Commit Graph

14403 Commits

Author SHA1 Message Date
adelaon 54acab06ee fix(schedule): match cron schedules on the edge of an hour (#44757)
* fix(schedule): match cron schedules on the edge of an hour

* test(schedule): add broader coverage for cron match across the last minute of an hour
2026-07-22 08:17:58 +00:00
Ville Skyttä f01f1b5994 feat(github-actions): support sigstore/cosign-installer version input (#44766)
Extract `with.cosign-release` as `sigstore/cosign` GitHub releases
dependency.

Ref https://github.com/sigstore/cosign-installer#usage
2026-07-22 07:55:56 +00:00
Sebastian Poxhofer 87088344a2 feat(managers): add support for the Smithy framework (#44737)
* feat: add support for smithy framework

* docs: remove comment and exclude from schema validation

* docs: use relativ link
2026-07-22 07:50:04 +00:00
Jamie Tanna 476d10a807 fix(manager/npm): don't include versions in extracted Yarn resolutions' depName# (#44776)
* test(manager/npm): add coverage for Yarn `resolutions` parsing

As part of follow-up changes, we'll fix this, but should have existing
test coverage first.

Co-authored-by: Claude Sonnet 5 <jamie.tanna+claude-code@mend.io>

* fix(manager/npm): don't include versions in extracted Yarn `resolutions`' `depName`

As noted in #44768, given the following in our `package.json`:

```json
{
  "resolutions": {
    "@cypress/request/qs@~6.14.1": "^6.15.1",
    "@verdaccio/core/ajv@8.17.1": "^8.18.0"
  }
}
```

Previously, Renovate would treat `~6.14.1` as the `depName`, which was
incorrect.

We can instead handle this by adding custom handling here.

Co-authored-by: Claude Sonnet 5 <jamie.tanna+claude-code@mend.io>

---------

Co-authored-by: Claude Sonnet 5 <jamie.tanna+claude-code@mend.io>
2026-07-22 07:39:11 +00:00
renovate[bot] 381a5b420d fix(deps): update ghcr.io/renovatebot/base-image docker tag to v13.76.11 (main) (#44775)
fix(deps): update ghcr.io/renovatebot/base-image docker tag to v13.76.11

| datasource | package                        | from     | to       |
| ---------- | ------------------------------ | -------- | -------- |
| docker     | ghcr.io/renovatebot/base-image | 13.76.10 | 13.76.11 |

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-07-22 06:31:47 +00:00
renovate[bot] 55860735c5 fix(deps): update ghcr.io/renovatebot/base-image docker tag to v13.76.10 (main) (#44771)
fix(deps): update ghcr.io/renovatebot/base-image docker tag to v13.76.10

| datasource | package                        | from    | to       |
| ---------- | ------------------------------ | ------- | -------- |
| docker     | ghcr.io/renovatebot/base-image | 13.76.9 | 13.76.10 |

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-07-22 03:30:03 +00:00
Jamie Tanna 969d1a1c49 feat(onboarding): use summary view if hitting platform limits (#44256)
As part of #41502, we're introducing a Platform-limit-aware
onboarding/reconfigure flow that will provide a summary where
appropriate.

This improves the experience where onboarding a large monorepo to
Renovate, especially when it produces an onboarding/reconfigure PR that
is too large to fit within Platform limits.

If we detect the Platform limits being exceeded for a given PR, we'll
switch to the "summary" view.

This builds on top of 4fbfc6095a and bcd44b991f, which introduced the
main changes this then enables.

Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
2026-07-21 18:02:10 +00:00
Niklas Volcz 572554f424 feat(datasource/docker): Read Official Image annotations (#44755)
Read Docker Official Image annotations
2026-07-21 15:09:35 +00:00
Jamie Tanna 4fbfc6095a refactor(onboarding): add functions to summarise "What to expect" (#43764)
* refactor(workers/repository): use `coerceNumber`

* refactor(workers/repository): link to `commitHourlyLimit` docs

So the reference is actionable by a user.

* refactor(workers/repository): add functions to summarise "What to expect" in onboarding

As part of future changes in #41502, we're introducing a
Platform-limit-aware onboarding/reconfigure flow that will provide a
summary where appropriate.

Before we do so, we can introduce the new functionality - but not
integrate it right now - to incrementally add support.

This provides a summary, following similar patterns to how
`getExpectedPrList` executes, but:

- provides a table summary of the detected updates for the repository,
  broken down by security updates, `updateType`, and then anything else
- user-configurable/match-able updates (like `minor`) are prioritised
  over i.e. `bump` updates
- if multiple base branches are used, there is a column to indicate the
  base branch

Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
Co-authored-by: Claude Opus 4.6 <jamie.tanna+claude-code@mend.io>

* fixup! refactor(workers/repository): add functions to summarise "What to expect" in onboarding

Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>

* feat(onboarding): add indication of branch/PR limits in "will create"

Per suggestion from Sebastian, this provides a quicker indication for a
user as to how many PRs they'll receive (if the limit caps the number of
PRs).

