util rule
Adds a custom oxlint rule that flags raw RegExp usage in lib/
production code: any `new RegExp(...)` call and any regex literal
that is not the direct first argument of `regEx(...)`. The regEx()
helper from lib/util/regex.ts uses the RE2 engine for ReDoS-safe
matching and caches compiled patterns. lib/util/regex.ts itself is
exempt.
The rule is disabled for **/*.spec.ts, test/**, and tools/** via
config overrides, because vitest APIs such as expect.stringMatching
need bare RegExp instances (a past commit reverted regEx() there).
Severity is set to "warn" instead of "error": the repo currently has
197 pre-existing violations (above the agreed mechanical-fix
threshold of 80), and a number of them are deliberately
RE2-incompatible patterns (lookahead/lookbehind/named backreferences,
see TODO #12872/#12875 markers in e.g. lib/modules/versioning/rez/
pattern.ts and lib/modules/manager/dockerfile/extract.ts) that need
per-site judgment before they can be wrapped in regEx() or suppressed
with a justified disable comment. No violation fixes are included in
this commit.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* ci(linter): enforce renovate/require-regex-util at error
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* refactor: use regEx() for regex literals and RegExp construction in lib
Burn down all renovate/require-regex-util violations (197):
- wrap RE2-compatible regex literals and RegExp constructions in regEx()
- rewrite lookaround patterns where behavior is provably preserved:
goproxy separator split, sbt-package link extraction, leiningen
comment stripping and keyword search, npm GitHub owner validation
(unit-count bound replaced by an explicit length check)
- keep native RegExp with disable comments where RE2 cannot be used:
moo / good-enough-parser lexer patterns (moo rejects RE2 instances),
MigrationsService propertyName (matched via isRegExp, which RE2
instances fail), rez named backreferences and lookaheads, GitHub
markdown link negative lookbehind, emoji astral-plane matching
- drop stale TODO #12875 comments for patterns current re2 handles
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* refactor: reduce require-regex-util disable comments
Rewrite the github massage-markdown-links URL regex to capture an
optional `api.` prefix in a named group (skipped in code) instead of
relying on a negative lookbehind, so both the base and global variants
can use regEx()/RE2 and their two disable comments are removed. Add
spec cases for api-prefixed URLs that match the URL shape.
Consolidate the four related line disables in rez/pattern.ts (bound and
range patterns emulating Python conditional patterns via named
backreferences and lookaheads, which RE2 cannot express) into a single
block disable/enable pair, matching the treatment of the lexer files.
Disable comment count drops from 13 to 8.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* refactor(datasource/sbt-package): use named capture group in link regex
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* refactor(manager/cake): restore original multiLineComment regex spelling
The [^] -> [\\s\\S] rewrite was only needed for an RE2 wrap that was
later reverted; keep the diff minimal.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(datasource/go): skip empty GOPROXY segments
The switch from a lookahead split to a capture-group split (needed because
RE2 has no lookahead support) changed how empty GOPROXY segments parse:
`a|,b` yielded `{ url: ',', fallback: '|' }` before and
`{ url: '', fallback: ',' }` after. The comma fallback only continues on
404/410, so a failing proxy ahead of an empty segment silently stopped the
lookup instead of falling through to the remaining proxies.
Empty segments carry no url to query, so drop them.
* refactor(datasource/go): use isTruthy for empty segment filter
* fix(datasource/go): filter empty segments before mapping
Filtering after the map broke the contextual typing from the
GoproxyItem[] annotation, widening fallback to string.
* refactor(platform/github): use regEx() for merge queue query stripping
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* ci(linter): add renovate/logger-static-message rule
Adds a custom oxlint rule that enforces a static msg component for
logger.warn/error/fatal calls (including logger.once variants) so the
messages can be grouped in metrics and error catching services, per
docs/development/best-practices.md. It also flags metadata properties
named 'error' that hold error-ish values, because the bunyan serializer
only handles the 'err' key.
The rule is enabled as an error for lib/ production code and disabled
for spec files. All 33 pre-existing violations are fixed by moving
interpolated values into the metadata object, making messages static,
and renaming 'error' metadata keys to 'err'. Affected log-message
assertions in co-located specs are updated accordingly.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* ci: ignore validator output
* fixup new merged in log messages
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* fix(platform/azure): guard against null work item on issue creation
The Azure DevOps REST client resolves createWorkItem to null (instead of
throwing) on a 404 or any 2xx response with an empty/non-JSON body, such
as a 203 sign-in page returned by an expired token or an SSO/proxy in
front of the instance. ensureIssue then dereferenced newWorkItem.id
unconditionally, crashing the dependency dashboard run with
"Cannot read properties of null (reading 'id')".
