Adds a custom oxlint rule renovate/v8-ignore-no-count that flags the
count form '/* v8 ignore next <N> */'. The count is not honored by
vitest's ast-v8-to-istanbul hint parser, which captures only the
keyword (if/else/next/file); 'next' always exempts exactly the next
AST node. Trailing counts therefore suggest a line range that is never
applied and mislead readers.
The rule is autofixable (drops the count, preserving actual behavior)
and has been applied to all existing occurrences.
When using the "summary view", in the case we hit platform limits, in
Onboarding PRs or Reconfigure PR comments, we should prioritise the
"What to Expect" as it provides a more actionable "executive summary" of
what's needed in the repository.
Co-authored-by: Claude Sonnet 5 <jamie.tanna+claude-code@mend.io>
* refactor(workers/repository): extract PR body template helpers for onboarding/reconfigure
As part of follow-up changes to reorder the "summary view", we need to
extract the core logic out for onboarding/reconfigure PRs.
Given the tests haven't needed to change, we can see this is a perfect
in-place rewrite.
Co-authored-by: Claude Sonnet 5 <jamie.tanna+claude-code@mend.io>
* fixup! refactor(workers/repository): extract PR body template helpers for onboarding/reconfigure
Adding existing missing coverage.
Co-authored-by: Claude Sonnet 5 <jamie.tanna+claude-code@mend.io>
---------
Co-authored-by: Claude Sonnet 5 <jamie.tanna+claude-code@mend.io>
* fix(vulnerabilities): scope Go stdlib OSV remediation to the `toolchain` directive
The module `go` directive was already excluded from OSV alerts, but the toolchain
rule still matched it via shared datasource/packageName and go-mod-directive ranges.
* fix(vulnerabilities): scope OSV remediation rules to the vulnerable depType
Remediation rules are generated per dependency. When that dep has a depType,
constrain the rule so it cannot match another dep that shares datasource and
packageName.
* fix(vulnerabilities): set matchDepTypes only for Go toolchain OSV rules
A generic matchDepTypes would stop an npm `dependencies` rule from also
matching `overrides` of the same package. Only the existing toolchain path
sets depType on the generated rule.
* feat(onboarding): improve wording of concurrency limits with PRs opened
When receiving an onboarding PR while using `prConcurrentLimit`,
`branchConcurrentLimit` or `prHourlyLimit` concurrency controls, users
may still receive a note such as:
> will create 189 Pull Requests
This isn't true, and can be surprising and/or worrying for a user who
may believe they're going to be swamped by PRs.
We can therefore improve this, to make it clearer how many will be
immediately raised, and how many will be raised over time.
Co-authored-by: Claude Sonnet 5 <jamie.tanna+claude-code@mend.io>
* test(onboarding): reduce duplicated test setup
As a way to make it clearer what each test is actually testing.
Co-authored-by: Claude Sonnet 5 <jamie.tanna+claude-code@mend.io>
---------
Co-authored-by: Claude Sonnet 5 <jamie.tanna+claude-code@mend.io>
As reported in #45357, changes in
116c3d610c caused a regression for cases
where an npm package had `homepage: [...]`.
We should restore the `catch(undefined)` and add a test to make sure
this isn't broken in the future.
Co-authored-by: Claude Sonnet 5 <jamie.tanna+claude-code@mend.io>
* refactor(changelog): make release-notes URLs overridable on ChangeLogSource
Move the changelog markdown source URL and heading-anchor URL construction
from standalone `project.type` conditionals in `release-notes.ts` into
overridable methods on `ChangeLogSource`:
- `getNotesSourceUrl` (default: `blob`, overridden for bitbucket `src` and
bitbucket-server `browse`)
- `getReleaseNotesMdAnchorUrl` (default: GitHub-style `#anchor`)
The source instance is threaded from `getChangeLogJSON` through
`addReleaseNotes` into `getReleaseNotesMd`, avoiding a `no-cycle` violation
that a registry lookup inside `release-notes.ts` would cause.
Behavior-neutral prefactor to allow an Azure changelog source to override
the anchor and path conventions without adding more type conditionals.
* fix oxlint finding
When reporting config validation issues, we generally use the same
constants for our validation errors/warnings.
Instead of having these strings duplicated everywhere, we can refactor
these into constants, making it clearer when reading the code.
We can retain a "soft" union for cases where we use a dynamically
generated topic, which we won't know ahead of time.
Co-authored-by: Claude Opus 4.8 <jamie.tanna+claude-code@mend.io>
* docs: update information about `renovate-pretty-log`
As I've made some changes recently to make it more useful, and visually
explaining it is better for this page.
* docs: don't try and cache Asciinema assets
As it leaks to flakiness in CI, and it's OK to resolve these.
When running the Release job, we restore our `node_modules` cache via
`setup-node`. This leads to `semantic-release` executing - with
`contents: write`, `packages: write`, `id-token: write` and Docker Hub
credentials - the release process.
If we were to have a poisoned cache, this could lead to backdoored npm
packages and Docker images.
Although not currently exploitable, we should further harden this by:
- never using the cache for `release` jobs
- requiring a full `pnpm install --frozen-lockfile` on release jobs
- increasing the build time slightly on release jobs
This ensures that we don't leave ourselves vulnerable to cache poisoning
in the future.
It appears that zizmor's `cache-poisoning` audit covers this pattern,
but doesn't recognise a branch-push `semantic-release` job as a release
workflow, so won't flag regressions here.
Co-authored-by: Claude Fable 5 <jamie.tanna+claude-code@mend.io>
As per the previous commit, we currently don't lint our composite
actions, but should do.
Co-authored-by: Claude Fable 5 <jamie.tanna+claude-code@mend.io>
To handle an ActionLint finding against the repository.
This isn't caught because `lint-actions` is a sparse checkout, which
doesn't include the in-repo Actions themselves, which is fixed in a
follow-up commit.
Co-authored-by: Claude Fable 5 <jamie.tanna+claude-code@mend.io>
The Unified Agent scan passes `secrets.WS_ORG_TOKEN` as a `-apiKey`
CLI argument. Actions masks it in logs, but command-line arguments
are visible in the runner's process table to anything else running on
the machine.
As the Unified Agent reads any configuration parameter from a
`WS_`-prefixed environment variable, we can supply `WS_APIKEY` via
`env:` and drop the argument.
Co-authored-by: Claude Fable 5 <jamie.tanna+claude-code@mend.io>
To avoid potentially expanding a `discussion.created_at` event, we can
make sure we don't interpolate it, by injecting it in via `env`.
Co-authored-by: Claude Fable 5 <jamie.tanna+claude-code@mend.io>
To reduce risk of template injection, we can pass secrets and inputs as
an `env` input, which avoids shell expansion and hardens our usage.
Co-authored-by: Claude Fable 5 <jamie.tanna+claude-code@mend.io>
To make sure that we cover these steps explicitly, we can add a check
for them in `test-success`.
Co-authored-by: Claude Fable 5 <jamie.tanna+claude-code@mend.io>
As we're missing the `${{ }}`, we're passing in the literal string
`github.event_name ...` to `fail_ci_if_error` which may not evaluate as
expected.
Co-authored-by: Claude Fable 5 <jamie.tanna+claude-code@mend.io>
renovate[bot]