renovate/lib/config/validation.ts

import is, {
  isArray,
  isBoolean,
  isEmptyString,
  isNonEmptyArray,
  isNonEmptyString,
  isNonEmptyStringAndNotWhitespace,
  isObject,
  isPlainObject,
  isString,
  isUndefined,
} from '@sindresorhus/is';
import type { PlatformId } from '../constants/index.ts';
import { instrument } from '../instrumentation/index.ts';
import { logger } from '../logger/index.ts';
import { AllManagersListLiteral } from '../manager-list.generated.ts';
import { isCustomManager } from '../modules/manager/custom/index.ts';
import type { CustomManager } from '../modules/manager/custom/types.ts';
import type { HostRule } from '../types/index.ts';
import { coerceArray } from '../util/array.ts';
import { packageCacheNamespaces } from '../util/cache/package/namespaces.ts';
import { clone } from '../util/clone.ts';
import { getToolConfig } from '../util/exec/containerbase.ts';
import { isConstraintName, isToolName } from '../util/exec/types.ts';
import { isValidCommitTrailer } from '../util/git/commit-trailers.ts';
import { getExpression } from '../util/jsonata.ts';
import { regEx } from '../util/regex.ts';
import {
  anyMatchRegexOrGlobList,
  getRegexOrGlobPredicate,
  getRegexPredicate,
  isRegexMatch,
  matchRegexOrGlobList,
} from '../util/string-match.ts';
import * as template from '../util/template/index.ts';
import { parseUrl } from '../util/url.ts';
import {
  AllVersioningsListLiteral,
  type VersioningName,
} from '../versioning-list.generated.ts';
import {
  hasValidSchedule,
  hasValidTimezone,
} from '../workers/repository/update/branch/schedule.ts';
import { getConfigFileNames } from './app-strings.ts';
import { GlobalConfig } from './global.ts';
import { migrateConfig } from './migration.ts';
import { getOptions } from './options/index.ts';
import {
  describeAllowedLocations,
  getAllowedParents,
} from './options/scopes.ts';
import { resolveConfigPresets } from './presets/index.ts';
import { isRelativePresetReference, parsePreset } from './presets/parse.ts';
import type {
  AllConfig,
  AllowedParents,
  RenovateConfig,
  RenovateOptions,
  StatusCheckKey,
  StatusCheckWhen,
  ValidationMessage,
  ValidationResult,
} from './types.ts';
import {
  allowedStatusCheckStrings,
  allowedStatusCheckWhenValues,
} from './types.ts';
import * as matchBaseBranchesValidator from './validation-helpers/match-base-branches.ts';
import * as regexOrGlobValidator from './validation-helpers/regex-glob-matchers.ts';
import { ConfigValidationTopic } from './validation-helpers/types.ts';
import {
  getParentName,
  isFalseGlobal,
  validateJSONataManagerFields,
  validateNumber,
  validatePlainObject,
  validateRegexManagerFields,
} from './validation-helpers/utils.ts';

const options = getOptions();

let optionsInitialized = false;
let optionTypes: Record<string, RenovateOptions['type']>;
let optionParents: Record<string, AllowedParents[]>;
let optionLocations: Record<string, string>;
let optionGlobals: Set<string>;
let optionInherits: Set<string>;
let optionRegexOrGlob: Set<string>;
let optionAllowsNegativeIntegers: Set<string>;
let optionSupportsTemplating: Set<string>;
let optionsByName: Map<string, RenovateOptions>;

const managerList: readonly string[] = AllManagersListLiteral;

const topLevelObjects = [...managerList, 'env'];

const ignoredNodes = [
  '$schema',
  'headers',
  'depType',
  'npmToken',
  'packageFile',
  'forkToken',
  'repository',
  'vulnerabilityAlertsOnly',
  'vulnerabilityAlert',
  'isVulnerabilityAlert',
  'vulnerabilityFixVersion', // not intended to be used by end users but may be by Mend apps
  'copyLocalLibs', // deprecated - functionality is now enabled by default
  'prBody', // deprecated
  'minimumConfidence', // undocumented feature flag
];
const tzRe = regEx(/^:timezone\((?<timezone>.+)\)$/);
const rulesRe = regEx(/p.*Rules\[\d+\]$/);
const repoEntryRe = regEx(/^repositories\[\d+\]$/);

function isIgnored(key: string): boolean {
  return ignoredNodes.includes(key);
}

function getDeprecationMessage(option: string): string | undefined {
  const deprecatedOptions: Record<string, string | undefined> = {
    branchName: `Direct editing of branchName is now deprecated. Please edit branchPrefix, additionalBranchPrefix, or branchTopic instead`,
    commitMessage: `Direct editing of commitMessage is now deprecated. Please edit commitMessage's subcomponents instead.`,
    prTitle: `Direct editing of prTitle is now deprecated. Please edit commitMessage subcomponents instead as they will be passed through to prTitle.`,
  };
  if (deprecatedOptions[option]) {
    return deprecatedOptions[option];
  }

  const found = options.find((o) => o.name === option);
  if (!found) {
    return undefined;
  }

  if (!found.deprecationMsg) {
    return undefined;
  }

  return `The '${option}' option is deprecated: ${found.deprecationMsg}`;
}

function isInhertConfigOption(key: string): boolean {
  return optionInherits.has(key);
}

function isRegexOrGlobOption(key: string): boolean {
  return optionRegexOrGlob.has(key);
}

function isGlobalOption(key: string): boolean {
  return optionGlobals.has(key);
}

function initOptions(): void {
  if (optionsInitialized) {
    return;
  }

  optionParents = {};
  optionLocations = {};
  optionInherits = new Set();
  optionTypes = {};
  optionRegexOrGlob = new Set();
  optionGlobals = new Set();
  optionAllowsNegativeIntegers = new Set();
  optionSupportsTemplating = new Set();
  optionsByName = new Map();

  for (const option of options) {
    optionTypes[option.name] = option.type;

    optionsByName.set(option.name, option);

