* ci(linter): add prefer-partial-in-specs oxlint rule
Flags object literals cast to `any` (`{...} as any`) in spec/test files and steers toward `partial<T>()` from `test/util`. Enabled at error in the spec-files override so CI blocks new occurrences.
Closes#44646
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* test: drop unnecessary object-literal `as any` casts
The casts masked values already assignable to the expected type (migration configs accepted as Record<string, unknown>, all-optional param types, etc.); removing them restores real type checking.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* test: replace object-literal `as any` casts with partial<T>()
Uses partial<T>() from test/util so incomplete mock/config objects keep proper typing. Azure API mocks switch to mockResolvedValue(partial<T>()) and their inner method mocks to mockResolvedValue(), matching the sibling-file idiom.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* test: suppress prefer-partial-in-specs for intentionally-invalid inputs
Some tests deliberately pass malformed or legacy data to exercise validation/error paths, where no real type fits; keep the cast with a reasoned oxlint-disable-next-line.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
* ci(linter): add renovate/logger-static-message rule
Adds a custom oxlint rule that enforces a static msg component for
logger.warn/error/fatal calls (including logger.once variants) so the
messages can be grouped in metrics and error catching services, per
docs/development/best-practices.md. It also flags metadata properties
named 'error' that hold error-ish values, because the bunyan serializer
only handles the 'err' key.
The rule is enabled as an error for lib/ production code and disabled
for spec files. All 33 pre-existing violations are fixed by moving
interpolated values into the metadata object, making messages static,
and renaming 'error' metadata keys to 'err'. Affected log-message
assertions in co-located specs are updated accordingly.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* ci: ignore validator output
* fixup new merged in log messages
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* refactor(config): move checkedBranches and rebaseAllOpenBranches into GlobalConfig
Both options are globalOnly but were being read directly off the
repository config object instead of GlobalConfig, so they weren't
part of the RepoGlobalConfig contract enforced elsewhere.
* test: reset GlobalConfig in beforeEach instead of per-test
Matches the pattern used elsewhere (common.spec.ts, error-config.spec.ts,
prune.spec.ts) and resets before each test instead of after, so a failed
assertion can't leak state into the next test.
* refactor: use isNonEmptyArray instead of .length check
* feat: add `--rebase-all-open-branches`
* feat: mark rebaseAllOpenBranches as cli: true explicitly
* feat: mark checkedBranches as cli: true explicitly
As part of an investigation around `commitHourlyLimit` performing slowly
on a repository with many branches, we can introduce more
instrumentation to be able to debug further.
* fix: misleading log message when updatePr is called due to autoApprove
* Log "PR body changed" only if PR body changed
* Revert "Log "PR body changed" only if PR body changed"
This reverts commit b4bd3de3d2.
* Add log assertion ot test
* ci(linter): add renovate/codeblock-in-spec-fixtures rule
Add a custom oxlint rule that requires the codeBlock (or stripIndent)
template helper from common-tags for multi-line string fixtures in spec
files (enabled for **/*.spec.ts and test/** only).
The rule only flags shapes whose value can round-trip through the
common-tags helpers unchanged, since both codeBlock and stripIndent trim
the end result and strip the shortest line indentation:
- only literals spanning multiple source lines are flagged (escaped \n
one-liners are left alone: tagging them is not value-preserving in
general and gains nothing)
- values with leading/trailing whitespace (e.g. fixtures ending in a
newline) are not flagged
- tagged templates, describe/it titles, and inline snapshot arguments
are skipped
All 55 pre-existing violations (22 files) were fixed with a one-off
codemod that re-emits each fixture indented to the statement depth and
verifies value preservation by evaluating codeBlock on the rewritten
template (substitutions kept as opaque placeholders). One site
(pip_requirements/artifacts.spec.ts) mixes line continuations with
escaped newlines and was tagged verbatim instead of re-indented.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* ci(linter): address review findings
Make getSimpleRequirementsFile in pip-compile/extract.spec.ts
value-preserving again: tagging the whole template with codeBlock
trimmed the trailing blank line when deps is empty (the headerOnly.txt
case), silently changing the fixture from ending in '#\n\n' to '#'.
