@paklo/runner 0.6.0 → 0.8.0

package/dist/{api-client-M8F9t7II.d.mts → api-client-BoQ6jjRB.d.mts}

@@ -1,5 +1,5 @@
+import { KyInstance } from "ky";
 import { DependabotCredential, DependabotJobConfig, DependabotMetric, DependabotRecordUpdateJobError } from "@paklo/core/dependabot";
-import { InnerApiClient } from "@paklo/core/http";
 
 //#region src/params.d.ts
 declare class JobParameters {
@@ -29,8 +29,9 @@ declare class ApiClient {
   readonly params: JobParameters;
   private readonly credentialsToken;
   private readonly secretMasker;
+  private dependabotApiUrl;
   private jobToken;
-  constructor(client: InnerApiClient, params: JobParameters, jobToken: string, credentialsToken: string, secretMasker: SecretMasker);
+  constructor(client: KyInstance, params: JobParameters, jobToken: string, credentialsToken: string, secretMasker: SecretMasker);
   UnknownSha: {
     'base-commit-sha': string;
   };
@@ -45,4 +46,4 @@ declare class ApiClient {
 }
 //#endregion
 export { JobParameters as a, SecretMasker as i, CredentialFetchingError as n, getJobParameters as o, JobDetailsFetchingError as r, ApiClient as t };
-//# sourceMappingURL=api-client-M8F9t7II.d.mts.map
+//# sourceMappingURL=api-client-BoQ6jjRB.d.mts.map

package/dist/index.d.mts

@@ -1,6 +1,6 @@
-import { a as JobParameters, i as SecretMasker, n as CredentialFetchingError, o as getJobParameters, r as JobDetailsFetchingError, t as ApiClient } from "./api-client-M8F9t7II.mjs";
-import { DependabotCredential, DependabotJobConfig, DependabotProxyConfig, FileFetcherInput, FileUpdaterInput } from "@paklo/core/dependabot";
+import { a as JobParameters, i as SecretMasker, n as CredentialFetchingError, o as getJobParameters, r as JobDetailsFetchingError, t as ApiClient } from "./api-client-BoQ6jjRB.mjs";
 import Docker, { Container, Network } from "dockerode";
+import { CertificateAuthority, DependabotCredential, DependabotJobConfig, DependabotProxyConfig, FileFetcherInput, FileUpdaterInput } from "@paklo/core/dependabot";
 import { UsageTelemetryRequestData } from "@paklo/core/usage";
 