    const parents = getAllowedParents(option);
    /* an option which can be used anywhere is valid in any object, even one which `any` doesn't (yet) expand to */
    if (parents && !option.scopes?.includes('any')) {
      optionParents[option.name] = parents;
      // TODO: types (#22198)
      optionLocations[option.name] = describeAllowedLocations(option)!;
    }

    if (option.inheritConfigSupport) {
      optionInherits.add(option.name);
    }

    if (option.patternMatch) {
      optionRegexOrGlob.add(option.name);
    }

    if (option.globalOnly) {
      optionGlobals.add(option.name);
    }

    if (option.allowNegative) {
      optionAllowsNegativeIntegers.add(option.name);
    }

    if (option.supportsTemplating) {
      optionSupportsTemplating.add(option.name);
    }
  }

  optionsInitialized = true;
}

/**
 * Removes every relative preset reference from a deep copy of the given
 * `packageRules` entry, at any nesting depth.
 *
 * Relative references are only resolvable while the preset which contains them
 * is fetched, so they must not be passed to `resolveConfigPresets()` during
 * validation. They are still syntax checked by the `extends` validation.
 */
function stripRelativePresets(packageRule: RenovateConfig): {
  rule: RenovateConfig;
  hasRelativePresets: boolean;
} {
  const rule = clone(packageRule);
  const hasRelativePresets = stripRelativePresetsFromValue(rule);
  return { rule, hasRelativePresets };
}

function stripRelativePresetsFromValue(value: unknown): boolean {
  if (isArray(value)) {
    let stripped = false;
    for (const element of value) {
      stripped = stripRelativePresetsFromValue(element) || stripped;
    }
    return stripped;
  }

  if (!isPlainObject(value)) {
    return false;
  }

  let stripped = false;
  for (const [key, val] of Object.entries(value)) {
    if (key === 'extends' && isArray(val)) {
      const remaining = val.filter(
        (preset) => !(isString(preset) && isRelativePresetReference(preset)),
      );
      if (remaining.length !== val.length) {
        value[key] = remaining;
        stripped = true;
      }
      continue;
    }

    stripped = stripRelativePresetsFromValue(val) || stripped;
  }
  return stripped;
}

type ConfigType = 'global' | 'inherit' | 'repo';

/**
 * Whether a `hostRules` `allowInternal` is honored from this kind of config.
 *
 * Only the self-hosted administrator's own configuration may grant access to internal hosts. The inherited config repository belongs to the organization rather than to them, so its rules only count where the administrator has opted into trusting them with `inheritConfigTrusted`.
 */
function mayGrantInternalHostAccess(configType: ConfigType): boolean {
  if (configType === 'global') {
    return true;
  }
  if (configType === 'inherit') {
    return GlobalConfig.get('inheritConfigTrusted');
  }
  return false;
}

function allowInternalNotAllowedMessage(configType: ConfigType): string {
  if (configType === 'inherit') {
    return 'hostRules `allowInternal` is not allowed in inherited config, as this Renovate instance has not set `inheritConfigTrusted=true`. The administrator can either set it, or move the rule to their global config or a `repositories[]` entry.';
  }
  return `hostRules \`allowInternal\` is only allowed in the self-hosted administrator's own configuration.`;
}

export async function validateConfig(
  configType: ConfigType,
  config: AllConfig,
  isPreset?: boolean,
  parentPath?: string,
  // the name of the option that `config` is a value of, for when it can't be derived from `parentPath` (i.e. the name of a `customDatasources` entry is the user's choice)
  parentOptionName?: string,
): Promise<ValidationResult> {
  return instrument(
    `validateConfig(${configType}, ${JSON.stringify(parentPath)})`,
    async () => {
      initOptions();

      let errors: ValidationMessage[] = [];
      let warnings: ValidationMessage[] = [];

      for (const [key, val] of Object.entries(config)) {
        const currentPath = parentPath ? `${parentPath}.${key}` : key;
        /* v8 ignore next -- TODO: add test */
        if (key === '__proto__') {
          errors.push({
            topic: ConfigValidationTopic.Security,
            message: '__proto__',
          });
          continue;
        }
        if (
          parentPath &&
          parentPath !== 'onboardingConfig' &&
          !repoEntryRe.test(parentPath) &&
          topLevelObjects.includes(key)
        ) {
          errors.push({
            topic: ConfigValidationTopic.Error,
            message: `The "${key}" object can only be configured at the top level of a config but was found inside "${parentPath}"`,
          });
        }

        if (isGlobalOption(key)) {
          if (configType === 'global') {
            await validateGlobalConfig(
              key,
              val,
              optionTypes[key],
              warnings,
              errors,
              currentPath,
              config,
            );
            continue;
          } else if (
            !isFalseGlobal(key, parentPath) &&
            !(configType === 'inherit' && isInhertConfigOption(key))
          ) {
            warnings.push({
              topic: ConfigValidationTopic.Error,
              message: `The "${key}" option is a global option reserved only for Renovate's global configuration and cannot be configured within a repository's config file.`,
            });
            continue;
          }
        }
        if (key === 'registryUrls' && !parentPath && isNonEmptyArray(val)) {
          warnings.push({
            topic: ConfigValidationTopic.Warning,
            message:
              'Setting `registryUrls` at the top level of your config will apply it to all managers and datasources, which can cause the wrong registry URL to be used for some packages. Use `registryUrls` inside `packageRules` to target specific managers or packages.',
          });
        }
        if (
          key === 'defaultRegistryUrls' &&
          !parentPath &&
          isNonEmptyArray(val)
        ) {
          warnings.push({
            topic: ConfigValidationTopic.Warning,
            message:
              'Setting `defaultRegistryUrls` at the top level of your config will apply it to all managers and datasources, which can cause the wrong registry URL to be used for some packages. Use `defaultRegistryUrls` inside `packageRules` to target specific managers or packages.',
          });
        }
        if (
          !isIgnored(key) && // We need to ignore some reserved keys
          !(is as any).function(val) // Ignore all functions
        ) {
          if (getDeprecationMessage(key)) {
            warnings.push({
              topic: ConfigValidationTopic.Deprecation,
              message: getDeprecationMessage(key)!,
            });
          }
          if (optionSupportsTemplating.has(key) && val) {
            try {
              // TODO: types (#22198)
              template.validate((val as string).toString());
            } catch {
              errors.push({
                topic: ConfigValidationTopic.Error,
                message: `Invalid template in config path: ${currentPath}`,
              });
            }
          }
          const parentName =
            parentOptionName ??
            (parentPath &&
            (parentPath === 'onboardingConfig' || repoEntryRe.test(parentPath))
              ? '.'
              : getParentName(parentPath));
          if (
            !isPreset &&
            parentName &&
            optionParents[key] &&
            !optionParents[key].includes(parentName as AllowedParents) &&
            /* an object which may only be top-level is already reported above, with a message which says so more precisely */
            !topLevelObjects.includes(key)
          ) {
            /* the path of the parent, like `packageRules[1]`, naming a custom manager like we do in `enabledManagers` */
            const { customType } = config as Partial<CustomManager>;
            const parent =
              parentName === 'customManagers' && isString(customType)
                ? parentPath?.replace('customManagers', `custom.${customType}`)
                : parentPath;
            const usedIn =
              parentName === '.'
                ? 'at the top level of a config'
                : `in "${parent}"`;
            const message = `"${key}" can't be used ${usedIn}, as it can only be used ${optionLocations[key]}.`;
            warnings.push({
              topic: `${parentPath ? `${parentPath}.` : ''}${key}`,
              message,
            });
          }

