Commit Graph

398 Commits

Author SHA1 Message Date
renovate[bot] 9d74625d93 build(deps): update dependency prettier to v3.9.6 (main) (#45815)
* build(deps): update dependency prettier to v3.9.6

| datasource | package  | from  | to    |
| ---------- | -------- | ----- | ----- |
| npm        | prettier | 3.8.1 | 3.9.6 |

* chore: prettier fixes

---------

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Michael Kriese <michael.kriese@mend.io>
2026-09-09 13:50:03 +00:00
Jamie Tanna a806d2f735 feat(onboarding): note that vulnerabilityAlerts can be rate limited (#45686)
For instance, when a repository is onboarding with many dependency
updates (some of which have many security releases), it would be
useful to let the user know that they're not unlimited, but that the
rate limit is taken into account.

Now we have the capability to specify these, we should:

- take them into account when determining how many PR(s) may be raised
  at a given time
- point users to the documentation when they may want to limit them, if
  the number of security PRs is more than the
  `prConcurrentLimit`/`branchConcurrentLimit`

Co-authored-by: Claude Sonnet 5 <jamie.tanna+claude-code@mend.io>
2026-09-04 20:05:08 +00:00
Sebastian Poxhofer 05e1271376 test: use expect().resolves instead of awaiting inside expect (#45672)
Enables the vitest/prefer-expect-resolves oxlint rule and applies its
autofix across the spec suite.
2026-09-04 10:40:46 +00:00
Sebastian Poxhofer df8c4051ff test(core): replace file snapshots with explicit assertions (#45660)
* test(core): replace file snapshots with explicit assertions

* test(core): replace inline snapshots with explicit assertions

* test(core): assert on relevant sections instead of full bodies

* test(core): drop assertions implied by full equality

* test(core): address review feedback

* test(core): use resolves instead of awaiting inside expect
2026-09-04 10:28:55 +00:00
Sebastian Poxhofer 3412de84ce refactor(linters): enable oxlint rule prefer-named-capture-group (#44714)
* refactor(lint): enable oxlint prefer-named-capture-group at error

Numbered capture groups (m[1], $1) break silently when a regex is
edited and group order shifts. Named groups (?<name>...) make intent
explicit and accesses (m.groups.name) resilient to reordering.

This enables the built-in eslint rule prefer-named-capture-group,
surfacing 321 pre-existing unnamed-group violations across ~121
files to be burned down incrementally in follow-up commits.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017RxHFNsSworLcv23xXk9Hk

* refactor(versioning): name capture groups for prefer-named-capture-group

Burns down all prefer-named-capture-group violations in
lib/modules/versioning/. Unused capture groups (only reachable via
.test() or whole-match) become non-capturing (?:...); groups whose
value is read become named (?<name>...), with accesses rewritten to
match.groups!.<name> (or destructured from .groups!) instead of
positional match[n]/$n so a future edit that reorders groups cannot
silently break the reader.

Two cases needed extra care to preserve behavior:
- semver/common.ts and poetry/patterns.ts split() on a regex whose
  capture group is relied upon by String.prototype.split to keep the
  separator in the output array; the group is kept capturing and
  named, not converted to non-capturing.
- hashicorp/convertor.ts's semverRegex is only ever embedded via
  .source into a named `(?<version>...)` group elsewhere and never
  matched directly, so its internal groups are safe to make
  non-capturing.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017RxHFNsSworLcv23xXk9Hk

* refactor(datasource): name capture groups for prefer-named-capture-group

Burns down all prefer-named-capture-group violations under
lib/modules/datasource/. Same treatment as the versioning module:
unused groups become non-capturing, used groups get names, and
positional match[n] reads move to match.groups!.<name>.

docker/ecr.ts and pypi/common.ts keep their positional destructuring
(`const [, region] = ...`, `!!m &&`) working unchanged since a named
capture group is still addressable by its numeric index in
JavaScript — only pypi/common.ts's access was rewritten to
m.groups!.owner for clarity since it read a single group directly.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017RxHFNsSworLcv23xXk9Hk