Tag only the static header and append the deps section via a
single-line template, which reproduces the original string exactly
for both empty and non-empty deps (verified by executing old vs new
in node).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Enable the unicorn/prefer-at rule as error in .oxlintrc.json and fix all
43 pre-existing violations (arr[arr.length - 1] -> arr.at(-1)) via oxlint
autofix. Where .at() widened the type to T | undefined, non-null
assertions were added at sites where surrounding logic guarantees the
element exists (length guards, split results), preserving the original
runtime behavior and typing.
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Enable the type-aware typescript/no-unnecessary-type-arguments rule as
error and remove all 44 pre-existing redundant type arguments (type
arguments identical to the type parameter default), e.g.
HttpResponse<string>, ZodError<unknown>,
PackageDependency<Record<string, any>>.
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
refactor(oxlint): enable vitest/consistent-test-it
Enforce `it` over `test` in spec files via
vitest/consistent-test-it (fn: "it"), matching repo convention.
Renamed all 52 pre-existing `test(`/`test.each` usages across
13 spec files to `it(`/`it.each` using oxlint --fix.
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Enable no-else-return (with allowElseIf: false) and unicorn/no-lonely-if
as errors in .oxlintrc.json and fix all 131 pre-existing violations
(91 no-else-return, 40 unicorn/no-lonely-if) across 98 files.
The no-else-return violations were fixed with the oxlint autofix
(iterated to a fixpoint, plus two else-if chains that required
--fix-dangerously) followed by Prettier formatting. One comment dropped
by the autofix in lib/modules/manager/pub/artifacts.ts was restored
manually. The unicorn/no-lonely-if violations were merged by hand,
preserving comments and coverage-ignore hints.
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
ci(linter): add renovate/no-redundant-mock-reset rule
Vitest sets mockReset: true globally in vitest.config.mts, which resets
all mocks before each test. This makes vi.resetAllMocks() /
vi.clearAllMocks() and per-mock .mockReset() / .mockClear() calls inside
beforeEach/afterEach hooks redundant. Add a custom oxlint rule (enabled
for **/*.spec.ts and test/**) flagging such calls, and remove the 40
redundant calls it found. restoreAllMocks/mockRestore are not flagged
because restoreMocks is not enabled globally.
Two sites keep an inline disable with a reason: nested beforeEach hooks
in filter-checks.spec.ts and onboarding/pr/index.spec.ts intentionally
call mockReset() to discard once-values queued by an outer beforeEach.
Requested by maintainer review feedback (review comment 3052324877).
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* ci(linter): add renovate/prefer-zod-nullish rule
Add a custom oxlint rule that flags zod chains calling .optional() and
.nullable() adjacently (in either order) and suggests .nullish(), which
is equivalent (both accept undefined | null in zod v4).
Fix all 26 pre-existing violations across 6 schema files.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* ci(linter): prefer schema-utils Nullish over zod .nullish()
Rename prefer-zod-nullish to prefer-nullish-util and extend it to flag
.nullish() itself, including the standalone forms z.nullish(x) and
z.optional(z.nullable(x)). Migrate all call sites to Nullish() and
DeepNullish() from schema-utils, which normalize null to undefined in
parsed output. Schemas with more than one nullish position are wrapped
in DeepNullish(); nullish object properties with nullish members use
Nullish(DeepNullish(...)) to keep the optional property type marker.
Spec files are exempt (result.spec.ts intentionally tests
null-preserving parses). Spec assertions expecting null in parsed
output were updated to undefined. Note: docker manifests with an
explicit "mediaType": null are now accepted and treated like an absent
mediaType instead of failing the discriminated union.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* fix(npm): remove old dependency when replacement exists
* Add coverage ignore comments
* Simplify implementation
* Rename to removeAsString
* Move it after replaceAsString
* Improve test case
* Improve error message of replaceAsString
* Fix coverage
* Fix coverage again
* Only remove dependency at depType like replaceAsString
* Refactor tests
* Fix tsc
* fix(npm): skip update when replacement dependency already exists
* Simplify else
* Avoid returning an error
* fix(flatten): skip replacement updates when a sibling dependency already exists
* Revert the other changes
* Also handle it in the Dependency Dashboard
* Filter out earlier
* Try some other way
* Try fix dep dashboard
* Try fix again
* Extract helper
* Improve some stuff
* Improve assertion
* Remove misleading comment
* Address review comments
- Convert `param: T | undefined = undefined` to optional `param?: T`.
