mirror of
https://github.com/renovatebot/renovate.git
synced 2026-10-25 23:11:31 +00:00
Jamie Tanna
bbe08af60f
* test(manager/github-actions): cover digest pinned `renovate-image` As noted in #46969, if `renovatebot/github-action`'s `renovate-image` was tag+digest pinned, we would not correctly generate an update for it. We can add test coverage for this scenario first, documenting the current (incorrect) behaviour, so we have a clear regression test for the fix in the next commit. Co-Authored-By: Claude Sonnet 5 <jamie.tanna+claude-code@mend.io> * fix(manager/github-actions): handle digest pinned `renovate-image` Previously we split on `@` which would result in `packageName: ghcr.io/renovatebot/renovate:44.104.2`, which was incorrectly extracted, and so if no `renovate-version` was set, this would lead to `skipReason: 'unspecified-version'`. We can instead reuse `splitImageParts`, already used for Dockerfile-style `image:tag@digest` parsing, so a tag embedded in `renovate-image` is extracted correctly. Its own tag takes priority over the separate `renovate-version` input when both are set, matching how the action itself resolves the image to pull. Co-Authored-By: Claude Sonnet 5 <jamie.tanna+claude-code@mend.io> --------- Co-authored-by: Claude Sonnet 5 <jamie.tanna+claude-code@mend.io>
5641 lines
152 KiB
TypeScript
5641 lines
152 KiB
TypeScript
import { codeBlock } from 'common-tags';
|
|
import { Fixtures } from '~test/fixtures.ts';
|
|
import { fs } from '~test/util.ts';
|
|
import { GlobalConfig } from '../../../config/global.ts';
|
|
import * as memCache from '../../../util/cache/memory/index.ts';
|
|
import * as yaml from '../../../util/yaml.ts';
|
|
import { extractPackageFile } from './index.ts';
|
|
|
|
vi.mock('../../../util/fs/index.ts');
|
|
|
|
describe('modules/manager/github-actions/extract', () => {
|
|
beforeEach(() => {
|
|
GlobalConfig.reset();
|
|
});
|
|
|
|
describe('extractPackageFile()', () => {
|
|
it('returns null for empty', async () => {
|
|
await expect(
|
|
extractPackageFile('nothing here', 'empty-workflow.yml'),
|
|
).resolves.toBeNull();
|
|
});
|
|
|
|
it('returns null for invalid yaml', async () => {
|
|
await expect(
|
|
extractPackageFile('nothing here: [', 'invalid-workflow.yml'),
|
|
).resolves.toBeNull();
|
|
});
|
|
|
|
it('extracts multiple docker image lines from yaml configuration file', async () => {
|
|
const res = await extractPackageFile(
|
|
Fixtures.get('workflow_1.yml'),
|
|
'workflow_1.yml',
|
|
);
|
|
expect(res?.deps).toMatchObject([
|
|
{
|
|
depName: 'actions/bin',
|
|
currentValue: 'master',
|
|
datasource: 'github-digest',
|
|
depType: 'action',
|
|
},
|
|
{
|
|
depName: 'replicated/dockerfilelint',
|
|
datasource: 'docker',
|
|
depType: 'docker',
|
|
},
|
|
{
|
|
depName: 'actions/docker',
|
|
currentValue: 'master',
|
|
datasource: 'github-digest',
|
|
depType: 'action',
|
|
},
|
|
{
|
|
depName: 'node',
|
|
currentValue: '6',
|
|
currentDigest:
|
|
'sha256:7b65413af120ec5328077775022c78101f103258a1876ec2f83890bce416e896',
|
|
datasource: 'docker',
|
|
depType: 'docker',
|
|
},
|
|
{
|
|
depName: 'ubuntu',
|
|
currentValue: 'latest',
|
|
datasource: 'github-runners',
|
|
depType: 'github-runner',
|
|
skipReason: 'invalid-version',
|
|
},
|
|
{
|
|
depName: 'ubuntu',
|
|
currentValue: 'latest',
|
|
datasource: 'github-runners',
|
|
depType: 'github-runner',
|
|
skipReason: 'invalid-version',
|
|
},
|
|
{
|
|
depName: 'ubuntu',
|
|
currentValue: 'latest',
|
|
datasource: 'github-runners',
|
|
depType: 'github-runner',
|
|
skipReason: 'invalid-version',
|
|
},
|
|
{
|
|
depName: 'ubuntu',
|
|
currentValue: 'latest',
|
|
datasource: 'github-runners',
|
|
depType: 'github-runner',
|
|
skipReason: 'invalid-version',
|
|
},
|
|
{
|
|
depName: 'node',
|
|
currentValue: '16-bullseye',
|
|
datasource: 'docker',
|
|
depType: 'container',
|
|
},
|
|
{
|
|
depName: 'redis',
|
|
currentValue: '5',
|
|
datasource: 'docker',
|
|
depType: 'service',
|
|
},
|
|
{
|
|
depName: 'postgres',
|
|
currentValue: '10',
|
|
datasource: 'docker',
|
|
depType: 'service',
|
|
},
|
|
{
|
|
depName: 'ubuntu',
|
|
currentValue: 'latest',
|
|
datasource: 'github-runners',
|
|
depType: 'github-runner',
|
|
skipReason: 'invalid-version',
|
|
},
|
|
{
|
|
depName: 'node',
|
|
currentValue: '16-bullseye',
|
|
datasource: 'docker',
|
|
depType: 'container',
|
|
},
|
|
{
|
|
depName: 'ubuntu',
|
|
currentValue: 'latest',
|
|
datasource: 'github-runners',
|
|
depType: 'github-runner',
|
|
skipReason: 'invalid-version',
|
|
},
|
|
]);
|
|
});
|
|
|
|
it('extracts multiple action tag lines from yaml configuration file', async () => {
|
|
const res = await extractPackageFile(
|
|
Fixtures.get('workflow_2.yml'),
|
|
'workflow_2.yml',
|
|
);
|
|
expect(res?.deps).toMatchObject([
|
|
{
|
|
depName: 'actions/bin',
|
|
currentValue: 'master',
|
|
datasource: 'github-digest',
|
|
depType: 'action',
|
|
},
|
|
{
|
|
depName: 'docker/setup-qemu-action',
|
|
currentValue: 'v1.1.0',
|
|
currentDigest: 'c308fdd69d26ed66f4506ebd74b180abe5362145',
|
|
datasource: 'github-tags',
|
|
depType: 'action',
|
|
replaceString:
|
|
'docker/setup-qemu-action@c308fdd69d26ed66f4506ebd74b180abe5362145 # renovate: tag=v1.1.0',
|
|
},
|
|
{
|
|
depName: 'actions/checkout',
|
|
currentValue: '1.0.0',
|
|
datasource: 'github-tags',
|
|
depType: 'action',
|
|
},
|
|
{
|
|
depName: 'docker/setup-qemu-action',
|
|
currentDigest: 'c308fdd69d26ed66f4506ebd74b180abe5362145',
|
|
datasource: 'github-tags',
|
|
depType: 'action',
|
|
enabled: false,
|
|
skipReason: 'unversioned-reference',
|
|
replaceString:
|
|
'docker/setup-qemu-action@c308fdd69d26ed66f4506ebd74b180abe5362145',
|
|
},
|
|
{
|
|
depName: 'docker/build-push-action',
|
|
currentValue: 'v2',
|
|
datasource: 'github-tags',
|
|
depType: 'action',
|
|
},
|
|
{
|
|
depName: 'actions/checkout',
|
|
currentValue: 'v2.4.0',
|
|
currentDigest: 'ec3a7ce113134d7a93b817d10a8272cb61118579',
|
|
datasource: 'github-tags',
|
|
depType: 'action',
|
|
replaceString:
|
|
'actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579 # tag=v2.4.0',
|
|
},
|
|
{
|
|
depName: 'actions-rs/toolchain',
|
|
currentValue: 'v1.0.7',
|
|
currentDigest: '16499b5e05bf2e26879000db0c1d13f7e13fa3af',
|
|
datasource: 'github-tags',
|
|
depType: 'action',
|
|
replaceString:
|
|
'actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af # renovate: tag=v1.0.7',
|
|
},
|
|
{
|
|
depName: 'actions-rs/cargo',
|
|
currentValue: 'v1.0.3',
|
|
datasource: 'github-tags',
|
|
depType: 'action',
|
|
},
|
|
{
|
|
depName: 'ubuntu',
|
|
currentValue: 'latest',
|
|
datasource: 'github-runners',
|
|
depType: 'github-runner',
|
|
skipReason: 'invalid-version',
|
|
},
|
|
{
|
|
depName: 'ubuntu',
|
|
currentValue: 'latest',
|
|
datasource: 'github-runners',
|
|
depType: 'github-runner',
|
|
skipReason: 'invalid-version',
|
|
},
|
|
{
|
|
depName: 'ubuntu',
|
|
currentValue: 'latest',
|
|
datasource: 'github-runners',
|
|
depType: 'github-runner',
|
|
skipReason: 'invalid-version',
|
|
},
|
|
]);
|
|
});
|
|
|
|
it('use github.com as registry when no settings provided', async () => {
|
|
const res = await extractPackageFile(
|
|
Fixtures.get('workflow_2.yml'),
|
|
'workflow_2.yml',
|
|
);
|
|
expect(res?.deps[0].registryUrls).toBeUndefined();
|
|
});
|
|
|
|
it('use github.enterprise.com first and then github.com as registry running against github.enterprise.com', async () => {
|
|
GlobalConfig.set({
|
|
platform: 'github',
|
|
endpoint: 'https://github.enterprise.com',
|
|
});
|
|
const res = await extractPackageFile(
|
|
Fixtures.get('workflow_2.yml'),
|
|
'workflow_2.yml',
|
|
);
|
|
expect(res?.deps[0].registryUrls).toEqual([
|
|
'https://github.enterprise.com',
|
|
'https://github.com',
|
|
]);
|
|
});
|
|
|
|
it('use github.enterprise.com first and then github.com as registry running against github.enterprise.com/api/v3', async () => {
|
|
GlobalConfig.set({
|
|
platform: 'github',
|
|
endpoint: 'https://github.enterprise.com/api/v3',
|
|
});
|
|
const res = await extractPackageFile(
|
|
Fixtures.get('workflow_2.yml'),
|
|
'workflow_2.yml',
|
|
);
|
|
expect(res?.deps[0].registryUrls).toEqual([
|
|
'https://github.enterprise.com',
|
|
'https://github.com',
|
|
]);
|
|
});
|
|
|
|
it('use github.com only as registry when running against non-GitHub', async () => {
|
|
GlobalConfig.set({
|
|
platform: 'bitbucket',
|
|
endpoint: 'https://bitbucket.enterprise.com',
|
|
});
|
|
const res = await extractPackageFile(
|
|
Fixtures.get('workflow_2.yml'),
|
|
'workflow_2.yml',
|
|
);
|
|
expect(res?.deps[0].registryUrls).toBeUndefined();
|
|
});
|
|
|
|
it('use github.com only as registry when running against github.com', async () => {
|
|
GlobalConfig.set({
|
|
platform: 'github',
|
|
endpoint: 'https://github.com',
|
|
});
|
|
const res = await extractPackageFile(
|
|
Fixtures.get('workflow_2.yml'),
|
|
'workflow_2.yml',
|
|
);
|
|
expect(res?.deps[0].registryUrls).toBeUndefined();
|
|
});
|
|
|
|
it('use github.com only as registry when running against api.github.com', async () => {
|
|
GlobalConfig.set({
|
|
platform: 'github',
|
|
endpoint: 'https://api.github.com',
|
|
});
|
|
const res = await extractPackageFile(
|
|
Fixtures.get('workflow_2.yml'),
|
|
'workflow_2.yml',
|
|
);
|
|
expect(res?.deps[0].registryUrls).toBeUndefined();
|
|
});
|
|
|
|
it('returns undefined registryUrls when endpoint is invalid URL', async () => {
|
|
GlobalConfig.set({
|
|
platform: 'github',
|
|
endpoint: 'not-a-valid-url',
|
|
});
|
|
const res = await extractPackageFile(
|
|
Fixtures.get('workflow_2.yml'),
|
|
'workflow_2.yml',
|
|
);
|
|
expect(res?.deps[0].registryUrls).toBeUndefined();
|
|
});
|
|
|
|
it('extracts multiple action tag lines with double quotes and comments', async () => {
|
|
const res = await extractPackageFile(
|
|
Fixtures.get('workflow_3.yml'),
|
|
'workflow_3.yml',
|
|
);
|
|
|
|
expect(res?.deps).toMatchObject([
|
|
{
|
|
currentValue: 'v0.13.1',
|
|
datasource: 'github-tags',
|
|
depName: 'pascalgn/automerge-action',
|
|
depType: 'action',
|
|
replaceString: '"pascalgn/automerge-action@v0.13.1"',
|
|
versioning: 'github-actions',
|
|
},
|
|
{
|
|
currentValue: 'v2.3.5',
|
|
datasource: 'github-tags',
|
|
depName: 'actions/checkout',
|
|
depType: 'action',
|
|
replaceString:
|
|
'actions/checkout@1e204e9a9253d643386038d443f96446fa156a97 # renovate: tag=v2.3.5',
|
|
versioning: 'github-actions',
|
|
},
|
|
{
|
|
currentValue: 'v1',
|
|
datasource: 'github-tags',
|
|
depName: 'actions/checkout',
|
|
depType: 'action',
|
|
replaceString: 'actions/checkout@v1',
|
|
versioning: 'github-actions',
|
|
},
|
|
{
|
|
currentValue: 'v1.1.2',
|
|
datasource: 'github-tags',
|
|
depName: 'actions/checkout',
|
|
depType: 'action',
|
|
replaceString: '"actions/checkout@v1.1.2"',
|
|
versioning: 'github-actions',
|
|
},
|
|
{
|
|
currentValue: '1.37.0-glibc',
|
|
datasource: 'docker',
|
|
depName: 'busybox',
|
|
depType: 'docker',
|
|
replaceString: 'busybox:1.37.0-glibc',
|
|
},
|
|
{
|
|
currentValue: 'latest',
|
|
datasource: 'github-runners',
|
|
depName: 'ubuntu',
|
|
depType: 'github-runner',
|
|
replaceString: 'ubuntu-latest',
|
|
},
|
|
{
|
|
currentValue: 'latest',
|
|
datasource: 'github-runners',
|
|
depName: 'ubuntu',
|
|
depType: 'github-runner',
|
|
replaceString: 'ubuntu-latest',
|
|
},
|
|
]);
|
|
});
|
|
|
|
it('maintains quotes', async () => {
|
|
const yamlContent = codeBlock`
|
|
jobs:
|
|
build:
|
|
steps:
|
|
- name: "test1"
|
|
uses: actions/setup-node@56337c425554a6be30cdef71bf441f15be286854 # tag=v3.1.1
|
|
- name: "test2"
|
|
uses: 'actions/setup-node@1f8c6b94b26d0feae1e387ca63ccbdc44d27b561' # tag=v3.1.1
|
|
- name: "test3"
|
|
uses: "actions/setup-node@1f8c6b94b26d0feae1e387ca63ccbdc44d27b561" # tag=v2.5.1
|
|
- name: "checkout repository"
|
|
uses: "actions/checkout@v2" # comment after
|
|
- name: "quoted, no comment, outdated"
|
|
uses: "actions/setup-java@v2"`;
|
|
|
|
const res = await extractPackageFile(yamlContent, 'workflow.yml');
|
|
expect(res?.deps).toMatchObject([
|
|
{
|
|
depName: 'actions/setup-node',
|
|
commitMessageTopic: '{{{depName}}} action',
|
|
datasource: 'github-tags',
|
|
versioning: 'github-actions',
|
|
depType: 'action',
|
|
replaceString:
|
|
'actions/setup-node@56337c425554a6be30cdef71bf441f15be286854 # tag=v3.1.1',
|
|
autoReplaceStringTemplate:
|
|
'{{depName}}@{{#if newDigest}}{{newDigest}}{{#if newValue}} # {{newValue}}{{/if}}{{/if}}{{#unless newDigest}}{{newValue}}{{/unless}}',
|
|
currentValue: 'v3.1.1',
|
|
currentDigest: '56337c425554a6be30cdef71bf441f15be286854',
|
|
},
|
|
{
|
|
depName: 'actions/setup-node',
|
|
commitMessageTopic: '{{{depName}}} action',
|
|
datasource: 'github-tags',
|
|
versioning: 'github-actions',
|
|
depType: 'action',
|
|
replaceString:
|
|
"'actions/setup-node@1f8c6b94b26d0feae1e387ca63ccbdc44d27b561' # tag=v3.1.1",
|
|
autoReplaceStringTemplate:
|
|
"'{{depName}}@{{#if newDigest}}{{newDigest}}'{{#if newValue}} # {{newValue}}{{/if}}{{/if}}{{#unless newDigest}}{{newValue}}'{{/unless}}",
|
|
currentValue: 'v3.1.1',
|
|
currentDigest: '1f8c6b94b26d0feae1e387ca63ccbdc44d27b561',
|
|
},
|
|
{
|
|
depName: 'actions/setup-node',
|
|
commitMessageTopic: '{{{depName}}} action',
|
|
datasource: 'github-tags',
|
|
versioning: 'github-actions',
|
|
depType: 'action',
|
|
replaceString:
|
|
'"actions/setup-node@1f8c6b94b26d0feae1e387ca63ccbdc44d27b561" # tag=v2.5.1',
|
|
autoReplaceStringTemplate:
|
|
'"{{depName}}@{{#if newDigest}}{{newDigest}}"{{#if newValue}} # {{newValue}}{{/if}}{{/if}}{{#unless newDigest}}{{newValue}}"{{/unless}}',
|
|
currentValue: 'v2.5.1',
|
|
currentDigest: '1f8c6b94b26d0feae1e387ca63ccbdc44d27b561',
|
|
},
|
|
{
|
|
depName: 'actions/checkout',
|
|
commitMessageTopic: '{{{depName}}} action',
|
|
datasource: 'github-tags',
|
|
versioning: 'github-actions',
|
|
depType: 'action',
|
|
replaceString: '"actions/checkout@v2"',
|
|
autoReplaceStringTemplate:
|
|
'"{{depName}}@{{#if newDigest}}{{newDigest}}"{{#if newValue}} # {{newValue}}{{/if}}{{/if}}{{#unless newDigest}}{{newValue}}"{{/unless}}',
|
|
currentValue: 'v2',
|
|
},
|
|
{
|
|
depName: 'actions/setup-java',
|
|
commitMessageTopic: '{{{depName}}} action',
|
|
datasource: 'github-tags',
|
|
versioning: 'github-actions',
|
|
depType: 'action',
|
|
replaceString: '"actions/setup-java@v2"',
|
|
autoReplaceStringTemplate:
|
|
'"{{depName}}@{{#if newDigest}}{{newDigest}}"{{#if newValue}} # {{newValue}}{{/if}}{{/if}}{{#unless newDigest}}{{newValue}}"{{/unless}}',
|
|
currentValue: 'v2',
|
|
},
|
|
]);
|
|
});
|
|
|
|
it('maintains spaces between hash and comment', async () => {
|
|
const yamlContent = codeBlock`
|
|
jobs:
|
|
build:
|
|
steps:
|
|
# One space
|
|
- name: "test1"
|
|
uses: actions/setup-node@56337c425554a6be30cdef71bf441f15be286854 # tag=v3.1.1
|
|
- name: "test2"
|
|
uses: 'actions/setup-node@1f8c6b94b26d0feae1e387ca63ccbdc44d27b561' # tag=v3.1.1
|
|
- name: "test3"
|
|
uses: "actions/setup-node@1f8c6b94b26d0feae1e387ca63ccbdc44d27b561" # tag=v2.5.1
|
|
|
|
# Two space
|
|
- name: "test1"
|
|
uses: actions/setup-node@56337c425554a6be30cdef71bf441f15be286854 # tag=v3.1.1
|
|
- name: "test2"
|
|
uses: 'actions/setup-node@1f8c6b94b26d0feae1e387ca63ccbdc44d27b561' # tag=v3.1.1
|
|
- name: "test3"
|
|
uses: "actions/setup-node@1f8c6b94b26d0feae1e387ca63ccbdc44d27b561" # tag=v2.5.1
|
|
"`;
|
|
|
|
const res = await extractPackageFile(yamlContent, 'workflow.yml');
|
|
expect(res).toMatchObject({
|
|
deps: [
|
|
{
|
|
replaceString:
|
|
'actions/setup-node@56337c425554a6be30cdef71bf441f15be286854 # tag=v3.1.1',
|
|
},
|
|
{
|
|
replaceString:
|
|
"'actions/setup-node@1f8c6b94b26d0feae1e387ca63ccbdc44d27b561' # tag=v3.1.1",
|
|
},
|
|
{
|
|
replaceString:
|
|
'"actions/setup-node@1f8c6b94b26d0feae1e387ca63ccbdc44d27b561" # tag=v2.5.1',
|
|
},
|
|
{
|
|
replaceString:
|
|
'actions/setup-node@56337c425554a6be30cdef71bf441f15be286854 # tag=v3.1.1',
|
|
},
|
|
{
|
|
replaceString:
|
|
"'actions/setup-node@1f8c6b94b26d0feae1e387ca63ccbdc44d27b561' # tag=v3.1.1",
|
|
},
|
|
{
|
|
replaceString:
|
|
'"actions/setup-node@1f8c6b94b26d0feae1e387ca63ccbdc44d27b561" # tag=v2.5.1',
|
|
},
|
|
],
|
|
});
|
|
});
|
|
|
|
it('extracts tags in different formats', async () => {
|
|
const res = await extractPackageFile(
|
|
Fixtures.get('workflow_4.yml'),
|
|
'workflow_4.yml',
|
|
);
|
|
expect(res?.deps).toMatchObject([
|
|
{
|
|
currentDigest: '1e204e9a9253d643386038d443f96446fa156a97',
|
|
currentValue: '1.2.3',
|
|
replaceString:
|
|
'actions/checkout@1e204e9a9253d643386038d443f96446fa156a97 # 1.2.3',
|
|
},
|
|
{
|
|
currentDigest: '1e204e9a9253d643386038d443f96446fa156a97',
|
|
currentValue: '1.2',
|
|
replaceString:
|
|
'actions/checkout@1e204e9a9253d643386038d443f96446fa156a97 # 1.2',
|
|
},
|
|
{
|
|
currentDigest: '1e204e9a9253d643386038d443f96446fa156a97',
|
|
currentValue: '1',
|
|
replaceString:
|
|
'actions/checkout@1e204e9a9253d643386038d443f96446fa156a97 # 1',
|
|
},
|
|
{
|
|
currentDigest: '1e204e9a9253d643386038d443f96446fa156a97',
|
|
currentValue: 'v1.2.3',
|
|
replaceString:
|
|
'actions/checkout@1e204e9a9253d643386038d443f96446fa156a97 # v1.2.3',
|
|
},
|
