renovate/lib/config/validation.ts

import is, {
  isArray,
  isEmptyString,
  isNonEmptyArray,
  isNonEmptyString,
  isNonEmptyStringAndNotWhitespace,
  isObject,
  isPlainObject,
  isString,
  isUndefined,
} from '@sindresorhus/is';
import type { PlatformId } from '../constants/index.ts';
import { instrument } from '../instrumentation/index.ts';
import { logger } from '../logger/index.ts';
import {
  AllManagersListLiteral,
  CustomManagersListLiteral,
} from '../manager-list.generated.ts';
import { isCustomManager } from '../modules/manager/custom/index.ts';
import type { CustomManager } from '../modules/manager/custom/types.ts';
import type { HostRule } from '../types/index.ts';
import { coerceArray } from '../util/array.ts';
import { packageCacheNamespaces } from '../util/cache/package/namespaces.ts';
import { clone } from '../util/clone.ts';
import { getToolConfig } from '../util/exec/containerbase.ts';
import { isConstraintName, isToolName } from '../util/exec/types.ts';
import { isValidCommitTrailer } from '../util/git/commit-trailers.ts';
import { getExpression } from '../util/jsonata.ts';
import { regEx } from '../util/regex.ts';
import {
  anyMatchRegexOrGlobList,
  getRegexPredicate,
  isRegexMatch,
  matchRegexOrGlobList,
} from '../util/string-match.ts';
import * as template from '../util/template/index.ts';
import { parseUrl } from '../util/url.ts';
import {
  AllVersioningsListLiteral,
  type VersioningName,
} from '../versioning-list.generated.ts';
import {
  hasValidSchedule,
  hasValidTimezone,
} from '../workers/repository/update/branch/schedule.ts';
import { getConfigFileNames } from './app-strings.ts';
import { GlobalConfig } from './global.ts';
import { migrateConfig } from './migration.ts';
import { getOptions } from './options/index.ts';
import { resolveConfigPresets } from './presets/index.ts';
import { supportedDatasources } from './presets/internal/merge-confidence.preset.ts';
import { isRelativePresetReference, parsePreset } from './presets/parse.ts';
import type {
  AllConfig,
  AllowedParents,
  RenovateConfig,
  RenovateOptions,
  StatusCheckKey,
  ValidationMessage,
  ValidationResult,
} from './types.ts';
import { allowedStatusCheckStrings } from './types.ts';
import * as matchBaseBranchesValidator from './validation-helpers/match-base-branches.ts';
import * as regexOrGlobValidator from './validation-helpers/regex-glob-matchers.ts';
import { ConfigValidationTopic } from './validation-helpers/types.ts';
import {
  getParentName,
  isFalseGlobal,
  validateJSONataManagerFields,
  validateNumber,
  validatePlainObject,
  validateRegexManagerFields,
} from './validation-helpers/utils.ts';

const options = getOptions();

let optionsInitialized = false;
let optionTypes: Record<string, RenovateOptions['type']>;
let optionParents: Record<string, AllowedParents[]>;
let optionGlobals: Set<string>;
let optionInherits: Set<string>;
let optionRegexOrGlob: Set<string>;
let optionAllowsNegativeIntegers: Set<string>;
let optionSupportsTemplating: Set<string>;

const managerList: readonly string[] = AllManagersListLiteral;

const allManagersList: readonly string[] = [
  ...AllManagersListLiteral,
  ...CustomManagersListLiteral,
];

const topLevelObjects = [...managerList, 'env'];

const ignoredNodes = [
  '$schema',
  'headers',
  'depType',
  'npmToken',
  'packageFile',
  'forkToken',
  'repository',
  'vulnerabilityAlertsOnly',
  'vulnerabilityAlert',
  'isVulnerabilityAlert',
  'vulnerabilityFixVersion', // not intended to be used by end users but may be by Mend apps
  'copyLocalLibs', // deprecated - functionality is now enabled by default
  'prBody', // deprecated
  'minimumConfidence', // undocumented feature flag
];
const tzRe = regEx(/^:timezone\((?<timezone>.+)\)$/);
const rulesRe = regEx(/p.*Rules\[\d+\]$/);
const repoEntryRe = regEx(/^repositories\[\d+\]$/);

function isIgnored(key: string): boolean {
  return ignoredNodes.includes(key);
}

function getUnsupportedEnabledManagers(enabledManagers: string[]): string[] {
  return enabledManagers.filter(
    (manager) => !allManagersList.includes(manager.replace('custom.', '')),
  );
}

function getDeprecationMessage(option: string): string | undefined {
  const deprecatedOptions: Record<string, string | undefined> = {
    branchName: `Direct editing of branchName is now deprecated. Please edit branchPrefix, additionalBranchPrefix, or branchTopic instead`,
    commitMessage: `Direct editing of commitMessage is now deprecated. Please edit commitMessage's subcomponents instead.`,
    prTitle: `Direct editing of prTitle is now deprecated. Please edit commitMessage subcomponents instead as they will be passed through to prTitle.`,
  };
  if (deprecatedOptions[option]) {
    return deprecatedOptions[option];
  }

  const found = options.find((o) => o.name === option);
  if (!found) {
    return undefined;
  }

  if (!found.deprecationMsg) {
    return undefined;
  }

  return `The '${option}' option is deprecated: ${found.deprecationMsg}`;
}

function isInhertConfigOption(key: string): boolean {
  return optionInherits.has(key);
}

function isRegexOrGlobOption(key: string): boolean {
  return optionRegexOrGlob.has(key);
}

function isGlobalOption(key: string): boolean {
  return optionGlobals.has(key);
}

function initOptions(): void {
  if (optionsInitialized) {
    return;
  }

  optionParents = {};
  optionInherits = new Set();
  optionTypes = {};
  optionRegexOrGlob = new Set();
  optionGlobals = new Set();
  optionAllowsNegativeIntegers = new Set();
  optionSupportsTemplating = new Set();