- Drop dead `= false` defaults on the required cache-provider options.
- Make `GraphqlPaginatedContent.nodes/edges` optional so the `= []`
fallbacks (load-bearing for partial GraphQL connections) are valid.
- Type the unchecked `default_branch` response field as optional so
the `'HEAD'` fallback is retained.
- Drop `tag = undefined` from the Forgejo/Gitea/GitLab preset configs.
Part of #43845
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Add distinct hints to the multi-snapshot tests flagged by the rule
and regenerate the affected snapshot files, then re-enable the rule.
Part of #43845
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
* refactor(onboarding): extract a function for calculating packageFiles
As part of a future change, we'll introduce a "summary" view for larger
repositories, and having a function extracted makes intent clearer.
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* refactor(onboarding): add a summary for detected package files
As part of future changes in #41502, we're introducing a
Platform-limit-aware onboarding/reconfigure flow that will provide a
summary where appropriate.
Before we do so, we can introduce the new functionality - but not
integrate it right now - to incrementally add support.
As a slightly better interface when we have a large list of detected
package files, we can provide a summary per Manager.
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* refactor(onboarding): group 3+ files under a directory as a list
As it's a more readable summary, especially with i.e. GitHub Actions,
where all package files commonly share the same directory.
The use of `3` as the lower bound was chosen without any research or too much
thought put into it.
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
---------
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* fix: `commitMessageExtra` not being honored
* Retain version for Maven property versions
* Fix PRs not being marked as immortal
* Revert "Fix PRs not being marked as immortal"
This reverts commit a17cc15342.
* Revert "Retain version for Maven property versions"
This reverts commit 3f14484f46.
* Revert "fix: `commitMessageExtra` not being honored"
This reverts commit 6c86357580.
* fix: avoid removing the version the PR title for Maven properties
* Do not consider Maven property updates as groups
---------
Co-authored-by: Jamie Tanna <jamie.tanna@mend.io>
* feat(config): set `groupSingleUpdates=false` by default
Although it didn't seem like this may be a breaking change when we
introduced this[0], there have been a number of follow-up Discussions
reported that have indicated there has been some breakage from the
changes.
Instead of continually fixing forward, we can revert this back to an
opt-in feature.
Once it's stable, we can look at re-enabling it (most likely in a major
release, unless we're confident no breakage should occur).
[0]: https://github.com/renovatebot/renovate/pull/43629#issuecomment-4594201274
* fixup! feat(config): set `groupSingleUpdates=false` by default
* fix(workers/repository): use GlobalConfig for productLinks
PR #44098 added productLinks to GlobalConfig.OPTIONS, which moves it into
GlobalConfig and deletes it from the per-repo config. Several readers
were not migrated and now receive undefined from config.productLinks.
Most visibly, setStability and setConfidence build the status check
target_url from config.productLinks?.documentation. With it now empty the
URL becomes scheme-relative (e.g. "key-concepts/minimum-release-age/"),
which GitLab rejects with HTTP 400. That throws in setBranchStatus and
aborts the branch before its merge request is created.
Migrate the remaining readers to GlobalConfig.get('productLinks'),
matching #44098, and drop the now-redundant coerceString calls and
non-null assertions.
* refactor(config): drop productLinks from RenovateSharedConfig
productLinks is globalOnly and is now read via GlobalConfig.get. Leaving
it on the per-repo RenovateSharedConfig let callers read the (always
empty) config.productLinks, which is the footgun this PR fixes. Remove it
from the shared interface so it only exists on RepoGlobalConfig, and the
type now prevents reintroducing config.productLinks.
