mirror of
https://github.com/renovatebot/renovate.git
synced 2026-10-31 01:37:24 +00:00
a1971afa78
* ci(linter): add renovate/require-regex-util rule Adds a custom oxlint rule that flags raw RegExp usage in lib/ production code: any `new RegExp(...)` call and any regex literal that is not the direct first argument of `regEx(...)`. The regEx() helper from lib/util/regex.ts uses the RE2 engine for ReDoS-safe matching and caches compiled patterns. lib/util/regex.ts itself is exempt. The rule is disabled for **/*.spec.ts, test/**, and tools/** via config overrides, because vitest APIs such as expect.stringMatching need bare RegExp instances (a past commit reverted regEx() there). Severity is set to "warn" instead of "error": the repo currently has 197 pre-existing violations (above the agreed mechanical-fix threshold of 80), and a number of them are deliberately RE2-incompatible patterns (lookahead/lookbehind/named backreferences, see TODO #12872/#12875 markers in e.g. lib/modules/versioning/rez/ pattern.ts and lib/modules/manager/dockerfile/extract.ts) that need per-site judgment before they can be wrapped in regEx() or suppressed with a justified disable comment. No violation fixes are included in this commit. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * ci(linter): enforce renovate/require-regex-util at error Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * refactor: use regEx() for regex literals and RegExp construction in lib Burn down all renovate/require-regex-util violations (197): - wrap RE2-compatible regex literals and RegExp constructions in regEx() - rewrite lookaround patterns where behavior is provably preserved: goproxy separator split, sbt-package link extraction, leiningen comment stripping and keyword search, npm GitHub owner validation (unit-count bound replaced by an explicit length check) - keep native RegExp with disable comments where RE2 cannot be used: moo / good-enough-parser lexer patterns (moo rejects RE2 instances), MigrationsService propertyName (matched via isRegExp, which RE2 instances fail), rez named backreferences and lookaheads, GitHub markdown link negative lookbehind, emoji astral-plane matching - drop stale TODO #12875 comments for patterns current re2 handles Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * refactor: reduce require-regex-util disable comments Rewrite the github massage-markdown-links URL regex to capture an optional `api.` prefix in a named group (skipped in code) instead of relying on a negative lookbehind, so both the base and global variants can use regEx()/RE2 and their two disable comments are removed. Add spec cases for api-prefixed URLs that match the URL shape. Consolidate the four related line disables in rez/pattern.ts (bound and range patterns emulating Python conditional patterns via named backreferences and lookaheads, which RE2 cannot express) into a single block disable/enable pair, matching the treatment of the lexer files. Disable comment count drops from 13 to 8. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * refactor(datasource/sbt-package): use named capture group in link regex Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * refactor(manager/cake): restore original multiLineComment regex spelling The [^] -> [\\s\\S] rewrite was only needed for an RE2 wrap that was later reverted; keep the diff minimal. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(datasource/go): skip empty GOPROXY segments The switch from a lookahead split to a capture-group split (needed because RE2 has no lookahead support) changed how empty GOPROXY segments parse: `a|,b` yielded `{ url: ',', fallback: '|' }` before and `{ url: '', fallback: ',' }` after. The comma fallback only continues on 404/410, so a failing proxy ahead of an empty segment silently stopped the lookup instead of falling through to the remaining proxies. Empty segments carry no url to query, so drop them. * refactor(datasource/go): use isTruthy for empty segment filter * fix(datasource/go): filter empty segments before mapping Filtering after the map broke the contextual typing from the GoproxyItem[] annotation, widening fallback to string. * refactor(platform/github): use regEx() for merge queue query stripping --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
