* chore(logger): serialize `DateTime` to ISO strings
As an alternative to 2228a79015, we can
instead serialize any `DateTime` objects that are present in our logging
fields.
Co-authored-by: Claude Sonnet 4.5 <jamie.tanna+github-copilot@mend.io>
* Revert "fix(util/git): log date as string (#41360)"
This reverts commit 2228a79015.
* test(logger): clarify Luxon dates
As we'll follow-up with native dates in the future.
---------
Co-authored-by: Claude Sonnet 4.5 <jamie.tanna+github-copilot@mend.io>
In the case that we are reading binary files in repositories, we should
not log a WARN that there are "hidden" characters in it, as it's a
binary file.
We can use a common heuristic (at least according to Claude Sonnet 4.5)
to look for null bytes at the beginning of our files, and not log the
warning in that case.
Co-authored-by: Claude Sonnet 4.5 <jamie.tanna+github-copilot@mend.io>
fix(logger): don't include filename in "Hidden Unicode" warning
As noted in #41467, if a repository has many files with these warnings,
the Dependency Dashboard can be flooded, which can reduce the utility,
especially if some of these may be false positives.
We can remove the filename from the WARN message, which will ensure that
only a single message is logged.
However, this will reduce the utility of the log message, as then users
need to check their logs to see the `file`.
feat(utilgit): log warning if file(s) contain hidden Unicode characters
With the rise of prompt injection, there is an increased number of
attacks occurring using hidden Unicode characters.
These hidden characters can also confuse other tools, so it's best for
Renovate to surface these to repository owners, as we read files that
may be problematic.
To avoid multiple reads of files, we can do this every time our
`readLocalFile` function is called, as we already have the file content.
An alternate option would be that in `workers/repository` we could check
the read package files, but given `extractAllPackageFiles` may be used
by a Manager, we can't inject the logic in, without Managers needing to
implement the logic themselves.
This should be performant, and not introduce too many false-positives,
but this will also depend on how (package) files are set up in
repositories.
The list of suspicious characters has been largely compiled by Claude
Sonnet 4.5.
Co-authored-by: Claude Sonnet 4.5 <jamie.tanna+github-copilot@mend.io>
fix: don't sign commits made in submodules created by test suite
The 'commit.gpgsign=false' configuration was already in place for some
tests in this file, but not all of them. I'm pretty sure that with this
change in place, there's no more commit signing happening in this test
suite.
Now we have instrumented our Git operations with tracing, we can make
sure that users who are not using OpenTelemetry still get insights into
their Git operation usage using a debug log output.
Following how other insights are produced, we can introduce a new type
in `lib/util/stats` for `GitOperationStats`, which will track the
overall execution for each operation type, and output them in the same
style as we use for other timing reports.
At the end of a Renovate run, we'll then make sure that this is logged
into a debug log for further investigation.
To create the report, we can make sure that we introduce a new
OpenTelemetry `SpanProcessor`, which will run when we end our Run, and
store any Git operations in `GitOperationStats`.
This adapts code from GPT-4.1 and code from [0].
Co-authored-by: gpt-4.1 <jamie.tanna+github-copilot@mend.io>
[0]: https://github.com/yurisouza/monitoria-sdk/blob/ca9d751fa7c3a785a04f87b8966bb782b4617021/src/adapters/nestjs/span-duration-tracker.ts#L18-L27
* fix(git): instrument `SimpleGit` operations
Now we have the basis for instrumentation for SimpleGit, we can now
fully integrate it.
This creates a wrapper, `InstrumentedSimpleGit`, which has a simplified
interface for `SimpleGit` to allow us to focus on the important parts of
the interface for what we need, instead of trying to correctly extend /
implement SimpleGit's interface (and slightly complex types).
In each of our methods, we then make sure we instrument it with the
relevant Git subcommand being invoked.
Co-authored-by: gpt-4.1 <jamie.tanna+github-copilot@mend.io>
* test(instrumentation): remove unused path
Currently, SimpleGit's `getRemotes` function being passed a `verbose:
false` is the same as not providing a `verbose`.
This fixes the code coverage failures, as we do not call this.
---------
Co-authored-by: gpt-4.1 <jamie.tanna+github-copilot@mend.io>
As part of being able to fully instrument our Git operations - using
SimpleGit - we can introduce some Git-specific instrumentation helpers.
These helpers will be used as part of a future change, where we will
instrument methods of SimpleGit that we're using.
This provides a set of types which will be used as OpenTelemetry
Attributes to categorise command types.
A number of subcommands that aren't currently deemed to be too important
are bucketed into an `other` category.
renovate[bot]