          // v8 ignore else -- intentionally unhandled - if we knew what was to be covered here, we'd add validation
          if (!optionTypes[key]) {
            errors.push({
              topic: ConfigValidationTopic.Error,
              message: `Invalid configuration option: ${currentPath}`,
            });
          } else if (key === 'schedule' && isArray(val, isString)) {
            const [validSchedule, errorMessage] = hasValidSchedule(val);
            if (!validSchedule) {
              errors.push({
                topic: ConfigValidationTopic.Error,
                message: `Invalid ${currentPath}: \`${errorMessage}\``,
              });
            }
          } else if (
            [
              'allowedVersions',
              'matchCurrentVersion',
              'matchCurrentValue',
              'matchNewValue',
            ].includes(key) &&
            isRegexMatch(val)
          ) {
            if (!getRegexPredicate(val)) {
              errors.push({
                topic: ConfigValidationTopic.Error,
                message: `Invalid regExp for ${currentPath}: \`${val}\``,
              });
            }
          } else if (key === 'timezone' && val !== null) {
            const [validTimezone, errorMessage] = hasValidTimezone(
              val as string,
            );
            if (!validTimezone) {
              errors.push({
                topic: ConfigValidationTopic.Error,
                message: `${currentPath}: ${errorMessage}`,
              });
            }
          } else if (val !== null) {
            const type = optionTypes[key];
            if (type === 'boolean') {
              if (val !== true && val !== false) {
                errors.push({
                  topic: ConfigValidationTopic.Error,
                  message: `Configuration option \`${currentPath}\` should be boolean. Found: ${JSON.stringify(
                    val,
                  )} (${typeof val})`,
                });
              }
            } else if (type === 'integer') {
              const allowsNegative = optionAllowsNegativeIntegers.has(key);
              errors.push(
                ...validateNumber(key, val, allowsNegative, currentPath),
              );
            } else if (type === 'array' && val) {
              if (isArray(val)) {
                validateStringArray(key, val, currentPath, errors);
                for (const [subIndex, subval] of val.entries()) {
                  if (isObject(subval)) {
                    const subValidation = await validateConfig(
                      configType,
                      subval,
                      isPreset,
                      `${currentPath}[${subIndex}]`,
                    );
                    warnings = warnings.concat(subValidation.warnings);
                    errors = errors.concat(subValidation.errors);
                  }
                }
                if (isRegexOrGlobOption(key)) {
                  errors.push(
                    ...regexOrGlobValidator.check({
                      val,
                      currentPath,
                    }),
                  );
                }
                if (key === 'extends') {
                  for (const subval of val) {
                    if (isString(subval)) {
                      if (
                        configType !== 'global' &&
                        subval.startsWith('global:')
                      ) {
                        errors.push({
                          topic: ConfigValidationTopic.Error,
                          message: `${currentPath}: you cannot extend from "global:" presets in a repository config's "extends"`,
                        });
                      }

                      if (
                        parentName === 'packageRules' &&
                        subval.startsWith('group:')
                      ) {
                        warnings.push({
                          topic: ConfigValidationTopic.Warning,
                          message: `${currentPath}: you should not extend "group:" presets`,
                        });
                      }
                      if (tzRe.test(subval)) {
                        const [, timezone] = tzRe.exec(subval)!;
                        const [validTimezone, errorMessage] =
                          hasValidTimezone(timezone);
                        if (!validTimezone) {
                          errors.push({
                            topic: ConfigValidationTopic.Error,
                            message: `${currentPath}: ${errorMessage}`,
                          });
                        }
                      }
                      if (!subval.includes('{{')) {
                        try {
                          parsePreset(subval);
                        } catch {
                          errors.push({
                            topic: ConfigValidationTopic.Error,
                            message: `${currentPath}: preset "${subval}" is not valid`,
                          });
                        }
                      }
                    } else {
                      errors.push({
                        topic: ConfigValidationTopic.Error,
                        message: `${currentPath}: preset value is not a string`,
                      });
                    }
                  }
                }

                if (key === 'commitTrailers') {
                  for (const subval of val) {
                    if (!isValidCommitTrailer(subval)) {
                      errors.push({
                        topic: ConfigValidationTopic.Error,
                        message: `Invalid commit trailer: \`${JSON.stringify(
                          subval,
                        )}\`. Must be a single-line string in the form \`Key: value\`, where the key contains only letters, digits and \`-\`.`,
                      });
                    }
                  }
                }