* refactor(platform): name capture groups for prefer-named-capture-group

Burns down all prefer-named-capture-group violations under
lib/modules/platform/. Uses the repo's established idiom of
`match.groups?.<name>` after an optional-chained exec()/match() (see
bitbucket/index.ts hostnameWithoutApiPrefix, gerrit/utils.ts
extractSourceBranch) and `$<name>` in String.replace replacement
strings. Unused groups (markdown/HTML massaging regexes matched only
to be stripped) become non-capturing.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017RxHFNsSworLcv23xXk9Hk

* refactor(manager): name capture groups in ansible-galaxy for prefer-named-capture-group

Burns down prefer-named-capture-group violations in
lib/modules/manager/ansible-galaxy/. newBlockRegEx and blockLineRegEx
dropped their unused outer wrapping group (only the inner key/value
groups were ever read) and named the key/value groups; nameMatchRegex's
remaining unused groups (protocol/user-info/port alternatives) become
non-capturing since only source/hostname/depName/version are read via
.groups. Accesses in collections.ts and roles.ts move from
lineMatch[2]/lineMatch[3] to lineMatch.groups!.key/value.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017RxHFNsSworLcv23xXk9Hk

* refactor(manager): name capture groups for prefer-named-capture-group (batch 1)

Burns down prefer-named-capture-group violations across the first
alphabetical slice of lib/modules/manager/ (ansible through mix).
Used groups get names with accesses rewritten to match.groups!.<name>
(or $<name> in replacement strings); groups whose value is never read
become non-capturing (?:...). Two String.split() call sites
(git-submodules/extract.ts, meteor/extract.ts) keep the established
"named group still readable positionally from the split() result
array" idiom instead of restructuring the destructuring.

bazel/rules/go.ts and buildpacks/extract.ts dockerRef verified
byte-for-byte equivalent before/after via a quick node script since
several nested groups collapsed to non-capturing at once.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017RxHFNsSworLcv23xXk9Hk

* refactor(manager): name capture groups for prefer-named-capture-group (batch 2)

Burns down prefer-named-capture-group violations across the remaining
alphabetical slice of lib/modules/manager/ (npm through terragrunt).
Same treatment as batch 1: used groups get names with accesses moved
to match.groups!.<name> or $<name> replacement strings; unused groups
(wrapping alternations, quantifier repetition groups only consumed via
.test(), or values never read from a match) become non-capturing.

terraform/extractors/others/modules.ts and terragrunt/modules.ts share
near-identical URL-parsing regexes (github/bitbucket/git/azure-devops
ref matchers) — the same set of always-unused `depth=`/`&depth=`
query-string groups is converted to non-capturing in both files.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017RxHFNsSworLcv23xXk9Hk

* refactor(config): name capture groups for prefer-named-capture-group

Burns down prefer-named-capture-group violations in lib/config/.
Used groups get names with replacement strings switched from $1/$2 to
$<name>; the unused separator group in schedule-migration.ts's
afterBeforeRegex becomes non-capturing. presets/parse.ts keeps
assigning through the already-declared `repo` variable rather than
array-destructuring the exec() result, matching this file's existing
style for the other named-group regexes just above it.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017RxHFNsSworLcv23xXk9Hk

* refactor(util): name capture groups for prefer-named-capture-group

Burns down prefer-named-capture-group violations across lib/util/ and
lib/logger/. Same treatment as previous batches: named groups for
values that are read (via $<name> replacement strings, .groups!.<name>,
or destructured from .groups), non-capturing groups where nothing reads
the captured value (e.g. semantic.ts's angular-commit .test()-only
regex). www-authenticate.ts's tokenizer entries each get their own
named group but keep accessing the match generically via match[1],
since a positionally-indexed named group is still readable by index.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017RxHFNsSworLcv23xXk9Hk

* refactor(workers): name capture groups for prefer-named-capture-group

Burns down prefer-named-capture-group violations in lib/workers/.
Used groups get names with $<name> replacement strings; unused
wrapper/alternation groups (e.g. semantic-commit-message.ts's optional
scope/issue wrappers, release-notes.ts's date-heading and
horizontal-rule matchers that are only probed with .search()/replaced
wholesale) become non-capturing.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017RxHFNsSworLcv23xXk9Hk

* refactor(test,tools): name capture groups for prefer-named-capture-group

Finishes the prefer-named-capture-group burndown: test/, tools/, and
vitest.config.mts. Groups whose value is read get names ($<name>
replacement strings or .groups.<name> access); groups only used via
.test()/.search() or that feed a .match(/…/g) call (whose return value
is the array of whole matches, not captured groups) become
non-capturing.