|
{
|
|
currentDigest: '1e204e9a9253d643386038d443f96446fa156a97',
|
|
currentValue: 'v1.2',
|
|
replaceString:
|
|
'actions/checkout@1e204e9a9253d643386038d443f96446fa156a97 # v1.2',
|
|
},
|
|
{
|
|
currentDigest: '1e204e9a9253d643386038d443f96446fa156a97',
|
|
currentValue: 'v1',
|
|
replaceString:
|
|
'actions/checkout@1e204e9a9253d643386038d443f96446fa156a97 # v1',
|
|
},
|
|
{
|
|
currentDigest: '1e204e9a9253d643386038d443f96446fa156a97',
|
|
currentValue: 'v2.1.0',
|
|
replaceString:
|
|
'actions/checkout@1e204e9a9253d643386038d443f96446fa156a97 # @v2.1.0',
|
|
},
|
|
{
|
|
currentDigest: '1e204e9a9253d643386038d443f96446fa156a97',
|
|
currentValue: 'v2.1.0',
|
|
replaceString:
|
|
'actions/checkout@1e204e9a9253d643386038d443f96446fa156a97 # pin @v2.1.0',
|
|
},
|
|
{
|
|
currentDigest: '1e204e9a9253d643386038d443f96446fa156a97',
|
|
currentValue: 'v2.1.0',
|
|
replaceString:
|
|
'actions/checkout@1e204e9a9253d643386038d443f96446fa156a97 # tag=v2.1.0',
|
|
},
|
|
{
|
|
currentDigest: '1e204e9a9253d643386038d443f96446fa156a97',
|
|
currentValue: 'v2.1.0',
|
|
replaceString:
|
|
'actions/checkout@1e204e9a9253d643386038d443f96446fa156a97 # v2.1.0',
|
|
},
|
|
{
|
|
currentDigest: '1e204e9a9253d643386038d443f96446fa156a97',
|
|
currentValue: 'v2.1.0',
|
|
replaceString:
|
|
'actions/checkout@1e204e9a9253d643386038d443f96446fa156a97 #v2.1.0',
|
|
},
|
|
{
|
|
currentDigest: '1e204e9a9253d643386038d443f96446fa156a97',
|
|
currentValue: 'v2.1.0',
|
|
replaceString:
|
|
'actions/checkout@1e204e9a9253d643386038d443f96446fa156a97 #v2.1.0',
|
|
},
|
|
{
|
|
currentDigestShort: '1e204e',
|
|
currentValue: 'v2.1.0',
|
|
replaceString: 'actions/checkout@1e204e # v2.1.0',
|
|
},
|
|
{
|
|
currentDigestShort: '1e204e',
|
|
currentValue: 'some-ref-name',
|
|
replaceString: 'actions/checkout@1e204e # some-ref-name',
|
|
},
|
|
{
|
|
currentValue: '01aecc#v2.1.0',
|
|
replaceString: 'actions/checkout@01aecc#v2.1.0',
|
|
},
|
|
{
|
|
currentDigest: '689fcce700ae7ffc576f2b029b51b2ffb66d3abd',
|
|
currentValue: undefined,
|
|
replaceString:
|
|
'actions/checkout@689fcce700ae7ffc576f2b029b51b2ffb66d3abd',
|
|
},
|
|
{
|
|
currentDigest: '689fcce700ae7ffc576f2b029b51b2ffb66d3abd',
|
|
currentValue: 'v2.1.0',
|
|
replaceString:
|
|
'actions/checkout@689fcce700ae7ffc576f2b029b51b2ffb66d3abd # v2.1.0',
|
|
},
|
|
{
|
|
currentDigest: '689fcce700ae7ffc576f2b029b51b2ffb66d3abd',
|
|
currentValue: 'v2.1.0',
|
|
replaceString:
|
|
'actions/checkout@689fcce700ae7ffc576f2b029b51b2ffb66d3abd # ratchet:actions/checkout@v2.1.0',
|
|
},
|
|
{
|
|
currentDigest: '689fcce700ae7ffc576f2b029b51b2ffb66d3abd',
|
|
currentValue: undefined,
|
|
replaceString:
|
|
'actions/checkout@689fcce700ae7ffc576f2b029b51b2ffb66d3abd # ratchet:exclude',
|
|
},
|
|
{
|
|
currentDigest: 'f1d7c52253b89f0beae60141f8465d9495cdc2cf',
|
|
currentValue: 'actions-runner-controller-0.23.5',
|
|
replaceString:
|
|
'actions-runner-controller/execute-assert-arc-e2e@f1d7c52253b89f0beae60141f8465d9495cdc2cf # actions-runner-controller-0.23.5',
|
|
},
|
|
{
|
|
currentDigest: '4b1248585248751e3b12fd020cf7ac91540ca09c',
|
|
currentValue: 'prettier/v2.0.1',
|
|
replaceString:
|
|
'grafana/writers-toolkit@4b1248585248751e3b12fd020cf7ac91540ca09c # prettier/v2.0.1',
|
|
},
|
|
]);
|
|
expect(res!.deps[14]).not.toHaveProperty('skipReason');
|
|
});
|
|
|
|
it('extracts non-semver ref automatically', async () => {
|
|
const res = await extractPackageFile(
|
|
`
|
|
jobs:
|
|
build:
|
|
steps:
|
|
- uses: taiki-e/install-action@cargo-llvm-cov
|
|
`,
|
|
'workflow.yml',
|
|
);
|
|
expect(res?.deps[0]).toMatchObject({
|
|
depName: 'taiki-e/install-action',
|
|
currentValue: 'cargo-llvm-cov',
|
|
datasource: 'github-digest',
|
|
versioning: 'exact',
|
|
autoReplaceStringTemplate:
|
|
'{{depName}}@{{#if newDigest}}{{newDigest}}{{#if newValue}} # {{newValue}}{{/if}}{{/if}}{{#unless newDigest}}{{newValue}}{{/unless}}',
|
|
});
|
|
});
|
|
|
|
it('extracts pinned non-semver ref with digest', async () => {
|
|
const res = await extractPackageFile(
|
|
`
|
|
jobs:
|
|
build:
|
|
steps:
|
|
- uses: taiki-e/install-action@4b1248585248751e3b12fd020cf7ac91540ca09c # cargo-llvm-cov
|
|
`,
|
|
'workflow.yml',
|
|
);
|
|
expect(res?.deps[0]).toMatchObject({
|
|
depName: 'taiki-e/install-action',
|
|
currentValue: 'cargo-llvm-cov',
|
|
currentDigest: '4b1248585248751e3b12fd020cf7ac91540ca09c',
|
|
datasource: 'github-digest',
|
|
versioning: 'exact',
|
|
replaceString:
|
|
'taiki-e/install-action@4b1248585248751e3b12fd020cf7ac91540ca09c # cargo-llvm-cov',
|
|
autoReplaceStringTemplate:
|
|
'{{depName}}@{{#if newDigest}}{{newDigest}}{{#if newValue}} # {{newValue}}{{/if}}{{/if}}{{#unless newDigest}}{{newValue}}{{/unless}}',
|
|
});
|
|
});
|
|
|
|
it('extracts ratchet pinned action in subdirectory', async () => {
|
|
const res = await extractPackageFile(
|
|
`
|
|
jobs:
|
|
build:
|
|
steps:
|
|
- uses: actions/cache/restore@b7e8d49f17405cc70c1c120101943203c98d3a4b # ratchet:actions/cache/restore@v4
|
|
`,
|
|
'workflow.yml',
|
|
);
|
|
expect(res?.deps[0]).toMatchObject({
|
|
depName: 'actions/cache',
|
|
currentValue: 'v4',
|
|
currentDigest: 'b7e8d49f17405cc70c1c120101943203c98d3a4b',
|
|
datasource: 'github-tags',
|
|
versioning: 'github-actions',
|
|
replaceString:
|
|
'actions/cache/restore@b7e8d49f17405cc70c1c120101943203c98d3a4b # ratchet:actions/cache/restore@v4',
|
|
});
|
|
});
|
|
|
|
it('extracts a reusable workflow call as a workflow', async () => {
|
|
const res = await extractPackageFile(
|
|
codeBlock`
|
|
jobs:
|
|
release:
|
|
uses: some-org/some-repo/.github/workflows/release.yml@v1.2.3
|
|
`,
|
|
'.github/workflows/ci.yml',
|
|
);
|
|
|
|
expect(res?.deps).toMatchObject([
|
|
{
|
|
depName: 'some-org/some-repo',
|
|
currentValue: 'v1.2.3',
|
|
datasource: 'github-tags',
|
|
versioning: 'github-actions',
|
|
depType: 'workflow',
|
|
replaceString:
|
|
'some-org/some-repo/.github/workflows/release.yml@v1.2.3',
|
|
autoReplaceStringTemplate:
|
|
'{{depName}}/.github/workflows/release.yml@{{#if newDigest}}{{newDigest}}{{#if newValue}} # {{newValue}}{{/if}}{{/if}}{{#unless newDigest}}{{newValue}}{{/unless}}',
|
|
},
|
|
]);
|
|
});
|
|
|
|
it.each`
|
|
uses | depType
|
|
${'some-org/some-repo/.github/workflows/release.yml@v1'} | ${'workflow'}
|
|
${'some-org/some-repo/.github/workflows/release.yaml@v1'} | ${'workflow'}
|
|
${'actions/checkout@v4'} | ${'action'}
|
|
${'github/codeql-action/init@v3'} | ${'action'}
|
|
${'some-org/some-repo/.github/workflows/sub/release.yml@v1'} | ${'action'}
|
|
${'some-org/some-repo/.github/workflows@v1'} | ${'action'}
|
|
${'some-org/some-repo/.github/workflows/release.json@v1'} | ${'action'}
|
|
${'some-org/some-repo/nested/.github/workflows/release.yml@v1'} | ${'action'}
|
|
`(
|
|
'gives $uses the depType $depType',
|
|
async ({ uses, depType }: { uses: string; depType: string }) => {
|
|
const res = await extractPackageFile(
|
|
codeBlock`
|
|
jobs:
|
|
build:
|
|
steps:
|
|
- uses: ${uses}
|
|
`,
|
|
'.github/workflows/ci.yml',
|
|
);
|
|
|
|
expect(res?.deps[0]).toMatchObject({ depType });
|
|
},
|
|
);
|
|
|
|
it('disables naked SHA pins without version comment', async () => {
|
|
const res = await extractPackageFile(
|
|
codeBlock`
|
|
jobs:
|
|
build:
|
|
steps:
|
|
- uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
|
|
`,
|
|
'workflow.yml',
|
|
);
|
|
expect(res?.deps[0]).toMatchObject({
|
|
depName: 'actions/checkout',
|
|
currentDigest: 'c85c95e3d7251135ab7dc9ce3241c5835cc595a9',
|
|
currentValue: undefined,
|
|
enabled: false,
|
|
skipReason: 'unversioned-reference',
|
|
});
|
|
});
|
|
|
|
it('disables naked short SHA pins without version comment', async () => {
|
|
const res = await extractPackageFile(
|
|
codeBlock`
|
|
jobs:
|
|
build:
|
|
steps:
|
|
- uses: actions/checkout@c85c95e
|
|
`,
|
|
'workflow.yml',
|
|
);
|
|
expect(res?.deps[0]).toMatchObject({
|
|
depName: 'actions/checkout',
|
|
currentDigestShort: 'c85c95e',
|
|
currentValue: undefined,
|
|
enabled: false,
|
|
skipReason: 'unversioned-reference',
|
|
});
|
|
});
|
|
|
|
it('does not disable SHA pins with version comment', async () => {
|
|
const res = await extractPackageFile(
|
|
codeBlock`
|
|
jobs:
|
|
build:
|
|
steps:
|
|
- uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v4
|
|
`,
|
|
'workflow.yml',
|
|
);
|
|
expect(res?.deps[0]).toEqual({
|
|
depName: 'actions/checkout',
|
|
commitMessageTopic: '{{{depName}}} action',
|
|
versioning: 'github-actions',
|
|
depType: 'action',
|
|
replaceString:
|
|
'actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v4',
|
|
autoReplaceStringTemplate:
|
|
'{{depName}}@{{#if newDigest}}{{newDigest}}{{#if newValue}} # {{newValue}}{{/if}}{{/if}}{{#unless newDigest}}{{newValue}}{{/unless}}',
|
|
currentValue: 'v4',
|
|
currentDigest: 'c85c95e3d7251135ab7dc9ce3241c5835cc595a9',
|
|
datasource: 'github-tags',
|
|
});
|
|
});
|
|
|
|
it('does not disable short SHA pins with version comment', async () => {
|
|
const res = await extractPackageFile(
|
|
codeBlock`
|
|
jobs:
|
|
build:
|
|
steps:
|
|
- uses: actions/checkout@c85c95e # v4
|
|
`,
|
|
'workflow.yml',
|
|
);
|
|
expect(res?.deps[0]).toEqual({
|
|
depName: 'actions/checkout',
|
|
commitMessageTopic: '{{{depName}}} action',
|
|
versioning: 'github-actions',
|
|
depType: 'action',
|
|
replaceString: 'actions/checkout@c85c95e # v4',
|
|
autoReplaceStringTemplate:
|
|
'{{depName}}@{{#if newDigest}}{{newDigest}}{{#if newValue}} # {{newValue}}{{/if}}{{/if}}{{#unless newDigest}}{{newValue}}{{/unless}}',
|
|
currentValue: 'v4',
|
|
currentDigestShort: 'c85c95e',
|
|
datasource: 'github-tags',
|
|
});
|
|
});
|
|
|
|
it('extracts actions with fqdn', async () => {
|
|
const res = await extractPackageFile(
|
|
codeBlock`
|
|
jobs:
|
|
build:
|
|
steps:
|
|
- name: "test1"
|
|
uses: https://github.com/actions/cache/save@1bd1e32a3bdc45362d1e726936510720a7c30a57 # tag=v4.2.0
|
|
- name: "test2"
|
|
uses: https://code.forgejo.org/actions/setup-node@56337c425554a6be30cdef71bf441f15be286854 # v3.1.1
|
|
- name: "test3"
|
|
uses: https://gitea.com/actions/setup-node@56337c425554a6be30cdef71bf441f15be286854 # v3.1.1
|
|
- name: "test4"
|
|
uses: https://code.domain.test/actions/setup-node@56337c425554a6be30cdef71bf441f15be286854 # v3.1.1
|
|
|
|
`,
|
|
'sample.yml',
|
|
);
|
|
expect(res).toMatchObject({
|
|
deps: [
|
|
{
|
|
depName: 'https://github.com/actions/cache',
|
|
packageName: 'actions/cache',
|
|
currentDigest: '1bd1e32a3bdc45362d1e726936510720a7c30a57',
|
|
currentValue: 'v4.2.0',
|
|
replaceString:
|
|
'https://github.com/actions/cache/save@1bd1e32a3bdc45362d1e726936510720a7c30a57 # tag=v4.2.0',
|
|
datasource: 'github-tags',
|
|
registryUrls: ['https://github.com/'],
|
|
},
|
|
{
|
|
depName: 'https://code.forgejo.org/actions/setup-node',
|
|
packageName: 'actions/setup-node',
|
|
currentDigest: '56337c425554a6be30cdef71bf441f15be286854',
|
|
currentValue: 'v3.1.1',
|
|
replaceString:
|
|
'https://code.forgejo.org/actions/setup-node@56337c425554a6be30cdef71bf441f15be286854 # v3.1.1',
|
|
datasource: 'forgejo-tags',
|
|
registryUrls: ['https://code.forgejo.org/'],
|
|
},
|
|
{
|
|
depName: 'https://gitea.com/actions/setup-node',
|
|
packageName: 'actions/setup-node',
|
|
currentDigest: '56337c425554a6be30cdef71bf441f15be286854',
|
|
currentValue: 'v3.1.1',
|
|
replaceString:
|
|
'https://gitea.com/actions/setup-node@56337c425554a6be30cdef71bf441f15be286854 # v3.1.1',
|
|
datasource: 'gitea-tags',
|
|
registryUrls: ['https://gitea.com/'],
|
|
},
|
|
{
|
|
skipReason: 'unsupported-url',
|
|
},
|
|
],
|
|
});
|
|
|
|
expect(res!.deps[3]).not.toHaveProperty('registryUrls');
|
|
});
|
|
|
|
it('extracts multiple macos action runners from yaml configuration file', async () => {
|
|
const runnerTestWorkflowMacos = codeBlock`
|
|
jobs:
|
|
test1:
|
|
runs-on: \${{ env.RUNNER }}
|
|
test2:
|
|
runs-on: abc-123
|
|
test3:
|
|
runs-on: "macos-12-large"
|
|
test4:
|
|
runs-on: 'macos-latest'
|
|
test5:
|
|
runs-on: macos-15-intel
|
|
test6:
|
|
runs-on: macos-26-intel
|
|
`;
|
|
const res = await extractPackageFile(
|
|
runnerTestWorkflowMacos,
|
|
'workflow.yml',
|
|
);
|
|
|
|
expect(res?.deps).toMatchObject([
|
|
{
|
|
depName: 'macos',
|
|
currentValue: '12-large',
|
|
replaceString: 'macos-12-large',
|
|
depType: 'github-runner',
|
|
datasource: 'github-runners',
|
|
autoReplaceStringTemplate: '{{depName}}-{{newValue}}',
|
|
},
|
|
{
|
|
depName: 'macos',
|
|
currentValue: 'latest',
|
|
replaceString: 'macos-latest',
|
|
depType: 'github-runner',
|
|
datasource: 'github-runners',
|
|
autoReplaceStringTemplate: '{{depName}}-{{newValue}}',
|
|
skipReason: 'invalid-version',
|
|
},
|
|
{
|
|
depName: 'macos',
|
|
currentValue: '15-intel',
|
|
replaceString: 'macos-15-intel',
|
|
depType: 'github-runner',
|
|
datasource: 'github-runners',
|
|
autoReplaceStringTemplate: '{{depName}}-{{newValue}}',
|
|
},
|
|
{
|
|
depName: 'macos',
|
|
currentValue: '26-intel',
|
|
replaceString: 'macos-26-intel',
|
|
depType: 'github-runner',
|
|
datasource: 'github-runners',
|
|
autoReplaceStringTemplate: '{{depName}}-{{newValue}}',
|
|
},
|
|
]);
|
|
expect(
|
|
res?.deps.filter((d) => d.datasource === 'github-runners'),
|
|
).toHaveLength(4);
|
|
});
|
|
|
|
it('extracts multiple ubuntu action runners from yaml configuration file', async () => {
|
|
const runnerTestWorkflowUbuntu = codeBlock`
|
|
jobs:
|
|
test1:
|
|
runs-on: ubuntu-latest
|
|
test2:
|
|
runs-on:
|
|
ubuntu-22.04
|
|
test3:
|
|
runs-on:
|
|
group: ubuntu-runners
|
|
labels: ubuntu-20.04-16core
|
|
test4:
|
|
runs-on: ubuntu-22.04-arm
|
|
`;
|
|
const res = await extractPackageFile(
|
|
runnerTestWorkflowUbuntu,
|
|
'workflow.yml',
|
|
);
|
|
|
|
expect(res?.deps).toMatchObject([
|
|
{
|
|
depName: 'ubuntu',
|
|
currentValue: 'latest',
|
|
replaceString: 'ubuntu-latest',
|
|
depType: 'github-runner',
|
|
datasource: 'github-runners',
|
|
autoReplaceStringTemplate: '{{depName}}-{{newValue}}',
|
|
skipReason: 'invalid-version',
|
|
},
|
|
{
|
|
depName: 'ubuntu',
|
|
currentValue: '22.04',
|
|
replaceString: 'ubuntu-22.04',
|
|
depType: 'github-runner',
|
|
datasource: 'github-runners',
|
|
autoReplaceStringTemplate: '{{depName}}-{{newValue}}',
|
|
},
|
|
{
|
|
depName: 'ubuntu',
|
|
currentValue: '22.04-arm',
|
|
replaceString: 'ubuntu-22.04-arm',
|
|
depType: 'github-runner',
|
|
datasource: 'github-runners',
|
|
autoReplaceStringTemplate: '{{depName}}-{{newValue}}',
|
|
},
|
|
]);
|
|
expect(
|
|
res?.deps.filter((d) => d.datasource === 'github-runners'),
|
|
).toHaveLength(3);
|
|
});
|
|
|
|
it('extracts multiple windows action runners from yaml configuration file', async () => {
|
|
const runnerTestWorkflowWindows = codeBlock`
|
|
jobs:
|
|
test1:
|
|
runs-on: |
|
|
windows-2019
|
|
test2:
|
|
runs-on: >
|
|
windows-2022
|
|
test3:
|
|
runs-on: [windows-2022, selfhosted]
|
|
test4:
|
|
runs-on: windows-11-arm
|
|
test5:
|
|
runs-on: windows-2025
|
|
`;
|
|
const res = await extractPackageFile(
|
|
runnerTestWorkflowWindows,
|
|
'workflow.yml',
|
|
);
|
|
|
|
expect(res?.deps).toMatchObject([
|
|
{
|
|
depName: 'windows',
|
|
currentValue: '2019',
|
|
replaceString: 'windows-2019',
|
|
depType: 'github-runner',
|
|
datasource: 'github-runners',
|
|
autoReplaceStringTemplate: '{{depName}}-{{newValue}}',
|
|
},
|
|
{
|
|
depName: 'windows',
|
|
currentValue: '2022',
|
|
replaceString: 'windows-2022',
|
|
depType: 'github-runner',
|
|
datasource: 'github-runners',
|
|
autoReplaceStringTemplate: '{{depName}}-{{newValue}}',
|
|
},
|
|
{
|
|
depName: 'windows',
|
|
currentValue: '2022',
|
|
replaceString: 'windows-2022',
|
|
depType: 'github-runner',
|
|
datasource: 'github-runners',
|
|
autoReplaceStringTemplate: '{{depName}}-{{newValue}}',
|
|
},
|
|
{
|
|
depName: 'windows',
|
|
currentValue: '11-arm',
|
|
replaceString: 'windows-11-arm',
|
|
depType: 'github-runner',
|
|
datasource: 'github-runners',
|
|
autoReplaceStringTemplate: '{{depName}}-{{newValue}}',
|
|
},
|
|
{
|
|
depName: 'windows',
|
|
currentValue: '2025',
|
|
replaceString: 'windows-2025',
|
|
depType: 'github-runner',
|
|
datasource: 'github-runners',
|
|
autoReplaceStringTemplate: '{{depName}}-{{newValue}}',
|
|
},
|
|
]);
|
|
expect(
|
|
res?.deps.filter((d) => d.datasource === 'github-runners'),
|
|
).toHaveLength(5);
|
|
});
|
|
|
|
it('extracts x-version from actions/setup-x', async () => {
|
|
const yamlContent = codeBlock`
|
|
jobs:
|
|
build:
|
|
steps:
|
|
- name: "Setup Node.js"
|
|
uses: actions/setup-node@v3
|
|
with:
|
|
node-version: '16.x'
|
|
- name: "Setup Node.js with exact version"
|
|
uses: actions/setup-node@v3
|
|
with:
|
|
node-version: '20.0.0'
|
|
- name: "Setup Go"
|
|
uses: actions/setup-go@v5
|
|
with:
|
|
go-version: '1.23'
|
|
- name: "Setup Python with range"
|
|
uses: actions/setup-python@v3
|
|
with:
|
|
python-version: '>=3.8.0 <3.10.0'
|
|
- name: "Setup Node.js with latest"
|
|
uses: actions/setup-node@v3
|
|
with:
|
|
node-version: 'latest'
|
|
`;
|
|
|
|
const res = await extractPackageFile(yamlContent, 'workflow.yml');
|
|
expect(res?.deps).toMatchObject([
|
|
{
|
|
autoReplaceStringTemplate:
|
|