* fixup! feat(onboarding): add indication of branch/PR limits in "will create"

* coverage

---------

Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
2026-07-21 14:53:48 +00:00
Jamie Tanna d16dc9a739 refactor(config/global): improve type restrictions for GlobalConfig.OPTIONS (#44636)
* refactor(config/global): improve type restrictions for `GlobalConfig.OPTIONS`

Co-authored-by: Claude Sonnet 5 <jamie.tanna+claude-code@mend.io>

* fixup! refactor(config/global): improve type restrictions for `GlobalConfig.OPTIONS`

---------

Co-authored-by: Claude Sonnet 5 <jamie.tanna+claude-code@mend.io>
2026-07-21 13:19:41 +00:00
Jamie Tanna f932d52fbd feat(platform): get all branch update dates in a more performant manner (#44582)
* feat(platform): get all branch update dates in a more performant manner

When Renovate is working on a repository with many /potential/ branches,
as well as some actually created branches, it's possible for the
calculation for `commitHourlyLimit` to end up taking significant time.

This can lead to a less performant job generally, but can sometimes lead
to the Renovate job failing to complete, and then timing out when
executed by a job runner.

To handle this, we can instead use use `git for-each-ref` to look up
each Git ref (remotely) and request the commit date, which leads to a
much more performant lookup.

Co-authored-by: Claude Sonnet 5 <jamie.tanna+claude-code@mend.io>

* fixup! feat(platform): get all branch update dates in a more performant manner

Co-authored-by: Claude Sonnet 5 <jamie.tanna+claude-code@mend.io>

* fixup! Merge remote-tracking branch 'origin/HEAD' into wip/commit-hourly-slow

---------

Co-authored-by: Claude Sonnet 5 <jamie.tanna+claude-code@mend.io>
2026-07-21 13:17:58 +00:00
KBS 1f5f6dab2a fix(manager/dockerfile): handle single-quoted empty ARG default value (#44522)
ARG value unquoting only stripped double quotes, so ARG FOO='' kept the
literal '' and resolved FROM ${FOO}node to ''node. Strip single quotes too.

Co-authored-by: youdie006 <youdie006@users.noreply.github.com>
2026-07-21 10:48:29 +00:00
Dharma Teja Thoutam bad5e2284e fix(git-submodule): handle ./ relative paths in URL resolution (#44742)
* fix(git-submodule): handle ./ relative paths in URL resolution

* Fix indentation

---------

Co-authored-by: Felipe Santos <felipe.santos@ericsson.com>
2026-07-21 08:17:08 +00:00
Maximilian Herrmann e5ace746bb fix(gomod): pseudo-version digest updates produce no change when module is absent from go proxy (#44477)
* fix(gomod): pseudo-version digest updates produce no change when module
    is absent from go proxy

* Update lib/modules/manager/gomod/update.spec.ts

Co-authored-by: RahulGautamSingh <rahultesnik@gmail.com>

---------

Co-authored-by: RahulGautamSingh <rahultesnik@gmail.com>
2026-07-21 07:17:45 +00:00
renovate[bot] d2aa7e3e94 fix(deps): update ghcr.io/renovatebot/base-image docker tag to v13.76.9 (main) (#44748)
fix(deps): update ghcr.io/renovatebot/base-image docker tag to v13.76.9

| datasource | package                        | from    | to      |
| ---------- | ------------------------------ | ------- | ------- |
| docker     | ghcr.io/renovatebot/base-image | 13.76.8 | 13.76.9 |

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-07-20 23:32:18 +00:00
renovate[bot] a00c621f8d fix(deps): update ghcr.io/renovatebot/base-image docker tag to v13.76.8 (main) (#44747)
fix(deps): update ghcr.io/renovatebot/base-image docker tag to v13.76.8

| datasource | package                        | from    | to      |
| ---------- | ------------------------------ | ------- | ------- |
| docker     | ghcr.io/renovatebot/base-image | 13.76.7 | 13.76.8 |

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-07-20 22:34:11 +00:00
renovate[bot] 1e7391f4a6 fix(deps): update ghcr.io/renovatebot/base-image docker tag to v13.76.7 (main) (#44743)
fix(deps): update ghcr.io/renovatebot/base-image docker tag to v13.76.7

| datasource | package                        | from    | to      |
| ---------- | ------------------------------ | ------- | ------- |
| docker     | ghcr.io/renovatebot/base-image | 13.76.6 | 13.76.7 |

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-07-20 19:36:56 +00:00
Sebastian Poxhofer 2dbfd85506 refactor(linters): enable node/no-sync and migrate to async calls (#44693)
* ci(linter): add renovate/no-sync-io rule

Flags calls to a fixed list of Node.js sync I/O APIs (readFileSync,
writeFileSync, mkdirSync, rmSync, readdirSync, statSync, existsSync,
copyFileSync, execSync, spawnSync, execFileSync) in tools/** and
**/*.spec.ts only; production lib code is not targeted.