                const selectors = [
                  'matchFileNames',
                  'matchLanguages',
                  'matchCategories',
                  'matchBaseBranches',
                  'matchManagers',
                  'matchDatasources',
                  'matchDepTypes',
                  'matchDepNames',
                  'matchPackageNames',
                  'matchCurrentValue',
                  'matchCurrentVersion',
                  'matchSourceUrls',
                  'matchRegistryUrls',
                  'matchUpdateTypes',
                  'matchIsBreaking',
                  'matchConfidence',
                  'matchCurrentAge',
                  'matchRepositories',
                  'matchNewValue',
                  'matchJsonata',
                ];
                if (key === 'packageRules') {
                  for (const [subIndex, packageRule] of val.entries()) {
                    if (isObject(packageRule)) {
                      const { rule, hasRelativePresets } =
                        stripRelativePresets(packageRule);
                      const { config: resolved } = await resolveConfigPresets(
                        rule,
                        config,
                      );
                      const resolvedRule = migrateConfig({
                        packageRules: [resolved],
                      }).migratedConfig.packageRules![0];
                      warnings.push(
                        ...matchBaseBranchesValidator.check({
                          resolvedRule,
                          currentPath: `${currentPath}[${subIndex}]`,
                          baseBranchPatterns: config.baseBranchPatterns!,
                        }),
                      );
                      const selectorLength = Object.keys(resolvedRule).filter(
                        (ruleKey) => selectors.includes(ruleKey),
                      ).length;
                      if (!selectorLength) {
                        if (hasRelativePresets) {
                          // the stripped relative preset may still provide the
                          // missing selectors, so this cannot be an error
                          const message = `${currentPath}[${subIndex}]: this rule extends a relative preset that cannot be resolved during validation, so its selectors could not be checked. Rule: ${JSON.stringify(
                            packageRule,
                          )}`;
                          warnings.push({
                            topic: ConfigValidationTopic.Error,
                            message,
                          });
                        } else {
                          const message = `${currentPath}[${subIndex}]: Each packageRule must contain at least one match* or exclude* selector. Rule: ${JSON.stringify(
                            packageRule,
                          )}`;
                          errors.push({
                            topic: ConfigValidationTopic.Error,
                            message,
                          });
                        }
                      }
                      if (
                        // the stripped relative preset legitimately provides
                        // the non-selector field
                        !hasRelativePresets &&
                        selectorLength === Object.keys(resolvedRule).length
                      ) {
                        const message = `${currentPath}[${subIndex}]: Each packageRule must contain at least one non-match* or non-exclude* field. Rule: ${JSON.stringify(
                          packageRule,
                        )}`;
                        warnings.push({
                          topic: ConfigValidationTopic.Error,
                          message,
                        });
                      }
                      // It's too late to apply any of these options once you already have updates determined
                      const preLookupOptions = [
                        'allowedVersions',
                        'extractVersion',
                        'followTag',
                        'ignoreDeps',
                        'ignoreUnstable',
                        'rangeStrategy',
                        'registryUrls',
                        'respectLatest',
                        'rollbackPrs',
                        'separateMajorMinor',
                        'separateMinorPatch',
                        'separateMultipleMajor',
                        'separateMultipleMinor',
                        'versioning',
                      ] as const;
                      // These selectors are only known after the lookup
                      const postLookupSelectors: string[] = [];
                      if (isNonEmptyArray(resolvedRule.matchUpdateTypes)) {
                        postLookupSelectors.push('matchUpdateTypes');
                      }
                      if (isBoolean(resolvedRule.matchIsBreaking)) {
                        postLookupSelectors.push('matchIsBreaking');
                      }
                      for (const selector of postLookupSelectors) {
                        for (const option of preLookupOptions) {
                          if (resolvedRule[option] !== undefined) {
                            const message = `${currentPath}[${subIndex}]: packageRules cannot combine both ${selector} and ${option}. Rule: ${JSON.stringify(
                              packageRule,
                            )}`;
                            errors.push({
                              topic: ConfigValidationTopic.Error,
                              message,
                            });
                          }
                        }
                      }
                    } else {
                      errors.push({
                        topic: ConfigValidationTopic.Error,
                        message: `${currentPath} must contain JSON objects`,
                      });
                    }
                  }
                }
                if (key === 'customManagers') {
                  const allowedKeys = [
                    'customType',
                    'description',
                    'fileFormat',
                    'managerFilePatterns',
                    'matchStrings',
                    'matchStringsStrategy',
                    'depNameTemplate',
                    'packageNameTemplate',
                    'datasourceTemplate',
                    'versioningTemplate',
                    'registryUrlTemplate',
                    'currentValueTemplate',
                    'extractVersionTemplate',
                    'autoReplaceStringTemplate',
                    'depTypeTemplate',
                  ];
                  for (const customManager of val as CustomManager[]) {
                    if (
                      Object.keys(customManager).some(
                        (k) => !allowedKeys.includes(k),
                      )
                    ) {
                      const disallowedKeys = Object.keys(customManager).filter(
                        (k) => !allowedKeys.includes(k),
                      );
                      errors.push({
                        topic: ConfigValidationTopic.Error,
                        message: `Custom Manager contains disallowed fields: ${disallowedKeys.join(
                          ', ',
                        )}`,
                      });
                    } else if (
                      isNonEmptyString(customManager.customType) &&
                      isCustomManager(customManager.customType)
                    ) {
                      if (isNonEmptyArray(customManager.managerFilePatterns)) {
                        switch (customManager.customType) {
                          case 'regex':
                            validateRegexManagerFields(
                              customManager,
                              currentPath,
                              errors,
                            );
                            break;
                          case 'jsonata':
                            validateJSONataManagerFields(
                              customManager,
                              currentPath,
                              errors,
                            );
                            break;
                        }
                      } else {
                        errors.push({
                          topic: ConfigValidationTopic.Error,
                          message: `Each Custom Manager must contain a non-empty managerFilePatterns array`,
                        });
                      }
                    } else if (
                      isEmptyString(customManager.customType) ||
                      isUndefined(customManager.customType)
                    ) {
                      errors.push({
                        topic: ConfigValidationTopic.Error,
                        message: `Each Custom Manager must contain a non-empty customType string`,
                      });
                    }
                  }