  for (const option of options) {
    optionTypes[option.name] = option.type;

    if (option.parents) {
      optionParents[option.name] = option.parents;
    }

    if (option.inheritConfigSupport) {
      optionInherits.add(option.name);
    }

    if (option.patternMatch) {
      optionRegexOrGlob.add(option.name);
    }

    if (option.globalOnly) {
      optionGlobals.add(option.name);
    }

    if (option.allowNegative) {
      optionAllowsNegativeIntegers.add(option.name);
    }

    if (option.supportsTemplating) {
      optionSupportsTemplating.add(option.name);
    }
  }

  optionsInitialized = true;
}

/**
 * Removes every relative preset reference from a deep copy of the given
 * `packageRules` entry, at any nesting depth.
 *
 * Relative references are only resolvable while the preset which contains them
 * is fetched, so they must not be passed to `resolveConfigPresets()` during
 * validation. They are still syntax checked by the `extends` validation.
 */
function stripRelativePresets(packageRule: RenovateConfig): {
  rule: RenovateConfig;
  hasRelativePresets: boolean;
} {
  const rule = clone(packageRule);
  const hasRelativePresets = stripRelativePresetsFromValue(rule);
  return { rule, hasRelativePresets };
}

function stripRelativePresetsFromValue(value: unknown): boolean {
  if (isArray(value)) {
    let stripped = false;
    for (const element of value) {
      stripped = stripRelativePresetsFromValue(element) || stripped;
    }
    return stripped;
  }

  if (!isPlainObject(value)) {
    return false;
  }

  let stripped = false;
  for (const [key, val] of Object.entries(value)) {
    if (key === 'extends' && isArray(val)) {
      const remaining = val.filter(
        (preset) => !(isString(preset) && isRelativePresetReference(preset)),
      );
      if (remaining.length !== val.length) {
        value[key] = remaining;
        stripped = true;
      }
      continue;
    }

    stripped = stripRelativePresetsFromValue(val) || stripped;
  }
  return stripped;
}

type ConfigType = 'global' | 'inherit' | 'repo';

/**
 * Whether a `hostRules` `allowInternal` is honored from this kind of config.
 *
 * Only the self-hosted administrator's own configuration may grant access to internal hosts. The inherited config repository belongs to the organization rather than to them, so its rules only count where the administrator has opted into trusting them with `inheritConfigTrusted`.
 */
function mayGrantInternalHostAccess(configType: ConfigType): boolean {
  if (configType === 'global') {
    return true;
  }
  if (configType === 'inherit') {
    return GlobalConfig.get('inheritConfigTrusted');
  }
  return false;
}

function allowInternalNotAllowedMessage(configType: ConfigType): string {
  if (configType === 'inherit') {
    return 'hostRules `allowInternal` is not allowed in inherited config, as this Renovate instance has not set `inheritConfigTrusted=true`. The administrator can either set it, or move the rule to their global config or a `repositories[]` entry.';
  }
  return `hostRules \`allowInternal\` is only allowed in the self-hosted administrator's own configuration.`;
}

export async function validateConfig(
  configType: ConfigType,
  config: AllConfig,
  isPreset?: boolean,
  parentPath?: string,
): Promise<ValidationResult> {
  return instrument(
    `validateConfig(${configType}, ${JSON.stringify(parentPath)})`,
    async () => {
      initOptions();

      let errors: ValidationMessage[] = [];
      let warnings: ValidationMessage[] = [];

      for (const [key, val] of Object.entries(config)) {
        const currentPath = parentPath ? `${parentPath}.${key}` : key;
        /* v8 ignore next -- TODO: add test */
        if (key === '__proto__') {
          errors.push({
            topic: ConfigValidationTopic.Security,
            message: '__proto__',
          });
          continue;
        }
        if (
          parentPath &&
          parentPath !== 'onboardingConfig' &&
          !repoEntryRe.test(parentPath) &&
          topLevelObjects.includes(key)
        ) {
          errors.push({
            topic: ConfigValidationTopic.Error,
            message: `The "${key}" object can only be configured at the top level of a config but was found inside "${parentPath}"`,
          });
        }

        if (isGlobalOption(key)) {
          if (configType === 'global') {
            await validateGlobalConfig(
              key,
              val,
              optionTypes[key],
              warnings,
              errors,
              currentPath,
              config,
            );
            continue;
          } else if (
            !isFalseGlobal(key, parentPath) &&
            !(configType === 'inherit' && isInhertConfigOption(key))
          ) {
            warnings.push({
              topic: ConfigValidationTopic.Error,
              message: `The "${key}" option is a global option reserved only for Renovate's global configuration and cannot be configured within a repository's config file.`,
            });
            continue;
          }
        }
        if (key === 'enabledManagers' && val) {
          const unsupportedManagers = getUnsupportedEnabledManagers(
            val as string[],
          );
          if (isNonEmptyArray(unsupportedManagers)) {
            errors.push({
              topic: ConfigValidationTopic.Error,
              message: `The following managers configured in enabledManagers are not supported: "${unsupportedManagers.join(
                ', ',
              )}"`,
            });
          }
        }
        if (key === 'registryUrls' && !parentPath && isNonEmptyArray(val)) {
          warnings.push({
            topic: ConfigValidationTopic.Warning,
            message:
              'Setting `registryUrls` at the top level of your config will apply it to all managers and datasources, which can cause the wrong registry URL to be used for some packages. Use `registryUrls` inside `packageRules` to target specific managers or packages.',
          });
        }
        if (
          key === 'defaultRegistryUrls' &&
          !parentPath &&
          isNonEmptyArray(val)
        ) {
          warnings.push({
            topic: ConfigValidationTopic.Warning,
            message:
              'Setting `defaultRegistryUrls` at the top level of your config will apply it to all managers and datasources, which can cause the wrong registry URL to be used for some packages. Use `defaultRegistryUrls` inside `packageRules` to target specific managers or packages.',
          });
        }
        if (
          !isIgnored(key) && // We need to ignore some reserved keys
          !(is as any).function(val) // Ignore all functions
        ) {
          if (getDeprecationMessage(key)) {
            warnings.push({
              topic: ConfigValidationTopic.Deprecation,
              message: getDeprecationMessage(key)!,
            });
          }
          if (optionSupportsTemplating.has(key) && val) {
            try {
              // TODO: types (#22198)
              template.validate((val as string).toString());
            } catch {
              errors.push({
                topic: ConfigValidationTopic.Error,
                message: `Invalid template in config path: ${currentPath}`,
              });
            }
          }
          const parentName =
            parentPath && repoEntryRe.test(parentPath)
              ? '.'
              : getParentName(parentPath);
          if (
            !isPreset &&
            optionParents[key] &&
            !optionParents[key].includes(parentName as AllowedParents)
          ) {
            // TODO: types (#22198)
            const options = optionParents[key]?.toSorted().join(', ');
            const message = `"${key}" can't be used in "${parentName}". Allowed objects: ${options}.`;
            warnings.push({
              topic: `${parentPath ? `${parentPath}.` : ''}${key}`,
              message,
            });
          }

