Merge branch 'main' into fix/host-rules-migration

.devcontainer/Dockerfile

@@ -1,4 +1,4 @@
-FROM containerbase/node:18.14.1@sha256:a1c21e163dc74321763e307186296b388956b4933e288f8a39399a8af1094882
+FROM containerbase/node:18.14.2@sha256:cb68fa4baae8632f43734cd9d98a80cf0a3c6a6f7898beb4173563a1ddd98a80
 
 USER root
 

.github/workflows/build.yml

@@ -84,7 +84,7 @@ jobs:
         run: yarn build
 
       - name: Cache jest cache
-        uses: actions/cache@6998d139ddd3e68c71e9e398d8e40b71a2f39812 # v3.2.5
+        uses: actions/cache@69d9d449aced6a2ede0bc19182fadc3a0a42d2b0 # v3.2.6
         with:
           path: .cache/jest
           key: ${{ runner.os }}-${{ matrix.node-version }}-jest-${{ hashFiles('yarn.lock') }}

docs/usage/configuration-options.md

@@ -894,6 +894,22 @@ Renovate follows tags _strictly_, this can cause problems when a tagged stream i
 For example: you're following the `next` tag, but later the stream you actually want is called `stable` instead.
 If `next` is no longer getting updates, you must switch your `followTag` to `stable` to get updates again.
 
+## forkModeDisallowMaintainerEdits
+
+Use `forkModeDisallowMaintainerEdits` to disallow maintainers from editing Renovate's pull requests when in fork mode.
+
+If GitHub pull requests are created from a [fork repository](https://docs.github.com/en/get-started/quickstart/fork-a-repo), the PR author can decide to allow upstream repository to modify the PR directly.
+
+Allowing maintainers to edit pull requests directly is helpful when Renovate pull requests require additional changes.
+The reviewer can simply push to the pull request without having to create a new PR. [More details here](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/allowing-changes-to-a-pull-request-branch-created-from-a-fork).
+
+You may decide to disallow edits to Renovate pull requests in order to workaround issues in Renovate where modified fork branches are not deleted properly: [See this issue](https://github.com/renovatebot/renovate/issues/16657).
+If this option is enabled, reviewers will need to create a new PR if additional changes are needed.
+
+<!-- prettier-ignore -->
+!!! note
+    This option is only relevant if you set `forkToken`.
+
 ## gitAuthor
 
 You can customize the Git author that's used whenever Renovate creates a commit.

lib/config/options/index.ts

@@ -1677,7 +1677,7 @@ const options: RenovateOptions[] = [
     type: 'boolean',
     default: false,
     experimental: true,
-    experimentalIssues: [20427],
+    experimentalIssues: [20542],
   },
   {
     name: 'pruneBranchAfterAutomerge',
@@ -1929,6 +1929,14 @@ const options: RenovateOptions[] = [
     default: false,
     supportedPlatforms: ['gitlab'],
   },
+  {
+    name: 'forkModeDisallowMaintainerEdits',
+    description:
+      'Disallow maintainers to push to Renovate pull requests when running in fork mode.',
+    type: 'boolean',
+    supportedPlatforms: ['github'],
+    default: false,
+  },
   {
     name: 'confidential',
     description:

lib/config/presets/internal/group.ts

@@ -336,6 +336,15 @@ const staticGroups = {
       },
     ],
   },
+  react: {
+    description: 'Group React and corresponding `@types` packages together.',
+    packageRules: [
+      {
+        groupName: 'react monorepo',
+        matchPackageNames: ['@types/react', '@types/react-dom'],
+      },
+    ],
+  },
   recommended: {
     description:
       'Use curated list of recommended non-monorepo package groupings.',
@@ -359,6 +368,7 @@ const staticGroups = {
       'group:kubernetes',
       'group:phpstan',
       'group:polymer',
+      'group:react',
       'group:resilience4j',
       'group:rubyOnRails',
       'group:rubyOmniauth',

lib/config/types.ts

@@ -230,6 +230,7 @@ export interface RenovateConfig
   postUpdateOptions?: string[];
   prConcurrentLimit?: number;
   prHourlyLimit?: number;
+  forkModeDisallowMaintainerEdits?: boolean;
 