                }
                if (['matchPackageNames', 'matchDepNames'].includes(key)) {
                  const startPattern = regEx(/!?\//);
                  const endPattern = regEx(/\/g?i?$/);
                  for (const pattern of val as string[]) {
                    if (
                      startPattern.test(pattern) &&
                      endPattern.test(pattern)
                    ) {
                      try {
                        // regEx isn't aware of our !/ prefix but can handle the suffix
                        regEx(pattern.replace(startPattern, '/'));
                      } catch {
                        errors.push({
                          topic: ConfigValidationTopic.Error,
                          message: `Invalid regExp for ${currentPath}: \`${pattern}\``,
                        });
                      }
                    }
                  }
                }
                if (key === 'baseBranchPatterns') {
                  for (const baseBranchPattern of val as string[]) {
                    if (
                      isRegexMatch(baseBranchPattern) &&
                      !getRegexPredicate(baseBranchPattern)
                    ) {
                      errors.push({
                        topic: ConfigValidationTopic.Error,
                        message: `Invalid regExp for ${currentPath}: \`${baseBranchPattern}\``,
                      });
                    }
                  }
                }
                if (
                  (selectors.includes(key) ||
                    key === 'matchCurrentVersion' ||
                    key === 'matchCurrentValue') &&
                  // TODO: can be undefined ? #22198
                  !rulesRe.test(parentPath!) && // Inside a packageRule
                  (isString(parentPath) || !isPreset) // top level in a preset
                ) {
                  errors.push({
                    topic: ConfigValidationTopic.Error,
                    message: `${currentPath}: ${key} should be inside a \`packageRule\` only`,
                  });
                }
              } else {
                errors.push({
                  topic: ConfigValidationTopic.Error,
                  message: `Configuration option \`${currentPath}\` should be a list (Array)`,
                });
              }
            } else if (type === 'string') {
              if (!isString(val)) {
                errors.push({
                  topic: ConfigValidationTopic.Error,
                  message: `Configuration option \`${currentPath}\` should be a string`,
                });
              }
            } else if (type === 'object') {
              if (isPlainObject(val)) {
                if (key === 'registryAliases') {
                  const res = validatePlainObject(val);
                  if (res !== true) {
                    errors.push({
                      topic: ConfigValidationTopic.Error,
                      message: `Invalid \`${currentPath}.${key}.${res}\` configuration: value is not a string`,
                    });
                  }
                } else if (key === 'env') {
                  const allowedEnvVars =
                    configType === 'global'
                      ? coerceArray(config.allowedEnv)
                      : GlobalConfig.get('allowedEnv');
                  for (const [envVarName, envVarValue] of Object.entries(val)) {
                    if (!isString(envVarValue)) {
                      errors.push({
                        topic: ConfigValidationTopic.Error,
                        message: `Invalid env variable value: \`${currentPath}.${envVarName}\` must be a string.`,
                      });
                    }
                    if (!matchRegexOrGlobList(envVarName, allowedEnvVars)) {
                      errors.push({
                        // `Security` is always a fatal error that blocks the rest of the Renovate run.
                        //
                        // As `env` is only applied when it's at the top-level (where `parentPath === undefined`), we should only report a security error there.
                        //
                        // If it's found to be set to a disallowed value - even if it's not going to be used - we should report as an error, which may block the run, but much less worryingly than Security.
                        topic: parentPath
                          ? ConfigValidationTopic.Error
                          : ConfigValidationTopic.Security,
                        message: `Env variable name \`${envVarName}\` is not allowed by this Renovate instance's \`allowedEnv\`.`,
                      });
                    }
                  }
                } else if (key === 'statusCheckNames') {
                  for (const [
                    statusCheckKey,
                    statusCheckValue,
                  ] of Object.entries(val)) {
                    if (
                      !allowedStatusCheckStrings.includes(
                        statusCheckKey as StatusCheckKey,
                      )
                    ) {
                      errors.push({
                        topic: ConfigValidationTopic.Error,
                        message: `Invalid \`${currentPath}.${key}.${statusCheckKey}\` configuration: key is not allowed.`,
                      });
                    }
                    if (!(
                      isString(statusCheckValue) || null === statusCheckValue
                    )) {
                      errors.push({
                        topic: ConfigValidationTopic.Error,
                        message: `Invalid \`${currentPath}.${statusCheckKey}\` configuration: status check is not a string.`,
                      });
                      continue;
                    }
                  }
                } else if (key === 'statusCheckWhen') {
                  for (const [
                    statusCheckKey,
                    statusCheckValue,
                  ] of Object.entries(val)) {
                    if (
                      !allowedStatusCheckStrings.includes(
                        statusCheckKey as StatusCheckKey,
                      )
                    ) {
                      errors.push({
                        topic: ConfigValidationTopic.Error,
                        message: `Invalid \`${currentPath}.${key}.${statusCheckKey}\` configuration: key is not allowed.`,
                      });
                    }
                    if (
                      !isString(statusCheckValue) ||
                      !allowedStatusCheckWhenValues.includes(
                        statusCheckValue as StatusCheckWhen,
                      )
                    ) {
                      errors.push({
                        topic: ConfigValidationTopic.Error,
                        message: `Invalid \`${currentPath}.${statusCheckKey}\` configuration: value must be one of "always", "never", or "failed".`,
                      });
                      continue;
                    }
                  }
                } else if (key === 'customDatasources') {
                  for (const [
                    customDatasourceName,
                    customDatasourceValue,
                  ] of Object.entries(val)) {
                    if (!isPlainObject(customDatasourceValue)) {
                      errors.push({
                        topic: ConfigValidationTopic.Error,
                        message: `Invalid \`${currentPath}.${customDatasourceName}\` configuration: customDatasource is not an object`,
                      });
                      continue;
                    }
                    const subValidation = await validateConfig(
                      configType,
                      customDatasourceValue,
                      isPreset,
                      `${currentPath}.${customDatasourceName}`,
                      key,
                    );
                    warnings = warnings.concat(subValidation.warnings);
                    errors = errors.concat(subValidation.errors);
                  }
                } else if (key === 'installTools') {
                  for (const toolName of Object.keys(val)) {
                    if (!isToolName(toolName)) {
                      warnings.push({
                        topic: ConfigValidationTopic.Error,
                        message: `Invalid \`${currentPath}.${toolName}\` configuration: not a valid tool name.`,
                      });
                    }
                  }
                } else if (key === 'constraints') {
                  const { get: getVersioning } =
                    await import('../modules/versioning/index.ts');
                  for (const [k, v] of Object.entries(val)) {
                    if (!isString(v)) {
                      errors.push({
                        topic: ConfigValidationTopic.Error,
                        message: `Configuration option \`${currentPath}.${k}\` should be an object of key-value pairs of constraints and their value`,
                      });
                      break;
                    }