          // v8 ignore else -- intentionally unhandled - if we knew what was to be covered here, we'd add validation
          if (!optionTypes[key]) {
            errors.push({
              topic: ConfigValidationTopic.Error,
              message: `Invalid configuration option: ${currentPath}`,
            });
          } else if (key === 'schedule') {
            const [validSchedule, errorMessage] = hasValidSchedule(
              val as string[],
            );
            if (!validSchedule) {
              errors.push({
                topic: ConfigValidationTopic.Error,
                message: `Invalid ${currentPath}: \`${errorMessage}\``,
              });
            }
          } else if (
            [
              'allowedVersions',
              'matchCurrentVersion',
              'matchCurrentValue',
              'matchNewValue',
            ].includes(key) &&
            isRegexMatch(val)
          ) {
            if (!getRegexPredicate(val)) {
              errors.push({
                topic: ConfigValidationTopic.Error,
                message: `Invalid regExp for ${currentPath}: \`${val}\``,
              });
            }
          } else if (key === 'timezone' && val !== null) {
            const [validTimezone, errorMessage] = hasValidTimezone(
              val as string,
            );
            if (!validTimezone) {
              errors.push({
                topic: ConfigValidationTopic.Error,
                message: `${currentPath}: ${errorMessage}`,
              });
            }
          } else if (val !== null) {
            const type = optionTypes[key];
            if (type === 'boolean') {
              if (val !== true && val !== false) {
                errors.push({
                  topic: ConfigValidationTopic.Error,
                  message: `Configuration option \`${currentPath}\` should be boolean. Found: ${JSON.stringify(
                    val,
                  )} (${typeof val})`,
                });
              }
            } else if (type === 'integer') {
              const allowsNegative = optionAllowsNegativeIntegers.has(key);
              errors.push(
                ...validateNumber(key, val, allowsNegative, currentPath),
              );
            } else if (type === 'array' && val) {
              if (isArray(val)) {
                for (const [subIndex, subval] of val.entries()) {
                  if (isObject(subval)) {
                    const subValidation = await validateConfig(
                      configType,
                      subval,
                      isPreset,
                      `${currentPath}[${subIndex}]`,
                    );
                    warnings = warnings.concat(subValidation.warnings);
                    errors = errors.concat(subValidation.errors);
                  }
                }
                if (isRegexOrGlobOption(key)) {
                  errors.push(
                    ...regexOrGlobValidator.check({
                      val,
                      currentPath,
                    }),
                  );
                }
                if (key === 'extends') {
                  for (const subval of val) {
                    if (isString(subval)) {
                      if (
                        configType !== 'global' &&
                        subval.startsWith('global:')
                      ) {
                        errors.push({
                          topic: ConfigValidationTopic.Error,
                          message: `${currentPath}: you cannot extend from "global:" presets in a repository config's "extends"`,
                        });
                      }

                      if (
                        parentName === 'packageRules' &&
                        subval.startsWith('group:')
                      ) {
                        warnings.push({
                          topic: ConfigValidationTopic.Warning,
                          message: `${currentPath}: you should not extend "group:" presets`,
                        });
                      }
                      if (tzRe.test(subval)) {
                        const [, timezone] = tzRe.exec(subval)!;
                        const [validTimezone, errorMessage] =
                          hasValidTimezone(timezone);
                        if (!validTimezone) {
                          errors.push({
                            topic: ConfigValidationTopic.Error,
                            message: `${currentPath}: ${errorMessage}`,
                          });
                        }
                      }
                      if (!subval.includes('{{')) {
                        try {
                          parsePreset(subval);
                        } catch {
                          errors.push({
                            topic: ConfigValidationTopic.Error,
                            message: `${currentPath}: preset "${subval}" is not valid`,
                          });
                        }
                      }
                    } else {
                      errors.push({
                        topic: ConfigValidationTopic.Error,
                        message: `${currentPath}: preset value is not a string`,
                      });
                    }
                  }
                }

                if (key === 'commitTrailers') {
                  for (const subval of val) {
                    if (!isValidCommitTrailer(subval)) {
                      errors.push({
                        topic: ConfigValidationTopic.Error,
                        message: `Invalid commit trailer: \`${JSON.stringify(
                          subval,
                        )}\`. Must be a single-line string in the form \`Key: value\`, where the key contains only letters, digits and \`-\`.`,
                      });
                    }
                  }
                }