This is the last remaining slice of pre-existing violations, so the
rule (already enabled at error repo-wide) now passes with zero
findings across the whole codebase.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017RxHFNsSworLcv23xXk9Hk

* fix prettier failure

* refactor(lint): use a named capture group in `v8-ignore-no-count`

New rule from main trips the newly enabled `prefer-named-capture-group` oxlint rule.

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
2026-09-03 09:54:40 +00:00
Jamie Tanna b62fe59594 fix: remove references to "bot" (#39305)
We dropped the "bot" from our terminology long ago, but it looks like
we've got some outdated docs + code that reference it.

We should remove this to keep things consistent.

A `fix`, as we're changing the commit author's name, and log lines.

Co-authored-by: Claude Sonnet 5 <jamie.tanna+claude-code@mend.io>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
2026-09-02 08:56:20 +00:00
Sebastian Poxhofer 8d08b51db0 refactor: return a RepositoryResult while onboarding (#45531)
* refactor(onboarding): return repository result from ensureOnboarding

Rename ensureOnboardingPr to ensureOnboarding and have it return a new
'onboarding' RepositoryResult. renovateRepository now branches on
repoIsOnboarded, so exactly one of ensureOnboarding/updateRepo produces
the repository result and the non-null assertion on the update result
(TODO #22198) is no longer needed. updateRepo/update no longer return
undefined for non-onboarded repositories.

* refactor(onboarding): keep ensureOnboardingPr name
2026-08-28 11:50:28 +00:00
Sebastian Poxhofer c32e2391a0 refactor(linters): add prefer-coerce-object rule (#45493)
Refs #45216

The object counterpart to `prefer-coerce-array`: `x ?? {}` becomes
`coerceObject(x)`. The rule flags a `??` whose default is a bare `{}`
literal, so a populated default or an asserted `({} as Foo)` still
passes; a `x ?? y ?? {}` chain maps onto `coerceObject(x, y)`.

Every hit across `lib/` converted cleanly, so no disable comments were
needed.
2026-08-28 09:27:59 +00:00
Sebastian Poxhofer 9d0e535934 feat(config): add overrideDescription option (#45400)
* feat(config): add `overrideDescription` option

Presets which extend many other presets used an `ignoreDeps: []` sentinel
to keep their own one-line summary in the onboarding PR instead of one line
per extended preset. Replace that hack with an explicit `overrideDescription`
option, which is consumed and removed while presets are resolved.

The resolved descriptions are unchanged. Repositories which set
`ignoreDeps: []` in their own config no longer lose all preset descriptions
in their onboarding PR.

* fixup! feat(config): add `overrideDescription` option

* fixup! feat(config): add `overrideDescription` option

* fixup! feat(config): add `overrideDescription` option
2026-08-24 11:22:31 +00:00
Jamie Tanna d1b6830ddf feat(onboarding): show "What to Expect" first in summary view (#44922)
When using the "summary view", in the case we hit platform limits, in
Onboarding PRs or Reconfigure PR comments, we should prioritise the
"What to Expect" as it provides a more actionable "executive summary" of
what's needed in the repository.

Co-authored-by: Claude Sonnet 5 <jamie.tanna+claude-code@mend.io>
2026-08-21 11:53:08 +00:00
Jamie Tanna 4593b9b5a6 refactor(workers/repository): extract PR body template helpers for onboarding/reconfigure (#45382)
* refactor(workers/repository): extract PR body template helpers for onboarding/reconfigure

As part of follow-up changes to reorder the "summary view", we need to
extract the core logic out for onboarding/reconfigure PRs.

Given the tests haven't needed to change, we can see this is a perfect
in-place rewrite.

Co-authored-by: Claude Sonnet 5 <jamie.tanna+claude-code@mend.io>

* fixup! refactor(workers/repository): extract PR body template helpers for onboarding/reconfigure

Adding existing missing coverage.

Co-authored-by: Claude Sonnet 5 <jamie.tanna+claude-code@mend.io>

---------

Co-authored-by: Claude Sonnet 5 <jamie.tanna+claude-code@mend.io>
2026-08-21 10:52:32 +00:00
Jamie Tanna 98988e1b2a fix(onboarding): clarify security PRs are not part of limits (#45215)
As it wasn't clear before that they would bypass limits.