 //#region src/cleanup.d.ts
@@ -42,15 +42,17 @@ type Proxy = {
   cert: string;
   shutdown: () => Promise<void>;
 };
+declare const CONFIG_FILE_NAME = "config.json";
 declare class ProxyBuilder {
   private readonly docker;
   private readonly proxyImage;
   private readonly cachedMode;
-  constructor(docker: Docker, proxyImage: string, cachedMode: boolean);
+  private readonly debug;
+  constructor(docker: Docker, proxyImage: string, cachedMode: boolean, debug: boolean);
   run(jobId: string, jobToken: string, dependabotApiUrl: string, credentials: DependabotCredential[]): Promise<Proxy>;
   private ensureNetwork;
   private buildProxyConfig;
-  private generateCertificateAuthority;
+  static generateCertificateAuthority(): Promise<CertificateAuthority>;
   private createContainer;
   private customCAPath;
 }
@@ -66,6 +68,7 @@ type RunJobOptions = {
   credentialsToken: string;
   updaterImage?: string;
   secretMasker: SecretMasker;
+  debug: boolean;
   usage: Pick<UsageTelemetryRequestData, 'trigger' | 'provider' | 'owner' | 'project' | 'package-manager'>;
 };
 type RunJobResult = {
@@ -88,8 +91,9 @@ declare class Updater {
   private readonly params;
   private readonly job;
   private readonly credentials;
+  private readonly debug;
   docker: Docker;
-  constructor(updaterImage: string, proxyImage: string, params: JobParameters, job: DependabotJobConfig, credentials: DependabotCredential[]);
+  constructor(updaterImage: string, proxyImage: string, params: JobParameters, job: DependabotJobConfig, credentials: DependabotCredential[], debug: boolean);
   /**
    * Execute an update job and report the result to Dependabot API.
    */
@@ -103,6 +107,13 @@ declare class Updater {
 }
 //#endregion
 //#region src/updater-builder.d.ts
+declare const JOB_OUTPUT_FILENAME = "output.json";
+declare const JOB_OUTPUT_PATH = "/home/dependabot/dependabot-updater/output";
+declare const JOB_INPUT_FILENAME = "job.json";
+declare const JOB_INPUT_PATH = "/home/dependabot/dependabot-updater";
+declare const REPO_CONTENTS_PATH = "/home/dependabot/dependabot-updater/repo";
+declare const CA_CERT_INPUT_PATH = "/usr/local/share/ca-certificates";
+declare const CA_CERT_FILENAME = "dbot-ca.crt";
 declare class UpdaterBuilder {
   private readonly docker;
   private readonly jobParams;
@@ -113,5 +124,13 @@ declare class UpdaterBuilder {
   run(containerName: string): Promise<Container>;
 }
 //#endregion
-export { ApiClient, ContainerRuntimeError, ContainerService, CredentialFetchingError, ImageService, JobDetailsFetchingError, JobParameters, JobRunnerImagingError, JobRunnerUpdaterError, MetricReporter, PROXY_IMAGE_NAME, Proxy, ProxyBuilder, RunJobOptions, RunJobResult, SecretMasker, Updater, UpdaterBuilder, cleanup, cleanupOldImageVersions, digestName, getJobParameters, getOrgFromImage, hasDigest, isRunningInDocker, repositoryName, runJob, updaterImageName, updaterImages };
+//#region src/utils.d.ts
+/**
+ * Extracts the SHA from an updater image string.
+ * @param updaterImage - Image string in the format "image:sha" or "registry/image:sha"
+ * @returns The SHA part after the last colon, or null if no colon is found
+ */
+declare const extractUpdaterSha: (updaterImage: string) => string | null;
+//#endregion
+export { ApiClient, CA_CERT_FILENAME, CA_CERT_INPUT_PATH, CONFIG_FILE_NAME, ContainerRuntimeError, ContainerService, CredentialFetchingError, ImageService, JOB_INPUT_FILENAME, JOB_INPUT_PATH, JOB_OUTPUT_FILENAME, JOB_OUTPUT_PATH, JobDetailsFetchingError, JobParameters, JobRunnerImagingError, JobRunnerUpdaterError, MetricReporter, PROXY_IMAGE_NAME, Proxy, ProxyBuilder, REPO_CONTENTS_PATH, RunJobOptions, RunJobResult, SecretMasker, Updater, UpdaterBuilder, cleanup, cleanupOldImageVersions, digestName, extractUpdaterSha, getJobParameters, getOrgFromImage, hasDigest, isRunningInDocker, repositoryName, runJob, updaterImageName, updaterImages };
 //# sourceMappingURL=index.d.mts.map

