For instance, when a repository is onboarding with many dependency
updates (some of which have many security releases), it would be
useful to let the user know that they're not unlimited, but that the
rate limit is taken into account.
Now we have the capability to specify these, we should:
- take them into account when determining how many PR(s) may be raised
at a given time
- point users to the documentation when they may want to limit them, if
the number of security PRs is more than the
`prConcurrentLimit`/`branchConcurrentLimit`
Co-authored-by: Claude Sonnet 5 <jamie.tanna+claude-code@mend.io>
* test(core): replace file snapshots with explicit assertions
* test(core): replace inline snapshots with explicit assertions
* test(core): assert on relevant sections instead of full bodies
* test(core): drop assertions implied by full equality
* test(core): address review feedback
* test(core): use resolves instead of awaiting inside expect
* refactor(lint): enable oxlint prefer-named-capture-group at error
Numbered capture groups (m[1], $1) break silently when a regex is
edited and group order shifts. Named groups (?<name>...) make intent
explicit and accesses (m.groups.name) resilient to reordering.
This enables the built-in eslint rule prefer-named-capture-group,
surfacing 321 pre-existing unnamed-group violations across ~121
files to be burned down incrementally in follow-up commits.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017RxHFNsSworLcv23xXk9Hk
* refactor(versioning): name capture groups for prefer-named-capture-group
Burns down all prefer-named-capture-group violations in
lib/modules/versioning/. Unused capture groups (only reachable via
.test() or whole-match) become non-capturing (?:...); groups whose
value is read become named (?<name>...), with accesses rewritten to
match.groups!.<name> (or destructured from .groups!) instead of
positional match[n]/$n so a future edit that reorders groups cannot
silently break the reader.
Two cases needed extra care to preserve behavior:
- semver/common.ts and poetry/patterns.ts split() on a regex whose
capture group is relied upon by String.prototype.split to keep the
separator in the output array; the group is kept capturing and
named, not converted to non-capturing.
- hashicorp/convertor.ts's semverRegex is only ever embedded via
.source into a named `(?<version>...)` group elsewhere and never
matched directly, so its internal groups are safe to make
non-capturing.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017RxHFNsSworLcv23xXk9Hk
* refactor(datasource): name capture groups for prefer-named-capture-group
Burns down all prefer-named-capture-group violations under
lib/modules/datasource/. Same treatment as the versioning module:
unused groups become non-capturing, used groups get names, and
positional match[n] reads move to match.groups!.<name>.
docker/ecr.ts and pypi/common.ts keep their positional destructuring
(`const [, region] = ...`, `!!m &&`) working unchanged since a named
capture group is still addressable by its numeric index in
JavaScript — only pypi/common.ts's access was rewritten to
m.groups!.owner for clarity since it read a single group directly.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017RxHFNsSworLcv23xXk9Hk
* refactor(platform): name capture groups for prefer-named-capture-group
Burns down all prefer-named-capture-group violations under
lib/modules/platform/. Uses the repo's established idiom of
`match.groups?.<name>` after an optional-chained exec()/match() (see
bitbucket/index.ts hostnameWithoutApiPrefix, gerrit/utils.ts
extractSourceBranch) and `$<name>` in String.replace replacement
strings. Unused groups (markdown/HTML massaging regexes matched only
to be stripped) become non-capturing.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017RxHFNsSworLcv23xXk9Hk
* refactor(manager): name capture groups in ansible-galaxy for prefer-named-capture-group
Burns down prefer-named-capture-group violations in
lib/modules/manager/ansible-galaxy/. newBlockRegEx and blockLineRegEx
dropped their unused outer wrapping group (only the inner key/value
groups were ever read) and named the key/value groups; nameMatchRegex's
remaining unused groups (protocol/user-info/port alternatives) become
non-capturing since only source/hostname/depName/version are read via
.groups. Accesses in collections.ts and roles.ts move from
lineMatch[2]/lineMatch[3] to lineMatch.groups!.key/value.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017RxHFNsSworLcv23xXk9Hk
* refactor(manager): name capture groups for prefer-named-capture-group (batch 1)
Burns down prefer-named-capture-group violations across the first
alphabetical slice of lib/modules/manager/ (ansible through mix).
Used groups get names with accesses rewritten to match.groups!.<name>
(or $<name> in replacement strings); groups whose value is never read
become non-capturing (?:...). Two String.split() call sites
(git-submodules/extract.ts, meteor/extract.ts) keep the established
"named group still readable positionally from the split() result
array" idiom instead of restructuring the destructuring.
bazel/rules/go.ts and buildpacks/extract.ts dockerRef verified
byte-for-byte equivalent before/after via a quick node script since
several nested groups collapsed to non-capturing at once.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017RxHFNsSworLcv23xXk9Hk
* refactor(manager): name capture groups for prefer-named-capture-group (batch 2)
Burns down prefer-named-capture-group violations across the remaining
alphabetical slice of lib/modules/manager/ (npm through terragrunt).