Co-authored-by: Claude Sonnet 5 <jamie.tanna+claude-code@mend.io>
2026-08-20 22:43:01 +00:00
Jamie Tanna bf17167a67 feat(onboarding): improve wording of concurrency limits with PRs opened (#45213)
* feat(onboarding): improve wording of concurrency limits with PRs opened

When receiving an onboarding PR while using `prConcurrentLimit`,
`branchConcurrentLimit` or `prHourlyLimit` concurrency controls, users
may still receive a note such as:

> will create 189 Pull Requests

This isn't true, and can be surprising and/or worrying for a user who
may believe they're going to be swamped by PRs.

We can therefore improve this, to make it clearer how many will be
immediately raised, and how many will be raised over time.

Co-authored-by: Claude Sonnet 5 <jamie.tanna+claude-code@mend.io>

* test(onboarding): reduce duplicated test setup

As a way to make it clearer what each test is actually testing.

Co-authored-by: Claude Sonnet 5 <jamie.tanna+claude-code@mend.io>

---------

Co-authored-by: Claude Sonnet 5 <jamie.tanna+claude-code@mend.io>
2026-08-20 18:55:04 +00:00
Jamie Tanna 10da664674 chore(config): be explicit about Renovate CLI in prFooter (#44949)
* chore(config): be explicit about `Renovate CLI` in `prFooter`

This was something I should have done in
72968d3726.

* fixup! chore(config): be explicit about `Renovate CLI` in `prFooter`
2026-07-30 12:00:37 +00:00
Felipe Santos ddbbb687f9 feat: add commitTrailers option (#44651)
* feat(config): add commitTrailers option

Renovate's only way to add git trailers today is `commitBody`, but it's
broken on Gerrit: Renovate appends its own `Renovate-Branch`/`Change-Id`
block after the body, so user trailers end up in a non-final message
block and are not real trailers per git-interpret-trailers rules.

This adds a `commitTrailers: string[]` option (each entry a full
`Key: value` line), standardizes Gerrit's own trailers through the same
mechanism so user trailers and platform trailers merge into one final
block, and verifies the result at runtime with `git interpret-trailers`
(commitlint's trailer-exists rule uses the same approach). The
`:gitSignOff` preset is migrated from `commitBody` to `commitTrailers`
so sign-off works correctly on Gerrit too.

* Simplify a bit

* Simplify docs even more

* Simplify another bit

* Add comment about rawExec

* Drop runtime commit trailer verification

Bypass simple-git only to emit a proactive warn log is not worth the
extra surface area. Config validation already enforces Key: value form.

* test(git): cover string commit message with trailers

Codecov patch failed on the partial ternary branch that normalizes a
string message before appending trailers.

* test(gerrit): fix trailers test after scm rework

Align the commitTrailers merge test with the post-rework Gerrit SCM:
use fakeSha helpers and drop the removed force flag.

* Improve wording on gitSignOff docs

* Validate compiled commitTrailers as well

* Improve trailers example

* Use isString instead

* Update lib/util/git/index.ts

Co-authored-by: Sebastian Poxhofer <secustor@users.noreply.github.com>

* Update lib/workers/repository/onboarding/branch/create.ts

Co-authored-by: Sebastian Poxhofer <secustor@users.noreply.github.com>

* Format code

* Fix type-check

* Fix tests

---------

Co-authored-by: Sebastian Poxhofer <secustor@users.noreply.github.com>
2026-07-27 06:49:09 +00:00
Jamie Tanna 969d1a1c49 feat(onboarding): use summary view if hitting platform limits (#44256)
As part of #41502, we're introducing a Platform-limit-aware
onboarding/reconfigure flow that will provide a summary where
appropriate.

This improves the experience where onboarding a large monorepo to
Renovate, especially when it produces an onboarding/reconfigure PR that
is too large to fit within Platform limits.

If we detect the Platform limits being exceeded for a given PR, we'll
switch to the "summary" view.

This builds on top of 4fbfc6095a and bcd44b991f, which introduced the
main changes this then enables.

Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
2026-07-21 18:02:10 +00:00
Jamie Tanna 4fbfc6095a refactor(onboarding): add functions to summarise "What to expect" (#43764)
* refactor(workers/repository): use `coerceNumber`

* refactor(workers/repository): link to `commitHourlyLimit` docs

So the reference is actionable by a user.

* refactor(workers/repository): add functions to summarise "What to expect" in onboarding

As part of future changes in #41502, we're introducing a
Platform-limit-aware onboarding/reconfigure flow that will provide a
summary where appropriate.

Before we do so, we can introduce the new functionality - but not
integrate it right now - to incrementally add support.

This provides a summary, following similar patterns to how
`getExpectedPrList` executes, but:

- provides a table summary of the detected updates for the repository,
  broken down by security updates, `updateType`, and then anything else
- user-configurable/match-able updates (like `minor`) are prioritised
  over i.e. `bump` updates
- if multiple base branches are used, there is a column to indicate the
  base branch

Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
Co-authored-by: Claude Opus 4.6 <jamie.tanna+claude-code@mend.io>

* fixup! refactor(workers/repository): add functions to summarise "What to expect" in onboarding

Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>

* feat(onboarding): add indication of branch/PR limits in "will create"

Per suggestion from Sebastian, this provides a quicker indication for a
user as to how many PRs they'll receive (if the limit caps the number of
PRs).

* fixup! feat(onboarding): add indication of branch/PR limits in "will create"

* coverage

---------

Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
2026-07-21 14:53:48 +00:00
Sebastian Poxhofer 1e03699cd6 test: add linter for as LongCommitSha in test files (#44681)
* test: add linter for `as LongCommitSha` in test files

Adds a custom oxlint rule `renovate/prefer-fake-sha-in-specs` that flags
`as LongCommitSha` casts in spec files and suggests the deterministic
`fakeSha()` helper from `test/util` instead. Enabled at error level for
`**/*.spec.ts` and `test/**`; all 131 pre-existing casts across 22 spec
files replaced.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* Update lib/modules/platform/bitbucket-server/index.spec.ts

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
2026-07-20 10:08:09 +00:00
Sebastian Poxhofer 9717259ffc refactor(oxlint): enable no-else-return and unicorn/no-lonely-if (#44553)
Enable no-else-return (with allowElseIf: false) and unicorn/no-lonely-if
as errors in .oxlintrc.json and fix all 131 pre-existing violations
(91 no-else-return, 40 unicorn/no-lonely-if) across 98 files.

The no-else-return violations were fixed with the oxlint autofix
(iterated to a fixpoint, plus two else-if chains that required
--fix-dangerously) followed by Prettier formatting. One comment dropped
by the autofix in lib/modules/manager/pub/artifacts.ts was restored
manually. The unicorn/no-lonely-if violations were merged by hand,
preserving comments and coverage-ignore hints.

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
2026-07-14 12:11:21 +00:00
Sebastian Poxhofer 7436b80cda test(linter): add renovate/no-redundant-mock-reset rule (#44557)
ci(linter): add renovate/no-redundant-mock-reset rule

Vitest sets mockReset: true globally in vitest.config.mts, which resets
all mocks before each test. This makes vi.resetAllMocks() /
vi.clearAllMocks() and per-mock .mockReset() / .mockClear() calls inside
beforeEach/afterEach hooks redundant. Add a custom oxlint rule (enabled
for **/*.spec.ts and test/**) flagging such calls, and remove the 40
redundant calls it found. restoreAllMocks/mockRestore are not flagged
because restoreMocks is not enabled globally.

Two sites keep an inline disable with a reason: nested beforeEach hooks
in filter-checks.spec.ts and onboarding/pr/index.spec.ts intentionally
call mockReset() to discard once-values queued by an outer beforeEach.

Requested by maintainer review feedback (review comment 3052324877).

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
2026-07-14 11:26:20 +00:00
Sebastian Poxhofer ad0b59f8b7 refactor(oxlint): enable vitest/require-to-throw-message (#44421) 2026-07-07 17:47:04 +00:00
Sebastian Poxhofer aac8365dd6 refactor(oxlint): enable vitest/prefer-snapshot-hint (#44420)
Add distinct hints to the multi-snapshot tests flagged by the rule
and regenerate the affected snapshot files, then re-enable the rule.