                    if (!isConstraintName(k)) {
                      warnings.push({
                        topic: ConfigValidationTopic.Error,
                        message: `Configuration option \`${currentPath}.${k}\`: \`${k}\` is not a supported constraint name`,
                      });
                    } else if (isToolName(k)) {
                      // TODO: #31831
                      const versioningId = getToolConfig(k)?.versioning;
                      const versioning = getVersioning(versioningId);
                      if (!versioning.isValid(v)) {
                        warnings.push({
                          topic: ConfigValidationTopic.Error,
                          message: `Configuration option \`${currentPath}.${k}=${v}\` is not a valid tool version constraint, according to \`${versioningId}\` versioning`,
                        });
                      }
                    }
                  }
                } else if (key === 'constraintsVersioning') {
                  for (const [k, v] of Object.entries(val)) {
                    if (!isString(v)) {
                      errors.push({
                        topic: ConfigValidationTopic.Error,
                        message: `Configuration option \`${currentPath}.${k}\` should be an object of key-value pairs of additional constraint names and their versioning`,
                      });
                      break;
                    }

                    if (isToolName(k)) {
                      errors.push({
                        topic: ConfigValidationTopic.Error,
                        message: `Configuration option \`${currentPath}.${k}\` is not a valid additional constraint name, as \`${k}\` is a tool name, and \`constraintsVersioning\` can only override the versioning for a non-tool constraint`,
                      });
                    } else if (isConstraintName(k)) {
                      const versioningName = v.split(':')[0];
                      if (
                        !AllVersioningsListLiteral.includes(
                          versioningName as VersioningName,
                        )
                      ) {
                        errors.push({
                          topic: ConfigValidationTopic.Error,
                          message: `Configuration option \`${currentPath}.${k}=${v}\`: \`${v}\` is not a valid versioning scheme`,
                        });
                      }
                    } else {
                      errors.push({
                        topic: ConfigValidationTopic.Error,
                        message: `Configuration option \`${currentPath}.${k}\`: \`${k}\` is not a known additional constraint name`,
                      });
                    }
                  }
                } else {
                  const ignoredObjects = options
                    .filter((option) => option.freeChoice)
                    .map((option) => option.name);
                  if (!ignoredObjects.includes(key)) {
                    const subValidation = await validateConfig(
                      configType,
                      val,
                      isPreset,
                      currentPath,
                    );
                    warnings = warnings.concat(subValidation.warnings);
                    errors = errors.concat(subValidation.errors);
                  }
                }
              } else {
                errors.push({
                  topic: ConfigValidationTopic.Error,
                  message: `Configuration option \`${currentPath}\` should be a json object`,
                });
              }
            } else {
              // v8 ignore next -- intentionally unhandled - if we knew what was to be covered here, we'd add validation
              logger.debug(
                {},
                `Unhandled validation for ${type} at \`${currentPath}\``,
              );
            }
          }
        }

        if (key === 'hostRules' && isArray(val)) {
          const allowedHeaders =
            configType === 'global'
              ? coerceArray(config.allowedHeaders)
              : GlobalConfig.get('allowedHeaders');
          for (const rule of val as HostRule[]) {
            if (isNonEmptyString(rule.matchHost)) {
              if (
                rule.matchHost.includes('://') &&
                parseUrl(rule.matchHost) === null
              ) {
                errors.push({
                  topic: ConfigValidationTopic.Error,
                  message: `hostRules matchHost \`${rule.matchHost}\` is not a valid URL.`,
                });
              }
            } else if (isEmptyString(rule.matchHost)) {
              errors.push({
                topic: ConfigValidationTopic.Error,
                message:
                  'Invalid value for hostRules matchHost. It cannot be an empty string.',
              });
            }

            if (
              !isUndefined(rule.allowInternal) &&
              !mayGrantInternalHostAccess(configType)
            ) {
              errors.push({
                // like disallowed `headers` below, `Security` only where the rules are actually applied - see the comment there
                topic: parentPath
                  ? ConfigValidationTopic.Error
                  : ConfigValidationTopic.Security,
                message: allowInternalNotAllowedMessage(configType),
              });
            }

            if (!rule.headers) {
              continue;
            }
            if (!isPlainObject(rule.headers)) {
              errors.push({
                topic: ConfigValidationTopic.Error,
                message: `Invalid hostRules headers configuration: headers must be an object.`,
              });
              continue;
            }
            for (const [header, value] of Object.entries(rule.headers)) {
              if (!isString(value)) {
                errors.push({
                  topic: ConfigValidationTopic.Error,
                  message: `Invalid hostRules headers value configuration: header must be a string.`,
                });
              }
              if (!matchRegexOrGlobList(header, allowedHeaders)) {
                errors.push({
                  // `Security` is always a fatal error that blocks the rest of the Renovate run.
                  //
                  // As `hostRules[]` is only applied when it's at the top-level (where `parentPath === undefined`), we should only report a security error there.
                  //
                  // If it's found to be set to a disallowed value - even if it's not going to be used - we should report as an error, which may block the run, but much less worryingly than Security.
                  topic: parentPath
                    ? ConfigValidationTopic.Error
                    : ConfigValidationTopic.Security,
                  message: `hostRules header \`${header}\` is not allowed by this Renovate instance's \`allowedHeaders\`.`,
                });
              }
            }
          }
        }

