* test(config/validation): document existing lack of coverage
So when we change it in the future, we have a failing test.
* fix(config/validation): validate children of arrays in global config
As we previously weren't doing so.
As the test case appears to be wrong (we return an error, not a warning)
and doesn't seem to be exercising a field we've had available in recent
Renovate releases, since this test was introduced in
bb6c27faf8.
* docs(manger/github-actions): reword "community actions" section
As some follow-ups to 27a3f5871f, we
can slightly reword the intro to add some more information about what
these target.
* docs(manager/github-actions): document why there may not be a `packageName`
* docs(manager/github-actions): generate a table for Actions and their `with`s
To provide further clarity on how each of the Actions' `with`s are used,
we can make this more explicit in our autogenerated docs, providing:
- which field(s) are extracted, taken from their Zod schema (with help
from Claude Opus to extract this)
- note the dependency updating, and where it may be determined from the
given `withSchema`
Co-authored-by: Claude Opus 4.7 <jamie.tanna+claude-code@mend.io>
---------
Co-authored-by: Claude Opus 4.7 <jamie.tanna+claude-code@mend.io>
* test(config/validation): remove `platformConfig` test
As the test case appears to be wrong (we return an error, not a warning)
and doesn't seem to be exercising a field we've had available in recent
Renovate releases, since this test was introduced in
bb6c27faf8.
* test(config/validation): use a valid cache namespace for test
To prevent unnecessary errors, when we start validating all
`warnings`/`errors`.
* test(config/validation): validate all `warnings`/`errors`
To make sure that we've got coverage to shows us any potential breaking
changes as new validation is added.
Co-authored-by: Claude Opus 4.7 <jamie.tanna+claude-code@mend.io>
---------
Co-authored-by: Claude Opus 4.7 <jamie.tanna+claude-code@mend.io>
When we introduced this in ce15607d5a, it
seems like this has been intermittently leading to PR workflows being
cancelled as they're "stale" because they were started after the current
time.
We shouldn't try and cancel these workflows, and should instead require
the per-workflow concurrency to do that for PRs.
Add regression tests for the fix that allows a null or missing
home_page in PyPI JSON responses (#43814). Covers both the schema
parser and the datasource, asserting that homepage is left unset and
sourceUrl/changelogUrl fall back to project_urls when home_page is null.
* fix(datasource/pypi): allow null home_page in PyPI JSON response
PyPI returns "home_page": null for projects that declare only
project_urls. The strict z.string().optional() schema threw a ZodError
in getDependency, aborting the JSON-API lookup and resolving such
packages to no-result. Use .nullish() to accept null, matching how
requires_python already handles PyPI's nulls.
* fix(datasource/pypi): allow missing home_page in PyPI JSON response
Apply the suggestion to chain `.optional()` and `.nullish()`.
* test(config/validation): explicitly check error/warning messages
Previously, we had a number of tests checking for i.e.
`expect(warnings).toHaveLength(1);` which wouldn't necessarily be the
warning that we were expecting to see, nor would break if the message
changed (un)intentionally.
We can refactor this and:
- assert on the contents of `errors`/`warnings`
- check the `topic` only if it's interesting - for instance if it's a
`Configuration Error`, but under `warnings`
- removed a `bumpVersion` test that doesn't make sense
- removed snapshot tests
This also reduces our usage of snapshot tests, as we're trying to remove
them where possible.
Co-authored-by: Claude Opus 4.7 <jamie.tanna+claude-code@mend.io>
* test(config/validation): use `toBeEmptyArray`
As it's a little clearer when looking in the file, and asserts that it's
an array.
* test(config/validation): expect new validation errors
---------
Co-authored-by: Claude Opus 4.7 <jamie.tanna+claude-code@mend.io>
As a follow-up to #43804, we can make sure that our configuration no
longer needs migrations.
If there are migrations needed, we can see the resulting configuration
and amend it.
* fix(config): drop removed rebaseStalePrs from lockFileMaintenance default
* fix(config): set rebaseWhen behind-base-branch in lockFileMaintenance default
The previous commit only removed rebaseStalePrs. Restore the default's
intent by setting its documented equivalent rebaseWhen: behind-base-branch
(the same mapping used by the rebaseStalePrs migration and the
:rebaseStalePrs preset).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(config): just remove deprecated rebaseStalePrs, no default change
Per maintainer feedback on the PR: keep this to removing the dead key
so lockFileMaintenance keeps tracking the global rebaseWhen default.
Revisit behind-base-branch in a future major.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The test for this has been broken for some time, and only highlighted
when we start to look at the reason the test is failing - we're
providing a `bumpVersion` but we're intending it to be the
`bumpVersions` config.
Even if we fix the code, this then highlights that we have no validation
code in place, so the tests fail.
We'll follow-up to re-add validation in the future, but for now we can
remove a test that isn't testing what we're intending it to.
As part of future changes, we want to perform strict validation on
the `allowedValues` for all config options as part of Config Validation.
Before we do this, per #40805, we should make sure that the config
options are all marked accordingly.
The list of relevant config options that support pattern matching has
been determined by Claude Opus.
Co-authored-by: Claude Opus 4.7 <jamie.tanna+claude-code@mend.io>
In the case of a config option that has both `allowedValues` and is
templateable - such as `bumpVersions.bumpType` - we should relax the
generated JSON schema to not restrict the exact value.
* fix(datasource/npm): tolerate non-string `time` entries in packument
JFrog Artifactory npm registries emit `"unpublished": null` under the
packument `time` field. Since the schema declared `time` values as
`z.string()`, the `null` failed validation and Zod rejected the entire
packument, so every package lookup returned no-result.
Strip non-string `time` entries via a shared `PackumentTime` transform so
a stray metadata key cannot invalidate the whole packument, while keeping
the real version->timestamp entries the datasource relies on.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* refactor(datasource/npm): use LooseRecord for packument time
Per PR review.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Stylelint come with two official config packages maintained separately.
However, some major release of one of the config packages require the
latest major release of the stylelint tool and vice versa.
On that case, Renovate will propose separated update merge requests that
will never be solvable because of dependencies conflict during npm
install.
Also, as stylelint is not a mono-repo and use a completly different
releases history from its related config package, we MUST ensure
major/minor separation is deactivated to get the group process working
correctly.
* fix(datasource): replace getJsonUnchecked with validated getJson in npm/Node/PyPI/Go
Replace all getJsonUnchecked calls in npm, Node.js, PyPI, and Go datasources
with Zod-validated getJson calls:
- datasource/npm: add NpmResponseSchema to schema.ts (shared with presets)
- config/presets/npm: migrate to NpmResponseSchema with passthrough version fields
- datasource/node-version: add NodeReleasesSchema using LooseArray
- datasource/pypi: add PypiJSONSchema (nullable+catch for lenient empty-body handling)
- datasource/go: add VersionInfoSchema for both versionInfo and getLatestVersion calls
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* some manual cleaning up
* removing schema level catch
* removing some more types
* refactor: rename schema
* fix linter errors
* remove schema suffix which hasn't been catched by linter
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
renovate[bot]