Set to "warn" instead of "error": the repo has 40 pre-existing
violations, exceeding the agreed fix threshold of 30, so violations
are left in place for follow-up rather than mass-fixed here.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* ci(linter): enforce renovate/no-sync-io at error

Promote the rule from warn to error now that the codebase has been
migrated off synchronous I/O in tools/ and spec files.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* refactor(tools): migrate synchronous fs calls to async equivalents

Replace *Sync fs calls with their async/promise-based counterparts in
tools/ scripts (generate-imports, check runner, utils, cwdchanged hook)
now that renovate/no-sync-io is enforced at error there.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* test: migrate synchronous fs calls in specs to async equivalents

Replace *Sync fs calls (readdirSync, writeFileSync, existsSync, etc.)
with their async/promise-based counterparts across affected spec
files, making the enclosing it()/module-scope initializers async as
needed, to satisfy renovate/no-sync-io now enforced at error.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* ci(linter): replace custom no-sync-io rule with built-in node/no-sync

The oxc built-in covers a superset of the custom fixed-name list.
Migrate the additionally flagged sites: async glob in test-shards,
async execa in prepare-deps, promisified gzip/generateKeyPair in
rpm/hex specs, and rename the misleading execSync mock alias
(it mocks the async rawExec).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
2026-07-20 14:28:26 +00:00
Sebastian Poxhofer 91e068f1fd test(linters): add linting rule to enforce v8 ignore reason declaration (#44726)
* ci(linter): add renovate/v8-ignore-reason rule

Flag coverage-ignore comments ("v8 ignore") that carry no justification.
Accepted forms: "-- reason" / "--- reason" (recommended) and the legacy
colon form "v8 ignore <kind>[ <count>]: reason", which is already
widespread in the codebase (29 sites). Bare "v8 ignore stop" markers are
exempt because the justification lives on the paired "start" marker. The
"v8 ignore next <N>" count form remains allowed; this rule only requires
a justification.

Registered as "warn" instead of "error": the repo currently has 119
reason-less v8 ignore comments, too many to fix mechanically in one PR,
so existing sites are left untouched and can be fixed incrementally.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* ci(linter): promote renovate/v8-ignore-reason to error

Record the empirical verdict on the contested "v8 ignore next <N>" count
semantics in the rule doc: verified against vitest 4 with
ast-v8-to-istanbul that the count is not honored - the ignore hint always
exempts exactly the next AST node regardless of N. Counts are therefore
inert and stay allowed; the rule keeps requiring only a justification.

Promoting to error so all remaining reason-less coverage-ignore comments
must be fixed; the burndown follows in subsequent commits.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017RxHFNsSworLcv23xXk9Hk

* refactor: add justifications to coverage-ignore comments (batch 1)

Give every reason-less "v8 ignore" comment outside the large platform
index files a site-specific justification explaining why the exempted
branch is untestable or defensive, as now required by the
renovate/v8-ignore-reason rule.

Also guard against a nullish comment.loc in the rule itself; the
merged-in stricter tools typechecking flagged the unguarded access.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017RxHFNsSworLcv23xXk9Hk

* refactor: add justifications to coverage-ignore comments (batch 2)

Cover the five large platform index files (github, bitbucket,
bitbucket-server, codecommit, gitlab) with site-specific reasons on
every "v8 ignore" comment, completing the renovate/v8-ignore-reason
burndown. Two meaningless ignore hints inside commented-out CodeCommit
mergePr code are dropped instead of annotated.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017RxHFNsSworLcv23xXk9Hk

* Apply suggestions from code review

Co-authored-by: Michael Kriese <michael.kriese@gmx.de>

* Update lib/util/regex.ts

Co-authored-by: Michael Kriese <michael.kriese@visualon.de>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Co-authored-by: Michael Kriese <michael.kriese@gmx.de>
Co-authored-by: Michael Kriese <michael.kriese@visualon.de>
2026-07-20 13:01:39 +00:00
Sebastian Poxhofer 1e03699cd6 test: add linter for as LongCommitSha in test files (#44681)
* test: add linter for `as LongCommitSha` in test files

