mirror of
https://github.com/renovatebot/renovate.git
synced 2026-10-24 22:48:06 +00:00
Sebastian Poxhofer
19306f7e17
* refactor(manager/helmv3): share generateHelmEnvs with kustomize Move kustomize's generateHelmEnvs into helmv3/common.ts and delete the kustomize copy. The merged function always sets the three HELM_* path variables and sets HELM_EXPERIMENTAL_OCI unless a helm constraint is present and proves helm >= 3.8 (which ignores the variable). Behaviour change: kustomize now sets HELM_EXPERIMENTAL_OCI when the helm constraint is unknown (previously it only set it for a known constraint below 3.8). helmv3 and helmfile now omit the variable once a resolved helm constraint proves helm >= 3.8. * refactor(manager/helmv3): share OCI registry login helper with helmfile Extract a shared generateRegistryLoginCmd(name, registry) helper in helmv3/common.ts that strips the oci:// prefix, derives the host and looks up the matching host rule before delegating to generateLoginCmd. helmv3/artifacts.ts and helmfile/artifacts.ts now both call this helper instead of each building a RepositoryRule inline, removing the stale oci:// TODO. helmfile/utils.ts loses its duplicate generateRegistryLoginCmd, and its unrelated isOCIRegistry(repository) (checking the oci flag) is renamed to isOciRepositoryFlagSet so it no longer collides in name with helmv3/oci.ts's prefix-based isOCIRegistry(string), which helmfile/extract.ts also imports. Addresses audit finding M8. Generated `helm registry login` commands are unchanged, proved by the existing artifacts specs passing with their original expectations untouched. * fix(manager): share one local Helm chart path check helmfile, flux, fleet and terraform each decided differently whether a Helm chart reference points at a local path. fleet and terraform used terraform's checkIfStringIsPath, whose regex was unanchored with unescaped dots, so it matched any string containing a slash followed by a non-slash character. Add isLocalChartPath to helmv3/utils.ts with helmfile's prefix check and use it in all four managers. This drops the fleet to terraform dependency and removes checkIfStringIsPath, which had no other users. * refactor(manager/helm-requirements): reuse helmv3 alias and repository helpers Replace the duplicated alias-resolution and repository-classification logic in helm-requirements/extract.ts with the shared isAlias, resolveAlias and parseRepository helpers from helmv3/utils.ts (audit finding M9). Behaviour is unchanged: same skipReasons, same registryUrls, same handling of a missing repository or missing registryAliases config. * refactor(manager/dockerfile): add an options form of getDep for CI managers `getDep()` gains an overload taking a `GetDepOptions` object with `specifyReplaceString`, `registryAliases` and `depType`, replacing the opaque boolean second positional argument at the CI manager call sites. The positional form keeps working for all other callers. Migrated: bitbucket-pipelines, droneci, circleci, github-actions, azure-pipelines and woodpecker. Behaviour changes: - azure-pipelines container resources now honour `registryAliases`, which `extractContainer()` previously ignored - woodpecker dependencies now carry `depType: 'docker'`, matching the other CI managers * refactor(manager/woodpecker): do not set depType on docker image deps * refactor(manager/dockerfile): drop the positional getDep signature * refactor(manager/helm-requirements): reuse helmv3 alias and repository helpers Replace the duplicated alias-resolution and repository-classification logic in helm-requirements/extract.ts with the shared isAlias, resolveAlias and parseRepository helpers from helmv3/utils.ts (audit finding M9). Behaviour is unchanged: same skipReasons, same registryUrls, same handling of a missing repository or missing registryAliases config.
The bazel-module manager can update Bazel module (bzlmod) enabled workspaces.
Maven
It also takes care about maven artifacts initalized with bzlmod. For simplicity the name of extension variable is limited to maven*. E.g.:
maven = use_extension("@rules_jvm_external//:extensions.bzl", "maven")
maven_1 = use_extension("@rules_jvm_external//:extensions.bzl", "maven")
Both install and artifact methods are supported:
maven.install(
artifacts = [
"org.seleniumhq.selenium:selenium-java:4.4.0",
],
)
maven.artifact(
artifact = "javapoet",
group = "com.squareup",
neverlink = True,
version = "1.11.1",
)
Docker
Similarly, it updates Docker / OCI images pulled with oci_pull.
Note that the extension must be called oci:
oci = use_extension("@rules_oci//oci:extensions.bzl", "oci")
oci.pull(
name = "nginx_image",
digest = "sha256:287ff321f9e3cde74b600cc26197424404157a72043226cbbf07ee8304a2c720",
image = "index.docker.io/library/nginx",
platforms = ["linux/amd64"],
tag = "1.27.1",
)
It also supports Docker images pulled with rules_img pull:
pull = use_repo_rule("@rules_img//img:pull.bzl", "pull")
pull(
name = "ubuntu",
digest = "sha256:1e622c5f9ac0c0144d577702ba5f2cce79fc8e3cf89ec88291739cd4eee3b7b9",
registry = "index.docker.io",
repository = "library/ubuntu",
tag = "24.04",
)
Crate
It also supports Rust crate dependencies initialized with rules_rust crate_universe. For simplicity the name of extension variable is limited to crate*. E.g.:
crate = use_extension("@rules_rust//crate_universe:extension.bzl", "crate")
crate_1 = use_extension("@rules_rust//crate_universe:extension.bzl", "crate")
The spec method is supported:
crate.spec(
package = "axum",
version = "0.8.4",
)
crate.spec(
package = "tokio",
version = "1.45.1",
features = [
"full",
],
)
crate.spec(
package = "custom_crate",
git = "https://github.com/example/custom_crate.git",
tag = "v1.0.0",
)
Lockfile support
The bazel-module manager updates the MODULE.bazel.lock file when dependencies change.
After updating MODULE.bazel, Renovate runs bazel mod deps to regenerate the lockfile.
Requirements:
- A
MODULE.bazel.lockfile must already exist in the repository - Bazelisk must be available (Renovate installs it automatically when using containerbase)
- Bazelisk determines the correct Bazel version from the
.bazelversionfile in the repository (if present)
If no MODULE.bazel.lock file is found, the lockfile update step is skipped.
It will only run if the allowedUnsafeExecutions global option includes bazelModDeps.