                const selectors = [
                  'matchFileNames',
                  'matchLanguages',
                  'matchCategories',
                  'matchBaseBranches',
                  'matchManagers',
                  'matchDatasources',
                  'matchDepTypes',
                  'matchDepNames',
                  'matchPackageNames',
                  'matchCurrentValue',
                  'matchCurrentVersion',
                  'matchSourceUrls',
                  'matchRegistryUrls',
                  'matchUpdateTypes',
                  'matchConfidence',
                  'matchCurrentAge',
                  'matchRepositories',
                  'matchNewValue',
                  'matchJsonata',
                ];
                if (key === 'packageRules') {
                  for (const [subIndex, packageRule] of val.entries()) {
                    if (isObject(packageRule)) {
                      const { rule, hasRelativePresets } =
                        stripRelativePresets(packageRule);
                      const { config: resolved } = await resolveConfigPresets(
                        rule,
                        config,
                      );
                      const resolvedRule = migrateConfig({
                        packageRules: [resolved],
                      }).migratedConfig.packageRules![0];
                      warnings.push(
                        ...matchBaseBranchesValidator.check({
                          resolvedRule,
                          currentPath: `${currentPath}[${subIndex}]`,
                          baseBranchPatterns: config.baseBranchPatterns!,
                        }),
                      );
                      const selectorLength = Object.keys(resolvedRule).filter(
                        (ruleKey) => selectors.includes(ruleKey),
                      ).length;
                      if (!selectorLength) {
                        if (hasRelativePresets) {
                          // the stripped relative preset may still provide the
                          // missing selectors, so this cannot be an error
                          const message = `${currentPath}[${subIndex}]: this rule extends a relative preset that cannot be resolved during validation, so its selectors could not be checked. Rule: ${JSON.stringify(
                            packageRule,
                          )}`;
                          warnings.push({
                            topic: ConfigValidationTopic.Error,
                            message,
                          });
                        } else {
                          const message = `${currentPath}[${subIndex}]: Each packageRule must contain at least one match* or exclude* selector. Rule: ${JSON.stringify(
                            packageRule,
                          )}`;
                          errors.push({
                            topic: ConfigValidationTopic.Error,
                            message,
                          });
                        }
                      }
                      if (
                        // the stripped relative preset legitimately provides
                        // the non-selector field
                        !hasRelativePresets &&
                        selectorLength === Object.keys(resolvedRule).length
                      ) {
                        const message = `${currentPath}[${subIndex}]: Each packageRule must contain at least one non-match* or non-exclude* field. Rule: ${JSON.stringify(
                          packageRule,
                        )}`;
                        warnings.push({
                          topic: ConfigValidationTopic.Error,
                          message,
                        });
                      }
                      // It's too late to apply any of these options once you already have updates determined
                      const preLookupOptions = [
                        'allowedVersions',
                        'extractVersion',
                        'followTag',
                        'ignoreDeps',
                        'ignoreUnstable',
                        'rangeStrategy',
                        'registryUrls',
                        'respectLatest',
                        'rollbackPrs',
                        'separateMajorMinor',
                        'separateMinorPatch',
                        'separateMultipleMajor',
                        'separateMultipleMinor',
                        'versioning',
                      ] as const;
                      if (isNonEmptyArray(resolvedRule.matchUpdateTypes)) {
                        for (const option of preLookupOptions) {
                          if (resolvedRule[option] !== undefined) {
                            const message = `${currentPath}[${subIndex}]: packageRules cannot combine both matchUpdateTypes and ${option}. Rule: ${JSON.stringify(
                              packageRule,
                            )}`;
                            errors.push({
                              topic: ConfigValidationTopic.Error,
                              message,
                            });
                          }
                        }
                      }
                    } else {
                      errors.push({
                        topic: ConfigValidationTopic.Error,
                        message: `${currentPath} must contain JSON objects`,
                      });
                    }
                  }
                }
                if (key === 'customManagers') {
                  const allowedKeys = [
                    'customType',
                    'description',
                    'fileFormat',
                    'managerFilePatterns',
                    'matchStrings',
                    'matchStringsStrategy',
                    'depNameTemplate',
                    'packageNameTemplate',
                    'datasourceTemplate',
                    'versioningTemplate',
                    'registryUrlTemplate',
                    'currentValueTemplate',
                    'extractVersionTemplate',
                    'autoReplaceStringTemplate',
                    'depTypeTemplate',
                  ];
                  for (const customManager of val as CustomManager[]) {
                    if (
                      Object.keys(customManager).some(
                        (k) => !allowedKeys.includes(k),
                      )
                    ) {
                      const disallowedKeys = Object.keys(customManager).filter(
                        (k) => !allowedKeys.includes(k),
                      );
                      errors.push({
                        topic: ConfigValidationTopic.Error,
                        message: `Custom Manager contains disallowed fields: ${disallowedKeys.join(
                          ', ',
                        )}`,
                      });
                    } else if (
                      isNonEmptyString(customManager.customType) &&
                      isCustomManager(customManager.customType)
                    ) {
                      if (isNonEmptyArray(customManager.managerFilePatterns)) {
                        switch (customManager.customType) {
                          case 'regex':
                            validateRegexManagerFields(
                              customManager,
                              currentPath,
                              errors,
                            );
                            break;
                          case 'jsonata':
                            validateJSONataManagerFields(
                              customManager,
                              currentPath,
                              errors,
                            );
                            break;
                        }
                      } else {
                        errors.push({
                          topic: ConfigValidationTopic.Error,
                          message: `Each Custom Manager must contain a non-empty managerFilePatterns array`,
                        });
                      }
                    } else {
                      if (
                        isEmptyString(customManager.customType) ||
                        isUndefined(customManager.customType)
                      ) {
                        errors.push({
                          topic: ConfigValidationTopic.Error,
                          message: `Each Custom Manager must contain a non-empty customType string`,
                        });
                      } else {
                        errors.push({
                          topic: ConfigValidationTopic.Error,
                          message: `Invalid customType: ${customManager.customType}. Key is not a custom manager`,
                        });
                      }
                    }
                  }
                }
                if (['matchPackageNames', 'matchDepNames'].includes(key)) {
                  const startPattern = regEx(/!?\//);
                  const endPattern = regEx(/\/g?i?$/);
                  for (const pattern of val as string[]) {
                    if (
                      startPattern.test(pattern) &&
                      endPattern.test(pattern)
                    ) {
                      try {
                        // regEx isn't aware of our !/ prefix but can handle the suffix
                        regEx(pattern.replace(startPattern, '/'));
                      } catch {
                        errors.push({
                          topic: ConfigValidationTopic.Error,
                          message: `Invalid regExp for ${currentPath}: \`${pattern}\``,
