Files
renovate/lib/modules/manager/cake/index.ts
Sebastian Poxhofer a1971afa78 fix(linters): add linting rule to enforce usage of our regEx utility (#44690)
* ci(linter): add renovate/require-regex-util rule

Adds a custom oxlint rule that flags raw RegExp usage in lib/
production code: any `new RegExp(...)` call and any regex literal
that is not the direct first argument of `regEx(...)`. The regEx()
helper from lib/util/regex.ts uses the RE2 engine for ReDoS-safe
matching and caches compiled patterns. lib/util/regex.ts itself is
exempt.

The rule is disabled for **/*.spec.ts, test/**, and tools/** via
config overrides, because vitest APIs such as expect.stringMatching
need bare RegExp instances (a past commit reverted regEx() there).

Severity is set to "warn" instead of "error": the repo currently has
197 pre-existing violations (above the agreed mechanical-fix
threshold of 80), and a number of them are deliberately
RE2-incompatible patterns (lookahead/lookbehind/named backreferences,
see TODO #12872/#12875 markers in e.g. lib/modules/versioning/rez/
pattern.ts and lib/modules/manager/dockerfile/extract.ts) that need
per-site judgment before they can be wrapped in regEx() or suppressed
with a justified disable comment. No violation fixes are included in
this commit.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* ci(linter): enforce renovate/require-regex-util at error

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* refactor: use regEx() for regex literals and RegExp construction in lib

Burn down all renovate/require-regex-util violations (197):

- wrap RE2-compatible regex literals and RegExp constructions in regEx()
- rewrite lookaround patterns where behavior is provably preserved:
  goproxy separator split, sbt-package link extraction, leiningen
  comment stripping and keyword search, npm GitHub owner validation
  (unit-count bound replaced by an explicit length check)
- keep native RegExp with disable comments where RE2 cannot be used:
  moo / good-enough-parser lexer patterns (moo rejects RE2 instances),
  MigrationsService propertyName (matched via isRegExp, which RE2
  instances fail), rez named backreferences and lookaheads, GitHub
  markdown link negative lookbehind, emoji astral-plane matching
- drop stale TODO #12875 comments for patterns current re2 handles

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* refactor: reduce require-regex-util disable comments

Rewrite the github massage-markdown-links URL regex to capture an
optional `api.` prefix in a named group (skipped in code) instead of
relying on a negative lookbehind, so both the base and global variants
can use regEx()/RE2 and their two disable comments are removed. Add
spec cases for api-prefixed URLs that match the URL shape.

Consolidate the four related line disables in rez/pattern.ts (bound and
range patterns emulating Python conditional patterns via named
backreferences and lookaheads, which RE2 cannot express) into a single
block disable/enable pair, matching the treatment of the lexer files.

Disable comment count drops from 13 to 8.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* refactor(datasource/sbt-package): use named capture group in link regex

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* refactor(manager/cake): restore original multiLineComment regex spelling

The [^] -> [\\s\\S] rewrite was only needed for an RE2 wrap that was
later reverted; keep the diff minimal.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(datasource/go): skip empty GOPROXY segments

The switch from a lookahead split to a capture-group split (needed because
RE2 has no lookahead support) changed how empty GOPROXY segments parse:
`a|,b` yielded `{ url: ',', fallback: '|' }` before and
`{ url: '', fallback: ',' }` after. The comma fallback only continues on
404/410, so a failing proxy ahead of an empty segment silently stopped the
lookup instead of falling through to the remaining proxies.

Empty segments carry no url to query, so drop them.

* refactor(datasource/go): use isTruthy for empty segment filter

* fix(datasource/go): filter empty segments before mapping

Filtering after the map broke the contextual typing from the
GoproxyItem[] annotation, widening fallback to string.

* refactor(platform/github): use regEx() for merge queue query stripping

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
2026-08-14 14:30:46 +00:00

110 lines
3.4 KiB
TypeScript

import moo from 'moo';
import type { Category } from '../../../constants/index.ts';
import { regEx } from '../../../util/regex.ts';
import { isHttpUrl, parseUrl } from '../../../util/url.ts';
import { NugetDatasource } from '../../datasource/nuget/index.ts';
import type { NugetPackageDependency, Registry } from '../nuget/types.ts';
import { applyRegistries, getConfiguredRegistries } from '../nuget/util.ts';
import type { ExtractConfig, PackageFileContent } from '../types.ts';
export const url = 'https://cakebuild.net/docs';
export const categories: Category[] = ['dotnet'];
export const defaultConfig = {
managerFilePatterns: ['/\\.cake$/'],
};
export const supportedDatasources = [NugetDatasource.id];
/* oxlint-disable renovate/require-regex-util -- moo lexer patterns must be native RegExp: moo recompiles their source with the native engine and rejects RE2 instances (TODO #12870) */
const lexer = moo.states({
main: {
lineComment: { match: /\/\/.*?$/ }, // TODO #12870
multiLineComment: { match: /\/\*[^]*?\*\//, lineBreaks: true }, // TODO #12870
dependency: {
match: /^#(?:addin|tool|module|load|l)\s+(?:nuget|dotnet):.*$/, // TODO #12870
},
dependencyQuoted: {
match: /^#(?:addin|tool|module|load|l)\s+"(?:nuget|dotnet):[^"]+"\s*$/, // TODO #12870
value: (s: string) => s.trim().slice(1, -1),
},
dependencyFromInstallTools: {
match: /(?:InstallTools?\s*\()[^)]+(?:\s*\)\s*;)/,
lineBreaks: true,
},
unknown: moo.fallback,
},
});
/* oxlint-enable renovate/require-regex-util */
function parseDependencyLine(line: string): NugetPackageDependency | null {
let url = line.replace(regEx(/^[^:]*:/), '');
const isEmptyHost = url.startsWith('?');
url = isEmptyHost ? `http://localhost/${url}` : url;
const parsedUrl = parseUrl(url);
if (!parsedUrl) {
return null;
}
const { origin, pathname, searchParams } = parsedUrl;
const registryUrl = `${origin}${pathname}`;
const depName = searchParams.get('package')!;
const currentValue = searchParams.get('version') ?? undefined;
const result: NugetPackageDependency = {
datasource: NugetDatasource.id,
depName,
currentValue,
};
if (!isEmptyHost) {
if (isHttpUrl(parsedUrl)) {
result.registryUrls = [registryUrl];
} else {
result.skipReason = 'unsupported-url';
}
}
return result;
}
function parseAndPushDependencyLine(
registries: Registry[] | undefined,
deps: NugetPackageDependency[],
value: string,
): void {
const dep = parseDependencyLine(value);
if (dep) {
applyRegistries(dep, registries);
deps.push(dep);
}
}
export async function extractPackageFile(
content: string,
packageFile: string,
_config: ExtractConfig,
): Promise<PackageFileContent> {
const deps: NugetPackageDependency[] = [];
const registries = await getConfiguredRegistries(packageFile);
lexer.reset(content);
let token = lexer.next();
while (token) {
const { type, value } = token;
if (type === 'dependency' || type === 'dependencyQuoted') {
parseAndPushDependencyLine(registries, deps, value);
} else if (type === 'dependencyFromInstallTools') {
const matches = value.matchAll(regEx(/"dotnet:[^"]+"/g));
for (const match of matches) {
const withoutQuote = match.toString().slice(1, -1);
parseAndPushDependencyLine(registries, deps, withoutQuote);
}
}
token = lexer.next();
}
return { deps };
}