package/dist/index.mjs

@@ -1,4 +1,4 @@
-import { S as JobDetailsFetchingError, _ as repositoryName, a as Updater, b as ApiClient, c as JobParameters, d as getOrgFromImage, f as ContainerRuntimeError, g as hasDigest, h as digestName, i as runJob, l as getJobParameters, m as PROXY_IMAGE_NAME, n as JobRunnerUpdaterError, o as UpdaterBuilder, p as ContainerService, r as isRunningInDocker, s as ProxyBuilder, t as JobRunnerImagingError, u as ImageService, v as updaterImageName, x as CredentialFetchingError, y as updaterImages } from "./run-DBD6Hefl.mjs";
+import { A as CredentialFetchingError, C as PROXY_IMAGE_NAME, D as updaterImageName, E as repositoryName, O as updaterImages, S as extractUpdaterSha, T as hasDigest, _ as getJobParameters, a as Updater, b as ContainerRuntimeError, c as JOB_INPUT_FILENAME, d as JOB_OUTPUT_PATH, f as REPO_CONTENTS_PATH, g as JobParameters, h as ProxyBuilder, i as runJob, j as JobDetailsFetchingError, k as ApiClient, l as JOB_INPUT_PATH, m as CONFIG_FILE_NAME, n as JobRunnerUpdaterError, o as CA_CERT_FILENAME, p as UpdaterBuilder, r as isRunningInDocker, s as CA_CERT_INPUT_PATH, t as JobRunnerImagingError, u as JOB_OUTPUT_FILENAME, v as ImageService, w as digestName, x as ContainerService, y as getOrgFromImage } from "./run-CXDAe0P_.mjs";
 import { logger } from "@paklo/core/logger";
 import Docker from "dockerode";
 
@@ -45,5 +45,5 @@ function imageMatches(imageInfo, imageName) {
 }
 
 //#endregion
-export { ApiClient, ContainerRuntimeError, ContainerService, CredentialFetchingError, ImageService, JobDetailsFetchingError, JobParameters, JobRunnerImagingError, JobRunnerUpdaterError, PROXY_IMAGE_NAME, ProxyBuilder, Updater, UpdaterBuilder, cleanup, cleanupOldImageVersions, digestName, getJobParameters, getOrgFromImage, hasDigest, isRunningInDocker, repositoryName, runJob, updaterImageName, updaterImages };
+export { ApiClient, CA_CERT_FILENAME, CA_CERT_INPUT_PATH, CONFIG_FILE_NAME, ContainerRuntimeError, ContainerService, CredentialFetchingError, ImageService, JOB_INPUT_FILENAME, JOB_INPUT_PATH, JOB_OUTPUT_FILENAME, JOB_OUTPUT_PATH, JobDetailsFetchingError, JobParameters, JobRunnerImagingError, JobRunnerUpdaterError, PROXY_IMAGE_NAME, ProxyBuilder, REPO_CONTENTS_PATH, Updater, UpdaterBuilder, cleanup, cleanupOldImageVersions, digestName, extractUpdaterSha, getJobParameters, getOrgFromImage, hasDigest, isRunningInDocker, repositoryName, runJob, updaterImageName, updaterImages };
 //# sourceMappingURL=index.mjs.map

package/dist/local/azure/index.d.mts

@@ -1,19 +1,19 @@
-import "../../api-client-M8F9t7II.mjs";
-import { a as LocalJobsRunner, i as LocalDependabotServerOptions, n as LocalDependabotServer, o as LocalJobsRunnerOptions, s as RunJobsResult } from "../../server-DTAFwSrb.mjs";
+import "../../api-client-BoQ6jjRB.mjs";
+import { a as LocalJobsRunner, i as LocalDependabotServerOptions, n as LocalDependabotServer, o as LocalJobsRunnerOptions, s as RunJobsResult } from "../../server-6BlJr2bw.mjs";
 import { DependabotRequest } from "@paklo/core/dependabot";
-import { AzureDevOpsRepositoryUrl, AzureDevOpsWebApiClient, IPullRequestProperties } from "@paklo/core/azure";
+import { AzdoPrExtractedWithProperties, AzdoPullRequestMergeStrategy, AzureDevOpsClientWrapper, AzureDevOpsRepositoryUrl } from "@paklo/core/azure";
 