Adds a custom oxlint rule `renovate/prefer-fake-sha-in-specs` that flags
`as LongCommitSha` casts in spec files and suggests the deterministic
`fakeSha()` helper from `test/util` instead. Enabled at error level for
`**/*.spec.ts` and `test/**`; all 131 pre-existing casts across 22 spec
files replaced.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* Update lib/modules/platform/bitbucket-server/index.spec.ts

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
2026-07-20 10:08:09 +00:00
Jamie Tanna 7ac677dc9b fix(platform/azure): evaluate policies before attempting to merge PR (#44631)
When a PR created on Azure is inside a project or repository that has
additional policy evaluations that need to be fulfilled for a given PR,
we should not attempt to perform a manual `mergePr` unless the policies
allow us to.

Previously, we would attempt to `mergePr` and would result in

    DEBUG: Failed to set the PR as completed.

Platform-native auto-merge functionality would still work as expected,
as once the evaluations had succeeded (for instance, a PR is approved by
a human) Azure will auto-merge it.

However, the failure in attempting to merge it is noisy, and should be
avoided by evaluating the policies before attempting to merge.

Co-authored-by: Claude Sonnet 5 <jamie.tanna+claude-code@mend.io>
2026-07-20 09:21:55 +00:00
Jamie Tanna 0e6429b13e refactor(types): document localDir isn't a globalOnly option (#44635)
* refactor(types): document `localDir` isn't a `globalOnly` option

To make sure that it's clear when reviewing `GlobalConfig`, as well as
working with our types, we can move the `localDir` definition into a
separate type.

* fixup! refactor(types): document `localDir` isn't a `globalOnly` option

* fixup! refactor(types): document `localDir` isn't a `globalOnly` option

Co-authored-by: Claude Sonnet 5 <jamie.tanna+claude-code@mend.io>

* fixup! refactor(types): document `localDir` isn't a `globalOnly` option

Co-authored-by: Claude Sonnet 5 <jamie.tanna+claude-code@mend.io>

* fixup! refactor(types): document `localDir` isn't a `globalOnly` option

Co-authored-by: Claude Sonnet 5 <jamie.tanna+claude-code@mend.io>

---------

Co-authored-by: Claude Sonnet 5 <jamie.tanna+claude-code@mend.io>
2026-07-20 08:07:17 +00:00
renovate[bot] 37372a158b fix(deps): update ghcr.io/renovatebot/base-image docker tag to v13.76.6 (main) (#44724)
fix(deps): update ghcr.io/renovatebot/base-image docker tag to v13.76.6

| datasource | package                        | from    | to      |
| ---------- | ------------------------------ | ------- | ------- |
| docker     | ghcr.io/renovatebot/base-image | 13.76.5 | 13.76.6 |

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-07-20 06:35:59 +00:00
renovate[bot] ac6614eb32 docs: update references to python to 311ea5b (main) (#44716)
docs: update references to python to 311ea5b

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-07-20 01:40:09 +00:00
Jonathan Hill 0f06e635df feat(platform-azure): initial bearer token auth support for Azure DevOps (#43888)
* feat(platform/azure): support bearer token auth (auto-detect token type)

* refactor(platform/azure): use isPlainObject for JWT header check

Replace manual typeof/null check with isPlainObject() from
@sindresorhus/is in isProbablyJwt(). Remove unused _GlobalConfig
import from test file.

* refactor(platform/azure): use parseJsonc to parse JWT header

* test(platform/azure): use a real JWT in the set bearer token/endpoint test

* feat(platform/azure): log detected token type

* refactor(platform/azure): guard token before JWT check; remove outdated todo comment

* docs(platform/azure): restore TODO note about possibly-undefined token (#22198)

* refactor(platform/azure): move isProbablyJwt() and tests to new files lib/util/http/jwt.ts and lib/util/http/jwt.spec.ts

* refactor(platform/azure): use Json.safeParse() instead of parseJsonc() in isProbablyJwt()

* refactor(platform/azure): accept undefined token in isProbablyJwt and add guard to drop non-null assertions

* test(platform/azure): extract shared buildTestJwt helper and dedupe

* docs(platform/azure): reword the Entra ID token instructions

* chore(platform/azure): remove irrelevant lines from docstring

* refactor(platform/azure): export buildTestJwt() from new test/jwt-util.ts

* docs(platform/azure): use 1 for numbered lists

* refactor(test): extract arrow function from buildTestJwt

---------

Co-authored-by: Bastian Wenske <bastianwenske@outlook.de>
2026-07-19 23:01:52 +00:00
renovate[bot] 3200bd41a2 fix(deps): update ghcr.io/renovatebot/base-image docker tag to v13.76.5 (main) (#44712)
fix(deps): update ghcr.io/renovatebot/base-image docker tag to v13.76.5

| datasource | package                        | from    | to      |
| ---------- | ------------------------------ | ------- | ------- |
| docker     | ghcr.io/renovatebot/base-image | 13.76.4 | 13.76.5 |