'{{depName}}@{{#if newDigest}}{{newDigest}}{{#if newValue}} # {{newValue}}{{/if}}{{/if}}{{#unless newDigest}}{{newValue}}{{/unless}}',
|
|
commitMessageTopic: '{{{depName}}} action',
|
|
currentValue: 'v3',
|
|
datasource: 'github-tags',
|
|
depName: 'actions/setup-node',
|
|
depType: 'action',
|
|
replaceString: 'actions/setup-node@v3',
|
|
versioning: 'github-actions',
|
|
},
|
|
{
|
|
autoReplaceStringTemplate:
|
|
'{{depName}}@{{#if newDigest}}{{newDigest}}{{#if newValue}} # {{newValue}}{{/if}}{{/if}}{{#unless newDigest}}{{newValue}}{{/unless}}',
|
|
commitMessageTopic: '{{{depName}}} action',
|
|
currentValue: 'v3',
|
|
datasource: 'github-tags',
|
|
depName: 'actions/setup-node',
|
|
depType: 'action',
|
|
replaceString: 'actions/setup-node@v3',
|
|
versioning: 'github-actions',
|
|
},
|
|
{
|
|
autoReplaceStringTemplate:
|
|
'{{depName}}@{{#if newDigest}}{{newDigest}}{{#if newValue}} # {{newValue}}{{/if}}{{/if}}{{#unless newDigest}}{{newValue}}{{/unless}}',
|
|
commitMessageTopic: '{{{depName}}} action',
|
|
currentValue: 'v5',
|
|
datasource: 'github-tags',
|
|
depName: 'actions/setup-go',
|
|
depType: 'action',
|
|
replaceString: 'actions/setup-go@v5',
|
|
versioning: 'github-actions',
|
|
},
|
|
{
|
|
autoReplaceStringTemplate:
|
|
'{{depName}}@{{#if newDigest}}{{newDigest}}{{#if newValue}} # {{newValue}}{{/if}}{{/if}}{{#unless newDigest}}{{newValue}}{{/unless}}',
|
|
commitMessageTopic: '{{{depName}}} action',
|
|
currentValue: 'v3',
|
|
datasource: 'github-tags',
|
|
depName: 'actions/setup-python',
|
|
depType: 'action',
|
|
replaceString: 'actions/setup-python@v3',
|
|
versioning: 'github-actions',
|
|
},
|
|
{
|
|
autoReplaceStringTemplate:
|
|
'{{depName}}@{{#if newDigest}}{{newDigest}}{{#if newValue}} # {{newValue}}{{/if}}{{/if}}{{#unless newDigest}}{{newValue}}{{/unless}}',
|
|
commitMessageTopic: '{{{depName}}} action',
|
|
currentValue: 'v3',
|
|
datasource: 'github-tags',
|
|
depName: 'actions/setup-node',
|
|
depType: 'action',
|
|
replaceString: 'actions/setup-node@v3',
|
|
versioning: 'github-actions',
|
|
},
|
|
{
|
|
depName: 'node',
|
|
packageName: 'actions/node-versions',
|
|
currentValue: '16.x',
|
|
datasource: 'github-releases',
|
|
versioning: 'node',
|
|
extractVersion: '^(?<version>\\d+\\.\\d+\\.\\d+)(-\\d+)?$',
|
|
depType: 'uses-with',
|
|
},
|
|
{
|
|
depName: 'node',
|
|
packageName: 'actions/node-versions',
|
|
currentValue: '20.0.0',
|
|
datasource: 'github-releases',
|
|
versioning: 'node',
|
|
extractVersion: '^(?<version>\\d+\\.\\d+\\.\\d+)(-\\d+)?$',
|
|
depType: 'uses-with',
|
|
},
|
|
{
|
|
depName: 'go',
|
|
packageName: 'actions/go-versions',
|
|
currentValue: '1.23',
|
|
datasource: 'github-releases',
|
|
versioning: 'npm',
|
|
extractVersion: '^(?<version>\\d+\\.\\d+\\.\\d+)(-\\d+)?$',
|
|
depType: 'uses-with',
|
|
},
|
|
{
|
|
depName: 'python',
|
|
packageName: 'actions/python-versions',
|
|
currentValue: '>=3.8.0 <3.10.0',
|
|
datasource: 'github-releases',
|
|
versioning: 'npm',
|
|
extractVersion: '^(?<version>\\d+\\.\\d+\\.\\d+)(-\\d+)?$',
|
|
depType: 'uses-with',
|
|
},
|
|
{
|
|
depName: 'node',
|
|
packageName: 'actions/node-versions',
|
|
currentValue: 'latest',
|
|
datasource: 'github-releases',
|
|
versioning: 'node',
|
|
extractVersion: '^(?<version>\\d+\\.\\d+\\.\\d+)(-\\d+)?$',
|
|
depType: 'uses-with',
|
|
},
|
|
]);
|
|
});
|
|
|
|
it('extracts x-version from actions/setup-x referenced by an https:// URL', async () => {
|
|
const yamlContent = codeBlock`
|
|
jobs:
|
|
build:
|
|
steps:
|
|
- uses: https://github.com/actions/setup-node@v4.4.0
|
|
with:
|
|
node-version: '23.7.0'
|
|
`;
|
|
|
|
const res = await extractPackageFile(yamlContent, 'workflow.yml');
|
|
expect(res?.deps).toMatchObject([
|
|
{
|
|
depName: 'https://github.com/actions/setup-node',
|
|
packageName: 'actions/setup-node',
|
|
currentValue: 'v4.4.0',
|
|
datasource: 'github-tags',
|
|
versioning: 'github-actions',
|
|
depType: 'action',
|
|
},
|
|
{
|
|
depName: 'node',
|
|
packageName: 'actions/node-versions',
|
|
currentValue: '23.7.0',
|
|
datasource: 'github-releases',
|
|
versioning: 'node',
|
|
extractVersion: '^(?<version>\\d+\\.\\d+\\.\\d+)(-\\d+)?$',
|
|
depType: 'uses-with',
|
|
},
|
|
]);
|
|
});
|
|
|
|
it('handles actions/setup-x without x-version field', async () => {
|
|
const yamlContent = codeBlock`
|
|
jobs:
|
|
build:
|
|
steps:
|
|
- name: "Setup Node.js without version"
|
|
uses: actions/setup-node@v3
|
|
with:
|
|
registry-url: 'https://npm.pkg.github.com'
|
|
`;
|
|
const res = await extractPackageFile(yamlContent, 'workflow.yml');
|
|
expect(res?.deps).toMatchObject([
|
|
{
|
|
depName: 'actions/setup-node',
|
|
depType: 'action',
|
|
},
|
|
{
|
|
depName: 'node',
|
|
depType: 'uses-with',
|
|
skipStage: 'extract',
|
|
skipReason: 'unspecified-version',
|
|
},
|
|
]);
|
|
});
|
|
|
|
it('extracts x-version from actions/setup-x in composite action', async () => {
|
|
const yamlContent = codeBlock`
|
|
runs:
|
|
using: 'composite'
|
|
steps:
|
|
- name: "Setup Node.js"
|
|
uses: actions/setup-node@v3
|
|
with:
|
|
node-version: '16.x'
|
|
- name: "Setup Node.js with exact version"
|
|
uses: actions/setup-node@v3
|
|
with:
|
|
node-version: '20.0.0'
|
|
- name: "Setup Go"
|
|
uses: actions/setup-go@v5
|
|
with:
|
|
go-version: '1.23'
|
|
- name: "Setup Python with range"
|
|
uses: actions/setup-python@v3
|
|
with:
|
|
python-version: '>=3.8.0 <3.10.0'
|
|
- name: "Setup Node.js with latest"
|
|
uses: actions/setup-node@v3
|
|
with:
|
|
node-version: 'latest'
|
|
`;
|
|
|
|
const res = await extractPackageFile(yamlContent, 'action.yml');
|
|
expect(res?.deps).toMatchObject([
|
|
{
|
|
autoReplaceStringTemplate:
|
|
'{{depName}}@{{#if newDigest}}{{newDigest}}{{#if newValue}} # {{newValue}}{{/if}}{{/if}}{{#unless newDigest}}{{newValue}}{{/unless}}',
|
|
commitMessageTopic: '{{{depName}}} action',
|
|
currentValue: 'v3',
|
|
datasource: 'github-tags',
|
|
depName: 'actions/setup-node',
|
|
depType: 'action',
|
|
replaceString: 'actions/setup-node@v3',
|
|
versioning: 'github-actions',
|
|
},
|
|
{
|
|
autoReplaceStringTemplate:
|
|
'{{depName}}@{{#if newDigest}}{{newDigest}}{{#if newValue}} # {{newValue}}{{/if}}{{/if}}{{#unless newDigest}}{{newValue}}{{/unless}}',
|
|
commitMessageTopic: '{{{depName}}} action',
|
|
currentValue: 'v3',
|
|
datasource: 'github-tags',
|
|
depName: 'actions/setup-node',
|
|
depType: 'action',
|
|
replaceString: 'actions/setup-node@v3',
|
|
versioning: 'github-actions',
|
|
},
|
|
{
|
|
autoReplaceStringTemplate:
|
|
'{{depName}}@{{#if newDigest}}{{newDigest}}{{#if newValue}} # {{newValue}}{{/if}}{{/if}}{{#unless newDigest}}{{newValue}}{{/unless}}',
|
|
commitMessageTopic: '{{{depName}}} action',
|
|
currentValue: 'v5',
|
|
datasource: 'github-tags',
|
|
depName: 'actions/setup-go',
|
|
depType: 'action',
|
|
replaceString: 'actions/setup-go@v5',
|
|
versioning: 'github-actions',
|
|
},
|
|
{
|
|
autoReplaceStringTemplate:
|
|
'{{depName}}@{{#if newDigest}}{{newDigest}}{{#if newValue}} # {{newValue}}{{/if}}{{/if}}{{#unless newDigest}}{{newValue}}{{/unless}}',
|
|
commitMessageTopic: '{{{depName}}} action',
|
|
currentValue: 'v3',
|
|
datasource: 'github-tags',
|
|
depName: 'actions/setup-python',
|
|
depType: 'action',
|
|
replaceString: 'actions/setup-python@v3',
|
|
versioning: 'github-actions',
|
|
},
|
|
{
|
|
autoReplaceStringTemplate:
|
|
'{{depName}}@{{#if newDigest}}{{newDigest}}{{#if newValue}} # {{newValue}}{{/if}}{{/if}}{{#unless newDigest}}{{newValue}}{{/unless}}',
|
|
commitMessageTopic: '{{{depName}}} action',
|
|
currentValue: 'v3',
|
|
datasource: 'github-tags',
|
|
depName: 'actions/setup-node',
|
|
depType: 'action',
|
|
replaceString: 'actions/setup-node@v3',
|
|
versioning: 'github-actions',
|
|
},
|
|
{
|
|
depName: 'node',
|
|
packageName: 'actions/node-versions',
|
|
currentValue: '16.x',
|
|
datasource: 'github-releases',
|
|
versioning: 'node',
|
|
extractVersion: '^(?<version>\\d+\\.\\d+\\.\\d+)(-\\d+)?$',
|
|
depType: 'uses-with',
|
|
},
|
|
{
|
|
depName: 'node',
|
|
packageName: 'actions/node-versions',
|
|
currentValue: '20.0.0',
|
|
datasource: 'github-releases',
|
|
versioning: 'node',
|
|
extractVersion: '^(?<version>\\d+\\.\\d+\\.\\d+)(-\\d+)?$',
|
|
depType: 'uses-with',
|
|
},
|
|
{
|
|
depName: 'go',
|
|
packageName: 'actions/go-versions',
|
|
currentValue: '1.23',
|
|
datasource: 'github-releases',
|
|
versioning: 'npm',
|
|
extractVersion: '^(?<version>\\d+\\.\\d+\\.\\d+)(-\\d+)?$',
|
|
depType: 'uses-with',
|
|
},
|
|
{
|
|
depName: 'python',
|
|
packageName: 'actions/python-versions',
|
|
currentValue: '>=3.8.0 <3.10.0',
|
|
datasource: 'github-releases',
|
|
versioning: 'npm',
|
|
extractVersion: '^(?<version>\\d+\\.\\d+\\.\\d+)(-\\d+)?$',
|
|
depType: 'uses-with',
|
|
},
|
|
{
|
|
depName: 'node',
|
|
packageName: 'actions/node-versions',
|
|
currentValue: 'latest',
|
|
datasource: 'github-releases',
|
|
versioning: 'node',
|
|
extractVersion: '^(?<version>\\d+\\.\\d+\\.\\d+)(-\\d+)?$',
|
|
depType: 'uses-with',
|
|
},
|
|
]);
|
|
});
|
|
|
|
it('logs unknown schema', async () => {
|
|
const yamlContent = codeBlock`
|
|
runs:
|
|
using: 'node20'
|
|
main: 'index.js'
|
|
`;
|
|
await expect(
|
|
extractPackageFile(yamlContent, 'action.yml'),
|
|
).resolves.toBeNull();
|
|
});
|
|
|
|
it('extracts actions and with-version inputs nested in a parallel block', async () => {
|
|
const yamlContent = codeBlock`
|
|
jobs:
|
|
build:
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- parallel:
|
|
- name: Setup Node.js
|
|
uses: actions/setup-node@v5
|
|
with:
|
|
node-version: '20.0.0'
|
|
- name: Setup Go
|
|
uses: actions/setup-go@v5
|
|
with:
|
|
go-version: '1.23'
|
|
- run: npm test
|
|
`;
|
|
|
|
const res = await extractPackageFile(yamlContent, 'workflow.yml');
|
|
expect(res?.deps).toMatchObject([
|
|
{ depName: 'actions/checkout', depType: 'action' },
|
|
{ depName: 'actions/setup-node', depType: 'action' },
|
|
{ depName: 'actions/setup-go', depType: 'action' },
|
|
{ depName: 'node', depType: 'uses-with', currentValue: '20.0.0' },
|
|
{ depName: 'go', depType: 'uses-with', currentValue: '1.23' },
|
|
]);
|
|
});
|
|
|
|
it('extracts community action with-inputs nested in a parallel block', async () => {
|
|
const yamlContent = codeBlock`
|
|
jobs:
|
|
build:
|
|
steps:
|
|
- parallel:
|
|
- uses: astral-sh/setup-uv@v8.2.0
|
|
with:
|
|
version: '0.4.x'
|
|
`;
|
|
|
|
const res = await extractPackageFile(yamlContent, 'workflow.yml');
|
|
expect(res?.deps).toMatchObject([
|
|
{ depName: 'astral-sh/setup-uv', depType: 'action' },
|
|
{
|
|
depName: 'astral-sh/uv',
|
|
depType: 'uses-with',
|
|
currentValue: '0.4.x',
|
|
datasource: 'github-releases',
|
|
},
|
|
]);
|
|
});
|
|
|
|
it.each`
|
|
sha256 | currentDigest
|
|
${'dad54e0b843908324282b8673f9c0ebc3a4da0c49ad2da309a49bfbc918ba180'} | ${'dad54e0b843908324282b8673f9c0ebc3a4da0c49ad2da309a49bfbc918ba180'}
|
|
${'DAD54E0B843908324282B8673F9C0EBC3A4DA0C49AD2DA309A49BFBC918BA180'} | ${undefined}
|
|
${'${{ inputs.mise-sha256 }}'} | ${undefined}
|
|
${undefined} | ${undefined}
|
|
`(
|
|
'extracts the mise version and checksum from jdx/mise-action',
|
|
async ({ sha256, currentDigest }) => {
|
|
const yamlContent = codeBlock`
|
|
jobs:
|
|
build:
|
|
steps:
|
|
- uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0
|
|
with:
|
|
version: 2026.7.10
|
|
${sha256 ? `sha256: ${sha256}` : ''}
|
|
install_args: cargo:cargo-deny
|
|
`;
|
|
|
|
const res = await extractPackageFile(yamlContent, 'workflow.yml');
|
|
expect(res?.deps).toMatchObject([
|
|
{
|
|
currentDigest: 'e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d',
|
|
currentValue: 'v4.2.0',
|
|
datasource: 'github-tags',
|
|
depName: 'jdx/mise-action',
|
|
depType: 'action',
|
|
},
|
|
{
|
|
...(currentDigest ? { currentDigest } : {}),
|
|
currentValue: '2026.7.10',
|
|
datasource: 'github-release-attachments',
|
|
depName: 'jdx/mise',
|
|
depType: 'uses-with',
|
|
packageName: 'jdx/mise',
|
|
},
|
|
]);
|
|
},
|
|
);
|
|
|
|
it('extracts steps nested in nested parallel blocks', async () => {
|
|
const yamlContent = codeBlock`
|
|
jobs:
|
|
build:
|
|
steps:
|
|
- parallel:
|
|
- name: Setup Node.js
|
|
uses: actions/setup-node@v5
|
|
with:
|
|
node-version: '18.0.0'
|
|
- parallel:
|
|
- name: Setup Go
|
|
uses: actions/setup-go@v5
|
|
with:
|
|
go-version: '1.22'
|
|
`;
|
|
|
|
const res = await extractPackageFile(yamlContent, 'workflow.yml');
|
|
expect(res?.deps).toMatchObject([
|
|
{ depName: 'actions/setup-node', depType: 'action' },
|
|
{ depName: 'actions/setup-go', depType: 'action' },
|
|
{ depName: 'node', depType: 'uses-with', currentValue: '18.0.0' },
|
|
{ depName: 'go', depType: 'uses-with', currentValue: '1.22' },
|
|
]);
|
|
});
|
|
});
|
|
|
|
it.each([
|
|
{
|
|
step: {
|
|
uses: 'actions/setup-dotnet@v4',
|
|
with: { 'dotnet-version': '8.0.404' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '8.0.404',
|
|
datasource: 'dotnet-version',
|
|
depName: 'dotnet-sdk',
|
|
depType: 'uses-with',
|
|
packageName: 'dotnet-sdk',
|
|
versioning: 'npm',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
// a channel installs the latest patch release on it, rather than
|
|
// pinning a version
|
|
step: {
|
|
uses: 'actions/setup-dotnet@v4',
|
|
with: { 'dotnet-version': '8.0' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '8.0',
|
|
datasource: 'dotnet-version',
|
|
depName: 'dotnet-sdk',
|
|
depType: 'uses-with',
|
|
packageName: 'dotnet-sdk',
|
|
versioning: 'npm',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
// the idiomatic x-range form is a range too
|
|
step: {
|
|
uses: 'actions/setup-dotnet@v4',
|
|
with: { 'dotnet-version': '8.0.x' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '8.0.x',
|
|
datasource: 'dotnet-version',
|
|
depName: 'dotnet-sdk',
|
|
depType: 'uses-with',
|
|
packageName: 'dotnet-sdk',
|
|
versioning: 'npm',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'actions/setup-dotnet@v4',
|
|
with: {},
|
|
},
|
|
expected: [
|
|
{
|
|
skipStage: 'extract',
|
|
skipReason: 'unspecified-version',
|
|
datasource: 'dotnet-version',
|
|
depName: 'dotnet-sdk',
|
|
depType: 'uses-with',
|
|
packageName: 'dotnet-sdk',
|
|
versioning: 'npm',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
// multiple SDKs, one per line, aren't a single version we can update
|
|
step: {
|
|
uses: 'actions/setup-dotnet@v4',
|
|
with: { 'dotnet-version': '3.1.x\n5.0.x' },
|
|
},
|
|
expected: [
|
|
{
|
|
skipStage: 'extract',
|
|
skipReason: 'invalid-version',
|
|
currentValue: '3.1.x\n5.0.x',
|
|
datasource: 'dotnet-version',
|
|
depName: 'dotnet-sdk',
|
|
depType: 'uses-with',
|
|
packageName: 'dotnet-sdk',
|
|
versioning: 'npm',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'actions/setup-java@v4',
|
|
with: { distribution: 'temurin', 'java-version': '21' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '21',
|
|
datasource: 'java-version',
|
|
depName: 'java-jdk',
|
|
depType: 'uses-with',
|
|
packageName: 'java-jdk',
|
|
versioning: 'semver-partial',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'actions/setup-java@v4',
|
|
with: { distribution: 'adopt', 'java-version': '11' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '11',
|
|
datasource: 'java-version',
|
|
depName: 'java-jdk',
|
|
depType: 'uses-with',
|
|
packageName: 'java-jdk',
|
|
versioning: 'semver-partial',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'actions/setup-java@v4',
|
|
with: {
|
|
distribution: 'temurin',
|
|
'java-version': '21',
|
|
'java-package': 'jre',
|
|
},
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '21',
|
|
datasource: 'java-version',
|
|
depName: 'java-jre',
|
|
depType: 'uses-with',
|
|
packageName: 'java-jre',
|
|
versioning: 'semver-partial',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'actions/setup-java@v4',
|
|
with: { distribution: 'temurin' },
|
|
},
|
|
expected: [
|
|
{
|
|
skipStage: 'extract',
|
|
skipReason: 'unspecified-version',
|
|
datasource: 'java-version',
|
|
depName: 'java-jdk',
|
|
depType: 'uses-with',
|
|
packageName: 'java-jdk',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
// we can't reliably track version updates for distributions other
|
|
// than Temurin/Adopt
|
|
step: {
|
|
uses: 'actions/setup-java@v4',
|
|
with: { distribution: 'zulu', 'java-version': '21' },
|
|
},
|
|
expected: [
|
|
{
|
|
skipStage: 'extract',
|
|
skipReason: 'unsupported',
|
|
datasource: 'java-version',
|
|
depName: 'java-jdk',
|
|
depType: 'uses-with',
|
|
packageName: 'java-jdk',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'actions/setup-java@v4',
|
|
with: { 'java-version': '21' },
|
|
},
|
|
expected: [
|
|
{
|
|
skipStage: 'extract',
|
|
skipReason: 'unsupported',
|
|
datasource: 'java-version',
|
|
depName: 'java-jdk',
|
|
depType: 'uses-with',
|
|
packageName: 'java-jdk',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
// a major.minor `java-version` is a range too, so it must keep its
|
|
// precision rather than gain a patch/build component
|
|
step: {
|
|
uses: 'actions/setup-java@v4',
|
|
with: { distribution: 'temurin', 'java-version': '21.0' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '21.0',