                        });
                      }
                    }
                  }
                }
                if (key === 'baseBranchPatterns') {
                  for (const baseBranchPattern of val as string[]) {
                    if (
                      isRegexMatch(baseBranchPattern) &&
                      !getRegexPredicate(baseBranchPattern)
                    ) {
                      errors.push({
                        topic: ConfigValidationTopic.Error,
                        message: `Invalid regExp for ${currentPath}: \`${baseBranchPattern}\``,
                      });
                    }
                  }
                }
                if (
                  (selectors.includes(key) ||
                    key === 'matchCurrentVersion' ||
                    key === 'matchCurrentValue') &&
                  // TODO: can be undefined ? #22198
                  !rulesRe.test(parentPath!) && // Inside a packageRule
                  (isString(parentPath) || !isPreset) // top level in a preset
                ) {
                  errors.push({
                    topic: ConfigValidationTopic.Error,
                    message: `${currentPath}: ${key} should be inside a \`packageRule\` only`,
                  });
                }
              } else {
                errors.push({
                  topic: ConfigValidationTopic.Error,
                  message: `Configuration option \`${currentPath}\` should be a list (Array)`,
                });
              }
            } else if (type === 'string') {
              if (!isString(val)) {
                errors.push({
                  topic: ConfigValidationTopic.Error,
                  message: `Configuration option \`${currentPath}\` should be a string`,
                });
              }
            } else if (type === 'object') {
              if (isPlainObject(val)) {
                if (key === 'registryAliases') {
                  const res = validatePlainObject(val);
                  if (res !== true) {
                    errors.push({
                      topic: ConfigValidationTopic.Error,
                      message: `Invalid \`${currentPath}.${key}.${res}\` configuration: value is not a string`,
                    });
                  }
                } else if (key === 'env') {
                  const allowedEnvVars =
                    configType === 'global'
                      ? coerceArray(config.allowedEnv)
                      : GlobalConfig.get('allowedEnv');
                  for (const [envVarName, envVarValue] of Object.entries(val)) {
                    if (!isString(envVarValue)) {
                      errors.push({
                        topic: ConfigValidationTopic.Error,
                        message: `Invalid env variable value: \`${currentPath}.${envVarName}\` must be a string.`,
                      });
                    }
                    if (!matchRegexOrGlobList(envVarName, allowedEnvVars)) {
                      errors.push({
                        // `Security` is always a fatal error that blocks the rest of the Renovate run.
                        //
                        // As `env` is only applied when it's at the top-level (where `parentPath === undefined`), we should only report a security error there.
                        //
                        // If it's found to be set to a disallowed value - even if it's not going to be used - we should report as an error, which may block the run, but much less worryingly than Security.
                        topic: parentPath
                          ? ConfigValidationTopic.Error
                          : ConfigValidationTopic.Security,
                        message: `Env variable name \`${envVarName}\` is not allowed by this Renovate instance's \`allowedEnv\`.`,
                      });
                    }
                  }
                } else if (key === 'statusCheckNames') {
                  for (const [
                    statusCheckKey,
                    statusCheckValue,
                  ] of Object.entries(val)) {
                    if (
                      !allowedStatusCheckStrings.includes(
                        statusCheckKey as StatusCheckKey,
                      )
                    ) {
                      errors.push({
                        topic: ConfigValidationTopic.Error,
                        message: `Invalid \`${currentPath}.${key}.${statusCheckKey}\` configuration: key is not allowed.`,
                      });
                    }
                    if (!(
                      isString(statusCheckValue) || null === statusCheckValue
                    )) {
                      errors.push({
                        topic: ConfigValidationTopic.Error,
                        message: `Invalid \`${currentPath}.${statusCheckKey}\` configuration: status check is not a string.`,
                      });
                      continue;
                    }
                  }
                } else if (key === 'statusCheckWhen') {
                  const allowedWhenValues = ['always', 'never', 'failed'];
                  for (const [
                    statusCheckKey,
                    statusCheckValue,
                  ] of Object.entries(val)) {
                    if (
                      !allowedStatusCheckStrings.includes(
                        statusCheckKey as StatusCheckKey,
                      )
                    ) {
                      errors.push({
                        topic: ConfigValidationTopic.Error,
                        message: `Invalid \`${currentPath}.${key}.${statusCheckKey}\` configuration: key is not allowed.`,
                      });
                    }
                    if (
                      !isString(statusCheckValue) ||
                      !allowedWhenValues.includes(statusCheckValue)
                    ) {
                      errors.push({
                        topic: ConfigValidationTopic.Error,
                        message: `Invalid \`${currentPath}.${statusCheckKey}\` configuration: value must be one of "always", "never", or "failed".`,
                      });
                      continue;
                    }
                  }
                } else if (key === 'customDatasources') {
                  const allowedKeys = [
                    'description',
                    'defaultRegistryUrlTemplate',
                    'format',
                    'transformTemplates',
                  ];
                  for (const [
                    customDatasourceName,
                    customDatasourceValue,
                  ] of Object.entries(val)) {
                    if (!isPlainObject(customDatasourceValue)) {
                      errors.push({
                        topic: ConfigValidationTopic.Error,
                        message: `Invalid \`${currentPath}.${customDatasourceName}\` configuration: customDatasource is not an object`,
                      });
                      continue;
                    }
                    for (const [subKey, subValue] of Object.entries(
                      customDatasourceValue,
                    )) {
                      if (!allowedKeys.includes(subKey)) {
                        errors.push({
                          topic: ConfigValidationTopic.Error,
                          message: `Invalid \`${currentPath}.${subKey}\` configuration: key is not allowed`,
                        });
                      } else if (subKey === 'transformTemplates') {
                        if (!isArray(subValue, isString)) {
                          errors.push({
                            topic: ConfigValidationTopic.Error,
                            message: `Invalid \`${currentPath}.${subKey}\` configuration: is not an array of string`,
                          });
                        }
                      } else if (subKey === 'description') {
                        if (!(
                          isString(subValue) || isArray(subValue, isString)
                        )) {
                          errors.push({
                            topic: ConfigValidationTopic.Error,
                            message: `Invalid \`${currentPath}.${subKey}\` configuration: is not an array of strings`,
                          });
                        }
                      } else if (!isString(subValue)) {
                        errors.push({
                          topic: ConfigValidationTopic.Error,
                          message: `Invalid \`${currentPath}.${subKey}\` configuration: is a string`,
                        });
                      }
                    }
                  }
                } else if (key === 'installTools') {
                  for (const toolName of Object.keys(val)) {
                    if (!isToolName(toolName)) {
                      warnings.push({
                        topic: ConfigValidationTopic.Error,
                        message: `Invalid \`${currentPath}.${toolName}\` configuration: not a valid tool name.`,
                      });
                    }
                  }
                } else if (key === 'constraints') {
                  const { get: getVersioning } =
                    await import('../modules/versioning/index.ts');
                  for (const [k, v] of Object.entries(val)) {
                    if (!isString(v)) {
                      errors.push({
                        topic: ConfigValidationTopic.Error,
                        message: `Configuration option \`${currentPath}.${k}\` should be an object of key-value pairs of constraints and their value`,
                      });
                      break;
                    }

