mirror of
https://github.com/renovatebot/renovate.git
synced 2026-10-26 07:20:39 +00:00
4b4d14ec00
* feat(manager): pass extracted constraints to updateArtifacts `extractedConstraints` were collected during extraction but only ever read by `fetch.ts` for the lookup. At artifact time every manager had to derive the same tool constraints a second time, and when the updated package file no longer carried the constraint there was nothing to fall back to. `generateBranchConfig()` now merges the `extractedConstraints` of all upgrades of a branch onto the branch config, which reaches `updateArtifacts()` through `patchConfigForArtifactsUpdate()`. `UpdateArtifactsConfig` declares the field and documents what it contains. The new `resolveToolConstraint()` helper implements the ladder once: user `constraints` > an optional artifact-time derivation > the extracted value. The derivation is ranked above the extracted value on purpose: it reads the package files as the branch changed them, so poetry (python is an updatable dependency there), composer, pipenv (`pipenv` can be a dev package) and pep621 (`requires-python` is an updatable dependency) would otherwise regress to a stale constraint. pipenv, pep621 uv/pdm, poetry and composer are migrated to the helper and keep their derivation. Behaviour change: these managers now use the extract-time constraint as a last resort instead of running unconstrained, for example on lock file maintenance where pipenv deletes `Pipfile.lock` before deriving. `execute-post-upgrade-commands.ts` is unaffected: it reads `upgrade.constraints` per upgrade, and the extracted values are kept in a separate field rather than folded into `constraints`, so post-upgrade task tool constraints still come from user config only. Not migrated, because their constraints are never extracted, so the fallback would be dead code: bundler (`ruby`/`bundler`), pixi (`pixi`), pep621 uv (`required-version`) and npm's node ladder, whose last step already reads `package.json` engines. * refactor(manager): resolve tool constraints through resolveToolConstraint() Every manager now obtains the constraint of a tool it runs through `resolveToolConstraint()` instead of reading `config.constraints` itself, so the precedence "user config, then a value derived from the updated files, then the constraints collected during extraction" applies everywhere. The helper treats an empty string as not set at every step and accepts the `PostUpdateConfig` shape, whose `constraints` may be `null`. Behaviour changes that go beyond the new fallback to extracted constraints: - `mix` applies its hardcoded erlang default only after the extracted constraint, so an erlang version collected at extraction can win over it. - `kustomize` decides `HELM_EXPERIMENTAL_OCI` from the fully resolved helm constraint; `generateHelmEnvs()` takes that value instead of the config. - `npm` (yarn): an upgrade of yarn without a new value now consults the user constraint before deriving one from package.json or the lock file. - The "Using <tool> constraint from config" debug lines in bundler, composer, copier and pip-compile are gone, as the helper is the only reader of the config now. Helpers that read the config synchronously became async: bundler `getBundlerConstraint()`, copier `getPythonVersionConstraint()` and `getCopierVersionConstraint()`, pip-compile `get*VersionConstraint()` and `getToolVersionConstraint()`, gomod `deriveGoToolchainConstraints()` and `getUpdateImportPathCmds()`, mise `getMiseLockToolConstraints()`. composer `getPhpConstraint()` is removed. Each converted manager has a test showing the extracted constraint reaching the executed tool, and, where a derive callback exists, that the derived value still wins over it. * refactor(linters): add prefer-resolve-tool-constraint rule Reports member reads and destructuring of `constraints` and `extractedConstraints` from a manager config in `lib/modules/manager/**`, so that tool constraints are resolved through `resolveToolConstraint()` in `lib/modules/manager/util.ts` only. Writes and the same properties on package files, which extraction has to populate, are not reported. The helper itself and spec files are exempt in `.oxlintrc.json`. * refactor(manager): inline thin resolveToolConstraint wrappers Drop copier/utils.ts and the pip-compile getPipToolsVersionConstraint / getUvVersionConstraint helpers, which only forwarded to resolveToolConstraint(). Callers now call it directly. * docs(development): note lock file maintenance in tool constraints section * refactor(manager): address review on tool constraint resolution composer only runs extractConstraints() when a user constraint is missing, via Lazy. UpdateArtifactsConfig no longer re-declares constraints and extractedConstraints, which ToolConstraintsConfig already provides.