|
|
datasource: 'java-version',
|
|
depName: 'java-jdk',
|
|
depType: 'uses-with',
|
|
packageName: 'java-jdk',
|
|
versioning: 'semver-partial',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
// a fully-qualified `java-version` is pinned, not a range, so it's
|
|
// looked up with the default Java versioning
|
|
step: {
|
|
uses: 'actions/setup-java@v4',
|
|
with: { distribution: 'temurin', 'java-version': '21.0.9+11.0.LTS' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '21.0.9+11.0.LTS',
|
|
datasource: 'java-version',
|
|
depName: 'java-jdk',
|
|
depType: 'uses-with',
|
|
packageName: 'java-jdk',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'actions/setup-java@v4',
|
|
with: { distribution: 'temurin', 'java-version': '21.0.9' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '21.0.9',
|
|
datasource: 'java-version',
|
|
depName: 'java-jdk',
|
|
depType: 'uses-with',
|
|
packageName: 'java-jdk',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'actions/setup-java@v4',
|
|
with: { distribution: 'temurin', 'java-version': '21.0.9-ea' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '21.0.9-ea',
|
|
datasource: 'java-version',
|
|
depName: 'java-jdk',
|
|
depType: 'uses-with',
|
|
packageName: 'java-jdk',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
// `latest` isn't a version we can pin or bump
|
|
step: {
|
|
uses: 'actions/setup-java@v4',
|
|
with: { distribution: 'temurin', 'java-version': 'latest' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: 'latest',
|
|
datasource: 'java-version',
|
|
depName: 'java-jdk',
|
|
depType: 'uses-with',
|
|
packageName: 'java-jdk',
|
|
skipStage: 'extract',
|
|
skipReason: 'unsupported-version',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
// an `x`-range has no single version to bump it to
|
|
step: {
|
|
uses: 'actions/setup-java@v4',
|
|
with: { distribution: 'temurin', 'java-version': '21.x' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '21.x',
|
|
datasource: 'java-version',
|
|
depName: 'java-jdk',
|
|
depType: 'uses-with',
|
|
packageName: 'java-jdk',
|
|
skipStage: 'extract',
|
|
skipReason: 'unsupported-version',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
// a comparator range has no single version to bump it to
|
|
step: {
|
|
uses: 'actions/setup-java@v4',
|
|
with: { distribution: 'temurin', 'java-version': '>=21' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '>=21',
|
|
datasource: 'java-version',
|
|
depName: 'java-jdk',
|
|
depType: 'uses-with',
|
|
packageName: 'java-jdk',
|
|
skipStage: 'extract',
|
|
skipReason: 'unsupported-version',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
// early-access releases aren't published by the java-version datasource
|
|
step: {
|
|
uses: 'actions/setup-java@v4',
|
|
with: { distribution: 'temurin', 'java-version': '21-ea' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '21-ea',
|
|
datasource: 'java-version',
|
|
depName: 'java-jdk',
|
|
depType: 'uses-with',
|
|
packageName: 'java-jdk',
|
|
skipStage: 'extract',
|
|
skipReason: 'unsupported-version',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'aquasecurity/setup-trivy@v0.2.6',
|
|
with: {},
|
|
},
|
|
expected: [
|
|
{
|
|
datasource: 'github-releases',
|
|
depName: 'aquasecurity/trivy',
|
|
depType: 'uses-with',
|
|
packageName: 'aquasecurity/trivy',
|
|
skipStage: 'extract',
|
|
skipReason: 'unspecified-version',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'aquasecurity/setup-trivy@v0.2.6',
|
|
with: {
|
|
version: 'latest',
|
|
},
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: 'latest',
|
|
datasource: 'github-releases',
|
|
depName: 'aquasecurity/trivy',
|
|
depType: 'uses-with',
|
|
packageName: 'aquasecurity/trivy',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'aquasecurity/setup-trivy@v0.2.6',
|
|
with: {
|
|
version: 'v0.70.0',
|
|
},
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: 'v0.70.0',
|
|
datasource: 'github-releases',
|
|
depName: 'aquasecurity/trivy',
|
|
depType: 'uses-with',
|
|
packageName: 'aquasecurity/trivy',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'aquasecurity/trivy-action@v0.35.0',
|
|
with: {
|
|
version: 'latest',
|
|
},
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: 'latest',
|
|
datasource: 'github-releases',
|
|
depName: 'aquasecurity/trivy',
|
|
depType: 'uses-with',
|
|
packageName: 'aquasecurity/trivy',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'aquasecurity/trivy-action@v0.35.0',
|
|
with: {
|
|
version: 'v0.70.0',
|
|
},
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: 'v0.70.0',
|
|
datasource: 'github-releases',
|
|
depName: 'aquasecurity/trivy',
|
|
depType: 'uses-with',
|
|
packageName: 'aquasecurity/trivy',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'astral-sh/setup-uv@v5',
|
|
with: {
|
|
version: 'latest',
|
|
},
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: 'latest',
|
|
datasource: 'github-releases',
|
|
depName: 'astral-sh/uv',
|
|
depType: 'uses-with',
|
|
packageName: 'astral-sh/uv',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
name: 'Pinning a minor version of uv',
|
|
uses: 'astral-sh/setup-uv@v5',
|
|
with: {
|
|
version: '0.4.x',
|
|
},
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '0.4.x',
|
|
datasource: 'github-releases',
|
|
depName: 'astral-sh/uv',
|
|
depType: 'uses-with',
|
|
packageName: 'astral-sh/uv',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
name: 'Pinning a minor version of uv',
|
|
uses: 'https://github.com/astral-sh/setup-uv@v5',
|
|
with: {
|
|
version: '0.4.x',
|
|
},
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '0.4.x',
|
|
datasource: 'github-releases',
|
|
depName: 'astral-sh/uv',
|
|
depType: 'uses-with',
|
|
packageName: 'astral-sh/uv',
|
|
versioning: 'npm',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'https://github.com/astral-sh/setup-uv@v5',
|
|
with: {},
|
|
},
|
|
expected: [
|
|
{
|
|
datasource: 'github-releases',
|
|
depName: 'astral-sh/uv',
|
|
depType: 'uses-with',
|
|
skipStage: 'extract',
|
|
skipReason: 'unspecified-version',
|
|
packageName: 'astral-sh/uv',
|
|
versioning: 'npm',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'aws-actions/amazon-ecs-render-task-definition@v1',
|
|
with: {
|
|
'container-name': 'web',
|
|
image: 'amazon/amazon-ecs-sample:latest',
|
|
},
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: 'latest',
|
|
datasource: 'docker',
|
|
depName: 'amazon/amazon-ecs-sample',
|
|
depType: 'uses-with',
|
|
packageName: 'amazon/amazon-ecs-sample',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'aws-actions/amazon-ecs-render-task-definition@v1',
|
|
with: {
|
|
'container-name': 'web',
|
|
image: '123456789012.dkr.ecr.us-east-1.amazonaws.com/my-repo:v1.2.3',
|
|
},
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: 'v1.2.3',
|
|
datasource: 'docker',
|
|
depName: '123456789012.dkr.ecr.us-east-1.amazonaws.com/my-repo',
|
|
depType: 'uses-with',
|
|
packageName: '123456789012.dkr.ecr.us-east-1.amazonaws.com/my-repo',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'aws-actions/amazon-ecs-render-task-definition@v1',
|
|
with: {
|
|
'container-name': 'web',
|
|
image:
|
|
'amazon/amazon-ecs-sample@sha256:0f7ba2b70c5d1a7e2d95b0f6c3d5b4a1e2f6b6a1e2f6b6a1e2f6b6a1e2f6b6a1',
|
|
},
|
|
},
|
|
expected: [
|
|
{
|
|
currentDigest:
|
|
'sha256:0f7ba2b70c5d1a7e2d95b0f6c3d5b4a1e2f6b6a1e2f6b6a1e2f6b6a1e2f6b6a1',
|
|
datasource: 'docker',
|
|
depName: 'amazon/amazon-ecs-sample',
|
|
depType: 'uses-with',
|
|
packageName: 'amazon/amazon-ecs-sample',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'aws-actions/amazon-ecs-render-task-definition@v1',
|
|
with: {
|
|
'container-name': 'web',
|
|
},
|
|
},
|
|
expected: [
|
|
{
|
|
depType: 'uses-with',
|
|
skipStage: 'extract',
|
|
skipReason: 'unspecified-version',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
// the image is templated, so we can't reliably determine what to update
|
|
step: {
|
|
uses: 'aws-actions/amazon-ecs-render-task-definition@v1',
|
|
with: {
|
|
'container-name': 'web',
|
|
image: '${{ steps.build-image.outputs.image }}',
|
|
},
|
|
},
|
|
expected: [
|
|
{
|
|
depType: 'uses-with',
|
|
skipStage: 'extract',
|
|
skipReason: 'contains-variable',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'pnpm/action-setup@v4',
|
|
with: {
|
|
version: 'latest',
|
|
},
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: 'latest',
|
|
datasource: 'npm',
|
|
depName: 'pnpm',
|
|
depType: 'uses-with',
|
|
packageName: 'pnpm',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'pnpm/action-setup@v4',
|
|
with: {},
|
|
},
|
|
expected: [
|
|
{
|
|
skipStage: 'extract',
|
|
skipReason: 'unspecified-version',
|
|
datasource: 'npm',
|
|
depName: 'pnpm',
|
|
depType: 'uses-with',
|
|
packageName: 'pnpm',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'pnpm/setup@v1',
|
|
with: {
|
|
version: '12.0.0',
|
|
runtime: 'node@24.1.0',
|
|
},
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '12.0.0',
|
|
datasource: 'npm',
|
|
depName: 'pnpm',
|
|
depType: 'uses-with',
|
|
packageName: 'pnpm',
|
|
},
|
|
{
|
|
currentValue: '24.1.0',
|
|
datasource: 'node-version',
|
|
depName: 'node',
|
|
depType: 'uses-with',
|
|
packageName: 'node',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'pnpm/setup@v1',
|
|
with: {
|
|
install: false,
|
|
runtime: 'bun@1.2.x',
|
|
},
|
|
},
|
|
expected: [
|
|
{
|
|
skipStage: 'extract',
|
|
skipReason: 'unspecified-version',
|
|
datasource: 'npm',
|
|
depName: 'pnpm',
|
|
depType: 'uses-with',
|
|
packageName: 'pnpm',
|
|
},
|
|
{
|
|
currentValue: '1.2.x',
|
|
datasource: 'npm',
|
|
depName: 'bun',
|
|
depType: 'uses-with',
|
|
packageName: 'bun',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'pnpm/setup@v1',
|
|
with: {
|
|
runtime: 'deno@2',
|
|
},
|
|
},
|
|
expected: [
|
|
{
|
|
skipStage: 'extract',
|
|
skipReason: 'unspecified-version',
|
|
datasource: 'npm',
|
|
depName: 'pnpm',
|
|
depType: 'uses-with',
|
|
packageName: 'pnpm',
|
|
},
|
|
{
|
|
currentValue: '2',
|
|
datasource: 'npm',
|
|
depName: 'deno',
|
|
depType: 'uses-with',
|
|
packageName: 'deno',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
// no version pinned: the runtime version comes from `devEngines.runtime`
|
|
step: {
|
|
uses: 'pnpm/setup@v1',
|
|
with: {
|
|
runtime: 'node',
|
|
},
|
|
},
|
|
expected: [
|
|
{
|
|
skipStage: 'extract',
|
|
skipReason: 'unspecified-version',
|
|
datasource: 'npm',
|
|
depName: 'pnpm',
|
|
depType: 'uses-with',
|
|
packageName: 'pnpm',
|
|
},
|
|
{
|
|
skipStage: 'extract',
|
|
skipReason: 'unspecified-version',
|
|
datasource: 'node-version',
|
|
depName: 'node',
|
|
depType: 'uses-with',
|
|
packageName: 'node',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'pnpm/setup@v1',
|
|
with: {
|
|
version: '12.0.0',
|
|
runtime: 'python@3.13',
|
|
},
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '12.0.0',
|
|
datasource: 'npm',
|
|
depName: 'pnpm',
|
|
depType: 'uses-with',
|
|
packageName: 'pnpm',
|
|
},
|
|
{
|
|
skipStage: 'extract',
|
|
skipReason: 'invalid-name',
|
|
depName: 'python',
|
|
depType: 'uses-with',
|
|
packageName: 'python',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
// missing name: reported under the raw input
|
|
step: {
|
|
uses: 'pnpm/setup@v1',
|
|
with: {
|
|
runtime: '@24',
|
|
},
|
|
},
|
|
expected: [
|
|
{
|
|
skipStage: 'extract',
|
|
skipReason: 'unspecified-version',
|
|
datasource: 'npm',
|
|
depName: 'pnpm',
|
|
depType: 'uses-with',
|
|
packageName: 'pnpm',
|
|
},
|
|
{
|
|
skipStage: 'extract',
|
|
skipReason: 'invalid-name',
|
|
depName: '@24',
|
|
depType: 'uses-with',
|
|
packageName: '@24',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
// the runtime is not a literal, so there's no name to resolve
|
|
step: {
|
|
uses: 'pnpm/setup@v1',
|
|
with: {
|
|
runtime: '${{ env.RUNTIME }}',
|
|
},
|
|
},
|
|
expected: [
|
|
{
|
|
skipStage: 'extract',
|
|
skipReason: 'unspecified-version',
|
|
datasource: 'npm',
|
|
depName: 'pnpm',
|
|
depType: 'uses-with',
|
|
packageName: 'pnpm',
|
|
},
|
|
{
|
|
skipStage: 'extract',
|
|
skipReason: 'invalid-name',
|
|
depName: '${{ env.RUNTIME }}',
|
|
depType: 'uses-with',
|
|
packageName: '${{ env.RUNTIME }}',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'pnpm/setup@v1',
|
|
with: {},
|
|
},
|
|
expected: [
|
|
{
|
|
skipStage: 'extract',
|
|
skipReason: 'unspecified-version',
|
|
datasource: 'npm',
|
|
depName: 'pnpm',
|
|
depType: 'uses-with',
|
|
packageName: 'pnpm',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
name: 'Install gotestsum',
|
|
uses: 'jaxxstorm/action-install-gh-release@v1.10.0',
|
|
with: {
|
|
repo: 'gotestyourself/gotestsum',
|
|
tag: 'v1.12.1',
|
|
platform: 'linux',
|
|
arch: 'amd64',
|
|
},
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: 'v1.12.1',
|
|
datasource: 'github-releases',
|
|
depName: 'gotestyourself/gotestsum',
|
|
depType: 'uses-with',
|
|
packageName: 'gotestyourself/gotestsum',
|
|
},
|
|
],
|
|
},
|
|
|
|
{
|
|
step: {
|
|
uses: 'pnpm/action-setup@v4',
|
|
with: {
|
|
version: 10,
|
|
},
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '10',
|
|
datasource: 'npm',
|
|
depName: 'pnpm',
|
|
depType: 'uses-with',
|
|
packageName: 'pnpm',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'pnpm/action-setup@v4',
|
|
with: {
|
|
version: '10.x',
|
|
},
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '10.x',
|
|
datasource: 'npm',
|
|
depName: 'pnpm',
|
|
depType: 'uses-with',
|
|
packageName: 'pnpm',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'pdm-project/setup-pdm@v4.2',
|
|
with: {
|
|
version: '1.2.3',
|
|
},
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '1.2.3',
|
|
datasource: 'pypi',
|
|
depName: 'pdm',
|
|
depType: 'uses-with',
|
|
packageName: 'pdm',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'pdm-project/setup-pdm@v4.2',
|
|
with: {},
|
|
},
|
|
expected: [
|
|
{
|
|
skipStage: 'extract',
|
|
skipReason: 'unspecified-version',
|
|
datasource: 'pypi',
|
|
depName: 'pdm',
|
|
depType: 'uses-with',
|
|
packageName: 'pdm',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'prefix-dev/setup-pixi@v0.8.3',
|
|
with: {
|
|
'pixi-version': 'v0.41.4',
|
|
},
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: 'v0.41.4',
|
|
datasource: 'github-releases',
|
|
depName: 'prefix-dev/pixi',
|
|
depType: 'uses-with',
|
|
packageName: 'prefix-dev/pixi',
|
|
versioning: 'semver',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
// `'latest'` is the default `pixi-version`, which is not a version that can be bumped
|
|
step: {
|
|
uses: 'prefix-dev/setup-pixi@v0.8.3',
|
|
with: {
|
|
'pixi-version': 'latest',
|
|
},
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: 'latest',
|
|
datasource: 'github-releases',
|
|
depName: 'prefix-dev/pixi',
|
|
depType: 'uses-with',
|
|
packageName: 'prefix-dev/pixi',
|
|
versioning: 'semver',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'oven-sh/setup-bun@v2',
|
|
with: {},
|
|
},
|
|
expected: [
|
|
{
|
|
skipStage: 'extract',
|
|
skipReason: 'unspecified-version',
|
|
datasource: 'npm',
|
|
depName: 'bun',
|
|
depType: 'uses-with',
|
|
packageName: 'bun',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'oven-sh/setup-bun@v2',
|
|
with: { 'bun-version': '1.2.0' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '1.2.0',
|
|
datasource: 'npm',
|
|
depName: 'bun',
|
|
depType: 'uses-with',
|
|
packageName: 'bun',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'denoland/setup-deno@v2',
|
|
with: {},
|
|
},
|
|
expected: [
|
|
{
|
|
skipStage: 'extract',
|
|
skipReason: 'unspecified-version',
|
|
datasource: 'github-releases',
|
|
depName: 'deno',
|
|
depType: 'uses-with',
|
|
packageName: 'denoland/deno',
|
|
versioning: 'npm',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'denoland/setup-deno@v2',
|
|
with: { 'deno-version': '2.4.0' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '2.4.0',
|
|
datasource: 'github-releases',
|
|
depName: 'deno',
|
|
depType: 'uses-with',
|
|
packageName: 'denoland/deno',
|
|
versioning: 'npm',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'expo/expo-github-action@v8',
|
|
with: {},
|
|
},
|
|
expected: [
|
|
{
|
|
skipStage: 'extract',
|
|
skipReason: 'unspecified-version',
|
|
datasource: 'npm',
|
|
depName: 'eas-cli',
|
|
depType: 'uses-with',
|
|
packageName: 'eas-cli',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'expo/expo-github-action@v8',
|
|
with: { 'eas-version': '23.2.0' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '23.2.0',
|
|
datasource: 'npm',
|
|
depName: 'eas-cli',
|
|
depType: 'uses-with',
|
|
packageName: 'eas-cli',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'ruby/setup-ruby@v1',
|
|
with: {},
|
|
},
|
|
expected: [
|
|
{
|
|
skipStage: 'extract',
|
|
skipReason: 'unspecified-version',
|
|
datasource: 'ruby-version',
|
|
depName: 'ruby',
|
|
depType: 'uses-with',
|
|
packageName: 'ruby',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
// a short `ruby-version` is the latest release matching it, so it must
|
|
// keep its precision rather than gain a patch component
|
