After recent changes to remove `shell: true`, it's clear from #40231
that this breaks Containerbase's installing of tools, as we use the
`hash` shell built-in.
As we no longer need the `hash` call, we can remove it.
* fix(util/exec): migrate to `execa` for command execution
As part of a future change, we need to make sure that we have
cross-platform support for specific command executions.
By using `execa`'s functionality on top of `node:child_process`, we can
provide this functionality, as well as retain a consistent API with
internal users.
We need to make a couple of small tweaks to setting the `RawExecOptions`
as we're now bound by `readonly` properties.
As the `stdio` property's type is not exported, we can replace this with
an explicit setting of `stdin`, `stdout` and `stderr`.
This requires a number of test changes to make sure that the `stdin`,
`stdout` and `stderr` are set.
This doesn't migrate any calls under `tools`, as they can remain using
`node:child_process`.
* chore(util/exec): ignore floating promises `.on` calls
Since moving to use `execa`, we now have "floating promises" for the
`.on` method calls.
As we aren't handling them here, we can now mark them as `void` (as an
alternative to ignoring the ESLint rule).
This has been deprecated since 2022-07, and is unused as we only ever
use UTF-8.
In `tools/utils/exec.ts` we make sure to specify it explicitly, so we
don't get a Buffer returned.
chore(platform/local): use shared `rawExec` for commands
Otherwise we miss out on instrumentation, and it makes it more difficult
to centrally change configuration.
* fix(cache): use `bitbucket-server` as platform cache key
Change the Bitbucket Server platform cache key from `bitbucketServer`
(camelCase) to `bitbucket-server` (kebab-case) to match the platform ID.
Adds migration logic to automatically convert existing caches using
the old key to the new format.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* Simplify
* Simplify more
* Update lib/modules/platform/bitbucket-server/pr-cache.ts
Co-authored-by: RahulGautamSingh <rahultesnik@gmail.com>
* Revert "Update lib/modules/platform/bitbucket-server/pr-cache.ts"
This reverts commit e564d91742.
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Co-authored-by: RahulGautamSingh <rahultesnik@gmail.com>
We recently introduced the ability for self-hosted administrators to
control execution of possibly unsafe commands with
`allowedUnsafeExecutions`.
An existing attack vector of Gradle Wrapper commands being executed
(i.e. for Verification Metadata or lockfile updates) needs to be
retrofit into `allowedUnsafeExecutions` as part of #39657.
This will be kept on-by-default until the next breaking change, after
which self-hosted administrators will be able to opt-in to enabling this
functionality is required.
* use regexes where feasable
* refactor: rename ruby files and use managerdata interface
* docs: add docs
* fix tests
* refactor to use class based handlers
* test: improve test coverage
* refactor: rename buildNewUrls to buildArchiveUrls
* moving depName to logging meta
* use parseUrl util
* remove unreachable code
* refactor: use unicode right-arrow for changes template
Signed-off-by: Adam Setch <adam.setch@outlook.com>
* refactor: use unicode right-arrow for changes template
Signed-off-by: Adam Setch <adam.setch@outlook.com>
---------
Signed-off-by: Adam Setch <adam.setch@outlook.com>
As noted in #35936, we've been collecting this data, but hadn't been
correctly returning it when enriching the release.
Although we could also collect this data from the `rawDetailedVersion`,
we can start by wiring in the `basicRelease`'s `releaseTimestamp`, if
present.
Without this, the Maven data source throws out all candidates in postprocessRelease as it cannot find the
releases by version which is not the original version anymore unless als extractVersion was used
Co-authored-by: Michael Kriese <michael.kriese@visualon.de>
We need to explicitly pass the gerrit credentials to the api calls
in initPlaform since the host rules for the platform aren't set up
until later on, so the standard http library won't find any credentials
for the gerrit platform yet.
This follows the same pattern as many of the other platforms on renovate
where they also explicitly pass credentials for the api calls made
during their initPlatform.
This appears to have been broken recently due to the recent addition
of an authenticated version api call in
https://github.com/renovatebot/renovate/pull/39223
See https://github.com/renovatebot/renovate/discussions/39969
* fix: handling of quoted Docker image references in Github Actions
The problem with the use of '\s' is that it swallows the newline at the
end of the line, meaning the $ anchor doesn't have anything to match
against, which results in it failing to match quoted entries. By simply
switching to a dot (which doesn't match newlines), the issue is
resolved for all references.
* fix: further modify regex for docker image refs in github actions
* Add a failing test
* Make version specifier optional
Signed-off-by: Edgar Ramírez-Mondragón <edgarrm358@gmail.com>
* Remove fixture
---------
Signed-off-by: Edgar Ramírez-Mondragón <edgarrm358@gmail.com>
* fix(gerrit): use most efficient search operators based on Gerrit version
Signed-off-by: Felipe Santos <felipe.santos@ericsson.com>
* Address review comments
* Use ignore if instead
* Rename client.version to client.gerritVersion
* Update lib/modules/platform/gerrit/client.spec.ts
Co-authored-by: Sebastian Poxhofer <secustor@users.noreply.github.com>
---------
Signed-off-by: Felipe Santos <felipe.santos@ericsson.com>
Co-authored-by: Sebastian Poxhofer <secustor@users.noreply.github.com>
* feat: add support for go:generate directives in gomod
This change adds a `goGenerate` postUpdateOption which enables
running `go generate ./...` after a dependency update.
Frequently when dependencies are brought in via tools or using
vendored code, and those dependencies are used for go:generate
instructions, we want to update the generated code after the dependency
has been updated.
Adding this as a postUpdateCommand wasn't really satisfactory since that
necessarily requires making a change in two spots (one in the allowed
commands, one in the postUpdateCommand). The other reason this was
undesirable was it would cause generate to run after every dependency
update, regardless of language.
* Updates
* Update fixes
* Self PR
* Fix docs link
* Trying to find the right path
* Fix
* Add deleted
* Fix
* And fix test...
* docs: tweak wording for `goGenerate`
* fix(types): don't default GlobalConfig
In a future change, `GlobalConfig.get` will correctly pull in the
defaults.
---------
Co-authored-by: Jamie Tanna <jamie.tanna@mend.io>
* feat(devbox): Add support for various versioning apis
* Update readme
* Fix tests
* Address PR comments
* Use toMatchObject instead of toEqual
* Revert "Use toMatchObject instead of toEqual"
This reverts commit 20dca6af5c.
* Add check to ensure only single versions are used
* feat(dashboard): open all PR controls for schedule and status checks
Signed-off-by: Adam Setch <adam.setch@outlook.com>
* feat(dashboard): open all pending schedule PRs
Signed-off-by: Adam Setch <adam.setch@outlook.com>
* feat(dashboard): open all awaiting schedule PRs
Signed-off-by: Adam Setch <adam.setch@outlook.com>
* feat(dashboard): open all awaiting schedule PRs
Signed-off-by: Adam Setch <adam.setch@outlook.com>
* fix order
Signed-off-by: Adam Setch <adam.setch@outlook.com>
* feat(dashboard): open all awaiting schedule PRs
Signed-off-by: Adam Setch <adam.setch@outlook.com>
* Update read-only-issue-body.ts
---------
Signed-off-by: Adam Setch <adam.setch@outlook.com>
RahulGautamSingh