Same treatment as batch 1: used groups get names with accesses moved
to match.groups!.<name> or $<name> replacement strings; unused groups
(wrapping alternations, quantifier repetition groups only consumed via
.test(), or values never read from a match) become non-capturing.
terraform/extractors/others/modules.ts and terragrunt/modules.ts share
near-identical URL-parsing regexes (github/bitbucket/git/azure-devops
ref matchers) — the same set of always-unused `depth=`/`&depth=`
query-string groups is converted to non-capturing in both files.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017RxHFNsSworLcv23xXk9Hk
* refactor(config): name capture groups for prefer-named-capture-group
Burns down prefer-named-capture-group violations in lib/config/.
Used groups get names with replacement strings switched from $1/$2 to
$<name>; the unused separator group in schedule-migration.ts's
afterBeforeRegex becomes non-capturing. presets/parse.ts keeps
assigning through the already-declared `repo` variable rather than
array-destructuring the exec() result, matching this file's existing
style for the other named-group regexes just above it.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017RxHFNsSworLcv23xXk9Hk
* refactor(util): name capture groups for prefer-named-capture-group
Burns down prefer-named-capture-group violations across lib/util/ and
lib/logger/. Same treatment as previous batches: named groups for
values that are read (via $<name> replacement strings, .groups!.<name>,
or destructured from .groups), non-capturing groups where nothing reads
the captured value (e.g. semantic.ts's angular-commit .test()-only
regex). www-authenticate.ts's tokenizer entries each get their own
named group but keep accessing the match generically via match[1],
since a positionally-indexed named group is still readable by index.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017RxHFNsSworLcv23xXk9Hk
* refactor(workers): name capture groups for prefer-named-capture-group
Burns down prefer-named-capture-group violations in lib/workers/.
Used groups get names with $<name> replacement strings; unused
wrapper/alternation groups (e.g. semantic-commit-message.ts's optional
scope/issue wrappers, release-notes.ts's date-heading and
horizontal-rule matchers that are only probed with .search()/replaced
wholesale) become non-capturing.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017RxHFNsSworLcv23xXk9Hk
* refactor(test,tools): name capture groups for prefer-named-capture-group
Finishes the prefer-named-capture-group burndown: test/, tools/, and
vitest.config.mts. Groups whose value is read get names ($<name>
replacement strings or .groups.<name> access); groups only used via
.test()/.search() or that feed a .match(/…/g) call (whose return value
is the array of whole matches, not captured groups) become
non-capturing.
This is the last remaining slice of pre-existing violations, so the
rule (already enabled at error repo-wide) now passes with zero
findings across the whole codebase.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017RxHFNsSworLcv23xXk9Hk
* fix prettier failure
* refactor(lint): use a named capture group in `v8-ignore-no-count`
New rule from main trips the newly enabled `prefer-named-capture-group` oxlint rule.
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* refactor(onboarding): return repository result from ensureOnboarding
Rename ensureOnboardingPr to ensureOnboarding and have it return a new
'onboarding' RepositoryResult. renovateRepository now branches on
repoIsOnboarded, so exactly one of ensureOnboarding/updateRepo produces
the repository result and the non-null assertion on the update result
(TODO #22198) is no longer needed. updateRepo/update no longer return
undefined for non-onboarded repositories.
* refactor(onboarding): keep ensureOnboardingPr name
When using the "summary view", in the case we hit platform limits, in
Onboarding PRs or Reconfigure PR comments, we should prioritise the
"What to Expect" as it provides a more actionable "executive summary" of
what's needed in the repository.
Co-authored-by: Claude Sonnet 5 <jamie.tanna+claude-code@mend.io>
* refactor(workers/repository): extract PR body template helpers for onboarding/reconfigure
As part of follow-up changes to reorder the "summary view", we need to
extract the core logic out for onboarding/reconfigure PRs.
Given the tests haven't needed to change, we can see this is a perfect
in-place rewrite.
Co-authored-by: Claude Sonnet 5 <jamie.tanna+claude-code@mend.io>
* fixup! refactor(workers/repository): extract PR body template helpers for onboarding/reconfigure
Adding existing missing coverage.