Guard the result and skip the issue with a warning instead.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* feat(platform/azure): detect missing Issue work item type
Check that the project's process defines the 'Issue' work item type
before attempting to create one. Processes such as Scrum do not define
it, so createWorkItem returned a 404 that the REST client surfaces as
null, producing a cryptic crash. Log an actionable warning instead.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* test(platform/azure): mock getWorkItemTypes in ensureIssue create test
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Enable no-else-return (with allowElseIf: false) and unicorn/no-lonely-if
as errors in .oxlintrc.json and fix all 131 pre-existing violations
(91 no-else-return, 40 unicorn/no-lonely-if) across 98 files.
The no-else-return violations were fixed with the oxlint autofix
(iterated to a fixpoint, plus two else-if chains that required
--fix-dangerously) followed by Prettier formatting. One comment dropped
by the autofix in lib/modules/manager/pub/artifacts.ts was restored
manually. The unicorn/no-lonely-if violations were merged by hand,
preserving comments and coverage-ignore hints.
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* fix(platform/azure): resolve work item states from process
Renovate hardcoded the Azure Boards work item state to `New` on
create/reopen and `Closed` on close. Processes that don't have those
states (Basic uses To Do/Done; custom inherited processes vary) reject
the request with "The field 'State' contains the value 'New' that is not
in the list of supported values", so the Dependency Dashboard (and any
issue) could not be created or closed.
Resolve the concrete open/closed state names for the `Issue` work item
type from its process via `getWorkItemTypeStates`, grouped by state
category (Proposed/InProgress = open, Completed/Resolved/Removed =
closed). Omit `System.State` on create so Azure DevOps applies the work
item type's default initial state. Classify issues open/closed by state
category rather than the literal `Closed`. Fall back to the previous
`New`/`Closed` names when the states cannot be read (e.g. older ADO
Server). Result is cached per repository.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* fix(platform/azure): prefer Completed state as close target
Address review: closedNames[0] picked the first state across the
Completed/Resolved/Removed categories in workflow order, so processes that
order a Resolved-category state before the Completed one (e.g. a custom
inherited Agile process) would close work items to `Resolved` instead of
`Closed`, changing prior behavior.
Resolve the close target from the `Completed` category first, falling back to
the wider closed set only when no Completed state exists. The full closed set
is still used to classify already-closed items.
Add tests covering a process where `Resolved` is ordered before `Closed`.
* fix(platform/azure): address review feedback on state resolution
- Extract namesByCategory into a module-level function declaration instead
of an arrow function assigned to a variable.
- Add a test where the Issue type exposes a closed-category state but no
Completed state, exercising the completedNames[0] ?? closedNames[0]
fallback (restores 100% patch coverage).
- Reword the readme to avoid possessives per the style guide.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* refactor(platform/azure): simplify state resolution per review
- use stateColors.find for the Completed close target instead of an
extra namesByCategory pass over a single-element array
- document that the open-state fallback may pick a closed state when a
process exposes only closed states (intentional, not a bug)
- reuse the workItemType const instead of repeating the 'Issue' literal
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* fix(platform/azure): resolve work item states via Lazy
getWorkItemStates was async with a plain null-check cache guard, so two
concurrent callers could both pass the guard and each fire a duplicate
getWorkItemTypeStates request. Wrap resolution in `Lazy<Promise<...>>`
so the executor runs once and all callers share the same promise.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Add support for Azure DevOps in dependency dashboards feature
related #9592
* Add missing test for got wrapper
* Apply all current CR suggestions
* fix: resolve eslint and tsx issues in Azure platform code
* test: add coverage for issue.number undefined cases
Add test cases to ensure proper handling when:
- Trying to reopen an issue without a number
- Trying to update an issue without a number
This improves code coverage for the null checks added in previous commit.
* test: fix and add tests of azure/issue.ts to up coverage
there was mismatch in mock resulting in testing of different code branch
* refactor: address review feedback
* fix: type-check
* refactor: address review feedback round 2
* apply suggestions
* Apply suggestions from code review
Co-authored-by: Sebastian Poxhofer <secustor@users.noreply.github.com>
* refactor: use partial helper and remove host-rules mock in issue.spec.ts
* more changes from suggestions
* Update lib/modules/platform/azure/issue.spec.ts
Co-authored-by: Michael Kriese <michael.kriese@visualon.de>
---------
Co-authored-by: Viktorie Novotná <viktorie.novotna@drmax.eu>
Co-authored-by: Sebastian Poxhofer <secustor@users.noreply.github.com>
Co-authored-by: Michael Kriese <michael.kriese@visualon.de>
Sebastian Poxhofer