Files
renovate/lib/modules/manager/mix/artifacts.ts
Sebastian Poxhofer 4b4d14ec00 feat(manager): pass extracted constraints to updateArtifacts (#45826)
* feat(manager): pass extracted constraints to updateArtifacts

`extractedConstraints` were collected during extraction but only ever read
by `fetch.ts` for the lookup. At artifact time every manager had to derive
the same tool constraints a second time, and when the updated package file
no longer carried the constraint there was nothing to fall back to.

`generateBranchConfig()` now merges the `extractedConstraints` of all
upgrades of a branch onto the branch config, which reaches `updateArtifacts()`
through `patchConfigForArtifactsUpdate()`. `UpdateArtifactsConfig` declares
the field and documents what it contains.

The new `resolveToolConstraint()` helper implements the ladder once:
user `constraints` > an optional artifact-time derivation > the extracted
value. The derivation is ranked above the extracted value on purpose: it
reads the package files as the branch changed them, so poetry (python is an
updatable dependency there), composer, pipenv (`pipenv` can be a dev
package) and pep621 (`requires-python` is an updatable dependency) would
otherwise regress to a stale constraint. pipenv, pep621 uv/pdm, poetry and
composer are migrated to the helper and keep their derivation.

Behaviour change: these managers now use the extract-time constraint as a
last resort instead of running unconstrained, for example on lock file
maintenance where pipenv deletes `Pipfile.lock` before deriving.

`execute-post-upgrade-commands.ts` is unaffected: it reads
`upgrade.constraints` per upgrade, and the extracted values are kept in a
separate field rather than folded into `constraints`, so post-upgrade task
tool constraints still come from user config only.

Not migrated, because their constraints are never extracted, so the
fallback would be dead code: bundler (`ruby`/`bundler`), pixi (`pixi`),
pep621 uv (`required-version`) and npm's node ladder, whose last step
already reads `package.json` engines.

* refactor(manager): resolve tool constraints through resolveToolConstraint()

Every manager now obtains the constraint of a tool it runs through
`resolveToolConstraint()` instead of reading `config.constraints` itself, so
the precedence "user config, then a value derived from the updated files, then
the constraints collected during extraction" applies everywhere. The helper
treats an empty string as not set at every step and accepts the
`PostUpdateConfig` shape, whose `constraints` may be `null`.

Behaviour changes that go beyond the new fallback to extracted constraints:

- `mix` applies its hardcoded erlang default only after the extracted
  constraint, so an erlang version collected at extraction can win over it.
- `kustomize` decides `HELM_EXPERIMENTAL_OCI` from the fully resolved helm
  constraint; `generateHelmEnvs()` takes that value instead of the config.
- `npm` (yarn): an upgrade of yarn without a new value now consults the user
  constraint before deriving one from package.json or the lock file.
- The "Using <tool> constraint from config" debug lines in bundler, composer,
  copier and pip-compile are gone, as the helper is the only reader of the
  config now.

Helpers that read the config synchronously became async: bundler
`getBundlerConstraint()`, copier `getPythonVersionConstraint()` and
`getCopierVersionConstraint()`, pip-compile `get*VersionConstraint()` and
`getToolVersionConstraint()`, gomod `deriveGoToolchainConstraints()` and
`getUpdateImportPathCmds()`, mise `getMiseLockToolConstraints()`. composer
`getPhpConstraint()` is removed.

Each converted manager has a test showing the extracted constraint reaching
the executed tool, and, where a derive callback exists, that the derived value
still wins over it.

* refactor(linters): add prefer-resolve-tool-constraint rule

Reports member reads and destructuring of `constraints` and
`extractedConstraints` from a manager config in `lib/modules/manager/**`, so
that tool constraints are resolved through `resolveToolConstraint()` in
`lib/modules/manager/util.ts` only. Writes and the same properties on package
files, which extraction has to populate, are not reported. The helper itself
and spec files are exempt in `.oxlintrc.json`.

* refactor(manager): inline thin resolveToolConstraint wrappers

Drop copier/utils.ts and the pip-compile getPipToolsVersionConstraint /
getUvVersionConstraint helpers, which only forwarded to
resolveToolConstraint(). Callers now call it directly.

* docs(development): note lock file maintenance in tool constraints section

* refactor(manager): address review on tool constraint resolution

composer only runs extractConstraints() when a user constraint is missing,
via Lazy. UpdateArtifactsConfig no longer re-declares constraints and
extractedConstraints, which ToolConstraintsConfig already provides.
2026-09-14 11:09:07 +00:00