Part of #43845

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-07 16:35:22 +00:00
Jamie Tanna bcd44b991f feat(onboarding): add a summary for detected package files (#44258)
* refactor(onboarding): extract a function for calculating packageFiles

As part of a future change, we'll introduce a "summary" view for larger
repositories, and having a function extracted makes intent clearer.

Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>

* refactor(onboarding): add a summary for detected package files

As part of future changes in #41502, we're introducing a
Platform-limit-aware onboarding/reconfigure flow that will provide a
summary where appropriate.

Before we do so, we can introduce the new functionality - but not
integrate it right now - to incrementally add support.

As a slightly better interface when we have a large list of detected
package files, we can provide a summary per Manager.

Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>

* refactor(onboarding): group 3+ files under a directory as a list

As it's a more readable summary, especially with i.e. GitHub Actions,
where all package files commonly share the same directory.

The use of `3` as the lower bound was chosen without any research or too much
thought put into it.

Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>

---------

Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
2026-06-27 15:14:00 +00:00
Alex Thomae f3492fe1c8 fix(workers/repository): use GlobalConfig for productLinks (#44126)
* fix(workers/repository): use GlobalConfig for productLinks

PR #44098 added productLinks to GlobalConfig.OPTIONS, which moves it into
GlobalConfig and deletes it from the per-repo config. Several readers
were not migrated and now receive undefined from config.productLinks.

Most visibly, setStability and setConfidence build the status check
target_url from config.productLinks?.documentation. With it now empty the
URL becomes scheme-relative (e.g. "key-concepts/minimum-release-age/"),
which GitLab rejects with HTTP 400. That throws in setBranchStatus and
aborts the branch before its merge request is created.

Migrate the remaining readers to GlobalConfig.get('productLinks'),
matching #44098, and drop the now-redundant coerceString calls and
non-null assertions.

* refactor(config): drop productLinks from RenovateSharedConfig

productLinks is globalOnly and is now read via GlobalConfig.get. Leaving
it on the per-repo RenovateSharedConfig let callers read the (always
empty) config.productLinks, which is the footgun this PR fixes. Remove it
from the shared interface so it only exists on RepoGlobalConfig, and the
type now prevents reintroducing config.productLinks.
2026-06-22 07:16:59 +00:00
Jamie Tanna e1e5c398e0 chore: ensure we use productLinks for docs site links where possible (#44066)
* chore: ensure we use `productLinks` for docs site links where possible

Where possible, we should be making sure that we're using the
`productLinks`' configuration for  the documentation site, especially
where self-hosted users may create a mirror of their docs[0].

To make sure we catch this in the future, we can introduce a custom
linting rule with Oxlint to enforce this.

Where we (currently) can't wire in the config, we can disable it against
that line.

[0]: https://www.jvt.me/posts/2024/11/19/renovate-private-docs/

Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>

* fixup! chore: ensure we use `productLinks` for docs site links where possible

Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>

* fixup! chore: ensure we use `productLinks` for docs site links where possible

Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>

---------

Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
2026-06-18 08:55:27 +00:00
Sebastian Poxhofer 171a591d84 feat(git): validate commit shas (#43988)
* feat(git): validate length commit shas

* test: adapt test mocks

* chore: update import paths

* feat(git): make the validation more strict and support repositories using sha256

* test: add fakeSha function for deterministic git commit shas in tests
2026-06-15 06:36:57 +00:00
Jamie Tanna 27a65ebea8 test(workers/repository): simplify config hash tests for onboarding (#43757)
As part of future changes, we'll be making further tweaks to how the
onboarding PR is generated.

However, recent changes to the onboarding PR has proved that the
generation of the hash is quite awkward to work with.

We can use Claude Sonnet's help to refactor this and introduce a test
that helps us understand what the new hashes should be if there are
changes.

Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
2026-06-03 10:43:17 +00:00
Sebastian Poxhofer 73b90e958b refactor: remove string concetation for production code (#43442)
refactor: prefer templates rather than `+`
2026-05-19 13:31:27 +00:00
Sebastian Poxhofer 0793274b86 refactor: prefer templates rather than + in test files (#43441)
refactor: prefer templates rather than `+`
2026-05-19 09:52:28 +00:00
Jamie Tanna ff6761ed23 fix(config/global): return default values for GlobalConfig.get (#42113)
* fix(config/global): return default values for `GlobalConfig.get`

As noted in #39949, it can be awkward working with in `GlobalConfig.get`, where
we would previously need to specify the default value when calling `.get`,
which could lead to drift with the defaults for a given config option.