265 lines
7.2 KiB
TypeScript
265 lines
7.2 KiB
TypeScript
import { isPlainObject, isString } from '@sindresorhus/is';
|
|
import { regEx } from '../../../util/regex.ts';
|
|
import { isHttpUrl } from '../../../util/url.ts';
|
|
import { BitbucketTagsDatasource } from '../../datasource/bitbucket-tags/index.ts';
|
|
import { CLOJARS_REPO } from '../../datasource/clojure/common.ts';
|
|
import { ClojureDatasource } from '../../datasource/clojure/index.ts';
|
|
import { GitRefsDatasource } from '../../datasource/git-refs/index.ts';
|
|
import { GithubTagsDatasource } from '../../datasource/github-tags/index.ts';
|
|
import { GitlabTagsDatasource } from '../../datasource/gitlab-tags/index.ts';
|
|
import { MAVEN_REPO } from '../../datasource/maven/common.ts';
|
|
import type { PackageDependency, PackageFileContent } from '../types.ts';
|
|
import { parseDepsEdnFile } from './parser.ts';
|
|
import type {
|
|
ParsedEdnData,
|
|
ParsedEdnMetadata,
|
|
ParsedEdnRecord,
|
|
} from './types.ts';
|
|
|
|
const dependencyRegex = regEx(
|
|
/^(?<groupId>[a-zA-Z][-_a-zA-Z0-9]*(?:\.[a-zA-Z0-9][-_a-zA-Z0-9]*)*)(?:\/(?<artifactId>[a-zA-Z][-_a-zA-Z0-9]*(?:\.[a-zA-Z0-9][-_a-zA-Z0-9]*)*))?$/,
|
|
);
|
|
|
|
function getPackageName(depName: string): string | null {
|
|
const matchGroups = dependencyRegex.exec(depName)?.groups;
|
|
if (matchGroups) {
|
|
const groupId = matchGroups.groupId;
|
|
const artifactId = matchGroups.artifactId
|
|
? matchGroups.artifactId
|
|
: groupId;
|
|
return `${groupId}:${artifactId}`;
|
|
}
|
|
|
|
return null;
|
|
}
|
|
|
|
const githubDependencyRegex = regEx(
|
|
/^(?:com|io)\.github\.(?<packageName>[^/]+\/[^/]+)$/,
|
|
);
|
|
const gitlabDependencyRegex = regEx(
|
|
/^(?:com|io)\.gitlab\.(?<packageName>[^/]+\/[^/]+)$/,
|
|
);
|
|
const bitbucketDependencyRegex = regEx(
|
|
/^(?:org|io)\.bitbucket\.(?<packageName>[^/]+\/[^/]+)$/,
|
|
);
|
|
|
|
function resolveGitPackageFromEdnKey(
|
|
dep: PackageDependency,
|
|
key: string,
|
|
): void {
|
|
if (dep.datasource) {
|
|
return;
|
|
}
|
|
|
|
const githubDependencyGroups = githubDependencyRegex.exec(key)?.groups;
|
|
if (githubDependencyGroups?.packageName) {
|
|
dep.datasource = GithubTagsDatasource.id;
|
|
dep.packageName = githubDependencyGroups.packageName;
|
|
return;
|
|
}
|
|
|
|
const gitlabDependencyGroups = gitlabDependencyRegex.exec(key)?.groups;
|
|
if (gitlabDependencyGroups?.packageName) {
|
|
dep.datasource = GitlabTagsDatasource.id;
|
|
dep.packageName = gitlabDependencyGroups.packageName;
|
|
return;
|
|
}
|
|
|
|
const bitbucketDependencyGroups = bitbucketDependencyRegex.exec(key)?.groups;
|
|
if (bitbucketDependencyGroups?.packageName) {
|
|
dep.datasource = BitbucketTagsDatasource.id;
|
|
dep.packageName = bitbucketDependencyGroups.packageName;
|
|
return;
|
|
}
|
|
}
|
|
|
|
const githubUrlRegex = regEx(
|
|
/^(?:https:\/\/|git@)github\.com[/:](?<packageName>[^/]+\/[^/]+?)(?:\.git)?$/,
|
|
);
|
|
const gitlabUrlRegex = regEx(
|
|
/^(?:https:\/\/|git@)gitlab\.com[/:](?<packageName>[^/]+\/[^/]+?)(?:\.git)?$/,
|
|
);
|
|
const bitbucketUrlRegex = regEx(
|
|
/^(?:https:\/\/|git@)bitbucket\.org[/:](?<packageName>[^/]+\/[^/]+?)(?:\.git)?$/,
|
|
);
|
|
|
|
function resolveGitPackageFromEdnVal(
|
|
dep: PackageDependency,
|
|
val: ParsedEdnRecord,
|
|
): void {
|
|
const gitUrl = val['git/url'];
|
|
if (!isString(gitUrl)) {
|
|
return;
|
|
}
|
|
|
|
const githubMatchGroups = githubUrlRegex.exec(gitUrl)?.groups;
|
|
if (githubMatchGroups) {
|
|
dep.datasource = GithubTagsDatasource.id;
|
|
dep.packageName = githubMatchGroups.packageName;
|
|
dep.sourceUrl = `https://github.com/${dep.packageName}`;
|
|
return;
|
|
}
|
|
|
|