245 lines
6.4 KiB
TypeScript

import { isEmptyArray, isString } from '@sindresorhus/is';
import { quote } from 'shlex';
import { GlobalConfig } from '../../../config/global.ts';
import { TEMPORARY_ERROR } from '../../../constants/error-messages.ts';
import { logger } from '../../../logger/index.ts';
import { exec } from '../../../util/exec/index.ts';
import type { ExecOptions } from '../../../util/exec/types.ts';
import {
deleteLocalFile,
ensureCacheDir,
findLocalSiblingOrParent,
getSiblingFileName,
localPathExists,
readLocalFile,
writeLocalFile,
} from '../../../util/fs/index.ts';
import * as hostRules from '../../../util/host-rules.ts';
import { regEx } from '../../../util/regex.ts';
import type { UpdateArtifact, UpdateArtifactsResult } from '../types.ts';
import { resolveToolConstraint } from '../util.ts';
const hexRepoUrl = 'https://hex.pm/';
const hexRepoOrgUrlRegex = regEx(
`^https://hex\\.pm/api/repos/(?<organization>[a-z0-9_]+)/$`,
);
export async function updateArtifacts({
packageFileName,
updatedDeps,
newPackageFileContent,
config,
}: UpdateArtifact): Promise<UpdateArtifactsResult[] | null> {
logger.debug(`mix.getArtifacts(${packageFileName})`);
const { isLockFileMaintenance } = config;
if (isEmptyArray(updatedDeps) && !isLockFileMaintenance) {
logger.debug('No updated mix deps');
return null;
}
let lockFileName = getSiblingFileName(packageFileName, 'mix.lock');
let isUmbrella = false;
let existingLockFileContent = await readLocalFile(lockFileName, 'utf8');
if (!existingLockFileContent) {
const lockFileError = await checkLockFileReadError(lockFileName);
if (lockFileError) {
return lockFileError;
}
const parentLockFileName = await findLocalSiblingOrParent(
packageFileName,
'mix.lock',
);
existingLockFileContent =
parentLockFileName && (await readLocalFile(parentLockFileName, 'utf8'));
if (parentLockFileName && existingLockFileContent) {
lockFileName = parentLockFileName;
isUmbrella = true;
} else if (parentLockFileName) {
const lockFileError = await checkLockFileReadError(parentLockFileName);
if (lockFileError) {
return lockFileError;
}
}
}
if (isLockFileMaintenance && isUmbrella) {
logger.debug(
`Cannot use lockFileMaintenance in an umbrella project, see ${GlobalConfig.get('productLinks').documentation}modules/manager/mix/#lockFileMaintenance`,
);
return null;
}
if (isLockFileMaintenance && !existingLockFileContent) {
logger.debug(
'Cannot use lockFileMaintenance when no mix.lock file is present',
);
return null;
}
try {
await writeLocalFile(packageFileName, newPackageFileContent);
if (isLockFileMaintenance) {
await deleteLocalFile(lockFileName);
}
} catch (err) {
logger.warn({ err }, 'mix.exs could not be written');
return [
{
artifactError: {
fileName: lockFileName,
stderr: err.message,
},
},
];
}
if (!existingLockFileContent) {
logger.debug('No mix.lock found');
return null;
}
const organizations = new Set<string>();
const hexHostRulesWithMatchHost = hostRules
.getAll()
.filter(
(hostRule) =>
!!hostRule.matchHost && hexRepoOrgUrlRegex.test(hostRule.matchHost),
);
for (const { matchHost } of hexHostRulesWithMatchHost) {
if (matchHost) {
const result = hexRepoOrgUrlRegex.exec(matchHost);
if (result?.groups) {
const { organization } = result.groups;
organizations.add(organization);
}
}
}
for (const { packageName } of updatedDeps) {
if (packageName) {
const [, organization] = packageName.split(':');
if (organization) {
organizations.add(organization);
}
}
}
const preCommands = Array.from(organizations).reduce((acc, organization) => {
const url = `${hexRepoUrl}api/repos/${organization}/`;
const { token } = hostRules.find({ url });
if (token) {
logger.debug(`Authenticating to hex organization ${organization}`);
const authCommand = `mix hex.organization auth ${quote(organization)} --key ${quote(token)}`;
return [...acc, authCommand];
}
return acc;
}, [] as string[]);
// renovate: will update this
const erlangVersion = '26';
const execOptions: ExecOptions = {
extraEnv: {
// https://hexdocs.pm/mix/1.15.0/Mix.Tasks.Archive.html
// TODO: should include a version constraint
MIX_ARCHIVES: await ensureCacheDir('mix_archives'),
},
cwdFile: lockFileName,
docker: {},
toolConstraints: [
{
toolName: 'erlang',
// https://hexdocs.pm/elixir/1.14.5/compatibility-and-deprecations.html#compatibility-between-elixir-and-erlang-otp
constraint:
(await resolveToolConstraint(config, 'erlang')) ??
`^${erlangVersion}`,
},
{
toolName: 'elixir',
constraint: await resolveToolConstraint(config, 'elixir'),
},
],
preCommands,
};
let command: string;
if (isLockFileMaintenance) {
command = 'mix deps.get';
} else {
command = [
'mix',
'deps.update',
...updatedDeps
.map((dep) => dep.depName)
.filter(isString)
.map((dep) => quote(dep)),
].join(' ');
}
try {
await exec(command, execOptions);
} catch (err) {
/* v8 ignore if -- defensive rethrow of TEMPORARY_ERROR from exec, not reproduced in mix specs */
if (err.message === TEMPORARY_ERROR) {
throw err;
}
logger.debug(
{ err, message: err.message, command },
'Failed to update Mix lock file',
);
return [
{
artifactError: {
fileName: lockFileName,
stderr: err.message,
},
},
];
}
const newMixLockContent = await readLocalFile(lockFileName, 'utf8');
if (existingLockFileContent === newMixLockContent) {
logger.debug('mix.lock is unchanged');
return null;
}
logger.debug('Returning updated mix.lock');
return [
{
file: {
type: 'addition',
path: lockFileName,
contents: newMixLockContent,
},
},
];
}
async function checkLockFileReadError(
lockFileName: string,
): Promise<UpdateArtifactsResult[] | null> {
if (await localPathExists(lockFileName)) {
return [
{
artifactError: {
fileName: lockFileName,
stderr: `Error reading ${lockFileName}`,
},
},
];
}
return null;
}