   defaultRegistryUrls?: string[];
   registryUrls?: string[] | null;

lib/modules/datasource/bitbucket-tags/index.ts

@@ -1,6 +1,7 @@
 import { cache } from '../../../util/cache/package/decorator';
 import { BitbucketHttp } from '../../../util/http/bitbucket';
 import { ensureTrailingSlash } from '../../../util/url';
+import type { PagedResult, RepoInfoBody } from '../../platform/bitbucket/types';
 import * as utils from '../../platform/bitbucket/utils';
 import { Datasource } from '../datasource';
 import type { DigestConfig, GetReleasesConfig, ReleaseResult } from '../types';
@@ -97,7 +98,7 @@ export class BitBucketTagsDatasource extends Datasource {
   })
   async getMainBranch(repo: string): Promise<string> {
     return (
-      await this.bitbucketHttp.getJson<utils.RepoInfoBody>(
+      await this.bitbucketHttp.getJson<RepoInfoBody>(
         `/2.0/repositories/${repo}`
       )
     ).body.mainbranch.name;
@@ -122,7 +123,7 @@ export class BitBucketTagsDatasource extends Datasource {
 
     const url = `/2.0/repositories/${repo}/commits/${mainBranch}`;
     const bitbucketCommits = (
-      await this.bitbucketHttp.getJson<utils.PagedResult<BitbucketCommit>>(url)
+      await this.bitbucketHttp.getJson<PagedResult<BitbucketCommit>>(url)
     ).body;
 
     if (bitbucketCommits.values.length === 0) {

lib/modules/datasource/packagist/index.ts

@@ -1,11 +1,10 @@
-import URL from 'url';
 import { logger } from '../../../logger';
 import { ExternalHostError } from '../../../types/errors/external-host-error';
 import { cache } from '../../../util/cache/package/decorator';
 import * as hostRules from '../../../util/host-rules';
 import type { HttpOptions } from '../../../util/http/types';
 import * as p from '../../../util/promises';
-import { ensureTrailingSlash, joinUrlParts } from '../../../util/url';
+import { joinUrlParts, resolveBaseUrl } from '../../../util/url';
 import * as composerVersioning from '../../versioning/composer';
 import { Datasource } from '../datasource';
 import type { GetReleasesConfig, ReleaseResult } from '../types';
@@ -42,7 +41,7 @@ export class PackagistDatasource extends Datasource {
   }
 
   private async getRegistryMeta(regUrl: string): Promise<RegistryMeta | null> {
-    const url = URL.resolve(ensureTrailingSlash(regUrl), 'packages.json');
+    const url = resolveBaseUrl(regUrl, 'packages.json');
     const opts = PackagistDatasource.getHostOpts(url);
     const res = (await this.http.getJson<PackageMeta>(url, opts)).body;
     const meta: RegistryMeta = {
@@ -225,14 +224,14 @@ export class PackagistDatasource extends Datasource {
       }
       let pkgUrl: string;
       if (packageName in providerPackages) {
-        pkgUrl = URL.resolve(
+        pkgUrl = resolveBaseUrl(
           registryUrl,
           providersUrl!
             .replace('%package%', packageName)
             .replace('%hash%', providerPackages[packageName])
         );
       } else if (providersLazyUrl) {
-        pkgUrl = URL.resolve(
+        pkgUrl = resolveBaseUrl(
           registryUrl,
           providersLazyUrl.replace('%package%', packageName)
         );

lib/modules/datasource/packagist/schema.ts

@@ -1,6 +1,7 @@
 import is from '@sindresorhus/is';
 import { z } from 'zod';
 import { logger } from '../../../logger';
+import { looseObject, looseValue } from '../../../util/schema';
 import type { Release, ReleaseResult } from '../types';
 
