* fix(gerrit): defer change creation to `createPr()`
Signed-off-by: Felipe Santos <felipe.santos@ericsson.com>
* Refactor hashtags handling
* Add prTitle to all missing commitAndPush()
* Fix gerrit tests
* Add warning when prTitle is set in updatePr
* Remove now useless labels from commitAndPush
* Fix gerrit client coverage
* Fix gerrit scm coverage
* Fix rebase coverage
* Improve TODO about assignees
* Fix formatting
* Fix review comment
* Extract to a pushForReview function
* Fix after #41382
* Fix onboarding
* Cleanup code
* Fix ESLint
* Fix tests
* Restore gitRetry for git.merge
* Fix tests
* Simplify hashtags code
* Delete pendingChangeBranch in pushForReview()
* Fix test name
* Remove unnecessary test comments
* Improve test name again
* Fix another test name
* Delete local branch in Gerrit SCM
* Add test for deleting pending branch
* Add tests for pushForReview()
* Fix test case name
* Improve another test name
* Fix another small test inconsistency
* Fix some code style issues
* Use isUndefined instead
* Fix one small test style issue
---------
Signed-off-by: Felipe Santos <felipe.santos@ericsson.com>
When we truncate the PR body (due to platform limits) we should be
clearer as to where this was trimmed.
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* chore(azure): simplify calculation for `getMergeMethod`
Instead of the complicated check we were previously performing which:
- recovered from errors if `policyConfigurations` wasn't undefined, or
other errors occurred
- trimmed the field names and checked if they were one of the
`GitPullRequestMergeStrategy` options
We can instead rewrite this with stronger types and compile time checks
to confirm that the mapping from a policy configuration matches the
different `GitPullRequestMergeStrategy`s.
This provides a clearer intent for what this code is doing.
This changes behaviour slightly - previously, the first JSON key defined
that was a `GitPullRequestMergeStrategy` would be used (which is JSON
implementation specific), whereas now it is a defined order.
We also add coverage for the new behaviour.
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* fixup! chore(azure): simplify calculation for `getMergeMethod`
---------
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
To aid with debugging, it would be useful to confirm what the resulting
method is, in both paths.
With help from GPT-4.1 to craft the enum-to-string conversion.
Co-authored-by: gpt-4.1 <jamie.tanna+github-copilot@mend.io>
As part of general work to reinforce the brand link between Mend and
Renovate, we can improve the default PR body footer to clarify this.
This feeds into #29885 and general naming, where we want to keep these
close, while also not being too "in your face".
This is still user-controlled, but provides a more reasonable default.
This also feeds into #26838 and #39305, where we should also remove the
"Bot" from the footer.
* feat: Gerrit supports gitUrl
This change adds support for the gitUrl parameter to the gerrit platform.
It queries the gerrit server to check what download options are available. If ssh is selected but not available, it will throw an error.
* feat: Gerrit supports gitUrl
This removes support for querying the supported download schemes and
instead hard-codes the default ssh port.
* fix: Review feedback
Addresses feedback left in review:
- constants for ports
- better SSH url creation
- more consistent util method usage
* fix: Review feedback
Addresses feedback left in review:
- Reverts SSH URL creation to ensure coverage target
* fix: Review feedback
Addresses feedback left in review:
- Convert switch statement to if/else
- Move endpointURL check into getGerritResponse
This makes the parse/clone calls unnecessary.
* fix: Review feedback
Addresses feedback left in review:
- Simplify ssh url creation
As part of the Enrichment module functionality, it would be useful to
have a consistent type for the status checks.
As a means to be able to use the underlying status check, without a
branch name, we can extract this into a separate type, while keeping the
existing type for use where we know the branch name.
* refactor(lint): extract custom oxlint rules into separate files
Split `tools/lint/rules.js` into one file per rule under
`tools/lint/rules/`. Also simplify `test-root-describe` with
early-exit guard clauses.
* feat(lint): add `enforce-ts-extension` oxlint rule
Add a custom JS-based oxlint rule that enforces `.ts` extensions on
local imports. The rule catches two problems:
- `.js` extension used instead of `.ts` (auto-fixable)
- missing file extension entirely (report only)
Checked locations:
- static import/export declarations
- dynamic `import()` expressions
- vitest module APIs: `vi.mock`, `vi.doMock`, `vi.unmock`,
`vi.doUnmock`, `vi.importActual`, `vi.importMock`
Both relative paths (`./`, `../`) and path aliases (`~test/`)
are treated as local. Package imports are ignored.