|
step: {
|
|
uses: 'ruby/setup-ruby@v1',
|
|
with: { 'ruby-version': '3.4' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '3.4',
|
|
datasource: 'ruby-version',
|
|
depName: 'ruby',
|
|
depType: 'uses-with',
|
|
packageName: 'ruby',
|
|
versioning: 'semver-partial',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'ruby/setup-ruby@v1',
|
|
with: { 'ruby-version': '3.4.7' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '3.4.7',
|
|
datasource: 'ruby-version',
|
|
depName: 'ruby',
|
|
depType: 'uses-with',
|
|
packageName: 'ruby',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'pypa/hatch@install',
|
|
with: { version: '1.14.2' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '1.14.2',
|
|
datasource: 'github-releases',
|
|
depName: 'pypa/hatch',
|
|
depType: 'uses-with',
|
|
packageName: 'pypa/hatch',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'pypa/hatch@install',
|
|
with: {},
|
|
},
|
|
expected: [
|
|
{
|
|
skipStage: 'extract',
|
|
skipReason: 'unspecified-version',
|
|
datasource: 'github-releases',
|
|
depName: 'pypa/hatch',
|
|
depType: 'uses-with',
|
|
packageName: 'pypa/hatch',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'jakebailey/pyright-action@v2',
|
|
with: { version: '1.1.100' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '1.1.100',
|
|
datasource: 'npm',
|
|
depName: 'pyright',
|
|
depType: 'uses-with',
|
|
packageName: 'pyright',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'jakebailey/pyright-action@v2',
|
|
with: {},
|
|
},
|
|
expected: [
|
|
{
|
|
skipStage: 'extract',
|
|
skipReason: 'unspecified-version',
|
|
datasource: 'npm',
|
|
depName: 'pyright',
|
|
depType: 'uses-with',
|
|
packageName: 'pyright',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'jakebailey/pyright-action@v2',
|
|
with: { version: 'PATH' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: 'PATH',
|
|
skipStage: 'extract',
|
|
skipReason: 'invalid-version',
|
|
datasource: 'npm',
|
|
depName: 'pyright',
|
|
depType: 'uses-with',
|
|
packageName: 'pyright',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'golangci/golangci-lint-action@v9',
|
|
with: { version: 'v2.5.0' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: 'v2.5.0',
|
|
datasource: 'github-releases',
|
|
depName: 'golangci/golangci-lint',
|
|
depType: 'uses-with',
|
|
packageName: 'golangci/golangci-lint',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
// a partial `version` resolves to the latest matching release, so it
|
|
// must keep both its precision and its `v` prefix
|
|
step: {
|
|
uses: 'golangci/golangci-lint-action@v9',
|
|
with: { version: 'v2.5' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: 'v2.5',
|
|
datasource: 'github-releases',
|
|
depName: 'golangci/golangci-lint',
|
|
depType: 'uses-with',
|
|
packageName: 'golangci/golangci-lint',
|
|
versioning: 'semver-partial',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'golangci/golangci-lint-action@v9',
|
|
with: {},
|
|
},
|
|
expected: [
|
|
{
|
|
skipStage: 'extract',
|
|
skipReason: 'unspecified-version',
|
|
datasource: 'github-releases',
|
|
depName: 'golangci/golangci-lint',
|
|
depType: 'uses-with',
|
|
packageName: 'golangci/golangci-lint',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'zizmorcore/zizmor-action@v0.5.2',
|
|
with: {},
|
|
},
|
|
expected: [
|
|
{
|
|
skipStage: 'extract',
|
|
skipReason: 'unspecified-version',
|
|
datasource: 'docker',
|
|
depName: 'ghcr.io/zizmorcore/zizmor',
|
|
depType: 'uses-with',
|
|
packageName: 'ghcr.io/zizmorcore/zizmor',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'zizmorcore/zizmor-action@v0.5.2',
|
|
with: {
|
|
version: 'v1.23.1',
|
|
},
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: 'v1.23.1',
|
|
datasource: 'docker',
|
|
depName: 'ghcr.io/zizmorcore/zizmor',
|
|
depType: 'uses-with',
|
|
packageName: 'ghcr.io/zizmorcore/zizmor',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'zizmorcore/zizmor-action@v0.5.2',
|
|
with: {
|
|
version: '1.23.1',
|
|
},
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '1.23.1',
|
|
datasource: 'docker',
|
|
depName: 'ghcr.io/zizmorcore/zizmor',
|
|
depType: 'uses-with',
|
|
packageName: 'ghcr.io/zizmorcore/zizmor',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'docker/setup-docker-action@v4',
|
|
with: { version: 'v27.1.0' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: 'v27.1.0',
|
|
datasource: 'github-releases',
|
|
depName: 'docker',
|
|
depType: 'uses-with',
|
|
packageName: 'moby/moby',
|
|
extractVersion: '^docker-(?<version>.+)$',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'dtolnay/rust-toolchain@master',
|
|
with: { toolchain: '1.89.0' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '1.89.0',
|
|
datasource: 'rust-version',
|
|
depName: 'rust',
|
|
depType: 'uses-with',
|
|
packageName: 'rust',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'dtolnay/rust-toolchain@master',
|
|
with: { toolchain: 'nightly-2025-01-01' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: 'nightly-2025-01-01',
|
|
datasource: 'rust-version',
|
|
depName: 'rust',
|
|
depType: 'uses-with',
|
|
packageName: 'rust',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'dtolnay/rust-toolchain@stable',
|
|
with: { toolchain: 'stable' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: 'stable',
|
|
datasource: 'rust-version',
|
|
depName: 'rust',
|
|
depType: 'uses-with',
|
|
packageName: 'rust',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'dtolnay/rust-toolchain@master',
|
|
with: {},
|
|
},
|
|
expected: [
|
|
{
|
|
datasource: 'rust-version',
|
|
depName: 'rust',
|
|
depType: 'uses-with',
|
|
packageName: 'rust',
|
|
skipStage: 'extract',
|
|
skipReason: 'unspecified-version',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'azure/setup-helm@v4',
|
|
with: { version: 'v3.17.0' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: 'v3.17.0',
|
|
datasource: 'github-releases',
|
|
depName: 'helm',
|
|
depType: 'uses-with',
|
|
packageName: 'helm/helm',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'azure/setup-helm@v4',
|
|
with: {},
|
|
},
|
|
expected: [
|
|
{
|
|
skipStage: 'extract',
|
|
skipReason: 'unspecified-version',
|
|
datasource: 'github-releases',
|
|
depName: 'helm',
|
|
depType: 'uses-with',
|
|
packageName: 'helm/helm',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'docker/setup-buildx-action@v3',
|
|
with: { version: 'v0.19.3' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: 'v0.19.3',
|
|
datasource: 'github-releases',
|
|
depName: 'buildx',
|
|
depType: 'uses-with',
|
|
packageName: 'docker/buildx',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'docker/setup-buildx-action@v3',
|
|
with: {},
|
|
},
|
|
expected: [
|
|
{
|
|
skipStage: 'extract',
|
|
skipReason: 'unspecified-version',
|
|
datasource: 'github-releases',
|
|
depName: 'buildx',
|
|
depType: 'uses-with',
|
|
packageName: 'docker/buildx',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'docker/setup-compose-action@v1',
|
|
with: { version: 'v2.36.1' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: 'v2.36.1',
|
|
datasource: 'github-releases',
|
|
depName: 'docker/compose',
|
|
depType: 'uses-with',
|
|
packageName: 'docker/compose',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'docker/setup-compose-action@v1',
|
|
with: {},
|
|
},
|
|
expected: [
|
|
{
|
|
skipStage: 'extract',
|
|
skipReason: 'unspecified-version',
|
|
datasource: 'github-releases',
|
|
depName: 'docker/compose',
|
|
depType: 'uses-with',
|
|
packageName: 'docker/compose',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'helm/chart-testing-action@v2',
|
|
with: { version: 'v3.12.0' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: 'v3.12.0',
|
|
datasource: 'github-releases',
|
|
depName: 'chart-testing',
|
|
depType: 'uses-with',
|
|
packageName: 'helm/chart-testing',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'helm/chart-testing-action@v2',
|
|
with: {},
|
|
},
|
|
expected: [
|
|
{
|
|
skipStage: 'extract',
|
|
skipReason: 'unspecified-version',
|
|
datasource: 'github-releases',
|
|
depName: 'chart-testing',
|
|
depType: 'uses-with',
|
|
packageName: 'helm/chart-testing',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'sigoden/install-binary@v1',
|
|
with: {
|
|
repo: 'sigoden/argc',
|
|
tag: 'v1.22.0',
|
|
},
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: 'v1.22.0',
|
|
datasource: 'github-releases',
|
|
depName: 'sigoden/argc',
|
|
depType: 'uses-with',
|
|
packageName: 'sigoden/argc',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'sigstore/cosign-installer@v4.1.2',
|
|
with: { 'cosign-release': 'v3.1.2' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: 'v3.1.2',
|
|
datasource: 'github-releases',
|
|
depName: 'sigstore/cosign',
|
|
depType: 'uses-with',
|
|
packageName: 'sigstore/cosign',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'slsa-framework/actions/attest/actions@v0.1.0',
|
|
with: { version: 'v0.1.0' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: 'v0.1.0',
|
|
datasource: 'github-releases',
|
|
depName: 'slsa-framework/attester',
|
|
depType: 'uses-with',
|
|
packageName: 'slsa-framework/attester',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'slsa-framework/actions/install/verifier@v0.1.0',
|
|
with: { version: 'v0.1.0' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: 'v0.1.0',
|
|
datasource: 'github-releases',
|
|
depName: 'slsa-framework/verifier',
|
|
depType: 'uses-with',
|
|
packageName: 'slsa-framework/verifier',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
// the `repo` input overrides which repository's releases are tracked
|
|
step: {
|
|
uses: 'slsa-framework/actions/install/verifier@v0.1.0',
|
|
with: { version: 'v1.2.3', repo: 'other-org/other-verifier' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: 'v1.2.3',
|
|
datasource: 'github-releases',
|
|
depName: 'other-org/other-verifier',
|
|
depType: 'uses-with',
|
|
packageName: 'other-org/other-verifier',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'slsa-framework/actions/install/verifier@v0.1.0',
|
|
with: {},
|
|
},
|
|
expected: [
|
|
{
|
|
skipStage: 'extract',
|
|
skipReason: 'unspecified-version',
|
|
datasource: 'github-releases',
|
|
depName: 'slsa-framework/verifier',
|
|
depType: 'uses-with',
|
|
packageName: 'slsa-framework/verifier',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'slsa-framework/actions/slsa_with_provenance@v0.1.0',
|
|
with: { version: 'v0.7.1' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: 'v0.7.1',
|
|
datasource: 'github-releases',
|
|
depName: 'slsa-framework/source-tool',
|
|
depType: 'uses-with',
|
|
packageName: 'slsa-framework/source-tool',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'slsa-framework/actions/verify/build@v0.1.0',
|
|
with: { version: 'v0.1.0' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: 'v0.1.0',
|
|
datasource: 'github-releases',
|
|
depName: 'slsa-framework/verifier',
|
|
depType: 'uses-with',
|
|
packageName: 'slsa-framework/verifier',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'slsa-framework/actions/verify/source@v0.1.0',
|
|
with: { version: 'v0.1.0' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: 'v0.1.0',
|
|
datasource: 'github-releases',
|
|
depName: 'slsa-framework/verifier',
|
|
depType: 'uses-with',
|
|
packageName: 'slsa-framework/verifier',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'slsa-framework/actions/verify/vsa@v0.1.0',
|
|
with: { version: 'v0.1.0' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: 'v0.1.0',
|
|
datasource: 'github-releases',
|
|
depName: 'slsa-framework/verifier',
|
|
depType: 'uses-with',
|
|
packageName: 'slsa-framework/verifier',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'renovatebot/github-action@v43.0.0',
|
|
with: { 'renovate-version': '43.100.0' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '43.100.0',
|
|
datasource: 'docker',
|
|
depName: 'ghcr.io/renovatebot/renovate',
|
|
depType: 'uses-with',
|
|
packageName: 'ghcr.io/renovatebot/renovate',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
// `renovate-version: '43'`, quoted, matching the action's own default
|
|
step: {
|
|
uses: 'renovatebot/github-action@v43.0.0',
|
|
with: { 'renovate-version': '43' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '43',
|
|
datasource: 'docker',
|
|
depName: 'ghcr.io/renovatebot/renovate',
|
|
depType: 'uses-with',
|
|
packageName: 'ghcr.io/renovatebot/renovate',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
// `renovate-version: 43`, unquoted, parses as a YAML number rather than a string
|
|
step: {
|
|
uses: 'renovatebot/github-action@v43.0.0',
|
|
with: { 'renovate-version': 43 },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '43',
|
|
datasource: 'docker',
|
|
depName: 'ghcr.io/renovatebot/renovate',
|
|
depType: 'uses-with',
|
|
packageName: 'ghcr.io/renovatebot/renovate',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'renovatebot/github-action@v43.0.0',
|
|
with: {},
|
|
},
|
|
expected: [
|
|
{
|
|
skipStage: 'extract',
|
|
skipReason: 'unspecified-version',
|
|
datasource: 'docker',
|
|
depName: 'ghcr.io/renovatebot/renovate',
|
|
depType: 'uses-with',
|
|
packageName: 'ghcr.io/renovatebot/renovate',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'renovatebot/github-action@v43.0.0',
|
|
with: {
|
|
'renovate-version': '43.100.0',
|
|
'renovate-image': 'ghcr.io/my-org/renovate',
|
|
},
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '43.100.0',
|
|
datasource: 'docker',
|
|
depName: 'ghcr.io/my-org/renovate',
|
|
depType: 'uses-with',
|
|
packageName: 'ghcr.io/my-org/renovate',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'renovatebot/github-action@v43.0.0',
|
|
with: {
|
|
'renovate-image':
|
|
'ghcr.io/renovatebot/renovate@sha256:0f7ba2b70c5d1a7e2d95b0f6c3d5b4a1e2f6b6a1e2f6b6a1e2f6b6a1e2f6b6a1',
|
|
},
|
|
},
|
|
expected: [
|
|
{
|
|
currentDigest:
|
|
'sha256:0f7ba2b70c5d1a7e2d95b0f6c3d5b4a1e2f6b6a1e2f6b6a1e2f6b6a1e2f6b6a1',
|
|
datasource: 'docker',
|
|
depName: 'ghcr.io/renovatebot/renovate',
|
|
depType: 'uses-with',
|
|
packageName: 'ghcr.io/renovatebot/renovate',
|
|
skipStage: 'extract',
|
|
skipReason: 'unspecified-version',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
// `renovate-image` tag- and digest-pinned, with no `renovate-version`
|
|
// set: https://github.com/renovatebot/renovate/discussions/46969
|
|
step: {
|
|
uses: 'renovatebot/github-action@v43.0.0',
|
|
with: {
|
|
'renovate-image':
|
|
'ghcr.io/renovatebot/renovate:44.104.2@sha256:0f7ba2b70c5d1a7e2d95b0f6c3d5b4a1e2f6b6a1e2f6b6a1e2f6b6a1e2f6b6a1',
|
|
},
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '44.104.2',
|
|
currentDigest:
|
|
'sha256:0f7ba2b70c5d1a7e2d95b0f6c3d5b4a1e2f6b6a1e2f6b6a1e2f6b6a1e2f6b6a1',
|
|
datasource: 'docker',
|
|
depName: 'ghcr.io/renovatebot/renovate',
|
|
depType: 'uses-with',
|
|
packageName: 'ghcr.io/renovatebot/renovate',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'erlef/setup-beam@v1',
|
|
with: {
|
|
'otp-version': '27.1.2',
|
|
'elixir-version': '1.17.3',
|
|
'gleam-version': '1.5.1',
|
|
'rebar3-version': '3.24.0',
|
|
},
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '27.1.2',
|
|
datasource: 'github-releases',
|
|
depName: 'erlang/otp',
|
|
depType: 'uses-with',
|
|
packageName: 'erlang/otp',
|
|
},
|
|
{
|
|
currentValue: '1.17.3',
|
|
datasource: 'github-releases',
|
|
depName: 'elixir-lang/elixir',
|
|
depType: 'uses-with',
|
|
packageName: 'elixir-lang/elixir',
|
|
versioning: 'npm',
|
|
},
|
|
{
|
|
currentValue: '1.5.1',
|
|
datasource: 'github-releases',
|
|
depName: 'gleam-lang/gleam',
|
|
depType: 'uses-with',
|
|
packageName: 'gleam-lang/gleam',
|
|
versioning: 'npm',
|
|
},
|
|
{
|
|
currentValue: '3.24.0',
|
|
datasource: 'github-releases',
|
|
depName: 'erlang/rebar3',
|
|
depType: 'uses-with',
|
|
packageName: 'erlang/rebar3',
|
|
versioning: 'npm',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
// most workflows only set a subset of the 4 possible inputs
|
|
step: {
|
|
uses: 'erlef/setup-beam@v1',
|
|
with: { 'otp-version': '27.1.2' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '27.1.2',
|
|
datasource: 'github-releases',
|
|
depName: 'erlang/otp',
|
|
depType: 'uses-with',
|
|
packageName: 'erlang/otp',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
// the documented version specification form is a range, not a pinned
|
|
// version
|
|
step: {
|
|
uses: 'erlef/setup-beam@v1',
|
|
with: { 'elixir-version': '1.17.x' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '1.17.x',
|
|
datasource: 'github-releases',
|
|
depName: 'elixir-lang/elixir',
|
|
depType: 'uses-with',
|
|
packageName: 'elixir-lang/elixir',
|
|
versioning: 'npm',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
// none of the inputs are set, so no deps should be extracted at all
|
|
// (rather than emitting skipped deps for inputs no one set)
|
|
step: {
|
|
uses: 'erlef/setup-beam@v1',
|
|
with: {},
|
|
},
|
|
expected: [],
|
|
},
|
|
{
|
|
// `'nightly'` is a valid, documented value for rebar3-version, but not
|
|
// one we can pin/bump — the value is passed through as-is, and the