To reduce this risk, we can rely on a given `default` for a configuration
option, providing that as a default.

Because this now definitely returns a value that matches the config option, it
now allows us to remove `!` assertions.

* fixup! fix(config/global): return default values for `GlobalConfig.get`

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>

* fixup! fix(config/global): return default values for `GlobalConfig.get`

* test(presets): remove impossible test

As it's now not possible to set a value as `undefined` (as
`GlobalConfig` will then use the default), this test no longer validates
anything.

* test(workers/repository): add mock

Now `platform` defaults to `github`, we need to mock out the call to
fetch config.

Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>

* test: coverage

* test: coverage

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
2026-05-15 17:10:38 +00:00
Felipe Santos 1bbe82400e fix(gerrit): defer change creation to createPr() (#39250)
* fix(gerrit): defer change creation to `createPr()`

Signed-off-by: Felipe Santos <felipe.santos@ericsson.com>

* Refactor hashtags handling

* Add prTitle to all missing commitAndPush()

* Fix gerrit tests

* Add warning when prTitle is set in updatePr

* Remove now useless labels from commitAndPush

* Fix gerrit client coverage

* Fix gerrit scm coverage

* Fix rebase coverage

* Improve TODO about assignees

* Fix formatting

* Fix review comment

* Extract to a pushForReview function

* Fix after #41382

* Fix onboarding

* Cleanup code

* Fix ESLint

* Fix tests

* Restore gitRetry for git.merge

* Fix tests

* Simplify hashtags code

* Delete pendingChangeBranch in pushForReview()

* Fix test name

* Remove unnecessary test comments

* Improve test name again

* Fix another test name

* Delete local branch in Gerrit SCM

* Add test for deleting pending branch

* Add tests for pushForReview()

* Fix test case name

* Improve another test name

* Fix another small test inconsistency

* Fix some code style issues

* Use isUndefined instead

* Fix one small test style issue

---------

Signed-off-by: Felipe Santos <felipe.santos@ericsson.com>
2026-04-28 08:29:26 +00:00
Jamie Tanna 72968d3726 chore: clarify "Mend Renovate" in PRs (#42841)
As part of general work to reinforce the brand link between Mend and
Renovate, we can improve the default PR body footer to clarify this.

This feeds into #29885 and general naming, where we want to keep these
close, while also not being too "in your face".

This is still user-controlled, but provides a more reasonable default.

This also feeds into #26838 and #39305, where we should also remove the
"Bot" from the footer.
2026-04-23 11:33:36 +00:00
RahulGautamSingh 36f9d4a185 refactor: move requireConfig to InheritConfig (#41385)
* refactor: move requireConfig to InheritConfig

* fix test

* update test

* refactor
2026-04-14 11:53:53 +00:00
Jamie Tanna 5f02aa860d chore(onboarding): add "reading list" link from onboarding PR (#42418)
As a potentially actionable suggestion for newly onboarding users.
2026-04-07 10:57:01 +00:00
Jamie Tanna 434606bfb4 feat(onboarding): make Add your custom config to ... more prominent (#42332)
* feat(onboarding): make `Add your custom config to ...` more prominent

As part of work to improve the Onboarding flow as part of larger repos,
we noticed that the `Add your custom config to ...` comment may be
missed.

We can make this more prominent by moving it up to the top of the PR.

* fixup! feat(onboarding): make `Add your custom config to ...` more prominent
2026-04-07 10:29:52 +00:00
Jamie Tanna b1d03bc8f3 chore(onboarding): add link to prHourlyLimit docs (#39445)
To make this more actionable.
2026-03-19 10:11:34 +00:00
RahulGautamSingh 2dc7d9c43f refactor: move onboardingCommitMessage to InheritConfig (#41380)
* refactor: move onbaordingCommitMessage to InheritConfig

* fix test

* fix sorting
2026-03-09 13:12:06 +00:00
RahulGautamSingh b4cb678bb9 refactor: move onboardingConfig to InheritConfig (#41382)
refactor: move onboardingConfig to InheritConfig
2026-03-02 12:23:13 +00:00
RahulGautamSingh d1fa243a08 refactor: move onboardingConfigFileName to InheritConfig (#41383)
* refactor: move onboardingConfigFilenName to InheritConfig

