* fix(terraform): normalize lock file constraint order after provider update
Terraform and OpenTofu reject a .terraform.lock.hcl whose constraints are
not in normalized form. When a provider version is updated in place, a bumped
exact pin can overtake an inherited `~>` range, leaving e.g.
"5.9.0, ~> 5.0" which fails "init" with "must be written in normalized form".
Re-sort the sub-constraints (boundary version ascending, ties broken by
operator priority) to match Terraform's canonical serialization.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* refactor(terraform): address review on constraint normalization
- link the Terraform source the sort logic mirrors
- avoid a regex lookahead in constrainToZero (RE2 wrapper compatibility)
- resolve the hashicorp versioning API once at module load
* Update lib/modules/manager/terraform/lockfile/util.ts
Co-authored-by: Michael Kriese <michael.kriese@gmx.de>
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: Michael Kriese <michael.kriese@gmx.de>
* ci(linter): add renovate/logger-static-message rule
Adds a custom oxlint rule that enforces a static msg component for
logger.warn/error/fatal calls (including logger.once variants) so the
messages can be grouped in metrics and error catching services, per
docs/development/best-practices.md. It also flags metadata properties
named 'error' that hold error-ish values, because the bunyan serializer
only handles the 'err' key.
The rule is enabled as an error for lib/ production code and disabled
for spec files. All 33 pre-existing violations are fixed by moving
interpolated values into the metadata object, making messages static,
and renaming 'error' metadata keys to 'err'. Affected log-message
assertions in co-located specs are updated accordingly.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* ci: ignore validator output
* fixup new merged in log messages
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* refactor(config): move checkedBranches and rebaseAllOpenBranches into GlobalConfig
Both options are globalOnly but were being read directly off the
repository config object instead of GlobalConfig, so they weren't
part of the RepoGlobalConfig contract enforced elsewhere.
* test: reset GlobalConfig in beforeEach instead of per-test
Matches the pattern used elsewhere (common.spec.ts, error-config.spec.ts,
prune.spec.ts) and resets before each test instead of after, so a failed
assertion can't leak state into the next test.
* refactor: use isNonEmptyArray instead of .length check
* feat: add `--rebase-all-open-branches`
* feat: mark rebaseAllOpenBranches as cli: true explicitly
* feat: mark checkedBranches as cli: true explicitly
* fix(platform/azure): guard against null work item on issue creation
The Azure DevOps REST client resolves createWorkItem to null (instead of
throwing) on a 404 or any 2xx response with an empty/non-JSON body, such
as a 203 sign-in page returned by an expired token or an SSO/proxy in
front of the instance. ensureIssue then dereferenced newWorkItem.id
unconditionally, crashing the dependency dashboard run with
"Cannot read properties of null (reading 'id')".
Guard the result and skip the issue with a warning instead.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* feat(platform/azure): detect missing Issue work item type
Check that the project's process defines the 'Issue' work item type
before attempting to create one. Processes such as Scrum do not define
it, so createWorkItem returned a 404 that the REST client surfaces as
null, producing a cryptic crash. Log an actionable warning instead.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* test(platform/azure): mock getWorkItemTypes in ensureIssue create test
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
As part of an investigation around `commitHourlyLimit` performing slowly
on a repository with many branches, we can introduce more
instrumentation to be able to debug further.
* fix: misleading log message when updatePr is called due to autoApprove
* Log "PR body changed" only if PR body changed
* Revert "Log "PR body changed" only if PR body changed"
This reverts commit b4bd3de3d2.
* Add log assertion ot test
* ci(linter): add renovate/codeblock-in-spec-fixtures rule
Add a custom oxlint rule that requires the codeBlock (or stripIndent)
template helper from common-tags for multi-line string fixtures in spec
files (enabled for **/*.spec.ts and test/** only).
The rule only flags shapes whose value can round-trip through the
common-tags helpers unchanged, since both codeBlock and stripIndent trim
the end result and strip the shortest line indentation:
- only literals spanning multiple source lines are flagged (escaped \n
one-liners are left alone: tagging them is not value-preserving in
general and gains nothing)
- values with leading/trailing whitespace (e.g. fixtures ending in a
newline) are not flagged
- tagged templates, describe/it titles, and inline snapshot arguments
are skipped
All 55 pre-existing violations (22 files) were fixed with a one-off
codemod that re-emits each fixture indented to the statement depth and
verifies value preservation by evaluating codeBlock on the rewritten
template (substitutions kept as opaque placeholders). One site
(pip_requirements/artifacts.spec.ts) mixes line continuations with
escaped newlines and was tagged verbatim instead of re-indented.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* ci(linter): address review findings
Make getSimpleRequirementsFile in pip-compile/extract.spec.ts
value-preserving again: tagging the whole template with codeBlock
trimmed the trailing blank line when deps is empty (the headerOnly.txt
case), silently changing the fixture from ending in '#\n\n' to '#'.