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-07-19 14:32:37 +00:00
renovate[bot] ac8e1d71e5 fix(deps): update ghcr.io/renovatebot/base-image docker tag to v13.76.4 (main) (#44710)
fix(deps): update ghcr.io/renovatebot/base-image docker tag to v13.76.4

| datasource | package                        | from    | to      |
| ---------- | ------------------------------ | ------- | ------- |
| docker     | ghcr.io/renovatebot/base-image | 13.76.3 | 13.76.4 |

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-07-19 11:28:09 +00:00
Sebastian Poxhofer 58771bb183 refactor(linters): enabled oxlints func-style (#44691)
* refactor(oxlint): enable func-style

Enable the built-in func-style rule as ["warn", "declaration"] so that
named functions are written as function declarations instead of arrow or
function expressions assigned to variables, matching the convention in
docs/development/best-practices.md (Functions section). Inline arrow
callbacks are unaffected; prefer-arrow-callback continues to cover the
callback direction.

Severity is "warn" instead of "error" as a fallback: a repo-wide run
found 196 pre-existing violations (70 in spec files, 126 in production
code), exceeding the 80-violation fix threshold for this change, so no
violations were fixed here. Follow-up work can convert the offenders
(largest clusters: lib/modules/versioning/ruby, lib/util/cache/package,
lib/modules/versioning/maven, lib/modules/versioning/gradle) and then
raise the rule to "error". Note oxlint 1.72 also supports an
allowTypeAnnotation option if typed consts should remain arrows.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* ci(linter): enforce func-style at error

* refactor(func-style): convert const-arrow functions to declarations in with-cache spec and ruby versioning

* refactor(func-style): convert const-arrow functions to declarations in maven/gradle modules

* refactor(func-style): convert const-arrow functions to declarations in remaining versioning modules

* refactor(func-style): convert const-arrow functions to declarations in platform modules

Discriminated-union closures (ensureCommentRemoval byTopic/byContent
helpers in github, gitlab, bitbucket, bitbucket-server) needed the
narrowed field passed explicitly as a parameter, since function
declarations are hoisted and lose the outer if-narrowing that inline
arrow-function closures previously relied on.

* refactor(func-style): convert const-arrow functions to declarations across util/manager/datasource modules

One case (logger/renovate-logger.ts logOnceFn) is kept as an arrow
function with a documented oxlint-disable: it is stored on
this.logger.once[level] and relies on lexically-bound this, which a
hoisted function declaration would not preserve.

* refactor(func-style): convert remaining const-arrow test helpers to declarations

get-updated.spec.ts: hoisted expectPipCompilePackageAndLockFile to
module scope (it only closes over the module-level pipCompile mock)
and added a documented oxlint-disable for vitest/expect-expect on its
caller test, since oxlint's expect-expect check does not trace
assertions through an externally-defined helper function.

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
2026-07-19 11:14:22 +00:00
Sebastian Poxhofer 5ad36a2387 test(linters): add linting rule to enforce usage of host rules test util (#44692)
* ci(linter): add renovate/no-host-rules-mock rule

Flags vi.mock()/vi.doMock() calls whose module specifier contains
"host-rules" in spec files. Tests should configure real rules via
hostRules.add() instead of mocking the host-rules module.

Enabled at "warn" severity instead of "error": the repo currently has
35 pre-existing violations across 34 spec files, which exceeds the
agreed fix threshold of 12 files. No violation fixes are included;
migrating each spec to real hostRules.add()/clear() setup is a
semantic test rewrite that should be done incrementally, after which
the rule can be promoted to "error".

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* ci(linter): enforce renovate/no-host-rules-mock at error

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* test(datasource): use real host-rules instead of mocking

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* test(manager): use real host-rules instead of mocking

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* test(platform): use real host-rules instead of mocking

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* test(util,workers): use real host-rules instead of mocking

Also narrow renovate/no-host-rules-mock to the host-rules module itself so that mocking e.g. host-rules-from-env is not flagged.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* ci(linter): mention '~test/host-rules.ts' util in no-host-rules-mock message

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
2026-07-19 10:36:12 +00:00
renovate[bot] 55df4c7eaa fix(deps): update ghcr.io/renovatebot/base-image docker tag to v13.76.3 (main) (#44708)
fix(deps): update ghcr.io/renovatebot/base-image docker tag to v13.76.3

| datasource | package                        | from    | to      |
| ---------- | ------------------------------ | ------- | ------- |
| docker     | ghcr.io/renovatebot/base-image | 13.76.2 | 13.76.3 |

