mirror of
https://github.com/renovatebot/renovate.git
synced 2026-10-25 15:01:49 +00:00
a1971afa78
* ci(linter): add renovate/require-regex-util rule Adds a custom oxlint rule that flags raw RegExp usage in lib/ production code: any `new RegExp(...)` call and any regex literal that is not the direct first argument of `regEx(...)`. The regEx() helper from lib/util/regex.ts uses the RE2 engine for ReDoS-safe matching and caches compiled patterns. lib/util/regex.ts itself is exempt. The rule is disabled for **/*.spec.ts, test/**, and tools/** via config overrides, because vitest APIs such as expect.stringMatching need bare RegExp instances (a past commit reverted regEx() there). Severity is set to "warn" instead of "error": the repo currently has 197 pre-existing violations (above the agreed mechanical-fix threshold of 80), and a number of them are deliberately RE2-incompatible patterns (lookahead/lookbehind/named backreferences, see TODO #12872/#12875 markers in e.g. lib/modules/versioning/rez/ pattern.ts and lib/modules/manager/dockerfile/extract.ts) that need per-site judgment before they can be wrapped in regEx() or suppressed with a justified disable comment. No violation fixes are included in this commit. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * ci(linter): enforce renovate/require-regex-util at error Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * refactor: use regEx() for regex literals and RegExp construction in lib Burn down all renovate/require-regex-util violations (197): - wrap RE2-compatible regex literals and RegExp constructions in regEx() - rewrite lookaround patterns where behavior is provably preserved: goproxy separator split, sbt-package link extraction, leiningen comment stripping and keyword search, npm GitHub owner validation (unit-count bound replaced by an explicit length check) - keep native RegExp with disable comments where RE2 cannot be used: moo / good-enough-parser lexer patterns (moo rejects RE2 instances), MigrationsService propertyName (matched via isRegExp, which RE2 instances fail), rez named backreferences and lookaheads, GitHub markdown link negative lookbehind, emoji astral-plane matching - drop stale TODO #12875 comments for patterns current re2 handles Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * refactor: reduce require-regex-util disable comments Rewrite the github massage-markdown-links URL regex to capture an optional `api.` prefix in a named group (skipped in code) instead of relying on a negative lookbehind, so both the base and global variants can use regEx()/RE2 and their two disable comments are removed. Add spec cases for api-prefixed URLs that match the URL shape. Consolidate the four related line disables in rez/pattern.ts (bound and range patterns emulating Python conditional patterns via named backreferences and lookaheads, which RE2 cannot express) into a single block disable/enable pair, matching the treatment of the lexer files. Disable comment count drops from 13 to 8. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * refactor(datasource/sbt-package): use named capture group in link regex Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * refactor(manager/cake): restore original multiLineComment regex spelling The [^] -> [\\s\\S] rewrite was only needed for an RE2 wrap that was later reverted; keep the diff minimal. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(datasource/go): skip empty GOPROXY segments The switch from a lookahead split to a capture-group split (needed because RE2 has no lookahead support) changed how empty GOPROXY segments parse: `a|,b` yielded `{ url: ',', fallback: '|' }` before and `{ url: '', fallback: ',' }` after. The comma fallback only continues on 404/410, so a failing proxy ahead of an empty segment silently stopped the lookup instead of falling through to the remaining proxies. Empty segments carry no url to query, so drop them. * refactor(datasource/go): use isTruthy for empty segment filter * fix(datasource/go): filter empty segments before mapping Filtering after the map broke the contextual typing from the GoproxyItem[] annotation, widening fallback to string. * refactor(platform/github): use regEx() for merge queue query stripping --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
95 lines
5.3 KiB
TypeScript
95 lines
5.3 KiB
TypeScript
// Regular Expressions have been copied from, some more work were necessary to make it work:
|
|
// original rez regex written in python (#11634)
|
|
// version_range_regex = (
|
|
// # Match a version number (e.g. 1.0.0)
|
|
// r" ^(?P<version>{version_group})$"
|
|
// "|"
|
|
// # Or match an exact version number (e.g. ==1.0.0)
|
|
// " ^(?P<exact_version>"
|
|
// " ==" # Required == operator
|
|
// " (?P<exact_version_group>{version_group})?"
|
|
// " )$"
|
|
// "|"
|
|
// # Or match an inclusive bound (e.g. 1.0.0..2.0.0)
|
|
// " ^(?P<inclusive_bound>"
|
|
// " (?P<inclusive_lower_version>{version_group})?"
|
|
// " \.\." # Required .. operator
|
|
// " (?P<inclusive_upper_version>{version_group})?"
|
|
// " )$"
|
|
// "|"
|
|
// # Or match a lower bound (e.g. 1.0.0+)
|
|
// " ^(?P<lower_bound>"
|
|
// " (?P<lower_bound_prefix>>|>=)?" # Bound is exclusive?
|
|
// " (?P<lower_version>{version_group})?"
|
|
// " (?(lower_bound_prefix)|\+)" # + only if bound is not exclusive
|
|
// " )$"
|
|
// "|"
|
|
// # Or match an upper bound (e.g. <=1.0.0)
|
|
// " ^(?P<upper_bound>"
|
|
// " (?P<upper_bound_prefix><(?={version_group})|<=)?" # Bound is exclusive?
|
|
// " (?P<upper_version>{version_group})?"
