mirror of
https://github.com/renovatebot/renovate.git
synced 2026-10-26 07:20:39 +00:00
a1971afa78
* ci(linter): add renovate/require-regex-util rule Adds a custom oxlint rule that flags raw RegExp usage in lib/ production code: any `new RegExp(...)` call and any regex literal that is not the direct first argument of `regEx(...)`. The regEx() helper from lib/util/regex.ts uses the RE2 engine for ReDoS-safe matching and caches compiled patterns. lib/util/regex.ts itself is exempt. The rule is disabled for **/*.spec.ts, test/**, and tools/** via config overrides, because vitest APIs such as expect.stringMatching need bare RegExp instances (a past commit reverted regEx() there). Severity is set to "warn" instead of "error": the repo currently has 197 pre-existing violations (above the agreed mechanical-fix threshold of 80), and a number of them are deliberately RE2-incompatible patterns (lookahead/lookbehind/named backreferences, see TODO #12872/#12875 markers in e.g. lib/modules/versioning/rez/ pattern.ts and lib/modules/manager/dockerfile/extract.ts) that need per-site judgment before they can be wrapped in regEx() or suppressed with a justified disable comment. No violation fixes are included in this commit. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * ci(linter): enforce renovate/require-regex-util at error Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * refactor: use regEx() for regex literals and RegExp construction in lib Burn down all renovate/require-regex-util violations (197): - wrap RE2-compatible regex literals and RegExp constructions in regEx() - rewrite lookaround patterns where behavior is provably preserved: goproxy separator split, sbt-package link extraction, leiningen comment stripping and keyword search, npm GitHub owner validation (unit-count bound replaced by an explicit length check) - keep native RegExp with disable comments where RE2 cannot be used: moo / good-enough-parser lexer patterns (moo rejects RE2 instances), MigrationsService propertyName (matched via isRegExp, which RE2 instances fail), rez named backreferences and lookaheads, GitHub markdown link negative lookbehind, emoji astral-plane matching - drop stale TODO #12875 comments for patterns current re2 handles Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * refactor: reduce require-regex-util disable comments Rewrite the github massage-markdown-links URL regex to capture an optional `api.` prefix in a named group (skipped in code) instead of relying on a negative lookbehind, so both the base and global variants can use regEx()/RE2 and their two disable comments are removed. Add spec cases for api-prefixed URLs that match the URL shape. Consolidate the four related line disables in rez/pattern.ts (bound and range patterns emulating Python conditional patterns via named backreferences and lookaheads, which RE2 cannot express) into a single block disable/enable pair, matching the treatment of the lexer files. Disable comment count drops from 13 to 8. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * refactor(datasource/sbt-package): use named capture group in link regex Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * refactor(manager/cake): restore original multiLineComment regex spelling The [^] -> [\\s\\S] rewrite was only needed for an RE2 wrap that was later reverted; keep the diff minimal. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(datasource/go): skip empty GOPROXY segments The switch from a lookahead split to a capture-group split (needed because RE2 has no lookahead support) changed how empty GOPROXY segments parse: `a|,b` yielded `{ url: ',', fallback: '|' }` before and `{ url: '', fallback: ',' }` after. The comma fallback only continues on 404/410, so a failing proxy ahead of an empty segment silently stopped the lookup instead of falling through to the remaining proxies. Empty segments carry no url to query, so drop them. * refactor(datasource/go): use isTruthy for empty segment filter * fix(datasource/go): filter empty segments before mapping Filtering after the map broke the contextual typing from the GoproxyItem[] annotation, widening fallback to string. * refactor(platform/github): use regEx() for merge queue query stripping --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
319 lines
9.9 KiB
TypeScript
319 lines
9.9 KiB
TypeScript
// TODO: types (#22198)
|
|
import { GlobalConfig } from '../../../config/global.ts';
|
|
import { logger } from '../../../logger/index.ts';
|
|
import { detectPlatform } from '../../../util/common.ts';
|
|
import * as hostRules from '../../../util/host-rules.ts';
|
|
import { Http } from '../../../util/http/index.ts';
|
|
import { regEx } from '../../../util/regex.ts';
|
|
import {
|
|
parseUrl,
|
|
trimLeadingSlash,
|
|
trimTrailingSlash,
|
|
} from '../../../util/url.ts';
|
|
import { BitbucketTagsDatasource } from '../bitbucket-tags/index.ts';
|
|
import { ForgejoTagsDatasource } from '../forgejo-tags/index.ts';
|
|
import { GitTagsDatasource } from '../git-tags/index.ts';
|
|
import { GiteaTagsDatasource } from '../gitea-tags/index.ts';
|
|
import { GithubTagsDatasource } from '../github-tags/index.ts';
|
|
import { GitlabTagsDatasource } from '../gitlab-tags/index.ts';
|
|
import type { DataSource } from './types.ts';
|
|
|
|
// TODO: figure out class hierarchy (#10532)
|
|
export class BaseGoDatasource {
|
|
private static readonly gitlabHttpsRegExp = regEx(
|
|
/^(?<httpsRegExpUrl>https:\/\/[^/]*gitlab\.[^/]*)\/(?<httpsRegExpName>.+?)(?:\/v\d+)?[/]?$/,
|
|
);
|
|
private static readonly gitlabRegExp = regEx(
|
|
/^(?<regExpUrl>gitlab\.[^/]*)\/(?<regExpPath>.+?)(?:\/v\d+)?[/]?$/,
|
|
);
|
|
private static readonly gitVcsRegexp = regEx(
|
|
/^(?:[^/]+)\/(?<module>.*)\.git(?:$|\/)/,
|
|
);
|
|
|
|
private static readonly id = 'go';
|
|
private static readonly http = new Http(BaseGoDatasource.id);
|
|
|
|
static async getDatasource(goModule: string): Promise<DataSource | null> {
|
|
if (goModule.startsWith('gopkg.in/')) {
|
|
const [pkg] = goModule.replace('gopkg.in/', '').split('.');
|
|
const packageName = pkg.includes('/') ? pkg : `go-${pkg}/${pkg}`;
|
|
return {
|
|
datasource: GithubTagsDatasource.id,
|
|
packageName,
|
|
registryUrl: 'https://github.com',
|
|
};
|
|
}
|
|
|
|
if (goModule.startsWith('github.com/')) {
|
|
const split = goModule.split('/');
|
|
const packageName = `${split[1]}/${split[2]}`;
|
|
return {
|
|
datasource: GithubTagsDatasource.id,
|
|
packageName,
|
|
registryUrl: 'https://github.com',
|
|
};
|
|
}
|
|
|
|
if (goModule.startsWith('bitbucket.org/')) {
|
|
const split = goModule.split('/');
|
|
const packageName = `${split[1]}/${split[2]}`;
|
|
return {
|
|
datasource: BitbucketTagsDatasource.id,
|
|
packageName,
|
|
registryUrl: 'https://bitbucket.org',
|
|
};
|
|
}
|
|
|
|
if (goModule.startsWith('code.cloudfoundry.org/')) {
|
|
const packageName = goModule.replace(
|
|
'code.cloudfoundry.org',
|
|
'cloudfoundry',
|
|
);
|
|
return {
|
|
datasource: GithubTagsDatasource.id,
|
|
packageName,
|
|
registryUrl: 'https://github.com',
|
|
};
|
|
}
|
|
|
|
if (goModule.startsWith('dev.azure.com/')) {
|
|