|
|
// versioning layer skips proposing an update since it isn't a real
|
|
// version
|
|
step: {
|
|
uses: 'erlef/setup-beam@v1',
|
|
with: { 'rebar3-version': 'nightly' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: 'nightly',
|
|
datasource: 'github-releases',
|
|
depName: 'erlang/rebar3',
|
|
depType: 'uses-with',
|
|
packageName: 'erlang/rebar3',
|
|
versioning: 'npm',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
// `false` is a valid, documented value for otp-version (skip
|
|
// installing OTP for Gleam-only workflows), but not one we can
|
|
// pin/bump — same pass-through treatment as rebar3-version's
|
|
// `nightly` above
|
|
step: {
|
|
uses: 'erlef/setup-beam@v1',
|
|
with: { 'otp-version': 'false', 'gleam-version': '1.5.0' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: 'false',
|
|
datasource: 'github-releases',
|
|
depName: 'erlang/otp',
|
|
depType: 'uses-with',
|
|
packageName: 'erlang/otp',
|
|
},
|
|
{
|
|
currentValue: '1.5.0',
|
|
datasource: 'github-releases',
|
|
depName: 'gleam-lang/gleam',
|
|
depType: 'uses-with',
|
|
packageName: 'gleam-lang/gleam',
|
|
versioning: 'npm',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'helm/kind-action@v1',
|
|
with: {
|
|
version: 'v0.33.0',
|
|
node_image: 'kindest/node:v1.31.0',
|
|
kubectl_version: 'v1.31.0',
|
|
},
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: 'v0.33.0',
|
|
datasource: 'github-releases',
|
|
depName: 'kubernetes-sigs/kind',
|
|
depType: 'uses-with',
|
|
packageName: 'kubernetes-sigs/kind',
|
|
},
|
|
{
|
|
currentValue: 'v1.31.0',
|
|
datasource: 'docker',
|
|
depName: 'kindest/node',
|
|
depType: 'uses-with',
|
|
packageName: 'kindest/node',
|
|
},
|
|
{
|
|
currentValue: 'v1.31.0',
|
|
datasource: 'github-releases',
|
|
depName: 'kubernetes/kubernetes',
|
|
depType: 'uses-with',
|
|
packageName: 'kubernetes/kubernetes',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
// most workflows only pin one of the 3 possible inputs
|
|
step: {
|
|
uses: 'helm/kind-action@v1',
|
|
with: { version: 'v0.33.0' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: 'v0.33.0',
|
|
datasource: 'github-releases',
|
|
depName: 'kubernetes-sigs/kind',
|
|
depType: 'uses-with',
|
|
packageName: 'kubernetes-sigs/kind',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
// none of the inputs are set, so no deps should be extracted at all
|
|
// (rather than emitting skipped deps for inputs no one set)
|
|
step: {
|
|
uses: 'helm/kind-action@v1',
|
|
with: {},
|
|
},
|
|
expected: [],
|
|
},
|
|
{
|
|
// `node_image` may be pinned by digest instead of (or alongside) a tag
|
|
step: {
|
|
uses: 'helm/kind-action@v1',
|
|
with: {
|
|
node_image:
|
|
'kindest/node:v1.31.0@sha256:0f7ba2b70c5d1a7e2d95b0f6c3d5b4a1e2f6b6a1e2f6b6a1e2f6b6a1e2f6b6a1',
|
|
},
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: 'v1.31.0',
|
|
currentDigest:
|
|
'sha256:0f7ba2b70c5d1a7e2d95b0f6c3d5b4a1e2f6b6a1e2f6b6a1e2f6b6a1e2f6b6a1',
|
|
datasource: 'docker',
|
|
depName: 'kindest/node',
|
|
depType: 'uses-with',
|
|
packageName: 'kindest/node',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'github/gh-aw-actions/setup-cli@v1',
|
|
with: { version: 'v0.37.18' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: 'v0.37.18',
|
|
datasource: 'github-releases',
|
|
depName: 'github/gh-aw',
|
|
depType: 'uses-with',
|
|
packageName: 'github/gh-aw',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'github/gh-aw-actions/setup-cli@v1',
|
|
with: { version: 'v1' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: 'v1',
|
|
datasource: 'github-releases',
|
|
depName: 'github/gh-aw',
|
|
depType: 'uses-with',
|
|
packageName: 'github/gh-aw',
|
|
versioning: 'semver-partial',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
// `latest` is already a rolling channel, not a version to update.
|
|
step: {
|
|
uses: 'github/gh-aw-actions/setup-cli@v1',
|
|
with: { version: 'latest' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: 'latest',
|
|
datasource: 'github-releases',
|
|
depName: 'github/gh-aw',
|
|
depType: 'uses-with',
|
|
packageName: 'github/gh-aw',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'github/gh-aw-actions/setup-cli@v1',
|
|
with: {},
|
|
},
|
|
expected: [
|
|
{
|
|
skipStage: 'extract',
|
|
skipReason: 'unspecified-version',
|
|
datasource: 'github-releases',
|
|
depName: 'github/gh-aw',
|
|
depType: 'uses-with',
|
|
packageName: 'github/gh-aw',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'GitTools/actions/gitversion/setup@v3',
|
|
with: { versionSpec: '6.8.2' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '6.8.2',
|
|
datasource: 'github-releases',
|
|
depName: 'gitversion',
|
|
depType: 'uses-with',
|
|
packageName: 'GitTools/GitVersion',
|
|
versioning: 'npm',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
// the documented `versionSpec` form is a range, not a pinned version
|
|
step: {
|
|
uses: 'GitTools/actions/gitversion/setup@v3',
|
|
with: { versionSpec: '6.8.x' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '6.8.x',
|
|
datasource: 'github-releases',
|
|
depName: 'gitversion',
|
|
depType: 'uses-with',
|
|
packageName: 'GitTools/GitVersion',
|
|
versioning: 'npm',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'GitTools/actions/gitversion/setup@v3',
|
|
with: {},
|
|
},
|
|
expected: [
|
|
{
|
|
skipStage: 'extract',
|
|
skipReason: 'unspecified-version',
|
|
datasource: 'github-releases',
|
|
depName: 'gitversion',
|
|
depType: 'uses-with',
|
|
packageName: 'GitTools/GitVersion',
|
|
versioning: 'npm',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'subosito/flutter-action@v2',
|
|
with: { 'flutter-version': '3.24.3' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '3.24.3',
|
|
datasource: 'github-releases',
|
|
depName: 'flutter',
|
|
depType: 'uses-with',
|
|
packageName: 'flutter/flutter',
|
|
versioning: 'npm',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
// an x-range is a range, not a pinned version
|
|
step: {
|
|
uses: 'subosito/flutter-action@v2',
|
|
with: { 'flutter-version': '3.24.x' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '3.24.x',
|
|
datasource: 'github-releases',
|
|
depName: 'flutter',
|
|
depType: 'uses-with',
|
|
packageName: 'flutter/flutter',
|
|
versioning: 'npm',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'subosito/flutter-action@v2',
|
|
with: {},
|
|
},
|
|
expected: [
|
|
{
|
|
skipStage: 'extract',
|
|
skipReason: 'unspecified-version',
|
|
datasource: 'github-releases',
|
|
depName: 'flutter',
|
|
depType: 'uses-with',
|
|
packageName: 'flutter/flutter',
|
|
versioning: 'npm',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'aquaproj/aqua-installer@v3',
|
|
with: { aqua_version: 'v2.62.3' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: 'v2.62.3',
|
|
datasource: 'github-releases',
|
|
depName: 'aqua',
|
|
depType: 'uses-with',
|
|
packageName: 'aquaproj/aqua',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'aquaproj/aqua-installer@v3',
|
|
with: {},
|
|
},
|
|
expected: [
|
|
{
|
|
skipStage: 'extract',
|
|
skipReason: 'unspecified-version',
|
|
datasource: 'github-releases',
|
|
depName: 'aqua',
|
|
depType: 'uses-with',
|
|
packageName: 'aquaproj/aqua',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'cycjimmy/semantic-release-action@v4',
|
|
with: { semantic_version: '^24.0.0' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '^24.0.0',
|
|
datasource: 'npm',
|
|
depName: 'semantic-release',
|
|
depType: 'uses-with',
|
|
packageName: 'semantic-release',
|
|
versioning: 'npm',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'cycjimmy/semantic-release-action@v4',
|
|
with: {},
|
|
},
|
|
expected: [
|
|
{
|
|
skipStage: 'extract',
|
|
skipReason: 'unspecified-version',
|
|
datasource: 'npm',
|
|
depName: 'semantic-release',
|
|
depType: 'uses-with',
|
|
packageName: 'semantic-release',
|
|
versioning: 'npm',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'cloudflare/wrangler-action@v3',
|
|
with: { wranglerVersion: '3.78.0' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '3.78.0',
|
|
datasource: 'npm',
|
|
depName: 'wrangler',
|
|
depType: 'uses-with',
|
|
packageName: 'wrangler',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'cloudflare/wrangler-action@v3',
|
|
with: {},
|
|
},
|
|
expected: [
|
|
{
|
|
skipStage: 'extract',
|
|
skipReason: 'unspecified-version',
|
|
datasource: 'npm',
|
|
depName: 'wrangler',
|
|
depType: 'uses-with',
|
|
packageName: 'wrangler',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'peaceiris/actions-hugo@v3',
|
|
with: { 'hugo-version': '0.166.0' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '0.166.0',
|
|
datasource: 'github-releases',
|
|
depName: 'hugo',
|
|
depType: 'uses-with',
|
|
packageName: 'gohugoio/hugo',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'peaceiris/actions-hugo@v3',
|
|
with: {},
|
|
},
|
|
expected: [
|
|
{
|
|
skipStage: 'extract',
|
|
skipReason: 'unspecified-version',
|
|
datasource: 'github-releases',
|
|
depName: 'hugo',
|
|
depType: 'uses-with',
|
|
packageName: 'gohugoio/hugo',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'jfrog/setup-jfrog-cli@v4',
|
|
with: { version: '2.91.0' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '2.91.0',
|
|
datasource: 'github-releases',
|
|
depName: 'jfrog-cli',
|
|
depType: 'uses-with',
|
|
packageName: 'jfrog/jfrog-cli',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'jfrog/setup-jfrog-cli@v4',
|
|
with: {},
|
|
},
|
|
expected: [
|
|
{
|
|
skipStage: 'extract',
|
|
skipReason: 'unspecified-version',
|
|
datasource: 'github-releases',
|
|
depName: 'jfrog-cli',
|
|
depType: 'uses-with',
|
|
packageName: 'jfrog/jfrog-cli',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'helm/chart-releaser-action@v1',
|
|
with: { version: 'v1.7.0' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: 'v1.7.0',
|
|
datasource: 'github-releases',
|
|
depName: 'chart-releaser',
|
|
depType: 'uses-with',
|
|
packageName: 'helm/chart-releaser',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'helm/chart-releaser-action@v1',
|
|
with: {},
|
|
},
|
|
expected: [
|
|
{
|
|
skipStage: 'extract',
|
|
skipReason: 'unspecified-version',
|
|
datasource: 'github-releases',
|
|
depName: 'chart-releaser',
|
|
depType: 'uses-with',
|
|
packageName: 'helm/chart-releaser',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'azure/setup-kubectl@v4',
|
|
with: { version: 'v1.31.0' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: 'v1.31.0',
|
|
datasource: 'github-releases',
|
|
depName: 'kubectl',
|
|
depType: 'uses-with',
|
|
packageName: 'kubernetes/kubernetes',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'azure/setup-kubectl@v4',
|
|
with: {},
|
|
},
|
|
expected: [
|
|
{
|
|
skipStage: 'extract',
|
|
skipReason: 'unspecified-version',
|
|
datasource: 'github-releases',
|
|
depName: 'kubectl',
|
|
depType: 'uses-with',
|
|
packageName: 'kubernetes/kubernetes',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
// `'latest'` is a valid, documented value (and the action's own
|
|
// default), but not one we can pin/bump — the value is passed
|
|
// through as-is, and the versioning layer skips proposing an update
|
|
// since it isn't a real version
|
|
step: {
|
|
uses: 'azure/setup-kubectl@v4',
|
|
with: { version: 'latest' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: 'latest',
|
|
datasource: 'github-releases',
|
|
depName: 'kubectl',
|
|
depType: 'uses-with',
|
|
packageName: 'kubernetes/kubernetes',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'snok/install-poetry@v1',
|
|
with: { version: '1.8.3' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '1.8.3',
|
|
datasource: 'pypi',
|
|
depName: 'poetry',
|
|
depType: 'uses-with',
|
|
packageName: 'poetry',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'snok/install-poetry@v1',
|
|
with: {},
|
|
},
|
|
expected: [
|
|
{
|
|
skipStage: 'extract',
|
|
skipReason: 'unspecified-version',
|
|
datasource: 'pypi',
|
|
depName: 'poetry',
|
|
depType: 'uses-with',
|
|
packageName: 'poetry',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'terraform-linters/setup-tflint@v4',
|
|
with: { tflint_version: 'v0.64.0' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: 'v0.64.0',
|
|
datasource: 'github-releases',
|
|
depName: 'tflint',
|
|
depType: 'uses-with',
|
|
packageName: 'terraform-linters/tflint',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'terraform-linters/setup-tflint@v4',
|
|
with: {},
|
|
},
|
|
expected: [
|
|
{
|
|
skipStage: 'extract',
|
|
skipReason: 'unspecified-version',
|
|
datasource: 'github-releases',
|
|
depName: 'tflint',
|
|
depType: 'uses-with',
|
|
packageName: 'terraform-linters/tflint',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
// `'latest'` is a valid, documented value, but not one we can pin/bump
|
|
step: {
|
|
uses: 'terraform-linters/setup-tflint@v4',
|
|
with: { tflint_version: 'latest' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: 'latest',
|
|
skipStage: 'extract',
|
|
skipReason: 'unsupported-version',
|
|
datasource: 'github-releases',
|
|
depName: 'tflint',
|
|
depType: 'uses-with',
|
|
packageName: 'terraform-linters/tflint',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'UpCloudLtd/upcloud-cli-action@main',
|
|
with: { version: 'v3.35.0' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: 'v3.35.0',
|
|
datasource: 'github-releases',
|
|
depName: 'UpCloudLtd/upcloud-cli',
|
|
depType: 'uses-with',
|
|
packageName: 'UpCloudLtd/upcloud-cli',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'extractions/setup-just@v3',
|
|
with: { 'just-version': '1.58.0' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '1.58.0',
|
|
datasource: 'github-releases',
|
|
depName: 'just',
|
|
depType: 'uses-with',
|
|
packageName: 'casey/just',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'extractions/setup-just@v3',
|
|
with: {},
|
|
},
|
|
expected: [
|
|
{
|
|
skipStage: 'extract',
|
|
skipReason: 'unspecified-version',
|
|
datasource: 'github-releases',
|
|
depName: 'just',
|
|
depType: 'uses-with',
|
|
packageName: 'casey/just',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'gradle/actions/setup-gradle@v4',
|
|
with: { 'gradle-version': '8.10' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '8.10',
|
|
datasource: 'gradle-version',
|
|
depName: 'gradle',
|
|
depType: 'uses-with',
|
|
packageName: 'gradle/gradle',
|
|
versioning: 'gradle',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'gradle/actions/setup-gradle@v4',
|
|
with: {},
|
|
},
|
|
expected: [
|
|
{
|
|
skipStage: 'extract',
|
|
skipReason: 'unspecified-version',
|
|
datasource: 'gradle-version',
|
|
depName: 'gradle',
|
|
depType: 'uses-with',
|
|
packageName: 'gradle/gradle',
|
|
versioning: 'gradle',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'gradle/actions/setup-gradle@v4',
|
|
with: { 'gradle-version': 'wrapper' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: 'wrapper',
|
|
skipStage: 'extract',
|
|
skipReason: 'invalid-version',
|
|
datasource: 'gradle-version',
|
|
depName: 'gradle',
|
|
depType: 'uses-with',
|
|
packageName: 'gradle/gradle',
|
|
versioning: 'gradle',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'gradle/actions/setup-gradle@v4',
|
|
with: { 'gradle-version': 'release-candidate' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: 'release-candidate',
|
|
skipStage: 'extract',
|
|
skipReason: 'invalid-version',
|
|
datasource: 'gradle-version',
|
|
depName: 'gradle',
|
|
depType: 'uses-with',
|
|
packageName: 'gradle/gradle',
|
|
versioning: 'gradle',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'hashicorp/setup-terraform@v3',
|
|
with: { terraform_version: '1.13.0' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '1.13.0',
|
|
datasource: 'github-releases',
|
|
depName: 'terraform',
|
|
depType: 'uses-with',
|
|
packageName: 'hashicorp/terraform',
|
|
versioning: 'npm',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
// a constraint string is a range, not a pinned version
|
|
step: {
|
|
uses: 'hashicorp/setup-terraform@v3',
|
|
with: { terraform_version: '~1.13.0' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '~1.13.0',
|
|
datasource: 'github-releases',
|
|
depName: 'terraform',
|
|
depType: 'uses-with',
|
|
packageName: 'hashicorp/terraform',
|
|
versioning: 'npm',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'hashicorp/setup-terraform@v3',
|
|
with: {},
|
|
},
|
|
expected: [
|
|
{
|
|
skipStage: 'extract',
|
|
skipReason: 'unspecified-version',
|
|
datasource: 'github-releases',
|
|
depName: 'terraform',
|
|
depType: 'uses-with',
|
|
packageName: 'hashicorp/terraform',
|
|
versioning: 'npm',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'goreleaser/goreleaser-action@v6',
|
|
with: { version: 'v2.4.4' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: 'v2.4.4',
|
|
datasource: 'github-releases',
|
|
depName: 'goreleaser/goreleaser',
|
|
depType: 'uses-with',
|
|
packageName: 'goreleaser/goreleaser',
|
|
versioning: 'npm',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'goreleaser/goreleaser-action@v6',