|
|
// " )$"
|
|
// "|"
|
|
// # Or match a range in ascending order (e.g. 1.0.0+<2.0.0)
|
|
// " ^(?P<range_asc>"
|
|
// " (?P<range_lower_asc>"
|
|
// " (?P<range_lower_asc_prefix>>|>=)?" # Lower bound is exclusive?
|
|
// " (?P<range_lower_asc_version>{version_group})?"
|
|
// " (?(range_lower_asc_prefix)|\+)?" # + only if lower bound is not exclusive
|
|
// " )(?P<range_upper_asc>"
|
|
// " (?(range_lower_asc_version),?|)" # , only if lower bound is found
|
|
// " (?P<range_upper_asc_prefix><(?={version_group})|<=)" # <= only if followed by a version group
|
|
// " (?P<range_upper_asc_version>{version_group})?"
|
|
// " )"
|
|
// " )$"
|
|
// "|"
|
|
// # Or match a range in descending order (e.g. <=2.0.0,1.0.0+)
|
|
// " ^(?P<range_desc>"
|
|
// " (?P<range_upper_desc>"
|
|
// " (?P<range_upper_desc_prefix><|<=)?" # Upper bound is exclusive?
|
|
// " (?P<range_upper_desc_version>{version_group})?"
|
|
// " (?(range_upper_desc_prefix)|\+)?" # + only if upper bound is not exclusive
|
|
// " )(?P<range_lower_desc>"
|
|
// " (?(range_upper_desc_version),|)" # Comma is not optional because we don't want to recognize something like "<4>3"
|
|
// " (?P<range_lower_desc_prefix><(?={version_group})|>=?)" # >= or > only if followed by a version group
|
|
// " (?P<range_lower_desc_version>{version_group})?"
|
|
// " )"
|
|
// " )$"
|
|
// ).format(version_group=version_group)
|
|
// - Replace {version_group} -> ${versionGroup}
|
|
// - Replace (?P<...>) -> (?<...>)
|
|
// - Replace ?(...) -> \k<...>
|
|
|
|
import { regEx } from '../../../util/regex.ts';
|
|
|
|
// - Replace single \ -> double \
|
|
export const versionGroup = '([0-9a-zA-Z_]+(?:[.-][0-9a-zA-Z_]+)*)';
|
|
export const matchVersion = regEx(
|
|
`^(?<version>${versionGroup})$`,
|
|
); /* Match a version number (e.g. 1.0.0) */
|
|
export const exactVersion = regEx(
|
|
`^(?<exact_version>==(?<exact_version_group>${versionGroup})?)$`,
|
|
); /* Match an exact version number (e.g. ==1.0.0) */
|
|
// inclusiveBound is called inclusive but behavior in rez is this:
|
|
// package-1..3 will match versions 1.2.3, 2.3.4, but not 3.0.0 or above
|
|
export const inclusiveBound = regEx(
|
|
`^(?<inclusive_bound>(?<inclusive_lower_version>${versionGroup})?\\.\\.(?<inclusive_upper_version>${versionGroup})?)$`,
|
|
); /* Match an inclusive bound (e.g. 1.0.0..2.0.0) */
|
|
/* oxlint-disable renovate/require-regex-util -- the bound/range patterns below emulate Python conditional patterns via named backreferences (\k<...>) and lookaheads (?=...), neither of which RE2 supports, TODO #12872 */
|
|
// Add ? after |\\+) in order to match >=1.15
|
|
export const lowerBound = new RegExp(
|
|
`^(?<lower_bound>(?<lower_bound_prefix>>|>=)?(?<lower_version>${versionGroup})?(\\k<lower_bound_prefix>|\\+)?)$`,
|
|
); /* Match a lower bound (e.g. 1.0.0+) */
|
|
export const upperBound = new RegExp(
|
|
`^(?<upper_bound>(?<upper_bound_prefix><(?=${versionGroup})|<=)?(?<upper_version>${versionGroup})?)$`,
|
|
); /* Match an upper bound (e.g. <=1.0.0) */
|
|
// Add ,? to match >=7,<9 (otherwise it just matches >=7<9)
|
|
export const ascendingRange = new RegExp(
|
|
`^(?<range_asc>(?<range_lower_asc>(?<range_lower_asc_prefix>>|>=)?(?<range_lower_asc_version>${versionGroup})?(\\k<range_lower_asc_prefix>|\\+)?),?(?<range_upper_asc>(\\k<range_lower_asc_version>,?|)(?<range_upper_asc_prefix><(?=${versionGroup})|<=)(?<range_upper_asc_version>${versionGroup})?))$`,
|
|
); /* Match a range in ascending order (e.g. 1.0.0+<2.0.0) */
|
|
// Add , to match <9,>=7 (otherwise it just matches <9>=7)
|
|
export const descendingRange = new RegExp(
|
|
`^(?<range_desc>(?<range_upper_desc>(?<range_upper_desc_prefix><|<=)?(?<range_upper_desc_version>${versionGroup})?(\\k<range_upper_desc_prefix>|\\+)?),(?<range_lower_desc>(\\k<range_upper_desc_version>,|)(?<range_lower_desc_prefix><(?=${versionGroup})|>=?)(?<range_lower_desc_version>${versionGroup})?))$`,
|
|
); /* Match a range in descending order (e.g. <=2.0.0,1.0.0+) */
|
|
/* oxlint-enable renovate/require-regex-util */
|