mirror of
https://github.com/renovatebot/renovate.git
synced 2026-11-08 04:53:36 +00:00
Gregor Zeitlinger
0338dd74ba
* fix(mise): trust Renovate repo checkout during lock file updates * docs(mise): document trusted config paths for lock updates * refactor(mise): sanitize config files for lock updates * test(mise): cover sanitized lock update flow * docs(mise): describe sanitized lock update flow * test(mise): cover sanitize failure paths * fix(mise): clarify mirror read coverage * fix(mise): allowlist mirrored settings * test(mise): fix schema and integration specs * fix(mise): trust only sanitized mirror workspace * test(mise): fix mirrored cwd type narrowing * test(mise): focus coverage on sanitized mirror flow * test(mise): cover recursive settings schema * fix(mise): ignore misreported lcov branch * test(mise): remove redundant integration gate * test(mise): drop local integration spec * fix(mise): gate lock updates as unsafe execution * fix(mise): restore settings schema typing * fix(mise): generalize unsafe execution to mise Rename allowedUnsafeExecutions value miseLock -> mise since any mise command reading repo config can execute arbitrary code, not just mise lock. Drop unused smol-toml dependency left over from the abandoned config-sanitize approach. Addresses PR review feedback. * fix(mise): drop unused settings schema parsing Nothing reads MiseFile.settings — the lock-update flow gates on allowedUnsafeExecutions and relies on CI=true auto-trust, not config sanitization. Remove the dead schema + tests per review. Signed-off-by: Gregor Zeitlinger <gregor.zeitlinger@grafana.com> * fix(mise): trust repo config via trusted paths * fix(mise): explicitly trust config before lock --------- Signed-off-by: Gregor Zeitlinger <gregor.zeitlinger@grafana.com>