|
|
with: {},
|
|
},
|
|
expected: [
|
|
{
|
|
skipStage: 'extract',
|
|
skipReason: 'unspecified-version',
|
|
datasource: 'github-releases',
|
|
depName: 'goreleaser/goreleaser',
|
|
depType: 'uses-with',
|
|
packageName: 'goreleaser/goreleaser',
|
|
versioning: 'npm',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'opentofu/setup-opentofu@v1',
|
|
with: { tofu_version: '1.8.0' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '1.8.0',
|
|
datasource: 'github-releases',
|
|
depName: 'opentofu',
|
|
depType: 'uses-with',
|
|
packageName: 'opentofu/opentofu',
|
|
versioning: 'npm',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
// a constraint string is a range, not a pinned version
|
|
step: {
|
|
uses: 'opentofu/setup-opentofu@v1',
|
|
with: { tofu_version: '<1.9.0' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '<1.9.0',
|
|
datasource: 'github-releases',
|
|
depName: 'opentofu',
|
|
depType: 'uses-with',
|
|
packageName: 'opentofu/opentofu',
|
|
versioning: 'npm',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'opentofu/setup-opentofu@v1',
|
|
with: {},
|
|
},
|
|
expected: [
|
|
{
|
|
skipStage: 'extract',
|
|
skipReason: 'unspecified-version',
|
|
datasource: 'github-releases',
|
|
depName: 'opentofu',
|
|
depType: 'uses-with',
|
|
packageName: 'opentofu/opentofu',
|
|
versioning: 'npm',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'abatilo/actions-poetry@v3',
|
|
with: { 'poetry-version': '1.8.3' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '1.8.3',
|
|
datasource: 'pypi',
|
|
depName: 'poetry',
|
|
depType: 'uses-with',
|
|
packageName: 'poetry',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'abatilo/actions-poetry@v3',
|
|
with: {},
|
|
},
|
|
expected: [
|
|
{
|
|
skipStage: 'extract',
|
|
skipReason: 'unspecified-version',
|
|
datasource: 'pypi',
|
|
depName: 'poetry',
|
|
depType: 'uses-with',
|
|
packageName: 'poetry',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'biomejs/setup-biome@v2',
|
|
with: { version: '1.9.4' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '1.9.4',
|
|
datasource: 'npm',
|
|
depName: '@biomejs/biome',
|
|
depType: 'uses-with',
|
|
packageName: '@biomejs/biome',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'biomejs/setup-biome@v2',
|
|
with: {},
|
|
},
|
|
expected: [
|
|
{
|
|
skipStage: 'extract',
|
|
skipReason: 'unspecified-version',
|
|
datasource: 'npm',
|
|
depName: '@biomejs/biome',
|
|
depType: 'uses-with',
|
|
packageName: '@biomejs/biome',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'astral-sh/ruff-action@v3',
|
|
with: { version: '0.16.7' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '0.16.7',
|
|
datasource: 'github-releases',
|
|
depName: 'ruff',
|
|
depType: 'uses-with',
|
|
packageName: 'astral-sh/ruff',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'astral-sh/ruff-action@v3',
|
|
with: {},
|
|
},
|
|
expected: [
|
|
{
|
|
skipStage: 'extract',
|
|
skipReason: 'unspecified-version',
|
|
datasource: 'github-releases',
|
|
depName: 'ruff',
|
|
depType: 'uses-with',
|
|
packageName: 'astral-sh/ruff',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'reviewdog/action-setup@v1',
|
|
with: { reviewdog_version: 'v0.21.1' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: 'v0.21.1',
|
|
datasource: 'github-releases',
|
|
depName: 'reviewdog',
|
|
depType: 'uses-with',
|
|
packageName: 'reviewdog/reviewdog',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'reviewdog/action-setup@v1',
|
|
with: {},
|
|
},
|
|
expected: [
|
|
{
|
|
skipStage: 'extract',
|
|
skipReason: 'unspecified-version',
|
|
datasource: 'github-releases',
|
|
depName: 'reviewdog',
|
|
depType: 'uses-with',
|
|
packageName: 'reviewdog/reviewdog',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'j178/prek-action@v1',
|
|
with: { 'prek-version': '0.3.x' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '0.3.x',
|
|
datasource: 'github-releases',
|
|
depName: 'prek',
|
|
depType: 'uses-with',
|
|
packageName: 'j178/prek',
|
|
versioning: 'npm',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'j178/prek-action@v1',
|
|
with: {},
|
|
},
|
|
expected: [
|
|
{
|
|
skipStage: 'extract',
|
|
skipReason: 'unspecified-version',
|
|
datasource: 'github-releases',
|
|
depName: 'prek',
|
|
depType: 'uses-with',
|
|
packageName: 'j178/prek',
|
|
versioning: 'npm',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'actions-rust-lang/setup-rust-toolchain@v1',
|
|
with: { toolchain: 'stable, nightly' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: 'nightly',
|
|
datasource: 'rust-version',
|
|
depName: 'rust',
|
|
depType: 'uses-with',
|
|
packageName: 'rust',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'actions-rust-lang/setup-rust-toolchain@v1',
|
|
with: {},
|
|
},
|
|
expected: [
|
|
{
|
|
skipStage: 'extract',
|
|
skipReason: 'unspecified-version',
|
|
datasource: 'rust-version',
|
|
depName: 'rust',
|
|
depType: 'uses-with',
|
|
packageName: 'rust',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'raven-actions/actionlint@v2',
|
|
with: { version: 'v1.7.12' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: 'v1.7.12',
|
|
datasource: 'github-releases',
|
|
depName: 'actionlint',
|
|
depType: 'uses-with',
|
|
packageName: 'rhysd/actionlint',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'raven-actions/actionlint@v2',
|
|
with: {},
|
|
},
|
|
expected: [
|
|
{
|
|
skipStage: 'extract',
|
|
skipReason: 'unspecified-version',
|
|
datasource: 'github-releases',
|
|
depName: 'actionlint',
|
|
depType: 'uses-with',
|
|
packageName: 'rhysd/actionlint',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'bufbuild/buf-setup-action@v1',
|
|
with: { version: '1.50.0' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '1.50.0',
|
|
datasource: 'github-releases',
|
|
depName: 'buf',
|
|
depType: 'uses-with',
|
|
packageName: 'bufbuild/buf',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'bufbuild/buf-setup-action@v1',
|
|
with: {},
|
|
},
|
|
expected: [
|
|
{
|
|
skipStage: 'extract',
|
|
skipReason: 'unspecified-version',
|
|
datasource: 'github-releases',
|
|
depName: 'buf',
|
|
depType: 'uses-with',
|
|
packageName: 'bufbuild/buf',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'stCarolas/setup-maven@v4.5',
|
|
with: { 'maven-version': '3.9.9' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '3.9.9',
|
|
datasource: 'github-releases',
|
|
depName: 'maven',
|
|
depType: 'uses-with',
|
|
packageName: 'apache/maven',
|
|
versioning: 'npm',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'stCarolas/setup-maven@v4.5',
|
|
with: {},
|
|
},
|
|
expected: [
|
|
{
|
|
skipStage: 'extract',
|
|
skipReason: 'unspecified-version',
|
|
datasource: 'github-releases',
|
|
depName: 'maven',
|
|
depType: 'uses-with',
|
|
packageName: 'apache/maven',
|
|
versioning: 'npm',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'pulumi/actions@v6',
|
|
with: { 'pulumi-version': '3.262.0' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '3.262.0',
|
|
datasource: 'github-releases',
|
|
depName: 'pulumi',
|
|
depType: 'uses-with',
|
|
packageName: 'pulumi/pulumi',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'pulumi/actions@v6',
|
|
with: {},
|
|
},
|
|
expected: [
|
|
{
|
|
skipStage: 'extract',
|
|
skipReason: 'unspecified-version',
|
|
datasource: 'github-releases',
|
|
depName: 'pulumi',
|
|
depType: 'uses-with',
|
|
packageName: 'pulumi/pulumi',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'supabase/setup-cli@v1',
|
|
with: { version: '1.200.3' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '1.200.3',
|
|
datasource: 'npm',
|
|
depName: 'supabase',
|
|
depType: 'uses-with',
|
|
packageName: 'supabase',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'supabase/setup-cli@v1',
|
|
with: {},
|
|
},
|
|
expected: [
|
|
{
|
|
skipStage: 'extract',
|
|
skipReason: 'unspecified-version',
|
|
datasource: 'npm',
|
|
depName: 'supabase',
|
|
depType: 'uses-with',
|
|
packageName: 'supabase',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
// `'latest'`/`'beta'` are valid, documented values, but not ones we
|
|
// can pin/bump — the value is passed through as-is, and the
|
|
// versioning layer skips proposing an update since it isn't a real
|
|
// version
|
|
step: {
|
|
uses: 'supabase/setup-cli@v1',
|
|
with: { version: 'beta' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: 'beta',
|
|
datasource: 'npm',
|
|
depName: 'supabase',
|
|
depType: 'uses-with',
|
|
packageName: 'supabase',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'mozilla-actions/sccache-action@v0.0.9',
|
|
with: { version: 'v0.18.0' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: 'v0.18.0',
|
|
datasource: 'github-releases',
|
|
depName: 'sccache',
|
|
depType: 'uses-with',
|
|
packageName: 'mozilla/sccache',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'mozilla-actions/sccache-action@v0.0.9',
|
|
with: {},
|
|
},
|
|
expected: [
|
|
{
|
|
skipStage: 'extract',
|
|
skipReason: 'unspecified-version',
|
|
datasource: 'github-releases',
|
|
depName: 'sccache',
|
|
depType: 'uses-with',
|
|
packageName: 'mozilla/sccache',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'hashicorp/setup-packer@v3',
|
|
with: { version: 'v1.16.0' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: 'v1.16.0',
|
|
datasource: 'github-releases',
|
|
depName: 'packer',
|
|
depType: 'uses-with',
|
|
packageName: 'hashicorp/packer',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'hashicorp/setup-packer@v3',
|
|
with: {},
|
|
},
|
|
expected: [
|
|
{
|
|
skipStage: 'extract',
|
|
skipReason: 'unspecified-version',
|
|
datasource: 'github-releases',
|
|
depName: 'packer',
|
|
depType: 'uses-with',
|
|
packageName: 'hashicorp/packer',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'dagger/dagger-for-github@v8',
|
|
with: { version: 'v0.21.9' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: 'v0.21.9',
|
|
datasource: 'github-releases',
|
|
depName: 'dagger',
|
|
depType: 'uses-with',
|
|
packageName: 'dagger/dagger',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'dagger/dagger-for-github@v8',
|
|
with: {},
|
|
},
|
|
expected: [
|
|
{
|
|
skipStage: 'extract',
|
|
skipReason: 'unspecified-version',
|
|
datasource: 'github-releases',
|
|
depName: 'dagger',
|
|
depType: 'uses-with',
|
|
packageName: 'dagger/dagger',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'foundry-rs/foundry-toolchain@v1',
|
|
with: { version: 'v1.8.1' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: 'v1.8.1',
|
|
datasource: 'github-releases',
|
|
depName: 'foundry',
|
|
depType: 'uses-with',
|
|
packageName: 'foundry-rs/foundry',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'foundry-rs/foundry-toolchain@v1',
|
|
with: {},
|
|
},
|
|
expected: [
|
|
{
|
|
skipStage: 'extract',
|
|
skipReason: 'unspecified-version',
|
|
datasource: 'github-releases',
|
|
depName: 'foundry',
|
|
depType: 'uses-with',
|
|
packageName: 'foundry-rs/foundry',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'dart-lang/setup-dart@v1',
|
|
with: { sdk: '3.5.3' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '3.5.3',
|
|
datasource: 'dart-version',
|
|
depName: 'dart',
|
|
depType: 'uses-with',
|
|
packageName: 'dart-lang/sdk',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
// an SDK release version installs the latest patch release of that
|
|
// version, so it must keep its precision
|
|
step: {
|
|
uses: 'dart-lang/setup-dart@v1',
|
|
with: { sdk: '3.5' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '3.5',
|
|
datasource: 'dart-version',
|
|
depName: 'dart',
|
|
depType: 'uses-with',
|
|
packageName: 'dart-lang/sdk',
|
|
versioning: 'semver-partial',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'dart-lang/setup-dart@v1',
|
|
with: {},
|
|
},
|
|
expected: [
|
|
{
|
|
skipStage: 'extract',
|
|
skipReason: 'unspecified-version',
|
|
datasource: 'dart-version',
|
|
depName: 'dart',
|
|
depType: 'uses-with',
|
|
packageName: 'dart-lang/sdk',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
// `'stable'` is a valid, documented channel name (and the action's
|
|
// own default), but not one we can pin/bump — the value is passed
|
|
// through as-is, and the versioning layer skips proposing an update
|
|
// since it isn't a real version
|
|
step: {
|
|
uses: 'dart-lang/setup-dart@v1',
|
|
with: { sdk: 'stable' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: 'stable',
|
|
datasource: 'dart-version',
|
|
depName: 'dart',
|
|
depType: 'uses-with',
|
|
packageName: 'dart-lang/sdk',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
// the action resolves `version` with node's semver package, so a
|
|
// partial version is a range rather than a pinned version
|
|
step: {
|
|
uses: 'julia-actions/setup-julia@v2',
|
|
with: { version: '1.10' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '1.10',
|
|
datasource: 'github-releases',
|
|
depName: 'julia',
|
|
depType: 'uses-with',
|
|
packageName: 'JuliaLang/julia',
|
|
versioning: 'npm',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'julia-actions/setup-julia@v2',
|
|
with: {},
|
|
},
|
|
expected: [
|
|
{
|
|
skipStage: 'extract',
|
|
skipReason: 'unspecified-version',
|
|
datasource: 'github-releases',
|
|
depName: 'julia',
|
|
depType: 'uses-with',
|
|
packageName: 'JuliaLang/julia',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
// `'lts'`/`'pre'` are valid, documented values, but not ones we can
|
|
// pin/bump — the value is passed through as-is, and the versioning
|
|
// layer skips proposing an update since it isn't a real version
|
|
step: {
|
|
uses: 'julia-actions/setup-julia@v2',
|
|
with: { version: 'lts' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: 'lts',
|
|
datasource: 'github-releases',
|
|
depName: 'julia',
|
|
depType: 'uses-with',
|
|
packageName: 'JuliaLang/julia',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'cargo-bins/cargo-binstall@v1',
|
|
with: { version: 'v1.23.0' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: 'v1.23.0',
|
|
datasource: 'github-releases',
|
|
depName: 'cargo-bins/cargo-binstall',
|
|
depType: 'uses-with',
|
|
packageName: 'cargo-bins/cargo-binstall',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'cargo-bins/cargo-binstall@v1',
|
|
with: {},
|
|
},
|
|
expected: [
|
|
{
|
|
skipStage: 'extract',
|
|
skipReason: 'unspecified-version',
|
|
datasource: 'github-releases',
|
|
depName: 'cargo-bins/cargo-binstall',
|
|
depType: 'uses-with',
|
|
packageName: 'cargo-bins/cargo-binstall',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'PyO3/maturin-action@v1',
|
|
with: { 'maturin-version': 'v1.7.4' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: 'v1.7.4',
|
|
datasource: 'pypi',
|
|
depName: 'maturin',
|
|
depType: 'uses-with',
|
|
packageName: 'maturin',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'PyO3/maturin-action@v1',
|
|
with: {},
|
|
},
|
|
expected: [
|
|
{
|
|
skipStage: 'extract',
|
|
skipReason: 'unspecified-version',
|
|
datasource: 'pypi',
|
|
depName: 'maturin',
|
|
depType: 'uses-with',
|
|
packageName: 'maturin',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'cue-lang/setup-cue@v1',
|
|
with: { version: 'v0.11.0' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: 'v0.11.0',
|
|
datasource: 'github-releases',
|
|
depName: 'cue',
|
|
depType: 'uses-with',
|
|
packageName: 'cue-lang/cue',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'cue-lang/setup-cue@v1',
|
|
with: {},
|
|
},
|
|
expected: [
|
|
{
|
|
skipStage: 'extract',
|
|
skipReason: 'unspecified-version',
|
|
datasource: 'github-releases',
|
|
depName: 'cue',
|
|
depType: 'uses-with',
|
|
packageName: 'cue-lang/cue',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'superfly/flyctl-actions/setup-flyctl@master',
|
|
with: { version: '0.4.102' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '0.4.102',
|
|
datasource: 'github-releases',
|
|
depName: 'flyctl',
|
|
depType: 'uses-with',
|
|
packageName: 'superfly/flyctl',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'superfly/flyctl-actions/setup-flyctl@master',
|
|
with: {},
|
|
},
|
|
expected: [
|
|
{
|
|
skipStage: 'extract',
|
|
skipReason: 'unspecified-version',
|
|
datasource: 'github-releases',
|
|
depName: 'flyctl',
|
|
depType: 'uses-with',
|
|
packageName: 'superfly/flyctl',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'graalvm/setup-graalvm@v1',
|
|
with: { 'java-version': '21', version: '21.0.1' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '21',
|
|
datasource: 'java-version',
|
|
depName: 'java-jdk',
|
|
depType: 'uses-with',
|
|
packageName: 'java-jdk',
|
|
versioning: 'semver-partial',
|
|
},
|
|
{
|
|
currentValue: '21.0.1',
|
|
datasource: 'github-releases',
|
|
depName: 'graalvm/graalvm-ce-builds',
|
|
depType: 'uses-with',
|
|
extractVersion: '^(?:jdk|graal)-(?<version>.+)$',
|
|
packageName: 'graalvm/graalvm-ce-builds',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
// the repo alternates between `jdk-` and `graal-` tag prefixes for
|
|
// current-era releases, so both must be matched
|
|
step: {
|
|
uses: 'graalvm/setup-graalvm@v1',
|
|