 //#region src/local/azure/server.d.ts
 type AzureLocalDependabotServerOptions = LocalDependabotServerOptions & {
   url: AzureDevOpsRepositoryUrl;
-  authorClient: AzureDevOpsWebApiClient;
+  authorClient: AzureDevOpsClientWrapper;
   autoApprove: boolean;
-  approverClient?: AzureDevOpsWebApiClient;
+  approverClient?: AzureDevOpsClientWrapper;
   setAutoComplete: boolean;
-  mergeStrategy?: string;
+  mergeStrategy?: AzdoPullRequestMergeStrategy;
   autoCompleteIgnoreConfigIds: number[];
   existingBranchNames: string[] | undefined;
-  existingPullRequests: IPullRequestProperties[];
+  existingPullRequests: AzdoPrExtractedWithProperties[];
 };
 declare class AzureLocalDependabotServer extends LocalDependabotServer {
   private readonly options;

package/dist/local/azure/index.mjs

@@ -1,10 +1,10 @@
-import { i as runJob } from "../../run-DBD6Hefl.mjs";
-import { n as LocalJobsRunner, t as LocalDependabotServer } from "../../server-M1ps5BVd.mjs";
-import { DependabotJobBuilder, getBranchNameForUpdate, mapPackageEcosystemToPackageManager } from "@paklo/core/dependabot";
+import { i as runJob } from "../../run-CXDAe0P_.mjs";
+import { n as LocalJobsRunner, t as LocalDependabotServer } from "../../server-BxUu1gGo.mjs";
 import { logger } from "@paklo/core/logger";
 import { readFile } from "node:fs/promises";
 import { existsSync } from "node:fs";
-import { AzureDevOpsWebApiClient, DEVOPS_PR_PROPERTY_MICROSOFT_GIT_SOURCE_REF_NAME, GitPullRequestMergeStrategy, buildPullRequestProperties, getPullRequestChangedFilesForOutputData, getPullRequestCloseReasonForOutputData, getPullRequestDependenciesPropertyValueForOutputData, getPullRequestDescription, getPullRequestForDependencyNames, normalizeBranchName, parsePullRequestProperties } from "@paklo/core/azure";
+import { DependabotJobBuilder, getBranchNameForUpdate, getPullRequestCloseReason, getPullRequestDependencies, getPullRequestDescription, mapPackageEcosystemToPackageManager, normalizeBranchName } from "@paklo/core/dependabot";
+import { AzureDevOpsClientWrapper, PR_DESCRIPTION_MAX_LENGTH, PR_PROPERTY_MICROSOFT_GIT_SOURCE_REF_NAME, buildPullRequestProperties, getPullRequestChangedFiles, getPullRequestForDependencyNames, parsePullRequestProperties } from "@paklo/core/azure";
 import { GitHubSecurityAdvisoryClient, SecurityVulnerabilitySchema, filterVulnerabilities, getGhsaPackageEcosystemFromDependabotPackageManager } from "@paklo/core/github";
 