Also fixes 26 pre-existing violations across 18 spec files.
* Update tools/lint/rules/enforce-ts-extension.js
Co-authored-by: Anne Stellingwerf <1637358+astellingwerf@users.noreply.github.com>
---------
Co-authored-by: Anne Stellingwerf <1637358+astellingwerf@users.noreply.github.com>
As a means to improve debuggability of Azure's `platformAutomerge` and
`autoApprove`, we can provide a log line to provide more context of what
we're changing.
fix(gerrit): use the "ready" push option to ensure changes are not wip
In gerrit, changes can be set to WIP by default instead of ready.
This breaks renovate because it doesn't see WIP changes and just
creates new ones again every run.
The solution is to always include the "ready" push option to ensure
the changes are ready and not wip.
https://gerrit-review.googlesource.com/Documentation/user-upload.html
* fix(platform/bitbucket): replace deprecated cross-workspace repos endpoint
The GET /2.0/repositories?role=contributor endpoint is being removed by
Bitbucket Cloud on 2026-03-31 (CHANGE-2770). Replace it with per-workspace
calls to GET /2.0/repositories/{workspace}.
When autodiscoverNamespaces is set, those values are used directly as
workspace slugs. Otherwise the current user's workspaces are first
discovered via GET /2.0/user/workspaces (the non-deprecated replacement
for GET /2.0/workspaces) and repositories are then fetched per workspace.
* fix(platform/bitbucket): address review comments
- Use z.array instead of LooseArray for WorkspaceAccesses schema
- Limit workspace fetch concurrency via promises.map
- Align test workspace slugs with reviewer suggestions
* fix(platform/bitbucket): address review comments
- Use z.array instead of LooseArray for WorkspaceAccesses schema
- Limit workspace fetch concurrency via promises.map
- Align test workspace slugs with reviewer suggestions
* fix(platform/bitbucket): restore original repo names in negation test
* fix: Add `github-digest` to `GITHUB_API_USING_HOST_TYPES` list
* fix(http): detect x-access-token prefix before hostType-based auth branching
Moves GitHub App installation token detection (`x-access-token:` prefix)
before the hostType-based authorization chain in `applyAuthorization`.
This ensures correct `token` scheme auth for any GitHub-related hostType,
not only those listed in `GITHUB_API_USING_HOST_TYPES`.
* test(http/auth): add regression test for GitHub App token with non-listed hostType
* Fixes
* Fix tests
* Fix double slash error
Endpoint will always have a trailing slash, therefore the path must not start with a slash
* Remove servlet context from path
Since the `scm` part can be reconfigured to another value, it should not be hardcoded, but a part of the endpoint config
* Fix invalid test setup
* Ensure the trailing slash on the endpoint
* chore: Add vitest plugin to oxlint
* Remove unused line in versioning spec
* Remove coverage threshold check job
The coverage threshold check has been removed from the build workflow. This job was redundant as
coverage is already handled by the codecov job.
* Refine versioning API schema with existence check
* Revert "Remove coverage threshold check job"
This reverts commit f2c9dd872b.
* Remove vitest ESLint plugin
The vitest ESLint plugin and its configurations have been removed. ESLint will no longer enforce
vitest-specific rules.
* Remove unused vitest eslint plugin
The `@vitest/eslint-plugin` is no longer used and can be safely removed.
* fix(gitlab): skip branch status when no pipeline found, retry after PR creation
On GitLab with MR pipelines, posting a commit status without a
pipeline_id causes GitLab to create an unwanted branch pipeline.
Skip posting the status in setBranchStatus() when no pipeline is found
after retries. Retry setting branch statuses after ensurePr() in the
with-pr block so that the MR pipeline created by GitLab can be found.