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-07-19 09:31:50 +00:00
github-actions[bot] fc68aea5f7 feat(data): automatic update of static data (#44699)
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-07-19 07:55:17 +00:00
renovate[bot] 54d839de7f fix(deps): update ghcr.io/renovatebot/base-image docker tag to v13.76.2 (main) (#44705)
fix(deps): update ghcr.io/renovatebot/base-image docker tag to v13.76.2

| datasource | package                        | from    | to      |
| ---------- | ------------------------------ | ------- | ------- |
| docker     | ghcr.io/renovatebot/base-image | 13.76.1 | 13.76.2 |

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-07-19 06:30:06 +00:00
renovate[bot] efe4c69afd fix(deps): update ghcr.io/renovatebot/base-image docker tag to v13.76.1 (main) (#44703)
fix(deps): update ghcr.io/renovatebot/base-image docker tag to v13.76.1

| datasource | package                        | from    | to      |
| ---------- | ------------------------------ | ------- | ------- |
| docker     | ghcr.io/renovatebot/base-image | 13.76.0 | 13.76.1 |

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-07-19 04:31:43 +00:00
renovate[bot] f532fdc8f6 feat(deps): update ghcr.io/renovatebot/base-image docker tag to v13.76.0 (main) (#44695)
feat(deps): update ghcr.io/renovatebot/base-image docker tag to v13.76.0

| datasource | package                        | from    | to      |
| ---------- | ------------------------------ | ------- | ------- |
| docker     | ghcr.io/renovatebot/base-image | 13.75.7 | 13.76.0 |

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-07-18 14:27:47 +00:00
Felipe Santos 8e6a7fc2e6 fix(git): detect commits modified through rebase or amend (#44587)
* fix(config): make platformCommit global-only

* fix(git): reapply committer check for isBranchModified

Reapply #42975 (reverted in #43171): treat a different committer
(rebase/amend/Gerrit UI) as a branch modification.

* fix(git): ignore platformCommit committer from init-time list

Register noreply@${host} at GitHub initPlatform when platform commits
are active. isBranchModified only consumes the list — correct for
github.com, ghe.com, and self-hosted GHES.

Share isPlatformCommitEnabled() with GithubScm so commit path and
ignore-list registration use the same rule.

* refactor: stop threading platformCommit through commits

Decision is resolved once in GitHub initPlatform
(isPlatformCommitEnabled). Workers no longer pass the raw option on
CommitFilesConfig — it was unused after that change.

* refactor: simplify platformCommit / ignore-author wiring

Drop cached platformCommitEnabled flag — isPlatformCommitEnabled() is
a pure read of GlobalConfig + isGHApp. Trim redundant tests and
trace noise.

* Simplify env var setting

* revert: keep platformCommit packageRules-capable

Do not make platformCommit global-only. Restore CommitFilesConfig
threading and GithubScm reading commitConfig.platformCommit so rules
can still set platformCommit per package (see #44585 discussion).

* fix(github): always ignore platformCommit noreply committer

Do not gate noreply@host on isPlatformCommitEnabled (that needed
global platformCommit). Always register host noreply at init so
packageRules can still flip platformCommit per commit while
isBranchModified stays correct.

Remove isPlatformCommitEnabled; GithubScm again uses
commitConfig.platformCommit.

* Simplify some stuff

* Add one assertion

* Change some comments
2026-07-18 12:47:11 +00:00
Eugene Harold Krabs 7ab2063040 fix(nuget): fall back to nupkg metadata on nuspec 404 (#44388) 2026-07-18 06:05:31 +00:00
Felipe Santos 18c9c9340e feat(gerrit): rework scm implementation (#38966)
* fix(gerrit): remove memCache to fix prNo coming as null when pr-created

* perf(gerrit): remove custom scm functions

* Fully remove login parameter from configureScm()

* Fetch refspecs in batches

* Remove unnecessary error handling

* Add tests

* Throw if branch init fails

* Simplify tests a little

* Reduce more the tests

* More test changes

* Reuse the existing test setup more

* Undo test import change

* Improve initializeBranchesFromRefspecs JSDoc

* The same for deleteBranchCreatedFromRefspec

* Reduce a log to trace level

* Abandon Code-Review -2 changes before initializing repository

* Simply initialize the branches after git.initRepo()

* Rework approach to be more generic

* Add TODO comment about commitAndPush()

* fix(gerrit): defer change creation to `createPr()`

Signed-off-by: Felipe Santos <felipe.santos@ericsson.com>

* Refactor hashtags handling

* Add prTitle to all missing commitAndPush()