                    if (!isConstraintName(k)) {
                      warnings.push({
                        topic: ConfigValidationTopic.Error,
                        message: `Configuration option \`${currentPath}.${k}\`: \`${k}\` is not a supported constraint name`,
                      });
                    } else if (isToolName(k)) {
                      // TODO: #31831
                      const versioningId = getToolConfig(k).versioning;
                      const versioning = getVersioning(versioningId);
                      if (!versioning.isValid(v)) {
                        warnings.push({
                          topic: ConfigValidationTopic.Error,
                          message: `Configuration option \`${currentPath}.${k}=${v}\` is not a valid tool version constraint, according to \`${versioningId}\` versioning`,
                        });
                      }
                    }
                  }
                } else if (key === 'constraintsVersioning') {
                  for (const [k, v] of Object.entries(val)) {
                    if (!isString(v)) {
                      errors.push({
                        topic: ConfigValidationTopic.Error,
                        message: `Configuration option \`${currentPath}.${k}\` should be an object of key-value pairs of additional constraint names and their versioning`,
                      });
                      break;
                    }

                    if (isToolName(k)) {
                      errors.push({
                        topic: ConfigValidationTopic.Error,
                        message: `Configuration option \`${currentPath}.${k}\` is not a valid additional constraint name, as \`${k}\` is a tool name, and \`constraintsVersioning\` can only override the versioning for a non-tool constraint`,
                      });
                    } else if (isConstraintName(k)) {
                      const versioningName = v.split(':')[0];
                      if (
                        !AllVersioningsListLiteral.includes(
                          versioningName as VersioningName,
                        )
                      ) {
                        errors.push({
                          topic: ConfigValidationTopic.Error,
                          message: `Configuration option \`${currentPath}.${k}=${v}\`: \`${v}\` is not a valid versioning scheme`,
                        });
                      }
                    } else {
                      errors.push({
                        topic: ConfigValidationTopic.Error,
                        message: `Configuration option \`${currentPath}.${k}\`: \`${k}\` is not a known additional constraint name`,
                      });
                    }
                  }
                } else {
                  const ignoredObjects = options
                    .filter((option) => option.freeChoice)
                    .map((option) => option.name);
                  if (!ignoredObjects.includes(key)) {
                    const subValidation = await validateConfig(
                      configType,
                      val,
                      isPreset,
                      currentPath,
                    );
                    warnings = warnings.concat(subValidation.warnings);
                    errors = errors.concat(subValidation.errors);
                  }
                }
              } else {
                errors.push({
                  topic: ConfigValidationTopic.Error,
                  message: `Configuration option \`${currentPath}\` should be a json object`,
                });
              }
            } else {
              // v8 ignore next -- intentionally unhandled - if we knew what was to be covered here, we'd add validation
              logger.debug(
                {},
                `Unhandled validation for ${type} at \`${currentPath}\``,
              );
            }
          }
        }

        if (key === 'hostRules' && isArray(val)) {
          const allowedHeaders =
            configType === 'global'
              ? coerceArray(config.allowedHeaders)
              : GlobalConfig.get('allowedHeaders');
          for (const rule of val as HostRule[]) {
            if (isNonEmptyString(rule.matchHost)) {
              if (
                rule.matchHost.includes('://') &&
                parseUrl(rule.matchHost) === null
              ) {
                errors.push({
                  topic: ConfigValidationTopic.Error,
                  message: `hostRules matchHost \`${rule.matchHost}\` is not a valid URL.`,
                });
              }
            } else if (isEmptyString(rule.matchHost)) {
              errors.push({
                topic: ConfigValidationTopic.Error,
                message:
                  'Invalid value for hostRules matchHost. It cannot be an empty string.',
              });
            }

            if (
              !isUndefined(rule.allowInternal) &&
              !mayGrantInternalHostAccess(configType)
            ) {
              errors.push({
                // like disallowed `headers` below, `Security` only where the rules are actually applied - see the comment there
                topic: parentPath
                  ? ConfigValidationTopic.Error
                  : ConfigValidationTopic.Security,
                message: allowInternalNotAllowedMessage(configType),
              });
            }

