Files
renovate/lib/modules/manager/kustomize/artifacts.ts
Sebastian Poxhofer 4b4d14ec00 feat(manager): pass extracted constraints to updateArtifacts (#45826)
* feat(manager): pass extracted constraints to updateArtifacts

`extractedConstraints` were collected during extraction but only ever read
by `fetch.ts` for the lookup. At artifact time every manager had to derive
the same tool constraints a second time, and when the updated package file
no longer carried the constraint there was nothing to fall back to.

`generateBranchConfig()` now merges the `extractedConstraints` of all
upgrades of a branch onto the branch config, which reaches `updateArtifacts()`
through `patchConfigForArtifactsUpdate()`. `UpdateArtifactsConfig` declares
the field and documents what it contains.

The new `resolveToolConstraint()` helper implements the ladder once:
user `constraints` > an optional artifact-time derivation > the extracted
value. The derivation is ranked above the extracted value on purpose: it
reads the package files as the branch changed them, so poetry (python is an
updatable dependency there), composer, pipenv (`pipenv` can be a dev
package) and pep621 (`requires-python` is an updatable dependency) would
otherwise regress to a stale constraint. pipenv, pep621 uv/pdm, poetry and
composer are migrated to the helper and keep their derivation.

Behaviour change: these managers now use the extract-time constraint as a
last resort instead of running unconstrained, for example on lock file
maintenance where pipenv deletes `Pipfile.lock` before deriving.

`execute-post-upgrade-commands.ts` is unaffected: it reads
`upgrade.constraints` per upgrade, and the extracted values are kept in a
separate field rather than folded into `constraints`, so post-upgrade task
tool constraints still come from user config only.

Not migrated, because their constraints are never extracted, so the
fallback would be dead code: bundler (`ruby`/`bundler`), pixi (`pixi`),
pep621 uv (`required-version`) and npm's node ladder, whose last step
already reads `package.json` engines.

* refactor(manager): resolve tool constraints through resolveToolConstraint()

Every manager now obtains the constraint of a tool it runs through
`resolveToolConstraint()` instead of reading `config.constraints` itself, so
the precedence "user config, then a value derived from the updated files, then
the constraints collected during extraction" applies everywhere. The helper
treats an empty string as not set at every step and accepts the
`PostUpdateConfig` shape, whose `constraints` may be `null`.

Behaviour changes that go beyond the new fallback to extracted constraints:

- `mix` applies its hardcoded erlang default only after the extracted
  constraint, so an erlang version collected at extraction can win over it.
- `kustomize` decides `HELM_EXPERIMENTAL_OCI` from the fully resolved helm
  constraint; `generateHelmEnvs()` takes that value instead of the config.
- `npm` (yarn): an upgrade of yarn without a new value now consults the user
  constraint before deriving one from package.json or the lock file.
- The "Using <tool> constraint from config" debug lines in bundler, composer,
  copier and pip-compile are gone, as the helper is the only reader of the
  config now.

Helpers that read the config synchronously became async: bundler
`getBundlerConstraint()`, copier `getPythonVersionConstraint()` and
`getCopierVersionConstraint()`, pip-compile `get*VersionConstraint()` and
`getToolVersionConstraint()`, gomod `deriveGoToolchainConstraints()` and
`getUpdateImportPathCmds()`, mise `getMiseLockToolConstraints()`. composer
`getPhpConstraint()` is removed.

Each converted manager has a test showing the extracted constraint reaching
the executed tool, and, where a derive callback exists, that the derived value
still wins over it.

* refactor(linters): add prefer-resolve-tool-constraint rule

Reports member reads and destructuring of `constraints` and
`extractedConstraints` from a manager config in `lib/modules/manager/**`, so
that tool constraints are resolved through `resolveToolConstraint()` in
`lib/modules/manager/util.ts` only. Writes and the same properties on package
files, which extraction has to populate, are not reported. The helper itself
and spec files are exempt in `.oxlintrc.json`.

* refactor(manager): inline thin resolveToolConstraint wrappers

Drop copier/utils.ts and the pip-compile getPipToolsVersionConstraint /
getUvVersionConstraint helpers, which only forwarded to
resolveToolConstraint(). Callers now call it directly.

* docs(development): note lock file maintenance in tool constraints section

* refactor(manager): address review on tool constraint resolution

composer only runs extractConstraints() when a user constraint is missing,
via Lazy. UpdateArtifactsConfig no longer re-declares constraints and
extractedConstraints, which ToolConstraintsConfig already provides.
2026-09-14 11:09:07 +00:00