Tag only the static header and append the deps section via a
single-line template, which reproduces the original string exactly
for both empty and non-empty deps (verified by executing old vs new
in node).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Enable the unicorn/prefer-at rule as error in .oxlintrc.json and fix all
43 pre-existing violations (arr[arr.length - 1] -> arr.at(-1)) via oxlint
autofix. Where .at() widened the type to T | undefined, non-null
assertions were added at sites where surrounding logic guarantees the
element exists (length guards, split results), preserving the original
runtime behavior and typing.
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Enable the type-aware typescript/no-unnecessary-type-arguments rule as
error and remove all 44 pre-existing redundant type arguments (type
arguments identical to the type parameter default), e.g.
HttpResponse<string>, ZodError<unknown>,
PackageDependency<Record<string, any>>.
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
refactor(oxlint): enable vitest/consistent-test-it
Enforce `it` over `test` in spec files via
vitest/consistent-test-it (fn: "it"), matching repo convention.
Renamed all 52 pre-existing `test(`/`test.each` usages across
13 spec files to `it(`/`it.each` using oxlint --fix.
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Enable no-else-return (with allowElseIf: false) and unicorn/no-lonely-if
as errors in .oxlintrc.json and fix all 131 pre-existing violations
(91 no-else-return, 40 unicorn/no-lonely-if) across 98 files.
The no-else-return violations were fixed with the oxlint autofix
(iterated to a fixpoint, plus two else-if chains that required
--fix-dangerously) followed by Prettier formatting. One comment dropped
by the autofix in lib/modules/manager/pub/artifacts.ts was restored
manually. The unicorn/no-lonely-if violations were merged by hand,
preserving comments and coverage-ignore hints.
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* fix(platform/azure): resolve work item states from process
Renovate hardcoded the Azure Boards work item state to `New` on
create/reopen and `Closed` on close. Processes that don't have those
states (Basic uses To Do/Done; custom inherited processes vary) reject
the request with "The field 'State' contains the value 'New' that is not
in the list of supported values", so the Dependency Dashboard (and any
issue) could not be created or closed.
Resolve the concrete open/closed state names for the `Issue` work item
type from its process via `getWorkItemTypeStates`, grouped by state
category (Proposed/InProgress = open, Completed/Resolved/Removed =
closed). Omit `System.State` on create so Azure DevOps applies the work
item type's default initial state. Classify issues open/closed by state
category rather than the literal `Closed`. Fall back to the previous
`New`/`Closed` names when the states cannot be read (e.g. older ADO
Server). Result is cached per repository.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* fix(platform/azure): prefer Completed state as close target
Address review: closedNames[0] picked the first state across the
Completed/Resolved/Removed categories in workflow order, so processes that
order a Resolved-category state before the Completed one (e.g. a custom
inherited Agile process) would close work items to `Resolved` instead of
`Closed`, changing prior behavior.
Resolve the close target from the `Completed` category first, falling back to
the wider closed set only when no Completed state exists. The full closed set
is still used to classify already-closed items.
Add tests covering a process where `Resolved` is ordered before `Closed`.
* fix(platform/azure): address review feedback on state resolution
- Extract namesByCategory into a module-level function declaration instead
of an arrow function assigned to a variable.
- Add a test where the Issue type exposes a closed-category state but no
Completed state, exercising the completedNames[0] ?? closedNames[0]
fallback (restores 100% patch coverage).
