mirror of
https://github.com/renovatebot/renovate.git
synced 2026-11-01 10:09:50 +00:00
826541b266
Previously, we were caching private Go modules' information, even when `cachePrivatePackages=false`. This leads to the module path, versions, and possibly the `go` directive being cached unintentionally. Instead of doing so, we should make sure that we're intentionally caching packages. To do this, we can use a mix of the `GOPRIVATE`/`GONOPROXY` to determine which packages shouldn't be fetched in the public Go proxy, given they're private, following how the Go toolchain itself does this. When interacting with the public Go proxy, we treat these packages as public (as the public Go proxy has no means to authenticate) and so anything outside of this should be treated as private. When `GOPROXY` contains `direct`, we only treat a package as public only when the public proxy is in the list too, the way Go's own default is written. This is used to imply that `direct` is the fallback for whatever the public proxy doesn't have. When thre is no Go proxy set, `GOPROXY=direct` means everything comes from source, which tells us nothing about who is allowed to read it. This doesn't catch everything: with the default `GOPROXY`, a private package the public proxy doesn't have falls through to `direct` and is still cached by Renovate, unless `GOPRIVATE` says otherwise. We only learn that no proxy served it after we've fetched it, which is after `cacheable` is determined. When using Renovate with a private Go proxy mirror, such as Artifactory, this will result in no cached packages until `cachePrivatePackages: true` is set. This is a similar change to #45348. Co-authored-by: Claude Opus 5 <jamie.tanna+claude-code@mend.io>
72 lines
2.8 KiB
TypeScript
72 lines
2.8 KiB
TypeScript
import { getSourceUrl as githubSourceUrl } from '../../../util/github/url.ts';
|
|
import { trimTrailingSlash } from '../../../util/url.ts';
|
|
import { BitbucketTagsDatasource } from '../bitbucket-tags/index.ts';
|
|
import { ForgejoTagsDatasource } from '../forgejo-tags/index.ts';
|
|
import { GiteaTagsDatasource } from '../gitea-tags/index.ts';
|
|
import { GithubTagsDatasource } from '../github-tags/index.ts';
|
|
import { GitlabTagsDatasource } from '../gitlab-tags/index.ts';
|
|
import { getSourceUrl as gitlabSourceUrl } from '../gitlab-tags/util.ts';
|
|
|
|
import { parseGoproxy, parseNoproxy } from './goproxy-parser.ts';
|
|
import type { DataSource, GoproxyItem } from './types.ts';
|
|
|
|
/**
|
|
* The Go module proxy which serves public modules only, and which the Go toolchain uses by default.
|
|
*
|
|
* @see https://go.dev/ref/mod#module-proxy
|
|
*/
|
|
export const publicGoproxyUrl = 'https://proxy.golang.org';
|
|
|
|
/**
|
|
* Whether a module's data may be written to a package cache which is shared with others.
|
|
*
|
|
* `GOPRIVATE`/`GONOPROXY` is how the user declares which modules are private, and `GOPROXY` decides who serves the rest: whatever the public proxy serves is public by definition, whereas a self-hosted proxy may serve modules which are not.
|
|
*
|
|
* `direct` only counts as public alongside the public proxy, which is how Go's own default `GOPROXY` is written: there, it is the fallback for what the public proxy doesn't have. On its own it means every module comes from its source, which tells us nothing about who may read it.
|
|
*
|
|
* An unset `GOPROXY` is the default, so it is public too.
|
|
*
|
|
* @see https://go.dev/ref/mod#private-modules
|
|
*/
|
|
function isPublicProxy({ url }: GoproxyItem): boolean {
|
|
return trimTrailingSlash(url) === publicGoproxyUrl;
|
|
}
|
|
|
|
export function isPublicGoPackage(packageName: string): boolean {
|
|
if (parseNoproxy()?.test(packageName)) {
|
|
return false;
|
|
}
|
|
|
|
const proxies = parseGoproxy();
|
|
|
|
return proxies.every(
|
|
(proxy) =>
|
|
proxy.url === 'off' ||
|
|
isPublicProxy(proxy) ||
|
|
(proxy.url === 'direct' && proxies.some(isPublicProxy)),
|
|
);
|
|
}
|
|
|
|
export function getSourceUrl(
|
|
dataSource?: DataSource | null,
|
|
): string | undefined {
|
|
if (dataSource) {
|
|
const { datasource, registryUrl, packageName } = dataSource;
|
|
|
|
switch (datasource) {
|
|
case ForgejoTagsDatasource.id:
|
|
return ForgejoTagsDatasource.getSourceUrl(packageName, registryUrl);
|
|
case GiteaTagsDatasource.id:
|
|
return GiteaTagsDatasource.getSourceUrl(packageName, registryUrl);
|
|
case GithubTagsDatasource.id:
|
|
return githubSourceUrl(packageName, registryUrl);
|
|
case GitlabTagsDatasource.id:
|
|
return gitlabSourceUrl(packageName, registryUrl);
|
|
case BitbucketTagsDatasource.id:
|
|
return BitbucketTagsDatasource.getSourceUrl(packageName, registryUrl);
|
|
}
|
|
}
|
|
|
|
return undefined;
|
|
}
|