 export const MinifiedArray = z.array(z.record(z.unknown())).transform((xs) => {
@@ -44,32 +45,20 @@ export const ComposerRelease = z
     version: z.string(),
   })
   .merge(
-    z
-      .object({
-        homepage: z.string().nullable().catch(null),
-        source: z
-          .object({
-            url: z.string(),
-          })
-          .nullable()
-          .catch(null),
-        time: z.string().nullable().catch(null),
-        require: z
-          .object({
-            php: z.string(),
-          })
-          .nullable()
-          .catch(null),
-      })
-      .partial()
+    looseObject({
+      homepage: z.string(),
+      source: z.object({ url: z.string() }),
+      time: z.string(),
+      require: z.object({ php: z.string() }),
+    })
   );
 export type ComposerRelease = z.infer<typeof ComposerRelease>;
 
 export const ComposerReleases = z
   .union([
-    z.array(ComposerRelease.nullable().catch(null)),
+    z.array(looseValue(ComposerRelease)),
     z
-      .record(ComposerRelease.nullable().catch(null))
+      .record(looseValue(ComposerRelease))
       .transform((map) => Object.values(map)),
   ])
   .catch([])

lib/modules/manager/npm/post-update/index.spec.ts

@@ -1,7 +1,7 @@
 // TODO: add tests
 import upath from 'upath';
 import { Fixtures } from '../../../../../test/fixtures';
-import { fs, git, logger, partial } from '../../../../../test/util';
+import { fs, git, logger, partial, scm } from '../../../../../test/util';
 import { GlobalConfig } from '../../../../config/global';
 import type { FileChange } from '../../../../util/git/types';
 import type { PostUpdateConfig } from '../../types';
@@ -628,7 +628,7 @@ describe('modules/manager/npm/post-update/index', () => {
 
     it('lockfile maintenance branch exists', async () => {
       // TODO: can this really happen?
-      git.branchExists.mockReturnValueOnce(true);
+      scm.branchExists.mockResolvedValueOnce(true);
       expect(
         await getAdditionalFiles(
           {

lib/modules/manager/npm/post-update/index.ts

@@ -17,12 +17,13 @@ import {
   readLocalFile,
   writeLocalFile,
 } from '../../../../util/fs';
-import { branchExists, getFile, getRepoStatus } from '../../../../util/git';
+import { getFile, getRepoStatus } from '../../../../util/git';
 import type { FileChange } from '../../../../util/git/types';
 import * as hostRules from '../../../../util/host-rules';
 import { newlineRegex, regEx } from '../../../../util/regex';
 import { ensureTrailingSlash } from '../../../../util/url';
 import { NpmDatasource } from '../../../datasource/npm';
+import { scm } from '../../../platform/scm';
 import type { PackageFile, PostUpdateConfig, Upgrade } from '../../types';
 import { getZeroInstallPaths } from '../extract/yarn';
 import type { NpmDepType, NpmManagerData } from '../types';
@@ -520,7 +521,7 @@ export async function getAdditionalFiles(
   if (
     config.updateType === 'lockFileMaintenance' &&
     config.reuseExistingBranch &&
-    branchExists(config.branchName)
+    (await scm.branchExists(config.branchName))
   ) {
     logger.debug('Skipping lockFileMaintenance update');
     return { artifactErrors, updatedArtifacts };

lib/modules/platform/azure/index.spec.ts

@@ -569,7 +569,12 @@ describe('modules/platform/azure/index', () => {
         () =>
           ({
             getBranch: jest.fn(() => ({ commit: { commitId: 'abcd1234' } })),
-            getStatuses: jest.fn(() => [{ state: GitStatusState.Succeeded }]),
+            getStatuses: jest.fn(() => [
+              {
+                state: GitStatusState.Succeeded,
+                context: { genre: 'renovate' },
+              },
+            ]),
           } as any)
       );
       const res = await azure.getBranchStatus('somebranch');

lib/modules/platform/azure/index.ts

@@ -391,15 +391,15 @@ export async function getBranchStatus(
     return 'yellow';
   }
   const noOfFailures = statuses.filter(
-    (status: GitStatus) =>
+    (status) =>
       status.state === GitStatusState.Error ||
       status.state === GitStatusState.Failed
   ).length;
   if (noOfFailures) {
     return 'red';
   }
   const noOfPending = statuses.filter(
-    (status: GitStatus) =>
+    (status) =>
       status.state === GitStatusState.NotSet ||
       status.state === GitStatusState.Pending
   ).length;