 //#region src/local/azure/server.ts
@@ -43,10 +43,20 @@ var AzureLocalDependabotServer = class extends LocalDependabotServer {
 					logger.warn(`Skipping pull request creation of '${title}' as the open pull requests limit (${openPullRequestsLimit}) has been reached`);
 					return true;
 				}
-				const changedFiles = getPullRequestChangedFilesForOutputData(data);
-				const dependencies = getPullRequestDependenciesPropertyValueForOutputData(data);
-				const targetBranch = update["target-branch"] || await authorClient.getDefaultBranch(project, repository);
-				const sourceBranch = getBranchNameForUpdate(update["package-ecosystem"], targetBranch, update.directory || update.directories?.find((dir) => changedFiles[0]?.path?.startsWith(dir)), !Array.isArray(dependencies) ? dependencies["dependency-group-name"] : void 0, !Array.isArray(dependencies) ? dependencies.dependencies : dependencies, update["pull-request-branch-name"]?.separator);
+				const changedFiles = getPullRequestChangedFiles(data);
+				const dependencies = getPullRequestDependencies(data);
+				const targetBranch = update["target-branch"] || await authorClient.getDefaultBranch({
+					project,
+					repository
+				});
+				const sourceBranch = getBranchNameForUpdate({
+					packageEcosystem: update["package-ecosystem"],
+					targetBranchName: targetBranch,
+					directory: update.directory || update.directories?.find((dir) => changedFiles[0]?.path?.startsWith(dir)),
+					dependencyGroupName: !Array.isArray(dependencies) ? dependencies["dependency-group-name"] : void 0,
+					dependencies: !Array.isArray(dependencies) ? dependencies.dependencies : dependencies,
+					separator: update["pull-request-branch-name"]?.separator
+				});
 				if ((existingBranchNames?.find((branch) => sourceBranch === branch) || []).length) {
 					logger.error(`Unable to create pull request '${title}' as source branch '${sourceBranch}' already exists; Delete the existing branch and try again.`);
 					return false;
@@ -66,19 +76,16 @@ var AzureLocalDependabotServer = class extends LocalDependabotServer {
 					target: { branch: targetBranch },
 					author,
 					title,
-					description: getPullRequestDescription(packageManager, data["pr-body"], data.dependencies),
+					description: getPullRequestDescription({
+						packageManager,
+						body: data["pr-body"],
+						dependencies: data.dependencies,
+						maxDescriptionLength: PR_DESCRIPTION_MAX_LENGTH
+					}),
 					commitMessage: data["commit-message"],
 					autoComplete: setAutoComplete ? {
 						ignorePolicyConfigIds: autoCompleteIgnoreConfigIds,
-						mergeStrategy: (() => {
-							switch (mergeStrategy) {
-								case "noFastForward": return GitPullRequestMergeStrategy.NoFastForward;
-								case "squash": return GitPullRequestMergeStrategy.Squash;
-								case "rebase": return GitPullRequestMergeStrategy.Rebase;
-								case "rebaseMerge": return GitPullRequestMergeStrategy.RebaseMerge;
-								default: return GitPullRequestMergeStrategy.Squash;
-							}
-						})()
+						mergeStrategy: mergeStrategy ?? "squash"
 					} : void 0,
 					assignees: update.assignees,
 					labels: update.labels?.map((label) => label?.trim()) || [],
@@ -91,10 +98,11 @@ var AzureLocalDependabotServer = class extends LocalDependabotServer {
 					repository,
 					pullRequestId: newPullRequestId
 				});
-				if (newPullRequestId && newPullRequestId > 0) {
+				if (newPullRequestId) {
 					affectedPullRequestIds.get(id).created.push(newPullRequestId);
 					return true;
-				} else return false;
+				}
+				return false;
 			}
 			case "update_pull_request": {
 				if (dryRun) {
@@ -109,21 +117,18 @@ var AzureLocalDependabotServer = class extends LocalDependabotServer {
 				const pullRequestWasUpdated = await authorClient.updatePullRequest({
 					project,
 					repository,
-					pullRequestId: pullRequestToUpdate.id,
+					pullRequestId: pullRequestToUpdate.pullRequestId,
 					commit: data["base-commit-sha"] || job.source.commit,
