mirror of
https://github.com/renovatebot/renovate.git
synced 2026-10-26 15:31:53 +00:00
Jamie Tanna
826541b266
Previously, we were caching private Go modules' information, even when `cachePrivatePackages=false`. This leads to the module path, versions, and possibly the `go` directive being cached unintentionally. Instead of doing so, we should make sure that we're intentionally caching packages. To do this, we can use a mix of the `GOPRIVATE`/`GONOPROXY` to determine which packages shouldn't be fetched in the public Go proxy, given they're private, following how the Go toolchain itself does this. When interacting with the public Go proxy, we treat these packages as public (as the public Go proxy has no means to authenticate) and so anything outside of this should be treated as private. When `GOPROXY` contains `direct`, we only treat a package as public only when the public proxy is in the list too, the way Go's own default is written. This is used to imply that `direct` is the fallback for whatever the public proxy doesn't have. When thre is no Go proxy set, `GOPROXY=direct` means everything comes from source, which tells us nothing about who is allowed to read it. This doesn't catch everything: with the default `GOPROXY`, a private package the public proxy doesn't have falls through to `direct` and is still cached by Renovate, unless `GOPRIVATE` says otherwise. We only learn that no proxy served it after we've fetched it, which is after `cacheable` is determined. When using Renovate with a private Go proxy mirror, such as Artifactory, this will result in no cached packages until `cachePrivatePackages: true` is set. This is a similar change to #45348. Co-authored-by: Claude Opus 5 <jamie.tanna+claude-code@mend.io>
Datasources
Datasources are used in Renovate primarily to fetch released versions of packages.
Follow the class-based programming style
New datasources must follow the class-based programming style.
Use the java-version datasource as a reference.
Add the datasource to the API in api.ts so that the new datasource is usable.
If you find Unused HTTP mocks errors in the Vitest tests and your mocked URLs are correct, make sure the datasource is correctly registered.
getReleases
The minimum exported interface for a datasource is a function called getReleases that takes a lookup config as input.
The config has:
packageName: the package's full name including scope if present (e.g.@foo/bar)registryUrls: an array of registry URLs to try
getReleases should return an object having:
releases: an array of strings of matched versions. This is the only mandatory fielddeprecationMessage: a string description of the package's deprecation notice, if applicablesourceUrl: a HTTP URL pointing to the source code (for example on GitHub)homepage: a HTTP URL for the package's homepage. Ideally should be empty if the homepage andsourceUrlare the samechangelogUrl: a URL pointing to the package's changelog (could be a Markdown file, for example). If not present then Renovate will search thesourceUrlfor a changelog filetags: an object mapping tag → version, for exampletags: { latest: '3.0.0' }. This is only used by thefollowTagsfunction
getDigest
Datasources that support digests (like Docker digests and Git commit hashes) can export a getDigest function.
The getDigest function has two inputs:
config: the Renovate config for the package being updated, has the same fields asgetReleasesnewValue: the version or value to retrieve the digest for
The getDigest function returns a string output representing the digest value.
If no digest is found, the getDigest function should return null.