* Fix type check

* Fix test issue

* Fix gerrit tests

* Add warning when prTitle is set in updatePr

* Remove now useless labels from commitAndPush

* Fix gerrit client coverage

* Fix gerrit scm coverage

* Fix rebase coverage

* Improve TODO about assignees

* Fix formatting

* Fix review comment

* Extract to a pushForReview function

* Fix after #41382

* Fix onboarding

* Cleanup code

* Fix ESLint

* Fix tests

* Restore gitRetry for git.merge

* Fix tests

* Simplify hashtags code

* Delete pendingChangeBranch in pushForReview()

* Fix test name

* Remove unnecessary test comments

* Improve test name again

* Fix another test name

* Delete local branch in Gerrit SCM

* Add test for deleting pending branch

* Add tests for pushForReview()

* Simplify/optimize commitAndPush

* Align jsdoc terminology on virtual branches

* Remove no longer relevant TODO

* Update virtal branch on push

* Simplify deleteVirtualBranch

* Fix test case name

* Improve another test name

* Restore test deleted by mistake

* Fix another small test inconsistency

* Fix coverage

* Fix Renovate not detecting modified commits

* Simplify Gerrit commitAndPush by leveraging git.commitFiles

* Fix some code style issues

* Revert "Simplify Gerrit commitAndPush by leveraging git.commitFiles"

This reverts commit d71edcc279.

* Fix another small code style issue

* Use isUndefined instead

* Fix one small test style issue

* Fix more code style issues

* Fix Gerrit mergeToLocal trying to fetch (and probably failing)

* Extract refs/remotes/origin to a function

* Rename virtualBranchRef to remoteBranchRef

* Fix remoteBranchRef tsc

* Consistently use currentRevision in Gerrit tests

* Remove unnecessary type assertion

* Instrument "fetch virtual branches"

* Remove pendingChangeBranches, avoid overriding deleteBranch and mergeToLocal

* Optimize virtual branches fetch (no longer requires update-ref), convert virtualBranches to Record, rename setVirtualBranch to registerVirtualBranch

* Combine registerVirtualBranch and updateVirtualBranch into a single setVirtualBranch, and update ref in virtual branch too

* Fix virtualBranches not being initialized

* Add some debug logs

* Simplify mergeToLocal for virtual branches

* Revert "Simplify mergeToLocal for virtual branches"

This reverts commit 375d57a474.

* Remove useless isVirtual const

* test(git): add toThrow message for virtualBranches fetch error

Satisfy vitest/require-to-throw-message so oxlint passes.

* Update lib/util/git/types.ts

Co-authored-by: RahulGautamSingh <rahultesnik@gmail.com>

* Address review feedback

---------

Signed-off-by: Felipe Santos <felipe.santos@ericsson.com>
Co-authored-by: RahulGautamSingh <rahultesnik@gmail.com>
2026-07-17 21:47:08 +00:00
Felipe Santos 636e888119 test(git): disable git maintenance to prevent test flakiness (#44670)
fix(git): disable git auto-maintenance in tests to prevent ENOTEMPTY flake

Background gc/maintenance can still be writing objects/pack when
unsafeCleanup removes the tmp dir, causing intermittent ENOTEMPTY errors.
2026-07-17 18:07:03 +00:00
renovate[bot] c92de21545 fix(deps): update ghcr.io/renovatebot/base-image docker tag to v13.75.7 (main) (#44668)
fix(deps): update ghcr.io/renovatebot/base-image docker tag to v13.75.7

| datasource | package                        | from    | to      |
| ---------- | ------------------------------ | ------- | ------- |
| docker     | ghcr.io/renovatebot/base-image | 13.75.6 | 13.75.7 |

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-07-17 16:28:44 +00:00
renovate[bot] 7bdb71336d fix(deps): update ghcr.io/renovatebot/base-image docker tag to v13.75.6 (main) (#44662)
fix(deps): update ghcr.io/renovatebot/base-image docker tag to v13.75.6

| datasource | package                        | from    | to      |
| ---------- | ------------------------------ | ------- | ------- |
| docker     | ghcr.io/renovatebot/base-image | 13.75.5 | 13.75.6 |

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-07-17 13:32:01 +00:00
Will Pfleger 556b1be775 fix(manager/hermit): propagate git credentials to hermit install (#43524)
* fix(manager/hermit): propagate git credentials to hermit install

hermit install runs without git auth, failing silently for packages
hosted in private repos. Spread getGitEnvironmentVariables(['hermit'])
into extraEnv, matching the pattern used by cargo, gomod, poetry,
copier, vendir, and conan managers.