 					author,
-					changes: getPullRequestChangedFilesForOutputData(data),
-					skipIfDraft: true,
-					skipIfCommitsFromAuthorsOtherThan: author.email,
-					skipIfNotBehindTargetBranch: true
+					changes: getPullRequestChangedFiles(data)
 				});
 				if (autoApprove && approverClient && pullRequestWasUpdated) await approverClient.approvePullRequest({
 					project,
 					repository,
-					pullRequestId: pullRequestToUpdate.id
+					pullRequestId: pullRequestToUpdate.pullRequestId
 				});
 				if (pullRequestWasUpdated) {
-					affectedPullRequestIds.get(id).updated.push(pullRequestToUpdate.id);
+					affectedPullRequestIds.get(id).updated.push(pullRequestToUpdate.pullRequestId);
 					return true;
 				}
 				return false;
@@ -141,11 +146,11 @@ var AzureLocalDependabotServer = class extends LocalDependabotServer {
 				if (await authorClient.abandonPullRequest({
 					project,
 					repository,
-					pullRequestId: pullRequestToClose.id,
-					comment: getPullRequestCloseReasonForOutputData(data),
+					pullRequestId: pullRequestToClose.pullRequestId,
+					comment: getPullRequestCloseReason(data),
 					deleteSourceBranch: true
 				})) {
-					affectedPullRequestIds.get(id).closed.push(pullRequestToClose.id);
+					affectedPullRequestIds.get(id).closed.push(pullRequestToClose.pullRequestId);
 					return true;
 				}
 				return false;
@@ -173,11 +178,11 @@ var AzureLocalDependabotServer = class extends LocalDependabotServer {
 			case "record_cooldown_meta":
 			case "record_metrics": return true;
 			case "record_update_job_error":
-				logger.error(`Update job error: ${data["error-type"]} ${JSON.stringify(data["error-details"])}`);
-				return true;
-			case "record_update_job_unknown_error":
-				logger.error(`Update job unknown error: ${data["error-type"]}, ${JSON.stringify(data["error-details"])}`);
+			case "record_update_job_unknown_error": {
+				const unknown = type === "record_update_job_unknown_error";
+				logger.error(`Update${unknown ? " unknown " : ""})job error: ${data["error-type"]} ${JSON.stringify(data["error-details"])}`);
 				return true;
+			}
 			default:
 				logger.warn(`Unknown dependabot request type '${type}', ignoring...`);
 				return true;
@@ -195,16 +200,23 @@ var AzureLocalJobsRunner = class extends LocalJobsRunner {
 		super({ ...options });
 		this.options = options;
 		const { url, gitToken, autoApprove, debug } = this.options;
-		this.authorClient = new AzureDevOpsWebApiClient(url, gitToken, debug);
-		this.approverClient = autoApprove ? new AzureDevOpsWebApiClient(url, options.autoApproveToken || gitToken, debug) : void 0;
+		this.authorClient = new AzureDevOpsClientWrapper(url, gitToken, debug);
+		this.approverClient = autoApprove ? new AzureDevOpsClientWrapper(url, options.autoApproveToken || gitToken, debug) : void 0;
 	}
 	async run() {
 		await super.run();
 		const { options: { url, port, config, targetUpdateIds, command }, authorClient, approverClient } = this;
 		if (config["multi-ecosystem-groups"] || config.updates?.some((u) => u["multi-ecosystem-group"])) logger.warn("Multi-ecosystem updates are not working yet. Only parsing and validation is supported at this time.");
 		if (config.updates?.some((u) => u["open-pull-requests-limit"] === 0)) logger.warn("Security-only updates incur a slight performance overhead due to limitations in Dependabot CLI. For more info, see: https://github.com/mburumaxwell/dependabot-azure-devops/blob/main/README.md#configuring-security-advisories-and-known-vulnerabilities");
-		const existingBranchNames = await authorClient.getBranchNames(url.project, url.repository);
-		const existingPullRequests = await authorClient.getActivePullRequestProperties(url.project, url.repository, await authorClient.getUserId());
+		const existingBranchNames = await authorClient.getBranchNames({
+			project: url.project,
+			repository: url.repository
+		});
+		const existingPullRequests = await authorClient.getActivePullRequestProperties({
+			project: url.project,
