mirror of
https://github.com/renovatebot/renovate.git
synced 2026-10-26 07:20:39 +00:00
a1971afa78
* ci(linter): add renovate/require-regex-util rule Adds a custom oxlint rule that flags raw RegExp usage in lib/ production code: any `new RegExp(...)` call and any regex literal that is not the direct first argument of `regEx(...)`. The regEx() helper from lib/util/regex.ts uses the RE2 engine for ReDoS-safe matching and caches compiled patterns. lib/util/regex.ts itself is exempt. The rule is disabled for **/*.spec.ts, test/**, and tools/** via config overrides, because vitest APIs such as expect.stringMatching need bare RegExp instances (a past commit reverted regEx() there). Severity is set to "warn" instead of "error": the repo currently has 197 pre-existing violations (above the agreed mechanical-fix threshold of 80), and a number of them are deliberately RE2-incompatible patterns (lookahead/lookbehind/named backreferences, see TODO #12872/#12875 markers in e.g. lib/modules/versioning/rez/ pattern.ts and lib/modules/manager/dockerfile/extract.ts) that need per-site judgment before they can be wrapped in regEx() or suppressed with a justified disable comment. No violation fixes are included in this commit. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * ci(linter): enforce renovate/require-regex-util at error Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * refactor: use regEx() for regex literals and RegExp construction in lib Burn down all renovate/require-regex-util violations (197): - wrap RE2-compatible regex literals and RegExp constructions in regEx() - rewrite lookaround patterns where behavior is provably preserved: goproxy separator split, sbt-package link extraction, leiningen comment stripping and keyword search, npm GitHub owner validation (unit-count bound replaced by an explicit length check) - keep native RegExp with disable comments where RE2 cannot be used: moo / good-enough-parser lexer patterns (moo rejects RE2 instances), MigrationsService propertyName (matched via isRegExp, which RE2 instances fail), rez named backreferences and lookaheads, GitHub markdown link negative lookbehind, emoji astral-plane matching - drop stale TODO #12875 comments for patterns current re2 handles Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * refactor: reduce require-regex-util disable comments Rewrite the github massage-markdown-links URL regex to capture an optional `api.` prefix in a named group (skipped in code) instead of relying on a negative lookbehind, so both the base and global variants can use regEx()/RE2 and their two disable comments are removed. Add spec cases for api-prefixed URLs that match the URL shape. Consolidate the four related line disables in rez/pattern.ts (bound and range patterns emulating Python conditional patterns via named backreferences and lookaheads, which RE2 cannot express) into a single block disable/enable pair, matching the treatment of the lexer files. Disable comment count drops from 13 to 8. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * refactor(datasource/sbt-package): use named capture group in link regex Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * refactor(manager/cake): restore original multiLineComment regex spelling The [^] -> [\\s\\S] rewrite was only needed for an RE2 wrap that was later reverted; keep the diff minimal. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(datasource/go): skip empty GOPROXY segments The switch from a lookahead split to a capture-group split (needed because RE2 has no lookahead support) changed how empty GOPROXY segments parse: `a|,b` yielded `{ url: ',', fallback: '|' }` before and `{ url: '', fallback: ',' }` after. The comma fallback only continues on 404/410, so a failing proxy ahead of an empty segment silently stopped the lookup instead of falling through to the remaining proxies. Empty segments carry no url to query, so drop them. * refactor(datasource/go): use isTruthy for empty segment filter * fix(datasource/go): filter empty segments before mapping Filtering after the map broke the contextual typing from the GoproxyItem[] annotation, widening fallback to string. * refactor(platform/github): use regEx() for merge queue query stripping --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