            if (!rule.headers) {
              continue;
            }
            for (const [header, value] of Object.entries(rule.headers)) {
              if (!isString(value)) {
                errors.push({
                  topic: ConfigValidationTopic.Error,
                  message: `Invalid hostRules headers value configuration: header must be a string.`,
                });
              }
              if (!matchRegexOrGlobList(header, allowedHeaders)) {
                errors.push({
                  // `Security` is always a fatal error that blocks the rest of the Renovate run.
                  //
                  // As `hostRules[]` is only applied when it's at the top-level (where `parentPath === undefined`), we should only report a security error there.
                  //
                  // If it's found to be set to a disallowed value - even if it's not going to be used - we should report as an error, which may block the run, but much less worryingly than Security.
                  topic: parentPath
                    ? ConfigValidationTopic.Error
                    : ConfigValidationTopic.Security,
                  message: `hostRules header \`${header}\` is not allowed by this Renovate instance's \`allowedHeaders\`.`,
                });
              }
            }
          }
        }

        if (key === 'matchJsonata' && isArray(val, isString)) {
          for (const expression of val) {
            const res = getExpression(expression);
            if (res instanceof Error) {
              errors.push({
                topic: ConfigValidationTopic.Error,
                message: `Invalid JSONata expression for ${currentPath}: ${res.message}`,
              });
            }
          }
        }
      }

      function sortAll(a: ValidationMessage, b: ValidationMessage): number {
        if (a.topic === b.topic) {
          return a.message > b.message ? 1 : -1;
        }
        return a.topic > b.topic ? 1 : -1;
      }

      errors.sort(sortAll);
      warnings.sort(sortAll);
      return { errors, warnings };
    },
  );
}

/**
 * Basic validation for global config options
 */
async function validateGlobalConfig(
  key: string,
  val: unknown,
  type: string,
  warnings: ValidationMessage[],
  errors: ValidationMessage[],
  currentPath: string | undefined,
  config: AllConfig,
): Promise<void> {
  /* v8 ignore next -- not testable yet */
  if (getDeprecationMessage(key)) {
    warnings.push({
      topic: ConfigValidationTopic.Deprecation,
      message: getDeprecationMessage(key)!,
    });
  }

  if (key === 'binarySource' && val === 'docker') {
    warnings.push({
      topic: ConfigValidationTopic.Deprecation,
      message:
        'Usage of `binarySource=docker` is deprecated, and will be removed in the future. Please migrate to `binarySource=install`. Feedback on the usage of `binarySource=docker` is welcome at https://github.com/renovatebot/renovate/discussions/40742',
    });
  }

  if (val !== null) {
    // v8 ignore else -- TODO: add test #40625
    if (type === 'string') {
      if (isString(val)) {
        if (
          key === 'onboardingConfigFileName' &&
          !getPossibleConfigFileNames({
            configFileNames: config.configFileNames,
            platform: config.platform,
          }).includes(val)
        ) {
          warnings.push({
            topic: ConfigValidationTopic.Error,
            message: `Invalid value \`${val}\` for \`${currentPath}\`. The allowed values are ${getPossibleConfigFileNames(
              {
                configFileNames: config.configFileNames,
                platform: config.platform,
              },
            ).join(', ')}.`,
          });
        } else if (
          key === 'repositoryCache' &&
          !['enabled', 'disabled', 'reset'].includes(val)
        ) {
          warnings.push({
            topic: ConfigValidationTopic.Error,
            message: `Invalid value \`${val}\` for \`${currentPath}\`. The allowed values are ${['enabled', 'disabled', 'reset'].join(', ')}.`,
          });
        } else if (
          key === 'dryRun' &&
          !['extract', 'lookup', 'full'].includes(val)
        ) {
          warnings.push({
            topic: ConfigValidationTopic.Error,
            message: `Invalid value \`${val}\` for \`${currentPath}\`. The allowed values are ${['extract', 'lookup', 'full'].join(', ')}.`,
          });
        } else if (
          key === 'binarySource' &&
          !['docker', 'global', 'install', 'hermit'].includes(val)
        ) {
          warnings.push({
            topic: ConfigValidationTopic.Error,
            message: `Invalid value \`${val}\` for \`${currentPath}\`. The allowed values are ${['docker', 'global', 'install', 'hermit'].join(', ')}.`,
          });
        } else if (
          key === 'requireConfig' &&
          !['required', 'optional', 'ignored'].includes(val)
        ) {
          warnings.push({
            topic: ConfigValidationTopic.Error,
            message: `Invalid value \`${val}\` for \`${currentPath}\`. The allowed values are ${['required', 'optional', 'ignored'].join(', ')}.`,
          });
        } else if (
          key === 'gitUrl' &&
          !['default', 'ssh', 'endpoint'].includes(val)
        ) {
          warnings.push({
            topic: ConfigValidationTopic.Error,
            message: `Invalid value \`${val}\` for \`${currentPath}\`. The allowed values are ${['default', 'ssh', 'endpoint'].join(', ')}.`,
          });
        }

        if (
          key === 'reportType' &&
          ['s3', 'file'].includes(val) &&
          !isString(config.reportPath)
        ) {
          errors.push({
            topic: ConfigValidationTopic.Error,
            message: `reportType '${val}' requires a configured reportPath`,
          });
        }
      } else {
        warnings.push({
          topic: ConfigValidationTopic.Error,
          message: `Configuration option \`${currentPath}\` should be a string.`,
        });
      }
    } else if (type === 'integer') {
      const allowsNegative = optionAllowsNegativeIntegers.has(key);
      warnings.push(...validateNumber(key, val, allowsNegative, currentPath));
    } else if (type === 'boolean') {
      if (val !== true && val !== false) {
        warnings.push({
          topic: ConfigValidationTopic.Error,
          message: `Configuration option \`${currentPath}\` should be a boolean. Found: ${JSON.stringify(
            val,
          )} (${typeof val}).`,
        });
      }
    } else if (type === 'array') {
      if (isArray(val) && key !== 'repositories') {
        for (const [subIndex, subval] of val.entries()) {
          if (isObject(subval)) {
            const subValidation = await validateConfig(
              'global',
              subval,
              false,
              `${currentPath}[${subIndex}]`,
            );
            warnings.push(...subValidation.warnings);
            errors.push(...subValidation.errors);
          }
        }