+			repository: url.repository,
+			creatorId: await authorClient.getUserId()
+		});
 		const server = new AzureLocalDependabotServer({
 			authorClient,
 			approverClient,
@@ -244,14 +256,14 @@ var AzureLocalJobsRunner = class extends LocalJobsRunner {
 		const { options: { url, dryRun }, authorClient } = this;
 		for (const pullRequestIndex in existingPullRequests) {
 			const pullRequest = existingPullRequests[pullRequestIndex];
-			const pullRequestSourceRefName = normalizeBranchName(pullRequest.properties?.find((x) => x.name === DEVOPS_PR_PROPERTY_MICROSOFT_GIT_SOURCE_REF_NAME)?.value);
+			const pullRequestSourceRefName = normalizeBranchName(pullRequest.properties?.find((x) => x.name === PR_PROPERTY_MICROSOFT_GIT_SOURCE_REF_NAME)?.value);
 			if (pullRequestSourceRefName && !existingBranchNames.includes(pullRequestSourceRefName)) {
 				if (!dryRun) {
-					logger.warn(`Detected source branch for PR #${pullRequest.id} has been deleted; The pull request will be abandoned`);
+					logger.warn(`Detected source branch for PR #${pullRequest.pullRequestId} has been deleted; The pull request will be abandoned`);
 					await authorClient.abandonPullRequest({
 						project: url.project,
 						repository: url.repository,
-						pullRequestId: pullRequest.id,
+						pullRequestId: pullRequest.pullRequestId,
 						comment: "It might be a good idea to add an [`ignore` condition](https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference#ignore--) with the desired `update-types` to your config file."
 					});
 				}
@@ -268,6 +280,11 @@ var AzureLocalJobsRunner = class extends LocalJobsRunner {
 	async performUpdates(server, updates, existingPullRequests, dependabotApiUrl, dependabotApiDockerUrl, command) {
 		const { options: { url, gitToken, githubToken, experiments, config, dryRun, securityAdvisoriesFile, secretMasker } } = this;
 		const results = [];
+		function makeRandomJobId() {
+			const array = new Uint32Array(1);
+			crypto.getRandomValues(array);
+			return `${array[0] % 1e10}`;
+		}
 		function makeUsageData(job) {
 			return {
 				trigger: "user",
@@ -300,14 +317,20 @@ var AzureLocalJobsRunner = class extends LocalJobsRunner {
 			let credentials;
 			let jobToken;
 			let credentialsToken;
-			let securityVulnerabilities = [];
-			let dependencyNamesToUpdate = [];
-			const securityUpdatesOnly = update["open-pull-requests-limit"] === 0;
+			const debug = this.options.debug;
+			const securityVulnerabilities = [];
+			const dependencyNamesToUpdate = [];
+			const openPullRequestsLimit = update["open-pull-requests-limit"];
+			const securityUpdatesOnly = openPullRequestsLimit === 0;
 			if (securityUpdatesOnly) {
-				({job, credentials} = builder.forDependenciesList({ command }));
+				const id = makeRandomJobId();
+				({job, credentials} = builder.forDependenciesList({
+					id,
+					command
+				}));
 				({jobToken, credentialsToken} = this.makeTokens());
 				server.add({
-					id: job.id,
+					id,
 					update,
 					job,
 					jobToken,
@@ -317,14 +340,15 @@ var AzureLocalJobsRunner = class extends LocalJobsRunner {
 				await runJob({
 					dependabotApiUrl,
 					dependabotApiDockerUrl,
-					jobId: job.id,
+					jobId: id,
 					jobToken,
 					credentialsToken,
 					updaterImage,
 					secretMasker,
+					debug,
 					usage: makeUsageData(job)
 				});
-				const packagesToCheckForVulnerabilities = server.requests(job.id).find((o) => o.type === "update_dependency_list")?.data.dependencies?.map((d) => ({
+				const packagesToCheckForVulnerabilities = server.requests(id).find((o) => o.type === "update_dependency_list")?.data.dependencies?.map((d) => ({
 					name: d.name,
 					version: d.version
 				}));
@@ -334,30 +358,33 @@ var AzureLocalJobsRunner = class extends LocalJobsRunner {
 						const filePath = securityAdvisoriesFile;
 						if (existsSync(filePath)) {
 							const fileContents = await readFile(filePath, "utf-8");
-							securityVulnerabilities = await SecurityVulnerabilitySchema.array().parseAsync(JSON.parse(fileContents));