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
* fix(gitlab): gate skip-status-without-pipeline behind experimental flag
Move the behavior that skips setting a branch status check when no
pipeline is found behind the RENOVATE_X_GITLAB_SKIP_STATUS_WITHOUT_PIPELINE
experimental environment variable. Without the flag, the original
behavior of always posting the status is preserved.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* test(gitlab): restore original 'sets branch status' test case
Keep the original test that verifies branch status is set without
the experimental flag alongside the new skip-behavior test.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix(docs): sort experimental env var headers alphabetically
Move RENOVATE_X_GITLAB_SKIP_STATUS_WITHOUT_PIPELINE after
RENOVATE_X_GITLAB_MERGE_REQUEST_DELAY to satisfy alphabetical
ordering requirement in self-hosted-experimental.md.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix(gitlab): address PR review comments for skip-status-without-pipeline
Use strict `=== 'true'` check for env var, update docs wording, and
add test coverage for the new experimental flag behavior.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
* - Added Renovate support for the [SCM-Manager](https://scm-manager.org/)
- SCM-Manager is a repository management tool like GitHub
- It is maintained as an open source project by the company [Cloudogu](https://cloudogu.com/en/)
- The SCM-Manager support is not feature complete yet, features like auto merging are still missing
- The SCM-Manager also got added to the documentation as another platform
author Thomas Zerr <thomas.zerr@cloudogu.com> 1690877165 +0200
committer Eduard Heimbuch <eduard.heimbuch@cloudogu.com> 1706264263 +0100
* Reverted numbering change in markdown docs
* Changed from type to interface, if possible
* Removed axios dependency and using the http layer of renovate instead
* Fixed not using scmm specific mime types for accept header
* Use git from test/util instead
* Add dummy tests for no ops
* Fix some phrasing and spelling issues
* Change scmm to scm-manager and fix SCM-Manager specific content type
* Add supported major versions, review plugin requirement, write permissions is needed
* Change using actual host rules instead of mocking it
* Change use http mocks for testing
* Update docs/usage/getting-started/running.md
Co-authored-by: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com>
* Update lib/modules/platform/scm-manager/index.ts
Co-authored-by: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com>
* Update lib/modules/platform/scm-manager/mapper.spec.ts
Co-authored-by: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com>
* Update lib/modules/platform/scm-manager/readme.md
Co-authored-by: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com>
* Update lib/modules/platform/scm-manager/readme.md
Co-authored-by: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com>
* Update lib/modules/platform/scm-manager/readme.md
Co-authored-by: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com>
* Update lib/modules/platform/scm-manager/readme.md
Co-authored-by: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com>
* Update lib/modules/platform/scm-manager/readme.md
Co-authored-by: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com>
* Fix scm-manager docs link
* Fix linting
* Fix linting
* Throw errors if username or token is not provided by the host rules
* Replace NO-OP with Not implemented
* Remove objects from log messages
* Fix linting
* Fix path to platform config options
* Fix link to self-host-configuration docs
* Fix link to self-host-configuration docs
* Remove the link to the platform config option, because the tests keep failing
* Fix link to self-host-configuration docs
* Remove not needed type cast
Co-authored-by: Michael Kriese <michael.kriese@visualon.de>
* Fix type check of protocol links
* Move scm-manager into util http folder
* Apply linting
* Add maxBodyLength function and its test
* Add test case if protocol links are not an array of links
* Use zod schema for pagination
* Apply linting
* Refactor typing with zod schema
* Fix test description
Co-authored-by: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com>
* Fix test description
Co-authored-by: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com>
* Fix test description
Co-authored-by: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com>
* Fix test description
Co-authored-by: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com>
* Update readme
Co-authored-by: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com>
* Add try catch around fetching the current user
* Switch log statement from info to debug
Co-authored-by: Michael Kriese <michael.kriese@visualon.de>
* Switch log statement from info to trace
Co-authored-by: Michael Kriese <michael.kriese@visualon.de>
* Switch log statement from debug to trace
Co-authored-by: Michael Kriese <michael.kriese@visualon.de>
* Switch log statement from info to trace
Co-authored-by: Michael Kriese <michael.kriese@visualon.de>
* Switch log statement from info to trace
Co-authored-by: Michael Kriese <michael.kriese@visualon.de>
* Switch log statement from info to trace