155 lines
3.8 KiB
TypeScript
155 lines
3.8 KiB
TypeScript
import { query as q } from '@renovatebot/good-enough-parser';
|
|
import { regEx } from '../../../util/regex.ts';
|
|
import { CpanDatasource } from '../../datasource/cpan/index.ts';
|
|
import { GithubTagsDatasource } from '../../datasource/github-tags/index.ts';
|
|
import * as perlVersioning from '../../versioning/perl/index.ts';
|
|
import type { PackageDependency } from '../types.ts';
|
|
import { cpanfile } from './language.ts';
|
|
|
|
interface Ctx {
|
|
deps: PackageDependency[];
|
|
|
|
perlVersion?: string;
|
|
|
|
phase?: string;
|
|
tempPhase?: string;
|
|
|
|
depName?: string;
|
|
currentValue?: string;
|
|
}
|
|
|
|
// requires perl, '5.36.1';
|
|
// requires 'perl' => 5.036001;
|
|
const perlVersionMatch = q
|
|
.sym<Ctx>('requires')
|
|
.alt(q.sym('perl'), q.str('perl'))
|
|
.alt(q.op(','), q.op('=>'))
|
|
.alt(
|
|
q.num<Ctx>((ctx, { value: perlVersion }) => ({ ...ctx, perlVersion })),
|
|
q.str<Ctx>((ctx, { value: perlVersion }) => ({ ...ctx, perlVersion })),
|
|
)
|
|
.op(';')
|
|
.handler((ctx) => {
|
|
if (ctx.perlVersion) {
|
|
ctx.deps.push({
|
|
depName: 'perl',
|
|
packageName: 'Perl/perl5',
|
|
currentValue: ctx.perlVersion,
|
|
datasource: GithubTagsDatasource.id,
|
|
versioning: perlVersioning.id,
|
|
extractVersion: '^v(?<version>\\S+)',
|
|
});
|
|
}
|
|
return ctx;
|
|
});
|
|
|
|
const requirementMatch = q.sym<Ctx>(
|
|
regEx(/^(?:requires|recommends|suggests)$/),
|
|
);
|
|
|
|
const phasedRequiresMatch = q.sym<Ctx>(
|
|
regEx(/^(?:configure|build|test|author)_requires$/),
|
|
(ctx, { value: phase }) => {
|
|
ctx.tempPhase = phase
|
|
.replace(regEx(/_requires/), '')
|
|
.replace(regEx(/author/), 'develop');
|
|
return ctx;
|
|
},
|
|
);
|
|
|
|
// requires 'Foo::Bar';
|
|
//
|
|
// requires 'Foo::Bar', '1.23';
|
|
// recommends 'Foo::Bar', '1.23';
|
|
// suggests 'Foo::Bar', '1.23';
|
|
//
|
|
// configure_requires 'Foo::Bar' => 1.023;
|
|
// build_requires 'Foo::Bar' => 1.023;
|
|
// test_requires 'Foo::Bar' => 1.023;
|
|
// author_requires 'Foo::Bar' => 1.023;
|
|
const moduleMatch = q
|
|
.alt(requirementMatch, phasedRequiresMatch)
|
|
.str((ctx, { value: depName }) => ({ ...ctx, depName }))
|
|
.opt(
|
|
q.alt<Ctx>(q.op(','), q.op('=>')).alt(
|
|
q.num<Ctx>((ctx, { value: currentValue }) => ({ ...ctx, currentValue })),
|
|
q.str<Ctx>((ctx, { value }) => {
|
|
const currentValue = value.replace(
|
|
regEx(/^(?:\s*(?:==|>=|>))?\s*v?/),
|
|
'',
|
|
);
|
|
return { ...ctx, currentValue };
|
|
}),
|
|
),
|
|
)
|
|
.op(';')
|
|
.handler((ctx) => {
|
|
const { phase, tempPhase, depName, currentValue } = ctx;
|
|
|
|
delete ctx.tempPhase;
|
|
delete ctx.depName;
|
|
delete ctx.currentValue;
|
|
|
|
if (depName) {
|
|
const dep: PackageDependency = {
|
|
depName,
|
|
};
|
|
if (currentValue) {
|
|
dep.currentValue = currentValue;
|
|
} else {
|
|
dep.skipReason = 'unspecified-version';
|
|
}
|
|
if (phase) {
|
|
dep.depType = phase;
|
|
} else if (tempPhase) {
|
|
dep.depType = tempPhase;
|
|
}
|
|
|
|
dep.datasource = CpanDatasource.id;
|
|
ctx.deps.push(dep);
|
|
}
|
|
|
|
return ctx;
|
|
});
|
|
|
|
const phaseRegex = regEx(/^(?:configure|build|test|runtime|develop)/);
|
|
|
|
const phaseMatch = q.alt<Ctx>(
|
|
q.sym(phaseRegex, (ctx, { value: phase }) => ({ ...ctx, phase })),
|
|
q.str(phaseRegex, (ctx, { value: phase }) => ({ ...ctx, phase })),
|
|
);
|
|
|
|
// on 'configure' => sub {
|
|
// on build => sub {
|
|
// on 'test' => sub {
|
|
// on runtime => sub {
|
|
// on 'develop' => sub {
|
|
const onMatch = q
|
|
.sym<Ctx>('on')
|
|
.join(phaseMatch)
|
|
.op('=>')
|
|
.sym('sub')
|
|
.tree({
|
|
type: 'wrapped-tree',
|
|
maxDepth: 1,
|
|
search: moduleMatch,
|
|
})
|
|
.handler((ctx) => {
|
|
delete ctx.phase;
|
|
return ctx;
|
|
});
|
|
|
|
const query = q.tree<Ctx>({
|
|
type: 'root-tree',
|
|
maxDepth: 4,
|
|
search: q.alt<Ctx>(perlVersionMatch, moduleMatch, onMatch),
|
|
});
|
|
|
|
export function parse(
|
|
content: string,
|
|
): Pick<Ctx, 'deps' | 'perlVersion'> | null {
|
|
return cpanfile.query(content, query, {
|
|
deps: [],
|
|
});
|
|
}
|