* chore(deps): update dependency pnpm to v11
* Fix test-e2e
* Rename npm_config to pnpm_config in Dockerfile
* test: fix test cases failing inside devcontainer
* Update pnpm to 11.5.3
* Remove extra pnpm-workspace.yaml
* Revert flag position
* Remove --prod as it's not relevant, there are no devdeps
* Downgrade to 11.5.2
* Remove offline flag not available in CI
* Fix mise.toml formatting
* Remove .npmrc from docker build
* feat: add generic statusCheckWhen option to control any renovate status check
Replace the artifacts-specific `artifactsCheckWhen` option with a generic
`statusCheckWhen` object that can control when ANY Renovate status check is
emitted. Keys mirror `statusCheckNames`: `artifactError`, `configValidation`,
`mergeConfidence`, `minimumReleaseAge`.
Each key accepts: "always" | "never" | "failed"
- always: set check on every commit (green on success, red on failure)
- never: skip the check entirely
- failed: only set the check when there is a failure (silent on success)
Default values preserve existing behavior:
- artifactError: "failed" (only report failures, as before)
- configValidation: "always"
- mergeConfidence: "always"
- minimumReleaseAge: "always"
The defaults table in docs is autogenerated from the option's `default`
field via `tools/docs` so the docs cannot drift from the source of truth.
Logging is gated so that "skipping" debug lines only fire when there is
something to skip (errors / status set), keeping logs quiet on every
branch run when a check is set to "never".
Example configuration:
```json
{
"statusCheckWhen": {
"artifactError": "always",
"mergeConfidence": "never"
}
}
```
Signed-off-by: Pierluigi Lenoci <pierluigilenoci@gmail.com>
* refactor(docs): address viceice review — single replace marker, coerceObject, simplify replaceContent call
- Use single replace marker instead of begin/end pair in docs and config.ts
- Use coerceObject from lib/util/object.ts instead of manual (val ?? {}) as Type
- Refactor replaceContent call to match upstream API signature (string, not object)
Signed-off-by: Pierluigi Lenoci <pierluigilenoci@gmail.com>
* fix: fix test for never mode with no errors and format docs
- Add missing config.artifactErrors = [] in test that checks
'skips status entirely when mode is never with no errors' (beforeEach
sets artifactErrors to [{fileName: 'some'}], test needs no errors)
- Reformat note block in docs from 4-space to 2-space indent to match
prettier formatting (custom mkdocs-admonitions plugin expectation)
Signed-off-by: Pierluigi Lenoci <pierluigilenoci@gmail.com>
---------
Signed-off-by: Pierluigi Lenoci <pierluigilenoci@gmail.com>
* fix(platform/gerrit): replace getJsonUnchecked with validated getJson
Migrate all getJsonUnchecked calls in lib/modules/platform/gerrit/client.ts
to use Zod-validated getJson. Co-locate schemas in schema.ts with lenient
optional fields to ensure backward compatibility with all existing API responses.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* strictly follow previous interfaces
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(github): use base_tree in pushFiles to avoid org ruleset file-path restrictions (#42554)
pushFiles sent the entire repo tree to POST /git/trees without base_tree.
GitHub validates all file paths against org rulesets, rejecting the tree
when it contains protected files (e.g. semgrep.yaml) — even if Renovate
only changed unrelated paths.
Use base_tree (parent commit's tree) with only the changed files from
git diff-tree, so unchanged protected files are inherited without
validation.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* test(git): add coverage for getCommitTreeSha and diffCommitTree
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(test): assert specific files instead of hardcoding diff count
The test fixture creates 2 known files between develop and
defaultBranch (master_file, file_to_delete), but CI produces 3
changed files — likely a .gitattributes from the CI environment.
Assert on the known files rather than the total count.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(git): handle renames, copies, and submodules in diffCommitTree
- Regex now matches multi-char status codes (R100, C100) and
tab-separated source/target paths for renames and copies.
- Renames emit a deletion for the source path + addition for target.
- Derive tree item type from mode: 160000→commit, 040000→tree,
otherwise blob.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* refactor(git): address review comments in diffCommitTree
Keep git utility types centralized and make diff status handling easier to follow.
Made-with: Cursor
* test(git): cover rename handling in diffCommitTree
Verify that renamed files are emitted as a deletion for the old path and an addition for the new path, matching the tree delta expected by GitHub.
Made-with: Cursor
* fix(git): validate parsed tree SHA
Fail fast when commit output cannot be parsed into a tree SHA so pushFiles does not propagate an invalid base_tree, and cover the failure path in tests.
Made-with: Cursor
* fix(git): enable rename detection and cover remaining diffCommitTree branches
Add -M to diff-tree so Git emits R status for renames, exercising the
existing case 'R' handler. Add focused tests for rename parsing,
submodule mode (160000), and tree mode (040000).