const split = goModule.split('/');
|
|
if ((split.length > 4 && split[3] === '_git') || split.length > 3) {
|
|
const packageName = `https://dev.azure.com/${split[1]}/${split[2]}/_git/${(split[3] === '_git' ? split[4] : split[3]).replace(regEx(/\.git$/), '')}`;
|
|
return {
|
|
datasource: GitTagsDatasource.id,
|
|
packageName,
|
|
};
|
|
}
|
|
}
|
|
|
|
//#region known gitea compatible hosts
|
|
if (goModule.startsWith('gitea.com/')) {
|
|
const split = goModule.split('/');
|
|
const packageName = `${split[1]}/${split[2]}`;
|
|
return {
|
|
datasource: GiteaTagsDatasource.id,
|
|
packageName,
|
|
registryUrl: 'https://gitea.com',
|
|
};
|
|
}
|
|
|
|
if (goModule.startsWith('code.forgejo.org/')) {
|
|
const split = goModule.split('/');
|
|
const packageName = `${split[1]}/${split[2]}`;
|
|
return {
|
|
datasource: ForgejoTagsDatasource.id,
|
|
packageName,
|
|
registryUrl: 'https://code.forgejo.org',
|
|
};
|
|
}
|
|
|
|
if (goModule.startsWith('codeberg.org/')) {
|
|
const split = goModule.split('/');
|
|
const packageName = `${split[1]}/${split[2]}`;
|
|
return {
|
|
datasource: ForgejoTagsDatasource.id,
|
|
packageName,
|
|
registryUrl: 'https://codeberg.org',
|
|
};
|
|
}
|
|
//#endregion
|
|
|
|
return await BaseGoDatasource.goGetDatasource(goModule);
|
|
}
|
|
|
|
private static async goGetDatasource(
|
|
goModule: string,
|
|
): Promise<DataSource | null> {
|
|
const goModuleUrl = goModule.replace(regEx(/\.git(\/[a-z0-9/]*)?$/), '');
|
|
const pkgUrl = `https://${goModuleUrl}?go-get=1`;
|
|
const { body: html } = await BaseGoDatasource.http.getText(pkgUrl);
|
|
|
|
const goSourceHeader = BaseGoDatasource.goSourceHeader(html, goModule);
|
|
if (goSourceHeader) {
|
|
return goSourceHeader;
|
|
}
|
|
|
|
// GitHub Enterprise only returns a go-import meta
|
|
const goImport = BaseGoDatasource.goImportHeader(html, goModule);
|
|
if (goImport) {
|
|
return goImport;
|
|
}
|
|
|
|
logger.trace({ goModule }, 'No go-source or go-import header found');
|
|
return null;
|
|
}
|
|
|
|
private static goSourceHeader(
|
|
html: string,
|
|
goModule: string,
|
|
): DataSource | null {
|
|
const sourceMatchGroups = regEx(
|
|
/<meta\s+name="?go-source"?\s+content="(?<prefix>[^"\s]+)\s+(?<goSourceUrl>[^"\s]+)/,
|
|
).exec(html)?.groups;
|
|
if (!sourceMatchGroups) {
|
|
return null;
|
|
}
|
|
const { prefix, goSourceUrl } = sourceMatchGroups;
|
|
|
|
if (!goModule.startsWith(prefix)) {
|
|
logger.trace({ goModule }, 'go-source header prefix not match');
|
|
return null;
|
|
}
|
|
|
|
logger.debug(`Go lookup source url ${goSourceUrl} for module ${goModule}`);
|
|
return this.detectDatasource(goSourceUrl, goModule);
|
|
}
|
|
|
|
private static detectDatasource(
|
|
metadataUrl: string,
|
|
goModule: string,
|
|
): DataSource | null {
|
|
if (metadataUrl.startsWith('https://github.com/')) {
|
|
return {
|
|
datasource: GithubTagsDatasource.id,
|
|
packageName: metadataUrl
|
|
.replace('https://github.com/', '')
|
|
.replace(regEx(/\/$/), ''),
|
|
registryUrl: 'https://github.com',
|
|
};
|
|
}
|
|
|
|
const gitlabModuleName =
|
|
BaseGoDatasource.gitlabRegExp.exec(goModule)?.groups?.regExpPath;
|
|
const vcsIndicatedModule =
|
|
BaseGoDatasource.gitVcsRegexp.exec(goModule)?.groups?.module;
|
|
|
|
const metadataUrlMatchGroups =
|
|
BaseGoDatasource.gitlabHttpsRegExp.exec(metadataUrl)?.groups;
|
|
if (metadataUrlMatchGroups) {
|
|
const { httpsRegExpUrl, httpsRegExpName } = metadataUrlMatchGroups;
|
|
|
|
let packageName = vcsIndicatedModule ?? gitlabModuleName;
|
|
|
|
// Detect submodules in monorepos by comparing metadata path and module path