Co-authored-by: Claude Sonnet 5 <jamie.tanna+claude-code@mend.io>
---------
Co-authored-by: Claude Sonnet 5 <jamie.tanna+claude-code@mend.io>
* feat(onboarding): improve wording of concurrency limits with PRs opened
When receiving an onboarding PR while using `prConcurrentLimit`,
`branchConcurrentLimit` or `prHourlyLimit` concurrency controls, users
may still receive a note such as:
> will create 189 Pull Requests
This isn't true, and can be surprising and/or worrying for a user who
may believe they're going to be swamped by PRs.
We can therefore improve this, to make it clearer how many will be
immediately raised, and how many will be raised over time.
Co-authored-by: Claude Sonnet 5 <jamie.tanna+claude-code@mend.io>
* test(onboarding): reduce duplicated test setup
As a way to make it clearer what each test is actually testing.
Co-authored-by: Claude Sonnet 5 <jamie.tanna+claude-code@mend.io>
---------
Co-authored-by: Claude Sonnet 5 <jamie.tanna+claude-code@mend.io>
* chore(config): be explicit about `Renovate CLI` in `prFooter`
This was something I should have done in
72968d3726.
* fixup! chore(config): be explicit about `Renovate CLI` in `prFooter`
As part of #41502, we're introducing a Platform-limit-aware
onboarding/reconfigure flow that will provide a summary where
appropriate.
This improves the experience where onboarding a large monorepo to
Renovate, especially when it produces an onboarding/reconfigure PR that
is too large to fit within Platform limits.
If we detect the Platform limits being exceeded for a given PR, we'll
switch to the "summary" view.
This builds on top of 4fbfc6095a and bcd44b991f, which introduced the
main changes this then enables.
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* refactor(workers/repository): use `coerceNumber`
* refactor(workers/repository): link to `commitHourlyLimit` docs
So the reference is actionable by a user.
* refactor(workers/repository): add functions to summarise "What to expect" in onboarding
As part of future changes in #41502, we're introducing a
Platform-limit-aware onboarding/reconfigure flow that will provide a
summary where appropriate.
Before we do so, we can introduce the new functionality - but not
integrate it right now - to incrementally add support.
This provides a summary, following similar patterns to how
`getExpectedPrList` executes, but:
- provides a table summary of the detected updates for the repository,
broken down by security updates, `updateType`, and then anything else
- user-configurable/match-able updates (like `minor`) are prioritised
over i.e. `bump` updates
- if multiple base branches are used, there is a column to indicate the
base branch
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
Co-authored-by: Claude Opus 4.6 <jamie.tanna+claude-code@mend.io>
* fixup! refactor(workers/repository): add functions to summarise "What to expect" in onboarding
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* feat(onboarding): add indication of branch/PR limits in "will create"
Per suggestion from Sebastian, this provides a quicker indication for a
user as to how many PRs they'll receive (if the limit caps the number of
PRs).
* fixup! feat(onboarding): add indication of branch/PR limits in "will create"
* coverage
---------
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
ci(linter): add renovate/no-redundant-mock-reset rule
Vitest sets mockReset: true globally in vitest.config.mts, which resets
all mocks before each test. This makes vi.resetAllMocks() /
vi.clearAllMocks() and per-mock .mockReset() / .mockClear() calls inside
beforeEach/afterEach hooks redundant. Add a custom oxlint rule (enabled
for **/*.spec.ts and test/**) flagging such calls, and remove the 40
redundant calls it found. restoreAllMocks/mockRestore are not flagged
because restoreMocks is not enabled globally.
Two sites keep an inline disable with a reason: nested beforeEach hooks
in filter-checks.spec.ts and onboarding/pr/index.spec.ts intentionally
call mockReset() to discard once-values queued by an outer beforeEach.
Requested by maintainer review feedback (review comment 3052324877).
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Add distinct hints to the multi-snapshot tests flagged by the rule
and regenerate the affected snapshot files, then re-enable the rule.
Part of #43845
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
* refactor(onboarding): extract a function for calculating packageFiles
As part of a future change, we'll introduce a "summary" view for larger
repositories, and having a function extracted makes intent clearer.
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* refactor(onboarding): add a summary for detected package files
As part of future changes in #41502, we're introducing a
Platform-limit-aware onboarding/reconfigure flow that will provide a
summary where appropriate.
Before we do so, we can introduce the new functionality - but not
integrate it right now - to incrementally add support.
As a slightly better interface when we have a large list of detected
package files, we can provide a summary per Manager.
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* refactor(onboarding): group 3+ files under a directory as a list
As it's a more readable summary, especially with i.e. GitHub Actions,
where all package files commonly share the same directory.
The use of `3` as the lower bound was chosen without any research or too much
thought put into it.
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
---------
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* fix(workers/repository): use GlobalConfig for productLinks
PR #44098 added productLinks to GlobalConfig.OPTIONS, which moves it into
GlobalConfig and deletes it from the per-repo config. Several readers
were not migrated and now receive undefined from config.productLinks.