        if (key === 'matchJsonata' && isArray(val, isString)) {
          for (const expression of val) {
            const res = getExpression(expression);
            if (res instanceof Error) {
              errors.push({
                topic: ConfigValidationTopic.Error,
                message: `Invalid JSONata expression for ${currentPath}: ${res.message}`,
              });
            }
          }
        }

        validateAllowedValues(key, val, currentPath, errors);
      }

      function sortAll(a: ValidationMessage, b: ValidationMessage): number {
        if (a.topic === b.topic) {
          return a.message > b.message ? 1 : -1;
        }
        return a.topic > b.topic ? 1 : -1;
      }

      errors.sort(sortAll);
      warnings.sort(sortAll);
      return { errors, warnings };
    },
  );
}

/**
 * Basic validation for global config options
 */
async function validateGlobalConfig(
  key: string,
  val: unknown,
  type: string,
  warnings: ValidationMessage[],
  errors: ValidationMessage[],
  currentPath: string | undefined,
  config: AllConfig,
): Promise<void> {
  /* v8 ignore next -- not testable yet */
  if (getDeprecationMessage(key)) {
    warnings.push({
      topic: ConfigValidationTopic.Deprecation,
      message: getDeprecationMessage(key)!,
    });
  }

  if (key === 'binarySource' && val === 'docker') {
    warnings.push({
      topic: ConfigValidationTopic.Deprecation,
      message:
        'Usage of `binarySource=docker` is deprecated, and will be removed in the future. Please migrate to `binarySource=install`. Feedback on the usage of `binarySource=docker` is welcome at https://github.com/renovatebot/renovate/discussions/40742',
    });
  }

  if (val !== null) {
    // v8 ignore else -- TODO: add test #40625
    if (type === 'string') {
      if (isString(val)) {
        if (optionSupportsTemplating.has(key)) {
          try {
            template.validate(val);
          } catch {
            errors.push({
              topic: ConfigValidationTopic.Error,
              message: `Invalid template in config path: ${currentPath}`,
            });
          }
        }

        if (
          key === 'onboardingConfigFileName' &&
          !getPossibleConfigFileNames({
            configFileNames: config.configFileNames,
            platform: config.platform,
          }).includes(val)
        ) {
          warnings.push({
            topic: ConfigValidationTopic.Error,
            message: `Invalid value \`${val}\` for \`${currentPath}\`. The allowed values are ${getPossibleConfigFileNames(
              {
                configFileNames: config.configFileNames,
                platform: config.platform,
              },
            ).join(', ')}.`,
          });
        }

        if (
          key === 'reportType' &&
          ['s3', 'file'].includes(val) &&
          !isString(config.reportPath)
        ) {
          errors.push({
            topic: ConfigValidationTopic.Error,
            message: `reportType '${val}' requires a configured reportPath`,
          });
        }
      } else {
        warnings.push({
          topic: ConfigValidationTopic.Error,
          message: `Configuration option \`${currentPath}\` should be a string.`,
        });
      }
    } else if (type === 'integer') {
      const allowsNegative = optionAllowsNegativeIntegers.has(key);
      warnings.push(...validateNumber(key, val, allowsNegative, currentPath));
    } else if (type === 'boolean') {
      if (val !== true && val !== false) {
        warnings.push({
          topic: ConfigValidationTopic.Error,
          message: `Configuration option \`${currentPath}\` should be a boolean. Found: ${JSON.stringify(
            val,
          )} (${typeof val}).`,
        });
      }
    } else if (type === 'array') {
      if (isArray(val) && key !== 'repositories') {
        validateStringArray(key, val, currentPath, errors);
        for (const [subIndex, subval] of val.entries()) {
          if (isObject(subval)) {
            const subValidation = await validateConfig(
              'global',
              subval,
              false,
              `${currentPath}[${subIndex}]`,
            );
            warnings.push(...subValidation.warnings);
            errors.push(...subValidation.errors);
          }
        }

        if (isRegexOrGlobOption(key)) {
          warnings.push(
            ...regexOrGlobValidator.check({
              val,
              currentPath: currentPath!,
            }),
          );
        }
      } else if (isArray(val)) {
        for (const [subIndex, subval] of val.entries()) {
          if (isPlainObject(subval)) {
            if (!isNonEmptyString(subval.repository)) {
              errors.push({
                topic: ConfigValidationTopic.Error,
                message: `${currentPath}[${subIndex}]: each repository object entry must have a \`repository\` string property`,
              });
            }
            const { repository: _, ...repoEntryConfig } = subval;
            // Each repository object entry is validated as its own global config, so it does not automatically see the top-level `allowedEnv`/`allowedHeaders`.
            // Inherit them (unless the entry sets its own) so that entry-level `env`/`headers` are validated against the allowlists, rather than an empty one.
            const subValidation = await validateConfig(
              'global',
              {
                ...(config.allowedEnv ? { allowedEnv: config.allowedEnv } : {}),
                ...(config.allowedHeaders
                  ? { allowedHeaders: config.allowedHeaders }
                  : {}),
                ...repoEntryConfig,
              },
              false,
              `${currentPath}[${subIndex}]`,
            );
            warnings.push(...subValidation.warnings);
            errors.push(...subValidation.errors);
          } else if (isString(subval)) {
            if (!isNonEmptyStringAndNotWhitespace(subval)) {
              warnings.push({
                topic: ConfigValidationTopic.Error,
                message: `${currentPath}[${subIndex}]: each repository string entry entry must be a non-empty string`,
              });
            }
          } else {
            warnings.push({
              topic: ConfigValidationTopic.Error,
              message: `${currentPath}[${subIndex}]: invalid type, should be either a string or an object`,
            });
          }
        }
      } else {
        warnings.push({
          topic: ConfigValidationTopic.Error,
          message: `Configuration option \`${currentPath}\` should be a list (Array).`,
        });
      }
    } else if (type === 'object') {
      if (isPlainObject(val)) {
        if (key === 'onboardingConfig') {
          const subValidation = await validateConfig('repo', val);
          for (const warning of subValidation.warnings.concat(
            subValidation.errors,
          )) {
            warnings.push(warning);
          }
        } else if (key === 'force') {
          // `force` is validated as a global config of its own, so it does not automatically see the top-level `allowedEnv`/`allowedHeaders`.
          // Inherit them (unless `force` sets its own) so that the self-hosted admin's own `force.env`/`force.hostRules[].headers` are validated against the allowlists they set, rather than an empty one.
          const subValidation = await validateConfig('global', {
            ...(config.allowedEnv ? { allowedEnv: config.allowedEnv } : {}),
            ...(config.allowedHeaders
              ? { allowedHeaders: config.allowedHeaders }
              : {}),
            ...val,
          });
          for (const warning of subValidation.warnings.concat(
            subValidation.errors,
          )) {
            warnings.push(warning);
          }
        } else if (key === 'cacheTtlOverride') {
          for (const [subKey, subValue] of Object.entries(val)) {
            const allowsNegative = optionAllowsNegativeIntegers.has(key);
            warnings.push(
              ...validateNumber(
                key,
                subValue,
                allowsNegative,
                currentPath,
                subKey,
              ),
            );