* fix: not applying global options in object entries in `repositories` array
* Use isNonEmptyObject
* Add test for per-repo override
* Use AllConfig instead
* chore: ensure we use `productLinks` for docs site links where possible
Where possible, we should be making sure that we're using the
`productLinks`' configuration for the documentation site, especially
where self-hosted users may create a mirror of their docs[0].
To make sure we catch this in the future, we can introduce a custom
linting rule with Oxlint to enforce this.
Where we (currently) can't wire in the config, we can disable it against
that line.
[0]: https://www.jvt.me/posts/2024/11/19/renovate-private-docs/
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* fixup! chore: ensure we use `productLinks` for docs site links where possible
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* fixup! chore: ensure we use `productLinks` for docs site links where possible
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
---------
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* fix(platform/forgejo): replace getJsonUnchecked with validated getJson
Migrate all getJsonUnchecked calls in the Forgejo platform module to use
getJson with Zod schemas for response validation. Add comprehensive Zod
schemas to schema.ts and update test mocks to use proper data formats.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* simplify by using infered types
* first pass on reducing duplications
* move PrStatus and CommitStatus to schema
* remove code handling BranchStatus values now ensured by schema
* remove now unreachable code
* fix coverage
* use forgejo schemas instead gitea for changelog fetching
* feat: do not abort repo on unrecognized default merge style
* refactor: instead of usages of `?? {}` with a default parameter
* tighten required parameters and move contentString generation to schema
* refactor: merge both content schemas and use a discriminated union
* refactor: move patchJson and postJson to schema validation
* Make body field required
* make schema more strict
* use DeepNullish
* simplify catch
* revert the gitea Content type change
* unify User
* log more nicely if accidentally not a file has been referenced
* Use fakeSha and LongCommitSha schema
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(workers/global): parse `.jsonc` files
As noted in #44033, this leads to cases where
`renovate-config-validator` can't parse a repo's `renovate.jsonc`.
This doesn't currently affect when Renovate itself runs fully.
* test(workers/global): add coverage for `getParsedContent`
This test also validates that the fix introduced in the previous commit
correctly fixes the issue.
This also makes sure that if we change the default JSON-like filenames,
we'll validate that it can be parsed, based on the filename.
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
---------
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* feat(release-notes): include gitRef in release notes cache key
Append the release gitRef to the changelog cache key so that releases
sharing a version but pointing at different git refs are cached and
matched independently.
* chore: remove global resets
* test(workers/repository): don't use generic `times(2)` matcher
So it's clearer what we're validating.
Co-authored-by: Claude Opus 4.7 <jamie.tanna+claude-code@mend.io>
* chore(workers/repository): add a summary of dependency updates
As part of future changes, we'll be making further tweaks to how the
onboarding PR is generated, which will introduce a summary of the
dependency updates a given onboarding PR would produce.
As this is valuable information regardless of whether we're in
onboarding/reconfigure mode or not, we can create a new function for
this, and output it after the `branches info extended`.
We can make sure to indicate when there are vulnerability alert updates
in a separate count to the per-`updateType` calculation, and a running
total.
Co-authored-by: Claude Opus 4.7 <jamie.tanna+claude-code@mend.io>
* chore(workers/repository): add manager-specific breakdowns to "Updates summary"
So we can use this information when providing a summary on
Onboarding/Reconfigure PRs.
Co-authored-by: Claude Opus 4.7 <jamie.tanna+claude-code@mend.io>
* fixup! chore(workers/repository): add manager-specific breakdowns to "Updates summary"
---------
Co-authored-by: Claude Opus 4.7 <jamie.tanna+claude-code@mend.io>
* feat(git): validate length commit shas
* test: adapt test mocks
* chore: update import paths
* feat(git): make the validation more strict and support repositories using sha256
* test: add fakeSha function for deterministic git commit shas in tests
* feat: add generic statusCheckWhen option to control any renovate status check
Replace the artifacts-specific `artifactsCheckWhen` option with a generic
`statusCheckWhen` object that can control when ANY Renovate status check is
emitted. Keys mirror `statusCheckNames`: `artifactError`, `configValidation`,
`mergeConfidence`, `minimumReleaseAge`.