132 lines
3.8 KiB
TypeScript
132 lines
3.8 KiB
TypeScript
// TODO: types (#22198)
|
|
import { isString } from '@sindresorhus/is';
|
|
import { quote } from 'shlex';
|
|
import { GlobalConfig } from '../../../config/global.ts';
|
|
import type { CombinedHostRule } from '../../../types/index.ts';
|
|
import type {
|
|
ConstraintName,
|
|
ToolConstraint,
|
|
} from '../../../util/exec/types.ts';
|
|
import { coerceNumber } from '../../../util/number.ts';
|
|
import {
|
|
api,
|
|
id as composerVersioningId,
|
|
} from '../../versioning/composer/index.ts';
|
|
import type { UpdateArtifactsConfig } from '../types.ts';
|
|
import type { Lockfile, PackageFile } from './schema.ts';
|
|
|
|
export { composerVersioningId };
|
|
|
|
const depRequireInstall = new Set(['symfony/flex']);
|
|
|
|
export function getComposerArguments(
|
|
config: UpdateArtifactsConfig,
|
|
toolConstraint: ToolConstraint,
|
|
): string {
|
|
let args = '';
|
|
|
|
if (config.composerIgnorePlatformReqs) {
|
|
if (config.composerIgnorePlatformReqs.length === 0) {
|
|
if (
|
|
isString(toolConstraint.constraint) &&
|
|
api.intersects!(toolConstraint.constraint, '^2.2')
|
|
) {
|
|
args += " --ignore-platform-req='ext-*' --ignore-platform-req='lib-*'";
|
|
} else {
|
|
args += ' --ignore-platform-reqs';
|
|
}
|
|
} else {
|
|
config.composerIgnorePlatformReqs.forEach((req) => {
|
|
args += ` --ignore-platform-req ${quote(req)}`;
|
|
});
|
|
}
|
|
}
|
|
|
|
args += ' --no-ansi --no-interaction';
|
|
if (!GlobalConfig.get('allowScripts') || config.ignoreScripts) {
|
|
args += ' --no-scripts --no-autoloader';
|
|
}
|
|
|
|
if (!GlobalConfig.get('allowPlugins') || config.ignorePlugins) {
|
|
args += ' --no-plugins';
|
|
}
|
|
|
|
return args;
|
|
}
|
|
|
|
export function getComposerUpdateArguments(
|
|
config: UpdateArtifactsConfig,
|
|
toolConstraint: ToolConstraint,
|
|
): string {
|
|
let args = getComposerArguments(config, toolConstraint);
|
|
|
|
if (
|
|
!config.isLockFileMaintenance &&
|
|
!config.postUpdateOptions?.includes('composerNoMinimalChanges') &&
|
|
isString(toolConstraint.constraint) &&
|
|
api.intersects!(toolConstraint.constraint, '>=2.7')
|
|
) {
|
|
args += ' --minimal-changes';
|
|
}
|
|
|
|
return args;
|
|
}
|
|
|
|
export function requireComposerDependencyInstallation({
|
|
packages,
|
|
packagesDev,
|
|
}: Lockfile): boolean {
|
|
return (
|
|
packages.some((p) => depRequireInstall.has(p.name)) === true ||
|
|
packagesDev.some((p) => depRequireInstall.has(p.name)) === true
|
|
);
|
|
}
|
|
|
|
export function extractConstraints(
|
|
{ config, require, requireDev }: PackageFile,
|
|
{ pluginApiVersion }: Lockfile,
|
|
): Partial<Record<ConstraintName, string>> {
|
|
const res: Record<string, string> = { composer: '1.*' };
|
|
|
|
// extract php
|
|
const phpVersion = config?.platform.php;
|
|
if (phpVersion) {
|
|
const major = api.getMajor(phpVersion);
|
|
const minor = coerceNumber(api.getMinor(phpVersion));
|
|
const patch = coerceNumber(api.getPatch(phpVersion));
|
|
res.php = `<=${major}.${minor}.${patch}`;
|
|
} else if (require.php) {
|
|
res.php = require.php;
|
|
}
|
|
|
|
// extract direct composer dependency
|
|
if (require['composer/composer']) {
|
|
res.composer = require['composer/composer'];
|
|
} else if (requireDev['composer/composer']) {
|
|
res.composer = requireDev['composer/composer'];
|
|
}
|
|
// composer platform package
|
|
else if (require.composer) {
|
|
res.composer = require.composer;
|
|
} else if (requireDev.composer) {
|
|
res.composer = requireDev.composer;
|
|
}
|
|
// check last used composer version
|
|
else if (pluginApiVersion) {
|
|
const major = api.getMajor(pluginApiVersion);
|
|
const minor = api.getMinor(pluginApiVersion);
|
|
res.composer = `^${major}.${minor}`;
|
|
}
|
|
// check composer api dependency
|
|
else if (require['composer-runtime-api']) {
|
|
const major = api.getMajor(require['composer-runtime-api']);
|
|
const minor = api.getMinor(require['composer-runtime-api']);
|
|
res.composer = `^${major}.${minor}`;
|
|
}
|
|
return res;
|
|
}
|
|
|
|
export function isArtifactAuthEnabled(rule: CombinedHostRule): boolean {
|
|
return !rule.artifactAuth || rule.artifactAuth.includes('composer');
|
|
}
|