Made-with: Cursor
* fix(git): clarify copy vs rename comment in diffCommitTree
R uses both tab-separated paths (delete old + add new), while C falls
through to default where only the target path matters.
Made-with: Cursor
* refactor(git): remove dead listCommitTree and TreeItem
Nothing imports listCommitTree after the switch to diffCommitTree with
base_tree. Remove the function, its regex, its test, and the TreeItem
interface.
Made-with: Cursor
* refactor(git): tighten DiffTreeItem.type to GitObjectType union
Define GitObjectType = 'blob' | 'tree' | 'commit' and use it in
DiffTreeItem and treeTypeFromMode instead of plain string.
Made-with: Cursor
* fix(git): remove unreachable nullish coalescing in getCommitTreeSha
split()[0] on a non-empty string is always defined, so the ?? ''
fallback was unreachable and caused an uncovered branch in Codecov.
Made-with: Cursor
* fix(git): add v8 ignore for partial branch on throw template literal
v8 reports template literal interpolations inside throw as partial
branch coverage even when the line is tested. Use the established
v8 ignore pattern to suppress the false positive.
Made-with: Cursor
* fix(github): guard pushFiles against empty diff from diffCommitTree
GitHub's POST /git/trees rejects an empty tree array with 422
"Invalid tree info". While prepareCommit already prevents no-op
commits from reaching pushFiles, add a defensive early return so
the failure mode is a clear log message instead of a swallowed 422.
Made-with: Cursor
* docs(github): document hybrid git/REST commit strategy in pushFiles
Restore architectural knowledge from PRs #13824 and #14271 that was
lost when the old "for reasons unknown" comments were replaced. The
push-then-recreate pattern exists because custom refs avoid CI triggers,
REST-created commits get GitHub signing, and GraphQL lacks force-push
and file mode support.
Made-with: Cursor
* fix(git): wrap bare regex literals in regEx() in tests
Use the project's regEx() helper instead of bare /pattern/ in
toMatch and stringMatching calls, consistent with repo conventions.
Made-with: Cursor
* fix(git): revert regEx() in expect.stringMatching (only accepts bare RegExp)
expect.stringMatching() is a Vitest/Jest API that requires a native
RegExp, not the wrapped object from Renovate's regEx() helper.
Made-with: Cursor
* fix(git): drop line count from v8 ignore next
Vitest uses ast-v8-to-istanbul which is AST-aware: it ignores the
entire next AST node (here the whole throw statement), making the
line count unnecessary.
Made-with: Cursor
* refactor(git): replace magic mode strings with GitTreeMode enum
Introduce a documented GitTreeMode enum in types.ts and use it in
treeTypeFromMode, replacing raw '160000'/'040000' literals with named
members linked to the git data model documentation.
Made-with: Cursor
* fix(git): use const object instead of enum for GitTreeMode
Node's TypeScript strip-only mode does not support enum syntax.
Use `as const` object pattern consistent with the rest of the codebase.
Co-authored-by: Cursor <cursoragent@cursor.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(flux): pin tag-only OCIRepository digests to separate ref.digest field
* fix(flux): simplify range checks in extractOCIRefTagRange function
* fix(extract): improve handling of OCI reference nodes by using Scalar types
* fix(extract): refactor findOCIRefNodes to accept parsed documents instead of raw content
* fix(extract): update OCIRepository handling to extract tag-only refs with YAML aliases
* ci: add agent instructions and ClaudeCode hooks
* refactor: rename start-check and use schemas
* fix: remove redundant flow diagram
* refactor: add block utility
* docs: add reference to development documentation
* ci: add pretooluse hook
* test: remove unnecessary schema tests
* ci: add --all flag run fixer and linters in a single command
* ci: switch stop hook to `pnpm check --all`
* refactor: use simple git
* refactor: use zod/v4
* ci: prevent usages of pnpm vitest
* ci: add must read and code example for codeBlock
* fixup! simplegit by allowing user pagers and editors
* ci(agent hooks): run installs on worktree changes
* docs: shorten description
* chore: remove additional new line at the end
* explicitly fail if parsing fails
* fix: rename to kebabcase
* docs: reduce commands highlighted for local dev
* fix(npm): use packageName for pnpm overrides with range selectors in minimumReleaseAgeExclude
For pnpm.overrides entries with version range selectors (e.g. "pkg@<=1.0.0"),
depName contains the full override key including the selector, which is needed
to correctly update package.json. However this caused invalid entries in
minimumReleaseAgeExclude like "fast-xml-parser@<=5.3.5@5.5.7" instead of
"fast-xml-parser@5.5.7", breaking pnpm install with ERR_PNPM_INVALID_MINIMUM_RELEASE_AGE_EXCLUDE.