- Reword the readme to avoid possessives per the style guide.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* refactor(platform/azure): simplify state resolution per review
- use stateColors.find for the Completed close target instead of an
extra namesByCategory pass over a single-element array
- document that the open-state fallback may pick a closed state when a
process exposes only closed states (intentional, not a bug)
- reuse the workItemType const instead of repeating the 'Issue' literal
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* fix(platform/azure): resolve work item states via Lazy
getWorkItemStates was async with a plain null-check cache guard, so two
concurrent callers could both pass the guard and each fire a duplicate
getWorkItemTypeStates request. Wrap resolution in `Lazy<Promise<...>>`
so the executor runs once and all callers share the same promise.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
ci(linter): add renovate/no-redundant-mock-reset rule
Vitest sets mockReset: true globally in vitest.config.mts, which resets
all mocks before each test. This makes vi.resetAllMocks() /
vi.clearAllMocks() and per-mock .mockReset() / .mockClear() calls inside
beforeEach/afterEach hooks redundant. Add a custom oxlint rule (enabled
for **/*.spec.ts and test/**) flagging such calls, and remove the 40
redundant calls it found. restoreAllMocks/mockRestore are not flagged
because restoreMocks is not enabled globally.
Two sites keep an inline disable with a reason: nested beforeEach hooks
in filter-checks.spec.ts and onboarding/pr/index.spec.ts intentionally
call mockReset() to discard once-values queued by an outer beforeEach.
Requested by maintainer review feedback (review comment 3052324877).
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
ci(linter): add renovate/no-stateful-global-regex rule
Flag module-scope const/let bindings initialized with a g- or y-flagged
regex (regex literal, regEx('...', 'g'), or regEx(/.../g)) that are
later used with .test() or .exec() in the same file. Such regexes are
stateful (lastIndex) and shared across calls, causing intermittent
match failures. Uses via matchAll()/replace()/split() are not flagged.
Fix the four pre-existing violations:
- gitea/forgejo utils: drop the pointless g flag from
reconfigurePrRegex, which made .test() alternate results.
- mix extract: convert module-scope exec() loops on g-flagged regexes
to matchAll().
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* ci(linter): add renovate/prefer-zod-nullish rule
Add a custom oxlint rule that flags zod chains calling .optional() and
.nullable() adjacently (in either order) and suggests .nullish(), which
is equivalent (both accept undefined | null in zod v4).
Fix all 26 pre-existing violations across 6 schema files.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* ci(linter): prefer schema-utils Nullish over zod .nullish()
Rename prefer-zod-nullish to prefer-nullish-util and extend it to flag
.nullish() itself, including the standalone forms z.nullish(x) and
z.optional(z.nullable(x)). Migrate all call sites to Nullish() and
DeepNullish() from schema-utils, which normalize null to undefined in
parsed output. Schemas with more than one nullish position are wrapped
in DeepNullish(); nullish object properties with nullish members use
Nullish(DeepNullish(...)) to keep the optional property type marker.
Spec files are exempt (result.spec.ts intentionally tests
null-preserving parses). Spec assertions expecting null in parsed
output were updated to undefined. Note: docker manifests with an
explicit "mediaType": null are now accepted and treated like an absent
mediaType instead of failing the discriminated union.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* refactor(platform/gitlab): changed merge_request to detailed_merge_request.
* refactor(platform/gitlab): changed merge_request to detailed_merge_request in scehma.ts and in pr-cache-tests
* refactor(platform/gitlab): enums added for detailed_merge_requests #44114
* refactor(platform/gitlab): added enums for detailed_merge_status and unit tests modified #44114
* refactor(platform/gitlab): detailed_merge_status field added in pr-cache unit tests
* refactor(platform/gitlab): made detailed_merge_status optional and catch statement to handle newer status for future #44114
* fix(npm): remove old dependency when replacement exists
* Add coverage ignore comments
* Simplify implementation
* Rename to removeAsString
* Move it after replaceAsString
* Improve test case
* Improve error message of replaceAsString
* Fix coverage
* Fix coverage again
* Only remove dependency at depType like replaceAsString
* Refactor tests
* Fix tsc
* fix(npm): skip update when replacement dependency already exists
* Simplify else
* Avoid returning an error
* fix(flatten): skip replacement updates when a sibling dependency already exists
* Revert the other changes
* Also handle it in the Dependency Dashboard
* Filter out earlier
* Try some other way
* Try fix dep dashboard
* Try fix again
* Extract helper
* Improve some stuff
* Improve assertion
* Remove misleading comment
* Address review comments
GitLab can return a non-string `message` in error bodies (e.g. validation errors as an object), which crashed `message.startsWith` with "err.body?.message?.startsWith is not a function". Guard with an `isString` check.
Wrap `expect` calls that sat directly in `describe` bodies in their
own `it` blocks (gomod and haskell-cabal extract/index specs), then
re-enable the rule.
Part of #43845
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Alexander Lindeskär