fix(datasource/go): use @latest to determine pseudo version (#28708)

Co-authored-by: Sebastian Poxhofer <secustor@users.noreply.github.com>

lib/modules/datasource/go/readme.md

@@ -1,5 +1,26 @@
-This datasource will default to using the `GOPROXY` settings `https://proxy.golang.org,direct` if there is no value defined in environment variables.
+The best way to lookup Go Modules is using Go proxies.
 
-To override this default and use a different proxy, simply configure `GOPROXY` to an alternative setting in env.
+## GOPROXY settings
+
+This datasource will use default `GOPROXY` settings of `https://proxy.golang.org,direct` if the environment variable is unset.
+
+To override this default and use a different proxy in self-hosted environments, configure `GOPROXY` to an alternative setting in env.
 
 To override this default and stop using any proxy at all, set `GOPROXY` to the value `direct`.
+
+## Pseudo versions
+
+Go proxies return an empty list of versions when queried (`@v/list`) for a package which uses pseudo versions, but return the latest pseudo-version when queried for `@latest`.
+
+If the `@latest` endpoint returns a pseudo-version, and the release list is empty, then this datasource will return the latest pseudo-version as the only release/version for the package.
+
+## Checking for new major releases
+
+When a Go proxy is queried for `@v/list` it returns only versions for v0 or v1 of a package.
+Therefore Renovate will also query `@v2/list` just in case there also exists a v2 of the package.
+Similarly, if the dependency is already on a higher version such as `v5`, Renovate will check in case higher major versions exist.
+You do not need to be worried about any 404 responses which result from such checks - they are the only way for Renovate to know if newer major releases exist.
+
+## Fallback to direct lookups
+
+If no result is found from Go proxy lookups then Renovate will fall back to direct lookups.

lib/modules/datasource/go/releases-goproxy.spec.ts

@@ -550,7 +550,7 @@ describe('modules/datasource/go/releases-goproxy', () => {
       expect(res).toBeNull();
     });
 
-    it('returns latest even if package has no releases', async () => {
+    it('uses latest if package has no releases', async () => {
       process.env.GOPROXY = baseUrl;
 
       httpMock
@@ -567,7 +567,13 @@ describe('modules/datasource/go/releases-goproxy', () => {
       });
 
       expect(res).toEqual({
-        releases: [],
+        releases: [
+          {
+            newDigest: '921286631fa9',
+            releaseTimestamp: '2023-09-05T20:02:55Z',
+            version: 'v0.0.0-20230905200255-921286631fa9',
+          },
+        ],
         sourceUrl: 'https://github.com/google/btree',
         tags: { latest: 'v0.0.0-20230905200255-921286631fa9' },
       });

lib/modules/datasource/go/releases-goproxy.ts

@@ -24,6 +24,24 @@ const pseudoVersionRegex = regEx(
   /v\d+\.\d+\.\d+-(?:\w+\.)?(?:0\.)?(?<timestamp>\d{14})-(?<digest>[a-f0-9]{12})/i,
 );
 
+export function pseudoVersionToRelease(pseudoVersion: string): Release | null {
+  const match = pseudoVersion.match(pseudoVersionRegex)?.groups;
+  if (!match) {
+    return null;
+  }
+
+  const { digest: newDigest, timestamp } = match;
+  const releaseTimestamp = DateTime.fromFormat(timestamp, 'yyyyMMddHHmmss', {
+    zone: 'UTC',
+  }).toISO({ suppressMilliseconds: true });
+
+  return {
+    version: pseudoVersion,
+    newDigest,
+    releaseTimestamp,
+  };
+}
+
 export class GoProxyDatasource extends Datasource {
   static readonly id = 'go-proxy';
 
@@ -69,9 +87,6 @@ export class GoProxyDatasource extends Datasource {
           result = res;
           break;
         }
-        if (res.tags?.latest) {
-          result = res;
-        }
       } catch (err) {
         const statusCode = err?.response?.statusCode;
         const canFallback =
@@ -119,30 +134,12 @@ export class GoProxyDatasource extends Datasource {
       }
 
       const [version, releaseTimestamp] = str.trim().split(regEx(/\s+/));
-      const release: Release = { version };
+      const release: Release = pseudoVersionToRelease(version) ?? { version };
 
       if (releaseTimestamp) {
         release.releaseTimestamp = releaseTimestamp;
       }
 
-      const pseudoVersionMatch = version.match(pseudoVersionRegex)?.groups;
-      if (pseudoVersionMatch) {
-        const { digest: newDigest, timestamp } = pseudoVersionMatch;
-
-        if (newDigest) {
-          release.newDigest = newDigest;
-        }
-
-        const pseudoVersionReleaseTimestamp = DateTime.fromFormat(
-          timestamp,
-          'yyyyMMddHHmmss',
-          { zone: 'UTC' },
-        ).toISO({ suppressMilliseconds: true });
-        if (pseudoVersionReleaseTimestamp) {
-          release.releaseTimestamp = pseudoVersionReleaseTimestamp;
-        }
-      }
-
       return release;
     });
   }
@@ -234,6 +231,12 @@ export class GoProxyDatasource extends Datasource {
         if (goVersioning.isGreaterThan(latestVersion, result.tags.latest)) {
           result.tags.latest = latestVersion;
         }
+        if (!result.releases.length) {
+          const releaseFromLatest = pseudoVersionToRelease(latestVersion);
+          if (releaseFromLatest) {
+            result.releases.push(releaseFromLatest);
+          }
+        }
       }
     }