        if (isRegexOrGlobOption(key)) {
          warnings.push(
            ...regexOrGlobValidator.check({
              val,
              currentPath: currentPath!,
            }),
          );
        }
        if (key === 'gitNoVerify') {
          const allowedValues = ['commit', 'push'];
          for (const value of val as string[]) {
            // v8 ignore else -- TODO: add test #40625
            if (!allowedValues.includes(value)) {
              warnings.push({
                topic: ConfigValidationTopic.Error,
                message: `Invalid value for \`${currentPath}\`. The allowed values are ${allowedValues.join(', ')}.`,
              });
            }
          }
        }
        if (key === 'mergeConfidenceDatasources') {
          const allowedValues = supportedDatasources;
          for (const value of val as string[]) {
            // v8 ignore else -- TODO: add test #40625
            if (!allowedValues.includes(value)) {
              warnings.push({
                topic: ConfigValidationTopic.Error,
                message: `Invalid value \`${value}\` for \`${currentPath}\`. The allowed values are ${allowedValues.join(', ')}.`,
              });
            }
          }
        }
      } else if (isArray(val)) {
        for (const [subIndex, subval] of val.entries()) {
          if (isPlainObject(subval)) {
            if (!isNonEmptyString(subval.repository)) {
              errors.push({
                topic: ConfigValidationTopic.Error,
                message: `${currentPath}[${subIndex}]: each repository object entry must have a \`repository\` string property`,
              });
            }
            const { repository: _, ...repoEntryConfig } = subval;
            // Each repository object entry is validated as its own global config, so it does not automatically see the top-level `allowedEnv`/`allowedHeaders`.
            // Inherit them (unless the entry sets its own) so that entry-level `env`/`headers` are validated against the allowlists, rather than an empty one.
            const subValidation = await validateConfig(
              'global',
              {
                ...(config.allowedEnv ? { allowedEnv: config.allowedEnv } : {}),
                ...(config.allowedHeaders
                  ? { allowedHeaders: config.allowedHeaders }
                  : {}),
                ...repoEntryConfig,
              },
              false,
              `${currentPath}[${subIndex}]`,
            );
            warnings.push(...subValidation.warnings);
            errors.push(...subValidation.errors);
          } else if (isString(subval)) {
            if (!isNonEmptyStringAndNotWhitespace(subval)) {
              warnings.push({
                topic: ConfigValidationTopic.Error,
                message: `${currentPath}[${subIndex}]: each repository string entry entry must be a non-empty string`,
              });
            }
          } else {
            warnings.push({
              topic: ConfigValidationTopic.Error,
              message: `${currentPath}[${subIndex}]: invalid type, should be either a string or an object`,
            });
          }
        }
      } else {
        warnings.push({
          topic: ConfigValidationTopic.Error,
          message: `Configuration option \`${currentPath}\` should be a list (Array).`,
        });
      }
    } else if (type === 'object') {
      if (isPlainObject(val)) {
        if (key === 'onboardingConfig') {
          const subValidation = await validateConfig('repo', val);
          for (const warning of subValidation.warnings.concat(
            subValidation.errors,
          )) {
            warnings.push(warning);
          }
        } else if (key === 'force') {
          // `force` is validated as a global config of its own, so it does not automatically see the top-level `allowedEnv`/`allowedHeaders`.
          // Inherit them (unless `force` sets its own) so that the self-hosted admin's own `force.env`/`force.hostRules[].headers` are validated against the allowlists they set, rather than an empty one.
          const subValidation = await validateConfig('global', {
            ...(config.allowedEnv ? { allowedEnv: config.allowedEnv } : {}),
            ...(config.allowedHeaders
              ? { allowedHeaders: config.allowedHeaders }
              : {}),
            ...val,
          });
          for (const warning of subValidation.warnings.concat(
            subValidation.errors,
          )) {
            warnings.push(warning);
          }
        } else if (key === 'cacheTtlOverride') {
          for (const [subKey, subValue] of Object.entries(val)) {
            const allowsNegative = optionAllowsNegativeIntegers.has(key);
            warnings.push(
              ...validateNumber(
                key,
                subValue,
                allowsNegative,
                currentPath,
                subKey,
              ),
            );

            if (
              !(packageCacheNamespaces as readonly string[]).includes(subKey) &&
              !anyMatchRegexOrGlobList(
                packageCacheNamespaces as unknown as string[],
                [subKey],
              )
            ) {
              errors.push({
                message: `${currentPath}: namespace \`${subKey}\` does not exist`,
                topic: ConfigValidationTopic.Error,
              });
            }
          }
        } else {
          const res = validatePlainObject(val);
          if (res !== true) {
            warnings.push({
              topic: ConfigValidationTopic.Error,
              message: `Invalid \`${currentPath}.${res}\` configuration: value must be a string.`,
            });
          }
        }
      } else {
        warnings.push({
          topic: ConfigValidationTopic.Error,
          message: `Configuration option \`${currentPath}\` should be a JSON object.`,
        });
      }
    }
  }
}

function getPossibleConfigFileNames({
  configFileNames,
  platform,
}: {
  configFileNames?: string[];
  platform?: PlatformId;
}): string[] {
  const filenames = getConfigFileNames(platform);
  if (isNonEmptyArray(configFileNames)) {
    return filenames.concat(configFileNames);
  }

  return filenames;
}