mirror of
https://github.com/renovatebot/renovate.git
synced 2026-10-27 07:50:47 +00:00
a1971afa78
* ci(linter): add renovate/require-regex-util rule Adds a custom oxlint rule that flags raw RegExp usage in lib/ production code: any `new RegExp(...)` call and any regex literal that is not the direct first argument of `regEx(...)`. The regEx() helper from lib/util/regex.ts uses the RE2 engine for ReDoS-safe matching and caches compiled patterns. lib/util/regex.ts itself is exempt. The rule is disabled for **/*.spec.ts, test/**, and tools/** via config overrides, because vitest APIs such as expect.stringMatching need bare RegExp instances (a past commit reverted regEx() there). Severity is set to "warn" instead of "error": the repo currently has 197 pre-existing violations (above the agreed mechanical-fix threshold of 80), and a number of them are deliberately RE2-incompatible patterns (lookahead/lookbehind/named backreferences, see TODO #12872/#12875 markers in e.g. lib/modules/versioning/rez/ pattern.ts and lib/modules/manager/dockerfile/extract.ts) that need per-site judgment before they can be wrapped in regEx() or suppressed with a justified disable comment. No violation fixes are included in this commit. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * ci(linter): enforce renovate/require-regex-util at error Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * refactor: use regEx() for regex literals and RegExp construction in lib Burn down all renovate/require-regex-util violations (197): - wrap RE2-compatible regex literals and RegExp constructions in regEx() - rewrite lookaround patterns where behavior is provably preserved: goproxy separator split, sbt-package link extraction, leiningen comment stripping and keyword search, npm GitHub owner validation (unit-count bound replaced by an explicit length check) - keep native RegExp with disable comments where RE2 cannot be used: moo / good-enough-parser lexer patterns (moo rejects RE2 instances), MigrationsService propertyName (matched via isRegExp, which RE2 instances fail), rez named backreferences and lookaheads, GitHub markdown link negative lookbehind, emoji astral-plane matching - drop stale TODO #12875 comments for patterns current re2 handles Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * refactor: reduce require-regex-util disable comments Rewrite the github massage-markdown-links URL regex to capture an optional `api.` prefix in a named group (skipped in code) instead of relying on a negative lookbehind, so both the base and global variants can use regEx()/RE2 and their two disable comments are removed. Add spec cases for api-prefixed URLs that match the URL shape. Consolidate the four related line disables in rez/pattern.ts (bound and range patterns emulating Python conditional patterns via named backreferences and lookaheads, which RE2 cannot express) into a single block disable/enable pair, matching the treatment of the lexer files. Disable comment count drops from 13 to 8. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * refactor(datasource/sbt-package): use named capture group in link regex Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * refactor(manager/cake): restore original multiLineComment regex spelling The [^] -> [\\s\\S] rewrite was only needed for an RE2 wrap that was later reverted; keep the diff minimal. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(datasource/go): skip empty GOPROXY segments The switch from a lookahead split to a capture-group split (needed because RE2 has no lookahead support) changed how empty GOPROXY segments parse: `a|,b` yielded `{ url: ',', fallback: '|' }` before and `{ url: '', fallback: ',' }` after. The comma fallback only continues on 404/410, so a failing proxy ahead of an empty segment silently stopped the lookup instead of falling through to the remaining proxies. Empty segments carry no url to query, so drop them. * refactor(datasource/go): use isTruthy for empty segment filter * fix(datasource/go): filter empty segments before mapping Filtering after the map broke the contextual typing from the GoproxyItem[] annotation, widening fallback to string. * refactor(platform/github): use regEx() for merge queue query stripping --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
96 lines
2.8 KiB
TypeScript
96 lines
2.8 KiB
TypeScript
import type { lexer, parser } from '@renovatebot/good-enough-parser';
|
|
import { lang, query as q } from '@renovatebot/good-enough-parser';
|
|
import { RANGE_PATTERN } from '@renovatebot/pep440';
|
|
import { regEx } from '../../../util/regex.ts';
|
|
import { normalizePythonDepName } from '../../datasource/pypi/common.ts';
|
|
import { PypiDatasource } from '../../datasource/pypi/index.ts';
|
|
import type {
|
|
ExtractConfig,
|
|
PackageDependency,
|
|
PackageFileContent,
|
|
} from '../types.ts';
|
|
|
|
interface ManagerData {
|
|
lineNumber: number;
|
|
}
|
|
|
|
type Context = PackageFileContent<ManagerData>;
|
|
|
|
const python = lang.createLang('python');
|
|
|
|
// Optimize regex memory usage when we don't need named groups
|
|
function cleanupNamedGroups(regexSource: string): string {
|
|
return regexSource.replace(regEx(/\(\?<\w+>/g), '(?:');
|
|
}
|
|
|
|
const rangePattern = cleanupNamedGroups(RANGE_PATTERN);
|
|
const versionPattern = `(?:${rangePattern}(?:\\s*,\\s*${rangePattern})*)`;
|
|
const depNamePattern = '(?:[a-zA-Z][-_a-zA-Z0-9\\.]*[a-zA-Z0-9])';
|
|
const depPattern = [
|
|
'^',
|
|
`(?<depName>${depNamePattern})`,
|
|
`(?<extra>(?:\\[\\s*(?:${depNamePattern}(?:\\s*,\\s*${depNamePattern})*\\s*)\\])?)`,
|
|
`(?<currentValue>${versionPattern})`,
|
|
].join('\\s*');
|
|
|
|
const extractRegex = regEx(depPattern);
|
|
|
|
// Extract dependency string
|
|
function depStringHandler(
|
|
ctx: Context,
|
|
token: lexer.StringValueToken,
|
|
): Context {
|
|
const depStr = token.value;
|
|
const match = extractRegex.exec(depStr);
|
|
// TODO #22198
|
|
const { depName, currentValue } = match!.groups!;
|
|
|
|
const dep: PackageDependency<ManagerData> = {
|
|
depName,
|
|
packageName: normalizePythonDepName(depName),
|
|
currentValue,
|
|
managerData: {
|
|
lineNumber: token.line - 1,
|
|
},
|
|
datasource: PypiDatasource.id,
|
|
};
|
|
|
|
if (currentValue?.startsWith('==')) {
|
|
dep.currentVersion = currentValue.replace(regEx(/^==\s*/), '');
|
|
}
|
|
|
|
return { ...ctx, deps: [...ctx.deps, dep] };
|
|
}
|
|
|
|
// Add `skip-reason` for dependencies annotated
|
|
// with "# renovate: ignore" comment
|
|
function depSkipHandler(ctx: Context): Context {
|
|
const dep = ctx.deps.at(-1);
|
|
const deps = ctx.deps.slice(0, -1);
|
|
deps.push({ ...dep, skipReason: 'ignored' });
|
|
return { ...ctx, deps };
|
|
}
|
|
|
|
const incompleteDepString = q
|
|
.str<Context>(regEx(cleanupNamedGroups(depPattern)))
|
|
.op(regEx(/^\+|\*$/));
|
|
|
|
const depString = q
|
|
.str<Context>(regEx(cleanupNamedGroups(depPattern)), depStringHandler)
|
|
.opt(
|
|
q
|
|
.opt(q.op<Context>(','))
|
|
.comment(regEx(/^#\s*renovate\s*:\s*ignore\s*$/), depSkipHandler),
|
|
);
|
|
|
|
const query = q.alt(incompleteDepString, depString);
|
|
|
|
export function extractPackageFile(
|
|
content: string,
|
|
_packageFile: string,
|
|
_config: ExtractConfig,
|
|
): PackageFileContent | null {
|
|
const res = python.query<Context, parser.Node>(content, query, { deps: [] });
|
|
return res?.deps?.length ? res : null;
|
|
}
|