            if (
              !(packageCacheNamespaces as readonly string[]).includes(subKey) &&
              !anyMatchRegexOrGlobList(
                packageCacheNamespaces as unknown as string[],
                [subKey],
              )
            ) {
              errors.push({
                message: `${currentPath}: namespace \`${subKey}\` does not exist`,
                topic: ConfigValidationTopic.Error,
              });
            }
          }
        } else {
          const res = validatePlainObject(val);
          if (res !== true) {
            warnings.push({
              topic: ConfigValidationTopic.Error,
              message: `Invalid \`${currentPath}.${res}\` configuration: value must be a string.`,
            });
          }
        }
      } else {
        warnings.push({
          topic: ConfigValidationTopic.Error,
          message: `Configuration option \`${currentPath}\` should be a JSON object.`,
        });
      }
    }
  }

  validateAllowedValues(key, val, currentPath, errors);
}

function getPossibleConfigFileNames({
  configFileNames,
  platform,
}: {
  configFileNames?: string[];
  platform?: PlatformId;
}): string[] {
  const filenames = getConfigFileNames(platform);
  if (isNonEmptyArray(configFileNames)) {
    return filenames.concat(configFileNames);
  }

  return filenames;
}

function validateStringArray(
  key: string,
  val: unknown[],
  currentPath: string | undefined,
  errors: ValidationMessage[],
): void {
  const option = optionsByName.get(key);
  if (
    option?.type === 'array' &&
    option.subType === 'string' &&
    // these report the invalid entries with a more specific message
    !['extends', 'commitTrailers'].includes(key) &&
    !val.every(isString)
  ) {
    errors.push({
      topic: ConfigValidationTopic.Error,
      message: `Configuration option \`${currentPath}\` should be a list of strings`,
    });
  }
}

function describeAllowedValues(option: RenovateOptions): string {
  const allowedValues = coerceArray(option.allowedValues);
  // for options with a lot of values (i.e. `enabledManagers`), listing them all makes for an unreadable message
  if (allowedValues.length > 10) {
    const page = option.globalOnly
      ? 'self-hosted-configuration'
      : 'configuration-options';
    return `allowedValues, which are listed at ${GlobalConfig.get('productLinks').documentation}${page}/#${option.name.toLowerCase()}`;
  }
  return `allowedValues: ${JSON.stringify(allowedValues)}`;
}

function isAllowedValue(
  option: RenovateOptions,
  allowedValues: readonly string[],
  val: string,
): boolean {
  if (allowedValues.includes(val)) {
    return true;
  }
  if (!option.patternMatch) {
    return false;
  }
  // pattern matching options also accept negation, globs and regexes, which are valid if they can match any of the allowed values
  const predicate = getRegexOrGlobPredicate(
    val.startsWith('!') ? val.slice(1) : val,
  );
  return allowedValues.some((allowed) => predicate(allowed));
}

function validateAllowedValues(
  key: string,
  val: unknown,
  currentPath: string | undefined,
  errors: ValidationMessage[],
): void {
  const option = optionsByName.get(key);
  if (!option) {
    return;
  }

  const allowedValues = option.allowedValues;
  if (allowedValues?.length) {
    if (val === null && option.default === null) {
      // do nothing
    } else if (isArray(val, isString)) {
      const invalidOptions = val.filter(
        (v) => !isAllowedValue(option, allowedValues, v),
      );
      if (invalidOptions.length) {
        errors.push({
          topic: ConfigValidationTopic.Error,
          message: `Invalid ${currentPath}: ${option.name} had invalid values \`${JSON.stringify(invalidOptions)}\` which are not part of the ${describeAllowedValues(option)}`,
        });
      }
    } else if (isString(val)) {
      if (key === 'versioning') {
        if (!allowedValues.includes(val) && !val.startsWith('regex:')) {
          errors.push({
            topic: ConfigValidationTopic.Error,
            message: `Invalid ${currentPath}: ${option.name} had invalid value \`${JSON.stringify(val)}\`. ${option.name} can only be a known versioning scheme, or be a string starting with \`regex:\` for custom regular expression versioning`,
          });
        }
      } else if (
        !isAllowedValue(option, allowedValues, val) &&
        // a templated value can't be checked until it's been rendered
        !(option.supportsTemplating && val.includes('{{'))
      ) {
        errors.push({
          topic: ConfigValidationTopic.Error,
          message: `Invalid ${currentPath}: ${option.name} had a value \`${JSON.stringify(val)}\` which was not part of the ${describeAllowedValues(option)}`,
        });
      }
    }
  }
}