|
|
if (!vcsIndicatedModule && httpsRegExpName && gitlabModuleName) {
|
|
const metadataPath = httpsRegExpName;
|
|
const modulePath = gitlabModuleName;
|
|
|
|
if (modulePath.startsWith(`${metadataPath}/`)) {
|
|
packageName = metadataPath;
|
|
}
|
|
}
|
|
|
|
// If we still don't have a package name, fall back to the metadata URL path
|
|
packageName = packageName ?? httpsRegExpName;
|
|
|
|
return {
|
|
datasource: GitlabTagsDatasource.id,
|
|
registryUrl: httpsRegExpUrl,
|
|
packageName,
|
|
};
|
|
}
|
|
|
|
if (hostRules.hostType({ url: metadataUrl }) === 'gitlab') {
|
|
const parsedUrl = parseUrl(metadataUrl);
|
|
if (!parsedUrl) {
|
|
logger.trace({ goModule }, 'Could not parse go-source URL');
|
|
return null;
|
|
}
|
|
|
|
const endpoint = GlobalConfig.get('endpoint');
|
|
const endpointPrefix = regEx(
|
|
/https:\/\/[^/]+\/(?<prefix>.*?\/)(?:api\/v4\/?)?/,
|
|
).exec(endpoint)?.groups?.prefix;
|
|
|
|
let packageName =
|
|
// a .git path indicates a concrete git repository, which can be different from metadata returned by gitlab
|
|
vcsIndicatedModule ?? trimLeadingSlash(parsedUrl.pathname);
|
|
if (endpointPrefix && endpointPrefix !== 'api/') {
|
|
packageName = packageName.replace(endpointPrefix, '');
|
|
}
|
|
|
|
const registryUrl = endpointPrefix
|
|
? endpoint.replace(regEx(/\/api\/v4\/?$/), '/')
|
|
: `${parsedUrl.protocol}//${parsedUrl.host}`;
|
|
|
|
return {
|
|
datasource: GitlabTagsDatasource.id,
|
|
registryUrl,
|
|
packageName,
|
|
};
|
|
}
|
|
/* istanbul ignore next */
|
|
return null;
|
|
}
|
|
|
|
private static goImportHeader(
|
|
html: string,
|
|
goModule: string,
|
|
): DataSource | null {
|
|
const importMatchGroups = regEx(
|
|
/<meta\s+name="?go-import"?\s+content="(?<prefix>[^"\s]+)\s+(?<proto>[^"\s]+)\s+(?<goImportURL>[^"\s]+)/,
|
|
).exec(html)?.groups;
|
|
if (!importMatchGroups) {
|
|
logger.trace({ goModule }, 'No go-source or go-import header found');
|
|
return null;
|
|
}
|
|
const { prefix, proto, goImportURL } = importMatchGroups;
|
|
|
|
if (!goModule.startsWith(prefix)) {
|
|
logger.trace({ goModule }, 'go-import header prefix not match');
|
|
return null;
|
|
}
|
|
|
|
if (proto !== 'git') {
|
|
logger.trace({ goModule }, 'go-import header proto not git');
|
|
return null;
|
|
}
|
|
|
|
// get server base url from import url
|
|
const parsedUrl = parseUrl(goImportURL);
|
|
if (!parsedUrl) {
|
|
logger.trace({ goModule }, 'Could not parse go-import URL');
|
|
return null;
|
|
}
|
|
|
|
logger.debug(`Go module: ${goModule} lookup import url ${goImportURL}`);
|
|
|
|
const datasource = this.detectDatasource(
|
|
goImportURL.replace(regEx(/\.git$/), ''),
|
|
goModule,
|
|
);
|
|
if (datasource !== null) {
|
|
return datasource;
|
|
}
|
|
// fall back to old behavior if detection did not work
|
|
|
|
switch (detectPlatform(goImportURL)) {
|
|
case 'github': {
|
|
// split the go module from the URL: host/go/module -> go/module
|
|
// TODO: `parsedUrl.pathname` can be undefined
|
|
const packageName = trimTrailingSlash(`${parsedUrl.pathname}`)
|
|
.replace(regEx(/\.git$/), '')
|
|
.split('/')
|
|
.slice(-2)
|
|
.join('/');
|
|
|
|
return {
|
|
datasource: GithubTagsDatasource.id,
|
|
registryUrl: `${parsedUrl.protocol}//${parsedUrl.host}`,
|
|
packageName,
|
|
};
|
|
}
|
|
case 'azure': {
|
|
return {
|
|
datasource: GitTagsDatasource.id,
|
|
packageName: goImportURL.replace(regEx(/\.git$/), ''),
|
|
};
|
|
}
|
|
default: {
|
|
return {
|
|
datasource: GitTagsDatasource.id,
|
|
packageName: goImportURL,
|
|
};
|
|
}
|
|
}
|
|
}
|
|
}
|