Most visibly, setStability and setConfidence build the status check
target_url from config.productLinks?.documentation. With it now empty the
URL becomes scheme-relative (e.g. "key-concepts/minimum-release-age/"),
which GitLab rejects with HTTP 400. That throws in setBranchStatus and
aborts the branch before its merge request is created.
Migrate the remaining readers to GlobalConfig.get('productLinks'),
matching #44098, and drop the now-redundant coerceString calls and
non-null assertions.
* refactor(config): drop productLinks from RenovateSharedConfig
productLinks is globalOnly and is now read via GlobalConfig.get. Leaving
it on the per-repo RenovateSharedConfig let callers read the (always
empty) config.productLinks, which is the footgun this PR fixes. Remove it
from the shared interface so it only exists on RepoGlobalConfig, and the
type now prevents reintroducing config.productLinks.
* chore: ensure we use `productLinks` for docs site links where possible
Where possible, we should be making sure that we're using the
`productLinks`' configuration for the documentation site, especially
where self-hosted users may create a mirror of their docs[0].
To make sure we catch this in the future, we can introduce a custom
linting rule with Oxlint to enforce this.
Where we (currently) can't wire in the config, we can disable it against
that line.
[0]: https://www.jvt.me/posts/2024/11/19/renovate-private-docs/
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* fixup! chore: ensure we use `productLinks` for docs site links where possible
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* fixup! chore: ensure we use `productLinks` for docs site links where possible
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
---------
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
As part of future changes, we'll be making further tweaks to how the
onboarding PR is generated.
However, recent changes to the onboarding PR has proved that the
generation of the hash is quite awkward to work with.
We can use Claude Sonnet's help to refactor this and introduce a test
that helps us understand what the new hashes should be if there are
changes.
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
As part of general work to reinforce the brand link between Mend and
Renovate, we can improve the default PR body footer to clarify this.
This feeds into #29885 and general naming, where we want to keep these
close, while also not being too "in your face".
This is still user-controlled, but provides a more reasonable default.
This also feeds into #26838 and #39305, where we should also remove the
"Bot" from the footer.
* feat(onboarding): make `Add your custom config to ...` more prominent
As part of work to improve the Onboarding flow as part of larger repos,
we noticed that the `Add your custom config to ...` comment may be
missed.
We can make this more prominent by moving it up to the top of the PR.
* fixup! feat(onboarding): make `Add your custom config to ...` more prominent
Our intent for `onboardingAutoCloseAge` would be that the global
config would take precedence over the inherited config value.
Our implementation missed this, which means that inherited config could
then override the value, including disabling it.
To correct this, we can make sure that when using `getInheritedOrGlobal`
we only allow the inherit config option if it is lower than the global
option.
Co-authored-by: Claude Sonnet 4.5 <jamie.tanna+github-copilot@mend.io>
* feat: inherit support for onboardingAutoCloseAge
* reduce changes
* onboardingAutoCloseAgeLimit
* use global onboardingAutoCloseAge as limiter
* update
* revert extra changes
* afterAll
As noted in #40631, when autoclosing an onboarding PR due to age, we're
not marking the repository status as `closed-onboarding`, which means
the repository cache (and current status fo the repo) is not
appropriately updated, and a repository needs to be scanned again to
update accordingly.
We should throw this error when we've performed the auto-close, so
Renovate can then mark the status correctly.
As noted in #40627, when using a Repository Cache, the
onboardingAutoCloseAge does not trigger if the repository already has
its onboarding state already cached.
This is most prevalent in the Mend Developer Platform, where we heavily
cache our users' repositories, but leads to the fact that turning on
`onboardingAutoCloseAge` will take no effect.
To make this work, we can refactor how we handle `ensureOnboardingPr`,
to make sure that we still perform auto-closing even if the cache is
up-to-date.
Although not at the "rule of there", we can reduce code duplication for
`ensureOnboardingAutoCloseAge` by extracting a function.
As noted in #40604, we're seeing cases where we need to wait
`onboardingAutoCloseAge+1` days until the onboarding PR will be
auto-closed.
To fix this, we can refactor `getElapsedDays` to optionally return a
floating point number, which we can then perform more careful
calculations against.
As we're now being a little more careful with timings being used for our
date comparisons, we need to make sure that Vitest fakes our timer
during these tests.
Instead of long floating-point numbers, we should use a 2 decimal
place value for log messages, as they're more readable to humans.
To provide more information around the process used to determine whether
an onboarding PR will be auto-closed by `onboardingAutoCloseAge`, we can
add some more logs.
renovate[bot]