239 lines
6.3 KiB
TypeScript

import { isNonEmptyString, isNullOrUndefined } from '@sindresorhus/is';
import { quote } from 'shlex';
import upath from 'upath';
import { TEMPORARY_ERROR } from '../../../constants/error-messages.ts';
import { logger } from '../../../logger/index.ts';
import { coerceArray } from '../../../util/array.ts';
import { exec } from '../../../util/exec/index.ts';
import type { ExecOptions, ToolConstraint } from '../../../util/exec/types.ts';
import {
deleteLocalFile,
getSiblingFileName,
localPathExists,
readLocalFile,
} from '../../../util/fs/index.ts';
import { getRepoStatus } from '../../../util/git/index.ts';
import { DockerDatasource } from '../../datasource/docker/index.ts';
import { HelmDatasource } from '../../datasource/helm/index.ts';
import type { UpdateArtifact, UpdateArtifactsResult } from '../types.ts';
import { resolveToolConstraint } from '../util.ts';
import { generateHelmEnvs } from './common.ts';
import { parseKustomize } from './extract.ts';
async function localExistingChartPath(
chartHome: string,
dependencyName: string,
version?: string,
): Promise<string | null> {
const folderName = `${dependencyName}-${version}`;
const path = upath.join(chartHome, folderName);
const pathExists = await localPathExists(path);
return pathExists ? path : null;
}
function helmRepositoryArgs(
repository: string,
depName: string,
datasource?: string,
): string {
switch (datasource) {
case HelmDatasource.id:
return `--repo ${quote(repository)} ${quote(depName)}`;
case DockerDatasource.id:
return quote(`oci://${repository}`);
/* v8 ignore next: should never happen */
default:
throw new Error(`Unknown datasource: ${datasource}`);
}
}
async function inflateHelmChart(
flagEnabled: boolean,
execOptions: ExecOptions,
chartHome: string,
depName: string,
repository: string,
currentVersion: string,
newVersion?: string,
datasource?: string,
): Promise<void> {
const currentChartExistingPath = await localExistingChartPath(
chartHome,
depName,
currentVersion,
);
if (!flagEnabled && isNullOrUndefined(currentChartExistingPath)) {
logger.debug(
`Not inflating Helm chart for ${depName} as kustomizeInflateHelmCharts is not enabled and the current version isn't inflated`,
);
return;
}
if (
isNonEmptyString(currentChartExistingPath) &&
isNonEmptyString(newVersion)
) {
logger.debug(`Deleting previous helm chart: ${currentChartExistingPath}`);
await deleteLocalFile(currentChartExistingPath);
}
const versionToPull = newVersion ?? currentVersion;
const versionToPullExistingPath = await localExistingChartPath(
chartHome,
depName,
versionToPull,
);
if (isNonEmptyString(versionToPullExistingPath)) {
logger.debug(
`Helm chart ${depName} version ${versionToPull} already exists at ${versionToPullExistingPath}`,
);
return;
}
const folderName = `${depName}-${versionToPull}`;
const untarDir = upath.join(chartHome, folderName);
logger.debug(
`Pulling helm chart ${depName} version ${versionToPull} to ${untarDir}`,
);
const cmd =
`helm pull --untar --untardir ${quote(untarDir)} ` +
`--version ${quote(versionToPull)} ${helmRepositoryArgs(repository, depName, datasource)}`;
await exec(cmd, execOptions);
}
export async function updateArtifacts({
packageFileName,
updatedDeps,
newPackageFileContent,
config,
}: UpdateArtifact): Promise<UpdateArtifactsResult[] | null> {
logger.debug(`kustomize.updateArtifacts(${packageFileName})`);
const project = parseKustomize(newPackageFileContent);
const isUpdateOptionInflateChartArchives =
config.postUpdateOptions?.includes('kustomizeInflateHelmCharts') === true;
if (isNullOrUndefined(project)) {
return [
{
artifactError: {
stderr: 'Failed to parse new package file content',
},
},
];
}
const chartHome = getSiblingFileName(
packageFileName,
project.helmGlobals?.chartHome ?? 'charts',
);
try {
const helmConstraint = await resolveToolConstraint(config, 'helm');
const helmToolConstraint: ToolConstraint = {
toolName: 'helm',
constraint: helmConstraint,
};
const execOptions: ExecOptions = {
docker: {},
extraEnv: generateHelmEnvs(helmConstraint),
toolConstraints: [helmToolConstraint],
};
for (const dependency of updatedDeps) {
if (!dependency.currentVersion) {
continue;
}
if (dependency.newVersion === dependency.currentVersion) {
continue;
}
if (!isNonEmptyString(dependency.depName)) {
continue;
}
if (dependency.depType !== 'HelmChart') {
continue;
}
let repository = null;
switch (dependency.datasource) {
case HelmDatasource.id:
repository = dependency.registryUrls?.[0];
break;
case DockerDatasource.id:
repository = dependency.packageName;
break;
}
if (isNullOrUndefined(repository)) {
continue;
}
await inflateHelmChart(
isUpdateOptionInflateChartArchives,
execOptions,
chartHome,
dependency.depName,
repository,
dependency.currentVersion,
dependency.newVersion,
dependency.datasource,
);
}
const status = await getRepoStatus();
const chartsAddition = coerceArray(status?.not_added);
const chartsDeletion = coerceArray(status?.deleted);
const fileChanges: UpdateArtifactsResult[] = [];
for (const file of chartsAddition) {
// only add artifacts in the chartHome path
if (!file.startsWith(chartHome)) {
continue;
}
fileChanges.push({
file: {
type: 'addition',
path: file,
contents: await readLocalFile(file),
},
});
}
for (const file of chartsDeletion) {
// only add artifacts in the chartHome path
if (!file.startsWith(chartHome)) {
continue;
}
fileChanges.push({
file: {
type: 'deletion',
path: file,
},
});
}
return fileChanges.length > 0 ? fileChanges : null;
} catch (err) {
if (err.message === TEMPORARY_ERROR) {
throw err;
}
logger.debug({ err }, 'Failed to inflate helm chart');
return [
{
artifactError: {
stderr: err.message,
},
},
];
}
}