perf(package-rules): avoid re-cloning packageRules array on every rule merge
applyPackageRules() merges each matching rule via mergeChildConfig(),
which deep-clones the entire accumulated config — including the
invariant packageRules array itself. On repos with many dependency
instances and large rule arrays (e.g. vulnerabilityAlerts force-rules
embedding advisory texts), this cloning dominates the whole run
(observed at ~66% of total CPU in a production profile).
Exclude packageRules from the working config while rules are applied
and restore it afterwards, preserving the previous merge semantics for
rules that themselves carry nested packageRules, and for null/empty/
absent inputs.
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* refactor(linters): add prefer-coerce-array rule
Refs #45217
`x ?? []` and `coerceArray(x)` say the same thing, but only the second
one is searchable and consistent. The rule flags a `??` whose default is
a bare `[]` literal; a non-empty default or an asserted `([] as Foo[])`
still passes.
Applying it across `lib/` surfaced three spots the helper cannot cover,
which keep `?? []` with a disable comment or a narrower fix:
- `package-files.ts` destructures a tuple, which `coerceArray()` widens
- `generate.spec.ts` defaults `matchAll()`, an iterator rather than an array
- `mise/upgradeable-tooling.ts` declares a `Record` return, so its
`?? []` fallback was wrong to begin with and becomes `coerceObject()`
* refactor(platform/github): hoist the GHE version header lookup
`Object.entries(...).find()` returns a tuple, and defaulting it with
`?? []` only to destructure the second element reads as an array
default when it is not one. Name the found entry instead, which drops
the `?? []` rather than routing a tuple through `coerceArray()`.
* fix(package-rules): correctly merge `force.enabled`
As noted in #42666, after changes in
f8b4477335, we're skipping vulnerability
alert PRs when using the `security:only-security-updates` preset.
This happens because the `enabled=false` that exists on the all
dependencies are not correctly merged into the `force` config in the
`vulnerabilityAlert` update.
To fix this, we need to take `force.enabled` into account when merging
config options.
To slightly improve the type checking, we can also make sure that
`removeMatchers` knows that `force` is field we want typed, too.
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* chore(package-rules): simplify condition
As we don't actually need to take into account whether the option is
currently enabled, as we can make sure the `skipReason` and `skipStage`
are always deleted if we're enabling the update.
---------
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
Add template compilation support for sourceUrl in package rules,
allowing users to dynamically construct source URLs using template
syntax. This enables use cases like OpenTofu providers where the
source URL needs to be constructed from the package name.
Eyal Zekaria