Files
renovate/lib/util/exec
Gregor Zeitlinger a2b96944f9 feat(mise): add lock file support (#42591)
* feat(mise): add lock file support

- Add lockfile.ts with getLockFileName() for deriving lock file paths
- Add artifacts.ts with updateArtifacts() and updateLockedDependency()
- Add MiseLockFile Zod schema for parsing lock files
- Update extract.ts to be async and extract lockedVersion from lock files
- Export supportsLockFileMaintenance, lockFileNames, updateArtifacts, updateLockedDependency

* refactor(mise): remove redundant comments

Remove comments that simply restate what the code already clearly
communicates. Keep valuable comments that explain non-obvious behavior
(e.g., why temporary errors are rethrown) and move helpful examples
into JSDoc comments.

* fix(mise): improve lock file version lookup and add tests

- Fix lock file key lookup for non-registry tools (aqua:, ubi:, etc.)
  Registry tools use short names (node), non-registry use full names
  (aqua:cli/cli). New getLockedVersion() tries both patterns.

- Add injection prevention test for shell quoting
- Add update-failed test for error handling
- Add comprehensive tests for getLockedVersion()
- Add null check for depName in updateLockedDependency
- Add JSDoc to updateArtifacts and extractPackageFile
- Add lock file support documentation to README
- Remove code duplication by consolidating into lockfile.ts

* fix(mise): pass --local flag and MISE_ENV for env/local config files

When updating mise.local.toml, `mise lock` updates mise.lock, not
mise.local.lock. Add --local flag to target the correct lock file.

For env-specific configs (mise.test.toml), set MISE_ENV=test so mise
reads and locks the correct configuration.

Extracted getConfigType() from getLockFileName() to share the parsing
logic between lock file name derivation and command flag generation.

Builds on #42099 by altendky.

* test(mise): cover tool absent from lock file

* refactor(mise): remove dead branches in extractPackageFile

tools is required by MiseFile schema so if(tools) is always true.
depName is always set by createDependency so if(dep.depName) is always true.

Add test for tool absent from lock file to cover the lockedVersion
assignment branch.

* fix(mise): address review feedback on lock file support

* fix(mise): remove unsupported tool constraint

* fix(mise): add containerbase tool definition

* fix(mise): add typed exec constraint support

* fix(config): restore requireConfig typing

* test(mise): await registry extraction cases

* Update lib/modules/manager/mise/artifacts.ts

Co-authored-by: Michael Kriese <michael.kriese@gmx.de>

* fix: revert unrelated types cleanup

* fix: drop missing VersioningName import

* fix(mise): use npm versioning string after import removal

* test(mise): set binarySource=global in artifacts spec

GlobalConfig.get now returns defaults; without explicit binarySource the
test fell into containerbase dynamic install and tried to resolve the
mise version via the github-releases datasource, causing missing HTTP
mock errors. Force binarySource=global so the spec only exercises the
mocked exec path.

---------

Co-authored-by: Kyle Altendorf <sda@fstab.net>
Co-authored-by: Michael Kriese <michael.kriese@gmx.de>
Co-authored-by: Jamie Tanna <jamie.tanna@mend.io>
2026-05-19 15:23:23 +00:00
..
2026-02-09 09:48:01 +00:00