Co-authored-by: Michael Kriese <michael.kriese@visualon.de>
* Fix linting errors
* Remove credentials check in initRepo
* Fix imports
* Fix zod schema for repositories
* Fix zod schema for pull requests
* Fix 500 error after attempting to update an pr
* Fix wrong typing
* Refactor parameterized tests for better readability
* Refactor SCM HTTP API
* Add setToken functionality
* Remove not needed type definition
Co-authored-by: Michael Kriese <michael.kriese@gmx.de>
* Fix assertion
* Fix istanbul comment
* Change log statement
* Remove type rename
* Move inferred types close to corresponding schemas
* Add platform is experimental
* Remove type renaming
* Fix type imports
* Fix test suite description
* Remove debug log statement
Co-authored-by: Michael Kriese <michael.kriese@gmx.de>
* Fix warning
* Fix paremeterized unit tests with string templates
* Fix spelling
Co-authored-by: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com>
* Fix eslint error
* Convert trace logs to debug logs
* Convert info logs to debug
* Replace manual null and undefinded check with is util
* Rephrase instruction in readme
* Use ensureTrailingSlash instead
* Fix linting
* Keep type and schema together
* Simplify hasAssignees check
* Simplify reviewer mapping
* Remove istanbul comments
* Replace custom scmm header option with renovate native http headers option
* Let the token be passed in initPlatform
* Add description which permissions are needed
* Add support for ignorePrAuthor filter
* Add notes about automerge feature within platform readme
* Add support for fast_forward_only
* Change supported versions due to merge strategy change
* Remove commented code
* Fix import
* Use email schema
* Heed review advice
* Fix import and empty array assertions
* Fix linting issue
* Fix import errors
* Fix removed ignorePrAuthor parameter from initRepo function
* Fix failing unit tests by setting/reseting the global config
* Mark scm-manager as experimental
* Fix zod import path
* Change endpoint configuration, so that user only needs to define origin, but not also the path
* Fix warning of redundant backslash
---------
Co-authored-by: Eduard Heimbuch <eduard.heimbuch@cloudogu.com>
Co-authored-by: HonkingGoose <34918129+HonkingGoose@users.noreply.github.com>
Co-authored-by: Michael Kriese <michael.kriese@visualon.de>
Co-authored-by: René Pfeuffer <rene@pfeuffer-web.de>
Co-authored-by: Michael Kriese <michael.kriese@gmx.de>
Co-authored-by: René Pfeuffer <rene.pfeuffer@cloudogu.com>
* feat(vulnerabilities): add support for github-actions vulnerability alerts
* fix failed merge from main
* now for real
* review comments
* remove no longer needed assertion
As part of efforts to improve the performance of the `getPrCache`
function, we can add additional instrumentation to understand the time
taken.
This adds additional insight through our instrumentation functions, for
those using OpenTelemetry, as well as a `durationMs` for our logs.
* fix(github): prevent PR cache sync from exhausting all pages
* refactor(github): derive cutoff from cached items, simplify reconcile
- When lastModified is missing but items exist (via updateItem()),
derive cutoff from max(item.updated_at) instead of falling back
to reconcile's return value. Eliminates the fallback branch.
- reconcile() now called purely for side effects; return value ignored.
- MAX_SYNC_PAGES guard checks needNextPageSync (not needNextPageFetch)
to avoid spurious warning when cutoff already stopped the loop.
- Add test for mixed pages (Renovate + non-Renovate PRs interleaved).
- Update derived-cutoff test for caches without lastModified.
* fix(github): advance PR cache watermark from unfiltered page
* fix(github): add comment clarifying MAX_SYNC_PAGES is a safety net
* refactor(platform): programatically mark Platforms as experimental
As part of future changes, we'll want to be able to more
straightforwardly determine whether a given Platform is experimental.
To do this, we can add a new optional `experimental` flag to the
`Platform`.
As part of having this available, we can refactor how our docs for
Platforms are built, and replace a hand-authored experimental notice, we
can automagically insert it into the built docs.
To make sure that we don't break the rendering of the Markdown for
Mkdocs, we need to insert the experimental notice after the page
heading.
As we're now using the Platform itself, not only the ID, we need to
refactor how `tools/docs/platforms.ts` renders the pages.
* docs(platforms): clarify which Platforms are experimental (#41249)
* chore: format code block
---------
Co-authored-by: Michael Kriese <michael.kriese@visualon.de>
As part of #39309 we enabled "Vigilant Mode" for the `@renovate-bot`
author.
To give an indication to folks who are self-hosting (on GitHub.com) and
using this Git commit author, we can provide a log message to let them
know.
This does not at all stop usage of this default committer email address,
but does provide a "nudge" to folks that they may see `Unverified`
commits pop up.
Avoid unnecessary retry loops when merge_when_pipeline_succeeds is already
enabled on a merge request. This prevents wasting ~15 seconds per MR when
reattempting platform automerge on MRs with failed pipelines.
Co-authored-by: Ona <no-reply@ona.com>
Sergei Zharinov