const gitlabMatchGroups = gitlabUrlRegex.exec(gitUrl)?.groups;
|
|
const bitbucketMatchGroups = bitbucketUrlRegex.exec(gitUrl)?.groups;
|
|
|
|
if (gitlabMatchGroups) {
|
|
dep.datasource = GitlabTagsDatasource.id;
|
|
dep.packageName = gitlabMatchGroups.packageName;
|
|
dep.sourceUrl = `https://gitlab.com/${dep.packageName}`;
|
|
return;
|
|
}
|
|
|
|
if (bitbucketMatchGroups) {
|
|
dep.datasource = GitlabTagsDatasource.id;
|
|
dep.packageName = bitbucketMatchGroups.packageName;
|
|
dep.sourceUrl = `https://bitbucket.org/${dep.packageName}`;
|
|
return;
|
|
}
|
|
|
|
dep.datasource = GitRefsDatasource.id;
|
|
dep.packageName = gitUrl;
|
|
if (isHttpUrl(gitUrl)) {
|
|
dep.sourceUrl = gitUrl.replace(regEx(/\.git$/), '');
|
|
}
|
|
}
|
|
|
|
function extractDependency(
|
|
key: string,
|
|
val: ParsedEdnData,
|
|
metadata: ParsedEdnMetadata,
|
|
mavenRegistries: string[],
|
|
depType?: string,
|
|
): PackageDependency | null {
|
|
if (!isPlainObject(val)) {
|
|
return null;
|
|
}
|
|
|
|
const packageName = getPackageName(key);
|
|
if (!packageName) {
|
|
return null;
|
|
}
|
|
const depName = key;
|
|
|
|
const dep: PackageDependency = {
|
|
depName,
|
|
packageName,
|
|
currentValue: null,
|
|
...metadata.get(val),
|
|
};
|
|
|
|
if (depType) {
|
|
dep.depType = depType;
|
|
}
|
|
|
|
const mvnVersion = val['mvn/version'];
|
|
if (isString(mvnVersion)) {
|
|
dep.datasource = ClojureDatasource.id;
|
|
dep.currentValue = mvnVersion;
|
|
dep.packageName = packageName.replace('/', ':');
|
|
dep.registryUrls = [...mavenRegistries];
|
|
return dep;
|
|
}
|
|
|
|
resolveGitPackageFromEdnVal(dep, val);
|
|
resolveGitPackageFromEdnKey(dep, key);
|
|
|
|
if (dep.datasource) {
|
|
const gitTag = val['git/tag'];
|
|
if (isString(gitTag)) {
|
|
dep.currentValue = gitTag;
|
|
}
|
|
|
|
const gitSha = val['git/sha'] ?? val.sha;
|
|
if (isString(gitSha)) {
|
|
dep.currentDigest = gitSha;
|
|
dep.currentDigestShort = gitSha.slice(0, 7);
|
|
}
|
|
|
|
return dep;
|
|
}
|
|
|
|
return null;
|
|
}
|
|
|
|
function extractSection(
|
|
section: ParsedEdnData,
|
|
metadata: ParsedEdnMetadata,
|
|
mavenRegistries: string[],
|
|
depType?: string,
|
|
): PackageDependency[] {
|
|
const deps: PackageDependency[] = [];
|
|
if (isPlainObject(section)) {
|
|
for (const [key, val] of Object.entries(section)) {
|
|
const dep = extractDependency(
|
|
key,
|
|
val,
|
|
metadata,
|
|
mavenRegistries,
|
|
depType,
|
|
);
|
|
if (dep) {
|
|
deps.push(dep);
|
|
}
|
|
}
|
|
}
|
|
return deps;
|
|
}
|
|
|
|
export function extractPackageFile(content: string): PackageFileContent | null {
|
|
const parsed = parseDepsEdnFile(content);
|
|
if (!parsed) {
|
|
return null;
|
|
}
|
|
const { data, metadata } = parsed;
|
|
|
|
const deps: PackageDependency[] = [];
|
|
|
|
// See: https://clojure.org/reference/deps_and_cli#_modifying_the_default_repositories
|
|
const registryMap: Record<string, string> = {
|
|
clojars: CLOJARS_REPO,
|
|
central: MAVEN_REPO,
|
|
};
|
|
const mavenRepos = data['mvn/repos'];
|
|
if (isPlainObject(mavenRepos)) {
|
|
for (const [repoName, repoSpec] of Object.entries(mavenRepos)) {
|
|
if (isString(repoName)) {
|
|
if (isPlainObject(repoSpec) && isString(repoSpec.url)) {
|
|
registryMap[repoName] = repoSpec.url;
|
|
} else if (isString(repoSpec) && repoSpec === 'nil') {
|
|
delete registryMap[repoName];
|
|
}
|
|
}
|
|
}
|
|
}
|
|
const mavenRegistries: string[] = Object.values(registryMap);
|
|
|
|
deps.push(...extractSection(data.deps, metadata, mavenRegistries));
|
|
|
|
const aliases = data.aliases;
|
|
if (isPlainObject(aliases)) {
|
|
for (const [depType, aliasSection] of Object.entries(aliases)) {
|
|
if (isPlainObject(aliasSection)) {
|
|
deps.push(
|
|
...extractSection(
|
|
aliasSection['extra-deps'],
|
|
metadata,
|
|
mavenRegistries,
|
|
depType,
|
|
),
|
|
);
|
|
deps.push(
|
|
...extractSection(
|
|
aliasSection['override-deps'],
|
|
metadata,
|
|
mavenRegistries,
|
|
depType,
|
|
),
|
|
);
|
|
}
|
|
}
|
|
}
|
|
|
|
return { deps };
|
|
}
|