lib/modules/platform/bitbucket/comments.ts

@@ -1,7 +1,8 @@
 import { logger } from '../../../logger';
 import { BitbucketHttp } from '../../../util/http/bitbucket';
 import type { EnsureCommentConfig, EnsureCommentRemovalConfig } from '../types';
-import { Config, accumulateValues } from './utils';
+import type { Config } from './types';
+import { accumulateValues } from './utils';
 
 const bitbucketHttp = new BitbucketHttp();
 

lib/modules/platform/bitbucket/index.spec.ts

@@ -245,7 +245,7 @@ describe('modules/platform/bitbucket/index', () => {
         .reply(200, {
           values: [
             {
-              key: 'foo',
+              key: 'renovate/stability-days',
               state: 'SUCCESSFUL',
             },
           ],

lib/modules/platform/bitbucket/index.ts

@@ -31,20 +31,25 @@ import { repoFingerprint } from '../util';
 import { smartTruncate } from '../utils/pr-body';
 import { readOnlyIssueBody } from '../utils/read-only-issue-body';
 import * as comments from './comments';
-import * as utils from './utils';
-import {
+import type {
   Account,
+  BitbucketStatus,
+  BranchResponse,
+  Config,
   EffectiveReviewer,
+  PagedResult,
   PrResponse,
+  RepoInfo,
   RepoInfoBody,
-  mergeBodyTransformer,
-} from './utils';
+} from './types';
+import * as utils from './utils';
+import { mergeBodyTransformer } from './utils';
 
 const bitbucketHttp = new BitbucketHttp();
 
 const BITBUCKET_PROD_ENDPOINT = 'https://api.bitbucket.org/';
 
-let config: utils.Config = {} as any;
+let config: Config = {} as any;
 
 const defaults = { endpoint: BITBUCKET_PROD_ENDPOINT };
 
@@ -127,7 +132,7 @@ export async function getRawFile(
 
   let finalBranchOrTag = branchOrTag;
   if (branchOrTag?.includes(pathSeparator)) {
-    // Branch name contans slash, so we have to replace branch name with SHA1 of the head commit; otherwise the API will not work.
+    // Branch name contains slash, so we have to replace branch name with SHA1 of the head commit; otherwise the API will not work.
     finalBranchOrTag = await getBranchCommit(branchOrTag);
   }
 
@@ -164,8 +169,8 @@ export async function initRepo({
     repository,
     username: opts.username,
     ignorePrAuthor,
-  } as utils.Config;
-  let info: utils.RepoInfo;
+  } as Config;
+  let info: RepoInfo;
   try {
     info = utils.repoInfoTransformer(
       (
@@ -306,12 +311,6 @@ export async function getPr(prNo: number): Promise<Pr | null> {
 const escapeHash = (input: string): string =>
   input ? input.replace(regEx(/#/g), '%23') : input;
 
-interface BranchResponse {
-  target: {
-    hash: string;
-  };
-}
-
 // Return the commit SHA for a branch
 async function getBranchCommit(
   branchName: string
@@ -344,9 +343,9 @@ export async function getBranchPr(branchName: string): Promise<Pr | null> {
 async function getStatus(
   branchName: string,
   useCache = true
-): Promise<utils.BitbucketStatus[]> {
+): Promise<BitbucketStatus[]> {
   const sha = await getBranchCommit(branchName);
-  return utils.accumulateValues<utils.BitbucketStatus>(
+  return utils.accumulateValues<BitbucketStatus>(
     // TODO: types (#7154)
     // eslint-disable-next-line @typescript-eslint/restrict-template-expressions
     `/2.0/repositories/${config.repository}/commit/${sha}/statuses`,
@@ -764,7 +763,7 @@ export async function createPr({
 
   if (platformOptions?.bbUseDefaultReviewers) {
     const reviewersResponse = (
-      await bitbucketHttp.getJson<utils.PagedResult<EffectiveReviewer>>(
+      await bitbucketHttp.getJson<PagedResult<EffectiveReviewer>>(
         `/2.0/repositories/${config.repository}/effective-default-reviewers`
       )
     ).body;