Fix by using packageName (bare npm package name parsed by @pnpm/parse-overrides)
instead of depName when constructing minimumReleaseAgeExclude entries. Falls back
to depName for dependency types where packageName is not set.
Made-with: Cursor
* test(npm): format pnpm override minimumReleaseAgeExclude test
Use codeBlock helper for expected pnpm-workspace.yaml contents per review.
* test(npm): avoid string concat in shrinkwrap exclude test
Use template literal instead of + to satisfy restrict-plus-operands.
* fix(npm): replace malformed minimumReleaseAgeExclude entries
Skip invalid package@version lines (extra @ after package prefix) when
matching excludes, and replace them instead of appending versions.
* test(npm): cover valid vs malformed exclude matching
* Update lib/modules/manager/npm/artifacts.spec.ts
Co-authored-by: Michael Kriese <michael.kriese@gmx.de>
* Update lib/modules/manager/npm/artifacts.spec.ts
Co-authored-by: Michael Kriese <michael.kriese@gmx.de>
* test(npm): use codeBlock for expected workspace contents
* fix(npm): remove stale malformed minimumReleaseAgeExclude entries
When a valid exclude entry exists for the same package, drop leftover
malformed lines from the prior double-@ bug instead of leaving them.
* test(npm): avoid string concat in codeBlock expectations
Use template literal instead of + '\n' for prefer-template.
---------
Co-authored-by: Tapio Oikarinen <tapio.oikarinen@hoxhunt.com>
Co-authored-by: Martijn van der Meij <Squixx@users.noreply.github.com>
Co-authored-by: Michael Kriese <michael.kriese@gmx.de>
* feat(config): add github to gitUrl supportedPlatforms
Declare GitHub as a supported platform for the gitUrl option so users
can configure ssh/endpoint URL resolution on github.com and GHES.
Wiring in the github platform module follows in subsequent commits.
Refs: renovatebot/renovate#43086
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* feat(platform/github): fetch sshUrl from repoInfoQuery
Add sshUrl to the GraphQL repository query and to the GhRepo type so
the platform can resolve SSH-based git remotes. Typed as nullable
to match the gitlab pattern and to allow a missing-field error path.
Refs: renovatebot/renovate#43086
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* feat(platform/github): add getRepoUrl helper
Introduce a getRepoUrl helper that returns the repository git URL based
on the gitUrl option:
- 'ssh' uses the sshUrl from the GraphQL repo response; throws
CONFIG_GIT_URL_UNAVAILABLE if not available
- 'default' and 'endpoint' build an https URL from the configured
endpoint with credentials embedded (current behavior)
The helper is unused in this commit; initRepo wiring follows.
Refs: renovatebot/renovate#43086
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* feat(platform/github): support gitUrl in initRepo
Destructure gitUrl from RepoParams and replace the inline URL
construction with getRepoUrl calls. The working URL uses the fork's
ssh_url when running in fork mode, otherwise the GraphQL repo.sshUrl.
The upstream URL (used when forkCreation and a parentRepo is set)
uses repo.sshUrl, which is the parent's URL because the GraphQL
query runs before the fork swap.
GhRestRepo gains an ssh_url field so findFork/createFork responses
can carry the fork's SSH URL forward.
Refs: renovatebot/renovate#43086
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* test(platform/github): cover gitUrl branches
Add unit tests for getRepoUrl in utils.spec.ts and three integration
tests in index.spec.ts that exercise initRepo with gitUrl=ssh:
- ssh URL is forwarded to git.initRepo
- missing sshUrl with gitUrl=ssh throws CONFIG_GIT_URL_UNAVAILABLE
- fork mode uses the fork's ssh_url for url and the parent's sshUrl
for upstreamUrl
initRepoMock and forkInitRepoMock now include sshUrl in the GraphQL
response so existing tests continue to populate the field that the
new code path reads.
Refs: renovatebot/renovate#43086
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* docs: note github-specific gitUrl behavior
Document that 'default' and 'endpoint' produce the same URL on GitHub,
that 'ssh' uses the repository's sshUrl, and that fork mode propagates
SSH selection to both the working URL and the upstream URL.
Refs: renovatebot/renovate#43086
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* refactor(platform/github): pass parsed URL to getRepoUrl
Accept a pre-parsed URL in getRepoUrl instead of re-parsing the
endpoint string inside the helper. The endpoint is validated during
initPlatform so the helper no longer needs its own null check. The
caller now parses once and passes the URL to both initRepo call
sites; the helper clones it before mutating.
Also assert config.repository as non-null at the initRepo call site,
fixing the TS2345 error reported by the lint-other job.
* Update docs/usage/self-hosted-configuration.md
Co-authored-by: Michael Kriese <michael.kriese@gmx.de>
---------
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
Co-authored-by: Michael Kriese <michael.kriese@gmx.de>
renovate[bot]