Passing ['hermit'] as additionalHostTypes ensures hostRules configured
with hostType: 'hermit' are picked up alongside the standard platform
host types.

Also guards against undefined stderr in the outer catch block —
non-UpdateHermitError exceptions rendered "undefined" in PR comments.

* test(manager/hermit): cover non-Error thrown value fallback

Exercise the String(err) branch in the generic error handler when
a non-Error value propagates from updateHermitPackage.

* fix: address review comments on hermit git auth

Remove unnecessary spread operator from getGitEnvironmentVariables() result
assignment and apply one-sentence-per-line docs convention.
2026-07-17 13:21:54 +00:00
Felipe Santos 768fd6c4b1 fix(presets/workarounds): keep major-only Java Docker tags rolling (#44603)
fix(presets/workarounds): don't upgrade major-only Java Docker tags to full-precision tags
2026-07-17 12:29:08 +00:00
Jonah Snider cc9497595d feat(presets): add Serwist monorepo group (#44626)
Signed-off-by: Jonah Snider <jonah@jonahsnider.com>
2026-07-17 12:20:28 +00:00
Jonah Snider 61d399e1b4 feat(presets): add Size Limit monorepo group (#44627)
Signed-off-by: Jonah Snider <jonah@jonahsnider.com>
2026-07-17 12:18:59 +00:00
Jonah Snider cea5263a43 feat(presets): add Error Prone Support monorepo group (#44628)
Signed-off-by: Jonah Snider <jonah@jonahsnider.com>
2026-07-17 12:17:22 +00:00
Sergei Zharinov 19a38430eb fix(post-upgrade): preserve executable file modes (#44505)
* fix(post-upgrade): preserve executable file modes

* refactor(post-upgrade): clarify executable detection

* refactor(post-upgrade): use filesystem abstraction

* Clarify Git executable bit detection

* test(post-upgrade): use CI platform for mode coverage

* fix(post-upgrade): trust Git file mode setting

* perf(git): cache file mode setting

* test(post-upgrade): cover existing executable artifact

* test(post-upgrade): verify committed executable mode

* test(git): skip chmod regression without file mode support
2026-07-17 12:03:51 +00:00
Aaron 78c978790d feat(datasource/docker): Identify private ECR registries across AWS partitions (#44655)
feat: Identify private ECR registries across AWS partitions
2026-07-17 11:58:44 +00:00
Pieter Willekens e0c13b6c57 feat(manager/npm): read private registries from pnpm-workspace.yaml (#44083)
* feat(manager/npm): read private registries from pnpm-workspace.yaml

Honor the `registry` and `registries` settings (pnpm v11+) declared in pnpm-workspace.yaml, applying them to workspace catalog/override deps and member package.json deps. Registry values containing ${...} are ignored, matching pnpm v11.5.3+.

* refactor(manager/npm): share pnpm registry resolution across extract paths

Extract a single applyPnpmWorkspaceRegistries helper so both the
pnpm-workspace catalog path and the package.json extract path apply
registries through one chokepoint, with env-var registry URLs filtered
once and consistently.

* refactor(manager/npm): filter pnpm env-var registries in schema

Move the env-var registry filtering into the PnpmWorkspaceFile schema as a
transform so registries are filtered once at parse time, and use the Nullish
helper for the registry/registries fields.

* refactor(manager/npm): simplify pnpm-workspace check and log parse errors
2026-07-17 11:56:13 +00:00
Tobias Bieniek 2c7060849d feat(github-actions): support jdx/mise-action version input (#44660)
This extracts `with.version` as a `jdx/mise` GitHub Releases dependency while keeping the action reference independent.
2026-07-17 11:35:43 +00:00
Sebastian Poxhofer 4add67e86e test: add linter for as any in test files (#44658)
* ci(linter): add prefer-partial-in-specs oxlint rule

Flags object literals cast to `any` (`{...} as any`) in spec/test files and steers toward `partial<T>()` from `test/util`. Enabled at error in the spec-files override so CI blocks new occurrences.

Closes #44646

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* test: drop unnecessary object-literal `as any` casts

The casts masked values already assignable to the expected type (migration configs accepted as Record<string, unknown>, all-optional param types, etc.); removing them restores real type checking.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* test: replace object-literal `as any` casts with partial<T>()

Uses partial<T>() from test/util so incomplete mock/config objects keep proper typing. Azure API mocks switch to mockResolvedValue(partial<T>()) and their inner method mocks to mockResolvedValue(), matching the sibling-file idiom.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* test: suppress prefer-partial-in-specs for intentionally-invalid inputs

Some tests deliberately pass malformed or legacy data to exercise validation/error paths, where no real type fits; keep the cast with a reasoned oxlint-disable-next-line.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-17 10:47:30 +00:00