mirror of
https://github.com/renovatebot/renovate.git
synced 2026-10-25 15:01:49 +00:00
Jamie Tanna
7386ea49c4
As part of looking to allow Inherit Config to manage Host Rules' grants, we need to perform a prefactor to create an additional trust tier between the global self-hosted administrator's config, and presets/repo config. The `find()` method already resolves sensitive fields - `headers`, `enabled`, and the computed internal-host grant - a "trust tier" at a time, so that the outcome cannot depend on how specific a rule from a less trusted tier makes itself. The new `inherit` tier slots in between the two we had: - `headers` are applied untrusted first, then inherited, then the administrator's, so theirs still win outright - `enabled` is taken from the administrator's rules, falling back to inherited config's, then a repository's - an administrator's `allowInternal: false` acts as a veto: it is resolved before inherited config's rules, and clears the scoped and implicit grants too, so inherited config cannot re-grant the host in any shape by out-scoping it. Meanwhile any inherited rule naming a host in its `matchHost` - credentialed or not - now implicitly permits it, like the admin's own rules do We introduce a separate field than `trusted` to avoid Inherit Config gaining the same precedence as the admin themselves. Co-authored-by: Claude Fable 5 <jamie.tanna+claude-code@mend.io> Co-authored-by: Claude Opus 5 <jamie.tanna+claude-code@mend.io>