* fix test

* fix type

* update fn
2026-02-26 20:29:53 +00:00
RahulGautamSingh 54547c97fc refactor: move onboarding to InheritConfig (#41377)
* refactor: move  to

* fix test
2026-02-24 21:52:41 +00:00
RahulGautamSingh af14f83a05 refactor: move onboardingNoDeps to InheritConfig (#41384)
refactor: move onboardingNoDeps to InheritConfig
2026-02-24 21:45:05 +00:00
RahulGautamSingh da50c75c49 refactor: move onboardingPrTitle to InheritConfig (#41376)
* refactor: move onboardingPrTitle to InheritConfig

* remove unwanted flat clone
2026-02-22 18:32:16 +00:00
Felipe Santos 7ebba26236 feat: add commitHourlyLimit (#36226)
* feat: add `commitHourlyLimit`

Signed-off-by: Felipe Santos <felipe.santos@ericsson.com>

* Update docs/usage/configuration-options.md

Co-authored-by: RahulGautamSingh <rahultesnik@gmail.com>

* Remove date optionality

* Fix lint comment

* Fix coverage

* Restore contents of commit.spec.ts

* Use ! somewhere else too

* Change optional parameter to nullish

* Refactor `!` to use proper check

* Fix set-branch-commit.spec.ts lint

* Fix test coverage

* Apply suggestions from code review

Co-authored-by: RahulGautamSingh <rahultesnik@gmail.com>

* Split commit-limit-reached into two

* Fix review comments

* Use toUTC() where applicable

* Simplify another test to utc()

---------

Signed-off-by: Felipe Santos <felipe.santos@ericsson.com>
Co-authored-by: RahulGautamSingh <rahultesnik@gmail.com>
Co-authored-by: Michael Kriese <michael.kriese@visualon.de>
2026-02-19 18:00:32 +00:00
RahulGautamSingh 7a8dcdbd01 refactor(config/inherit): move onboardingBranch to InheritConfig (#40865)
* move onboardingBranch to InheritConfig

* fix lint issue

* fix import order

* more fixrs

* fix import

* fix imports
2026-02-15 08:17:11 +00:00
Sergei Zharinov 9d857c1f68 refactor(lint): Organize imports with biome (#40966) 2026-02-06 13:40:01 +00:00
Jamie Tanna dc9f86873d fix(onboardingAutoCloseAge): don't allow higher inherited value than global (#40810) (#40817)
Our intent for `onboardingAutoCloseAge` would be that the global
config would take precedence over the inherited config value.

Our implementation missed this, which means that inherited config could
then override the value, including disabling it.

To correct this, we can make sure that when using `getInheritedOrGlobal`
we only allow the inherit config option if it is lower than the global
option.

Co-authored-by: Claude Sonnet 4.5 <jamie.tanna+github-copilot@mend.io>
2026-02-02 08:55:23 +00:00
Jamie Tanna 991fdbfd6b chore(onboarding): capitalise the prHourlyLimit (#39443)
As that is the correct name.
2026-01-29 17:58:45 +00:00
RahulGautamSingh c58c16f82d feat: inherit support for onboardingAutoCloseAge (#40086)
* feat: inherit support for onboardingAutoCloseAge

* reduce changes

* onboardingAutoCloseAgeLimit

* use global onboardingAutoCloseAge as limiter

* update

* revert extra changes

* afterAll
2026-01-27 16:36:44 +00:00
Sergei Zharinov 930cf6633c refactor: Rewrite imports with .ts extensions (#40700)
fix: Additional vi.mock path corrections and prettier formatting
2026-01-26 22:48:17 +00:00
Jamie Tanna 0326bd60cd fix(onboardingAutoCloseAge): mark repositories as "closed-onboarding" after close (#40633)
As noted in #40631, when autoclosing an onboarding PR due to age, we're
not marking the repository status as `closed-onboarding`, which means
the repository cache (and current status fo the repo) is not
appropriately updated, and a repository needs to be scanned again to
update accordingly.

We should throw this error when we've performed the auto-close, so
Renovate can then mark the status correctly.
2026-01-23 15:08:40 +00:00