with: { version: '25.3.4.1' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '25.3.4.1',
|
|
datasource: 'github-releases',
|
|
depName: 'graalvm/graalvm-ce-builds',
|
|
depType: 'uses-with',
|
|
extractVersion: '^(?:jdk|graal)-(?<version>.+)$',
|
|
packageName: 'graalvm/graalvm-ce-builds',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
// most workflows only pin one of the 2 possible inputs
|
|
step: {
|
|
uses: 'graalvm/setup-graalvm@v1',
|
|
with: { 'java-version': '21' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '21',
|
|
datasource: 'java-version',
|
|
depName: 'java-jdk',
|
|
depType: 'uses-with',
|
|
packageName: 'java-jdk',
|
|
versioning: 'semver-partial',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
// neither input is set, so no deps should be extracted at all (rather
|
|
// than emitting skipped deps for inputs no one set)
|
|
step: {
|
|
uses: 'graalvm/setup-graalvm@v1',
|
|
with: {},
|
|
},
|
|
expected: [],
|
|
},
|
|
{
|
|
// `java-version` is a range here too, so it must keep its precision
|
|
step: {
|
|
uses: 'graalvm/setup-graalvm@v1',
|
|
with: { 'java-version': '21.0.2' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '21.0.2',
|
|
datasource: 'java-version',
|
|
depName: 'java-jdk',
|
|
depType: 'uses-with',
|
|
packageName: 'java-jdk',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
// `dev` and `latest-ea` are documented `java-version`s that we have no
|
|
// version to bump them to
|
|
step: {
|
|
uses: 'graalvm/setup-graalvm@v1',
|
|
with: { 'java-version': 'latest-ea' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: 'latest-ea',
|
|
datasource: 'java-version',
|
|
depName: 'java-jdk',
|
|
depType: 'uses-with',
|
|
packageName: 'java-jdk',
|
|
skipStage: 'extract',
|
|
skipReason: 'unsupported-version',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'moonrepo/setup-toolchain@v1',
|
|
with: { 'moon-version': '1.35.0', 'proto-version': '0.51.4' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '1.35.0',
|
|
datasource: 'github-releases',
|
|
depName: 'moonrepo/moon',
|
|
depType: 'uses-with',
|
|
packageName: 'moonrepo/moon',
|
|
},
|
|
{
|
|
currentValue: '0.51.4',
|
|
datasource: 'github-releases',
|
|
depName: 'moonrepo/proto',
|
|
depType: 'uses-with',
|
|
packageName: 'moonrepo/proto',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
// most workflows only pin one of the 2 possible inputs
|
|
step: {
|
|
uses: 'moonrepo/setup-toolchain@v1',
|
|
with: { 'moon-version': '1.35.0' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '1.35.0',
|
|
datasource: 'github-releases',
|
|
depName: 'moonrepo/moon',
|
|
depType: 'uses-with',
|
|
packageName: 'moonrepo/moon',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
// neither input is set, so no deps should be extracted at all (rather
|
|
// than emitting skipped deps for inputs no one set)
|
|
step: {
|
|
uses: 'moonrepo/setup-toolchain@v1',
|
|
with: {},
|
|
},
|
|
expected: [],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'moonrepo/setup-rust@v1',
|
|
with: { channel: 'stable' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: 'stable',
|
|
datasource: 'rust-version',
|
|
depName: 'rust',
|
|
depType: 'uses-with',
|
|
packageName: 'rust',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'moonrepo/setup-rust@v1',
|
|
with: {},
|
|
},
|
|
expected: [
|
|
{
|
|
skipStage: 'extract',
|
|
skipReason: 'unspecified-version',
|
|
datasource: 'rust-version',
|
|
depName: 'rust',
|
|
depType: 'uses-with',
|
|
packageName: 'rust',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'crystal-lang/install-crystal@v1',
|
|
with: { crystal: '1.21.0', shards: 'v0.20.0' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '1.21.0',
|
|
datasource: 'github-releases',
|
|
depName: 'crystal-lang/crystal',
|
|
depType: 'uses-with',
|
|
packageName: 'crystal-lang/crystal',
|
|
},
|
|
{
|
|
currentValue: 'v0.20.0',
|
|
datasource: 'github-releases',
|
|
depName: 'crystal-lang/shards',
|
|
depType: 'uses-with',
|
|
packageName: 'crystal-lang/shards',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
// most workflows only pin one of the 2 possible inputs
|
|
step: {
|
|
uses: 'crystal-lang/install-crystal@v1',
|
|
with: { crystal: '1.21.0' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '1.21.0',
|
|
datasource: 'github-releases',
|
|
depName: 'crystal-lang/crystal',
|
|
depType: 'uses-with',
|
|
packageName: 'crystal-lang/crystal',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
// a partial version installs the latest patch of that release series,
|
|
// so it must keep its precision
|
|
step: {
|
|
uses: 'crystal-lang/install-crystal@v1',
|
|
with: { crystal: '1.21', shards: '0.20' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '1.21',
|
|
datasource: 'github-releases',
|
|
depName: 'crystal-lang/crystal',
|
|
depType: 'uses-with',
|
|
packageName: 'crystal-lang/crystal',
|
|
versioning: 'semver-partial',
|
|
},
|
|
{
|
|
currentValue: '0.20',
|
|
datasource: 'github-releases',
|
|
depName: 'crystal-lang/shards',
|
|
depType: 'uses-with',
|
|
packageName: 'crystal-lang/shards',
|
|
versioning: 'semver-partial',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
// neither input is set, so no deps should be extracted at all (rather
|
|
// than emitting skipped deps for inputs no one set)
|
|
step: {
|
|
uses: 'crystal-lang/install-crystal@v1',
|
|
with: {},
|
|
},
|
|
expected: [],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'baptiste0928/cargo-install@v3',
|
|
with: { crate: 'cargo-hack', version: '0.6.14' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '0.6.14',
|
|
datasource: 'crate',
|
|
depName: 'cargo-hack',
|
|
depType: 'uses-with',
|
|
packageName: 'cargo-hack',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'baptiste0928/cargo-install@v3',
|
|
with: { crate: 'cargo-hack', version: '' },
|
|
},
|
|
expected: [
|
|
{
|
|
skipStage: 'extract',
|
|
skipReason: 'unspecified-version',
|
|
datasource: 'crate',
|
|
depName: 'cargo-hack',
|
|
depType: 'uses-with',
|
|
packageName: 'cargo-hack',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
// `version` has a default (`'latest'`), so real workflows commonly
|
|
// omit it from `with:` entirely rather than passing an empty string
|
|
step: {
|
|
uses: 'baptiste0928/cargo-install@v3',
|
|
with: { crate: 'cargo-hack' },
|
|
},
|
|
expected: [
|
|
{
|
|
skipStage: 'extract',
|
|
skipReason: 'unspecified-version',
|
|
datasource: 'crate',
|
|
depName: 'cargo-hack',
|
|
depType: 'uses-with',
|
|
packageName: 'cargo-hack',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'jwlawson/actions-setup-cmake@v2',
|
|
with: { 'cmake-version': '4.3.5' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '4.3.5',
|
|
datasource: 'github-releases',
|
|
depName: 'cmake',
|
|
depType: 'uses-with',
|
|
packageName: 'Kitware/CMake',
|
|
versioning: 'npm',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
// a wildcard version is a range, not a pinned version
|
|
step: {
|
|
uses: 'jwlawson/actions-setup-cmake@v2',
|
|
with: { 'cmake-version': '4.3.x' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '4.3.x',
|
|
datasource: 'github-releases',
|
|
depName: 'cmake',
|
|
depType: 'uses-with',
|
|
packageName: 'Kitware/CMake',
|
|
versioning: 'npm',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'jwlawson/actions-setup-cmake@v2',
|
|
with: {},
|
|
},
|
|
expected: [
|
|
{
|
|
skipStage: 'extract',
|
|
skipReason: 'unspecified-version',
|
|
datasource: 'github-releases',
|
|
depName: 'cmake',
|
|
depType: 'uses-with',
|
|
packageName: 'Kitware/CMake',
|
|
versioning: 'npm',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'swift-actions/setup-swift@v2',
|
|
with: { 'swift-version': '6.3.3' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '6.3.3',
|
|
datasource: 'github-releases',
|
|
depName: 'swift',
|
|
depType: 'uses-with',
|
|
packageName: 'swiftlang/swift',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
// a partial `swift-version` resolves to the latest matching release,
|
|
// so it must keep its precision
|
|
step: {
|
|
uses: 'swift-actions/setup-swift@v2',
|
|
with: { 'swift-version': '6.3' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '6.3',
|
|
datasource: 'github-releases',
|
|
depName: 'swift',
|
|
depType: 'uses-with',
|
|
packageName: 'swiftlang/swift',
|
|
versioning: 'semver-partial',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'swift-actions/setup-swift@v2',
|
|
with: {},
|
|
},
|
|
expected: [
|
|
{
|
|
skipStage: 'extract',
|
|
skipReason: 'unspecified-version',
|
|
datasource: 'github-releases',
|
|
depName: 'swift',
|
|
depType: 'uses-with',
|
|
packageName: 'swiftlang/swift',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'WillAbides/setup-go-faster@v1',
|
|
with: { 'go-version': '1.23.4' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '1.23.4',
|
|
datasource: 'github-releases',
|
|
depName: 'go',
|
|
depType: 'uses-with',
|
|
packageName: 'actions/go-versions',
|
|
versioning: 'npm',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'WillAbides/setup-go-faster@v1',
|
|
with: {},
|
|
},
|
|
expected: [
|
|
{
|
|
skipStage: 'extract',
|
|
skipReason: 'unspecified-version',
|
|
datasource: 'github-releases',
|
|
depName: 'go',
|
|
depType: 'uses-with',
|
|
packageName: 'actions/go-versions',
|
|
versioning: 'npm',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'conda-incubator/setup-miniconda@v3',
|
|
with: { 'miniforge-version': '26.7.2-0', 'python-version': '3.12' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '26.7.2-0',
|
|
datasource: 'github-releases',
|
|
depName: 'miniforge',
|
|
depType: 'uses-with',
|
|
packageName: 'conda-forge/miniforge',
|
|
},
|
|
{
|
|
currentValue: '3.12',
|
|
datasource: 'github-releases',
|
|
depName: 'python',
|
|
depType: 'uses-with',
|
|
packageName: 'actions/python-versions',
|
|
versioning: 'npm',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
// most workflows only pin one of the 2 supported inputs (of the 6
|
|
// this action exposes overall)
|
|
step: {
|
|
uses: 'conda-incubator/setup-miniconda@v3',
|
|
with: { 'python-version': '3.12' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '3.12',
|
|
datasource: 'github-releases',
|
|
depName: 'python',
|
|
depType: 'uses-with',
|
|
packageName: 'actions/python-versions',
|
|
versioning: 'npm',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
// neither supported input is set, so no deps should be extracted at
|
|
// all (rather than emitting skipped deps for inputs no one set)
|
|
step: {
|
|
uses: 'conda-incubator/setup-miniconda@v3',
|
|
with: {},
|
|
},
|
|
expected: [],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'voidzero-dev/setup-vp@v1.17.0',
|
|
with: { version: '0.3.3' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '0.3.3',
|
|
datasource: 'npm',
|
|
depName: 'vite-plus',
|
|
depType: 'uses-with',
|
|
packageName: 'vite-plus',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'voidzero-dev/setup-vp@v1.17.0',
|
|
with: { 'node-version': '22.15.0' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '22.15.0',
|
|
datasource: 'node-version',
|
|
depName: 'node',
|
|
depType: 'uses-with',
|
|
packageName: 'node',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'voidzero-dev/setup-vp@v1.17.0',
|
|
with: { version: '0.3.3', 'node-version': '22.15.0' },
|
|
},
|
|
expected: [
|
|
{
|
|
currentValue: '0.3.3',
|
|
datasource: 'npm',
|
|
depName: 'vite-plus',
|
|
depType: 'uses-with',
|
|
packageName: 'vite-plus',
|
|
},
|
|
{
|
|
currentValue: '22.15.0',
|
|
datasource: 'node-version',
|
|
depName: 'node',
|
|
depType: 'uses-with',
|
|
packageName: 'node',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
step: {
|
|
uses: 'voidzero-dev/setup-vp@v1.17.0',
|
|
with: {},
|
|
},
|
|
expected: [],
|
|
},
|
|
])('extract from $step.uses', async ({ step, expected }) => {
|
|
const yamlContent = yaml.dump({ jobs: { build: { steps: [step] } } });
|
|
|
|
const res = await extractPackageFile(yamlContent, 'workflow.yml');
|
|
expect(res?.deps.filter((pkg) => pkg.depType !== 'action')).toMatchObject(
|
|
expected,
|
|
);
|
|
});
|
|
|
|
describe('actions.lock', () => {
|
|
beforeEach(() => {
|
|
// the lock file is read through the memory cache, which production initialises per repository
|
|
memCache.init();
|
|
});
|
|
|
|
const workflow = codeBlock`
|
|
jobs:
|
|
build:
|
|
steps:
|
|
- uses: actions/checkout@v4.3.1
|
|
- uses: docker://alpine:3.20
|
|
`;
|
|
|
|
const lockfile = codeBlock`
|
|
version: 'v0.0.2'
|
|
workflows:
|
|
'.github/workflows/ci.yml':
|
|
- 'actions/checkout@v4.3.1'
|
|
`;
|
|
|
|
it('marks digests as externally managed for an onboarded workflow', async () => {
|
|
fs.readLocalFile.mockResolvedValueOnce(lockfile);
|
|
|
|
const res = await extractPackageFile(
|
|
workflow,
|
|
'.github/workflows/ci.yml',
|
|
);
|
|
|
|
// `gh actions-lock` strips an inline pin back out, so the lookup must not offer one
|
|
expect(res?.deps).toMatchObject([
|
|
{ depName: 'actions/checkout', digestManagedExternally: true },
|
|
{ depName: 'alpine' },
|
|
]);
|
|
// the lockfile only records `OWNER/REPO@REF` pins, so a `docker://` image is still ours to pin
|
|
expect(res?.deps[1]).not.toHaveProperty('digestManagedExternally');
|
|
});
|
|
|
|
it('marks a reusable workflow call, which the lockfile records too', async () => {
|
|
fs.readLocalFile.mockResolvedValueOnce(lockfile);
|
|
|
|
const res = await extractPackageFile(
|
|
codeBlock`
|
|
jobs:
|
|
release:
|
|
uses: some-org/some-repo/.github/workflows/release.yml@v1
|
|
`,
|
|
'.github/workflows/ci.yml',
|
|
);
|
|
|
|
expect(res?.deps).toMatchObject([
|
|
{ depType: 'workflow', digestManagedExternally: true },
|
|
]);
|
|
});
|
|
|
|
it('leaves a workflow which is not onboarded alone', async () => {
|
|
fs.readLocalFile.mockResolvedValueOnce(lockfile);
|
|
|
|
// a repository can deliberately keep workflows out of the lockfile
|
|
const res = await extractPackageFile(
|
|
workflow,
|
|
'.github/workflows/not-onboarded.yml',
|
|
);
|
|
|
|
expect(res?.deps[0]).not.toHaveProperty('digestManagedExternally');
|
|
});
|
|
|
|
it.each`
|
|
packageFile
|
|
${'workflow-templates/ci.yml'}
|
|
${'.gitea/workflows/ci.yml'}
|
|
${'.forgejo/workflows/ci.yml'}
|
|
${'.gitea/actions/build/action.yml'}
|
|
`(
|
|
'leaves $packageFile alone, as the tool never reads it',
|
|
async ({ packageFile }: { packageFile: string }) => {
|
|
fs.readLocalFile.mockResolvedValueOnce(lockfile);
|
|
|
|
const res = await extractPackageFile(workflow, packageFile);
|
|
|
|
expect(res?.deps[0]).not.toHaveProperty('digestManagedExternally');
|
|
},
|
|
);
|
|
|
|
it('marks a local composite action, which the lockfile does not key', async () => {
|
|
fs.readLocalFile.mockResolvedValueOnce(lockfile);
|
|
|
|
// composite actions are transitive dependencies of onboarded workflows, so the tool rewrites them too
|
|
const res = await extractPackageFile(
|
|
workflow,
|
|
'.github/actions/build/action.yml',
|
|
);
|
|
|
|
expect(res?.deps[0].digestManagedExternally).toBe(true);
|
|
});
|
|
|
|
it('marks a local composite action when the lockfile has onboarded nothing', async () => {
|
|
fs.readLocalFile.mockResolvedValueOnce(
|
|
"version: 'v0.0.2'\nworkflows: {}",
|
|
);
|
|
|
|
// a composite action isn't keyed by `workflows:`, so it's still managed even when that key is missing entirely
|
|
const res = await extractPackageFile(
|
|
workflow,
|
|
'.github/actions/build/action.yml',
|
|
);
|
|
|
|
expect(res?.deps[0].digestManagedExternally).toBe(true);
|
|
});
|
|
|
|
it('leaves digests alone when there is no lockfile', async () => {
|
|
fs.readLocalFile.mockResolvedValueOnce(null);
|
|
|
|
const res = await extractPackageFile(
|
|
workflow,
|
|
'.github/workflows/ci.yml',
|
|
);
|
|
|
|
expect(res?.deps[0]).not.toHaveProperty('digestManagedExternally');
|
|
});
|
|
|
|
it('leaves the digests to the tool when the lockfile cannot be parsed', async () => {
|
|
fs.readLocalFile.mockResolvedValueOnce('workflows: [a, b]');
|
|
|
|
const res = await extractPackageFile(
|
|
workflow,
|
|
'.github/workflows/ci.yml',
|
|
);
|
|
|
|
// `updateActionsLockfile` refuses to regenerate a lockfile it cannot parse, so pinning inline would leave the lockfile stale
|
|
expect(res?.deps[0].digestManagedExternally).toBe(true);
|
|
});
|
|
|
|
it('does not read the lockfile when nothing was extracted', async () => {
|
|
const res = await extractPackageFile('nothing: here', 'workflow.yml');
|
|
|
|
expect(res).toBeNull();
|
|
expect(fs.readLocalFile).not.toHaveBeenCalled();
|
|
});
|
|
|
|
it('reads the lockfile once for all package files', async () => {
|
|
fs.readLocalFile.mockResolvedValue(lockfile);
|
|
|
|
const [onboarded, notOnboarded] = await Promise.all([
|
|
extractPackageFile(workflow, '.github/workflows/ci.yml'),
|
|
extractPackageFile(workflow, '.github/workflows/not-onboarded.yml'),
|
|
]);
|
|
|
|
expect(onboarded?.deps[0].digestManagedExternally).toBe(true);
|
|
expect(notOnboarded?.deps[0]).not.toHaveProperty(
|
|
'digestManagedExternally',
|
|
);
|
|
expect(fs.readLocalFile).toHaveBeenCalledOnce();
|
|
});
|
|
});
|
|
});
|