Each key accepts: "always" | "never" | "failed"
- always: set check on every commit (green on success, red on failure)
- never: skip the check entirely
- failed: only set the check when there is a failure (silent on success)
Default values preserve existing behavior:
- artifactError: "failed" (only report failures, as before)
- configValidation: "always"
- mergeConfidence: "always"
- minimumReleaseAge: "always"
The defaults table in docs is autogenerated from the option's `default`
field via `tools/docs` so the docs cannot drift from the source of truth.
Logging is gated so that "skipping" debug lines only fire when there is
something to skip (errors / status set), keeping logs quiet on every
branch run when a check is set to "never".
Example configuration:
```json
{
"statusCheckWhen": {
"artifactError": "always",
"mergeConfidence": "never"
}
}
```
Signed-off-by: Pierluigi Lenoci <pierluigilenoci@gmail.com>
* refactor(docs): address viceice review — single replace marker, coerceObject, simplify replaceContent call
- Use single replace marker instead of begin/end pair in docs and config.ts
- Use coerceObject from lib/util/object.ts instead of manual (val ?? {}) as Type
- Refactor replaceContent call to match upstream API signature (string, not object)
Signed-off-by: Pierluigi Lenoci <pierluigilenoci@gmail.com>
* fix: fix test for never mode with no errors and format docs
- Add missing config.artifactErrors = [] in test that checks
'skips status entirely when mode is never with no errors' (beforeEach
sets artifactErrors to [{fileName: 'some'}], test needs no errors)
- Reformat note block in docs from 4-space to 2-space indent to match
prettier formatting (custom mkdocs-admonitions plugin expectation)
Signed-off-by: Pierluigi Lenoci <pierluigilenoci@gmail.com>
---------
Signed-off-by: Pierluigi Lenoci <pierluigilenoci@gmail.com>
As part of future changes, we'll be making further tweaks to how the
onboarding PR is generated.
However, recent changes to the onboarding PR has proved that the
generation of the hash is quite awkward to work with.
We can use Claude Sonnet's help to refactor this and introduce a test
that helps us understand what the new hashes should be if there are
changes.
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* test(workers/repository): use more explicit test case
Otherwise this could pass unnecessarily if either `schedule` or
`automergeScheudle` renders to this.
* test(workers/repository): document `force` doesn't apply in this function
As it should've been performed higher up in the configuration merging.
* fix(workers/repository): correctly render `schedule` for vulnerability alerts
Otherwise we see i.e.
- Branch creation
- ""
- Automerge
- At any time (no schedule defined)
When the `init` phase encounters an error, we're currently processing it
twice.
This leads to "Action Required" Issues losing any error context (as only
the `errorRes`, not the full `error` is returned), making them much less
useful.
We can refactor to:
- not duplicate the handling
- pass around the full `error` so we can log it outside of the `init`
phase
As noted in #43558.
* feat: add `groupSingleUpdates` option
* Add test coverage for comment
* Remove extra documentation, the description should probably be enough
* Group single updates by default
* Increment docs
* chore: migrate from zod/v3 to zod/v4
This commit contains the logic changes
* chore: migrate imports from zod/v3 to zod/v4
This contains import updates and adds explicit record keys as zod/v4 requires these now
* ci: enforce usage of zod/v4
`checkForPendingVersions` (introduced in #41629) previously threw
`WORKER_FILE_UPDATE_FAILED` when the re-extracted dep had none of
`lockedVersion`, `newVersion`, `currentVersion`, or `currentValue`
populated. That aborts the entire `getUpdatedPackageFiles` flow for a
single dep we cannot verify, which is disproportionate to the intent of
the check (flag artifact updates that introduced a pending version).
Demote the abort to a warn-and-continue: if we cannot determine the
resolved version for a single dep, skip the pending-version check for
that dep only and let the rest of the update proceed. The remaining
deps in the same file can still be verified normally, and a
`logger.warn` makes the skip visible without taking down the update.
Sergei Zharinov