+							securityVulnerabilities.push(...await SecurityVulnerabilitySchema.array().parseAsync(JSON.parse(fileContents)));
 						} else logger.info(`Private security advisories file '${filePath}' does not exist`);
 					}
 					if (githubToken) {
 						const githubVulnerabilities = await new GitHubSecurityAdvisoryClient(githubToken).getSecurityVulnerabilitiesAsync(getGhsaPackageEcosystemFromDependabotPackageManager(packageManager), packagesToCheckForVulnerabilities || []);
 						securityVulnerabilities.push(...githubVulnerabilities);
 					} else logger.info("GitHub access token is not provided; Checking for vulnerabilities from GitHub is skipped. This is not an issue if you are using private security advisories file.");
-					securityVulnerabilities = filterVulnerabilities(securityVulnerabilities);
-					dependencyNamesToUpdate = Array.from(new Set(securityVulnerabilities.map((v) => v.package.name)));
+					const filtered = filterVulnerabilities(securityVulnerabilities);
+					securityVulnerabilities.splice(0);
+					securityVulnerabilities.push(...filtered);
+					dependencyNamesToUpdate.push(...Array.from(new Set(securityVulnerabilities.map((v) => v.package.name))));
 					logger.info(`Detected ${securityVulnerabilities.length} vulnerabilities affecting ${dependencyNamesToUpdate.length} dependencies`);
 					if (dependencyNamesToUpdate.length) logger.trace(dependencyNamesToUpdate);
 				} else {
 					logger.info(`No vulnerabilities detected for update ${update["package-ecosystem"]} in ${update.directory}`);
-					server.clear(job.id);
+					server.clear(id);
 					continue;
 				}
-				server.clear(job.id);
+				server.clear(id);
 			}
-			const openPullRequestsLimit = update["open-pull-requests-limit"];
 			const openPullRequestsCount = Object.entries(existingPullRequestsForPackageManager).length;
 			if (!(openPullRequestsLimit > 0 && openPullRequestsCount >= openPullRequestsLimit)) {
 				const dependenciesHaveVulnerabilities = dependencyNamesToUpdate.length && securityVulnerabilities.length;
 				if (!securityUpdatesOnly || dependenciesHaveVulnerabilities) {
+					const id = makeRandomJobId();
 					({job, credentials} = builder.forUpdate({
+						id,
 						command,
 						dependencyNamesToUpdate,
 						existingPullRequests: existingPullRequestDependenciesForPackageManager,
@@ -365,7 +392,7 @@ var AzureLocalJobsRunner = class extends LocalJobsRunner {
 					}));
 					({jobToken, credentialsToken} = this.makeTokens());
 					server.add({
-						id: job.id,
+						id,
 						update,
 						job,
 						jobToken,
@@ -375,17 +402,18 @@ var AzureLocalJobsRunner = class extends LocalJobsRunner {
 					const { success, message } = await runJob({
 						dependabotApiUrl,
 						dependabotApiDockerUrl,
-						jobId: job.id,
+						jobId: id,
 						jobToken,
 						credentialsToken,
 						updaterImage,
 						secretMasker,
+						debug,
 						usage: makeUsageData(job)
 					});
-					const affectedPrs = server.allAffectedPrs(job.id);
-					server.clear(job.id);
+					const affectedPrs = server.allAffectedPrs(id);
+					server.clear(id);
 					results.push({
-						id: job.id,
+						id,
 						success,
 						message,
 						affectedPrs
@@ -394,7 +422,9 @@ var AzureLocalJobsRunner = class extends LocalJobsRunner {
 			} else logger.warn(`Skipping update for ${packageEcosystem} packages as the open pull requests limit (${openPullRequestsLimit}) has already been reached`);
 			const numberOfPullRequestsToUpdate = Object.keys(existingPullRequestsForPackageManager).length;
 			if (numberOfPullRequestsToUpdate > 0) if (!dryRun) for (const pullRequestId in existingPullRequestsForPackageManager) {
+				const id = makeRandomJobId();
 				({job, credentials} = builder.forUpdate({
+					id,
 					command,
 					existingPullRequests: existingPullRequestDependenciesForPackageManager,
 					pullRequestToUpdate: existingPullRequestsForPackageManager[pullRequestId],
@@ -402,7 +432,7 @@ var AzureLocalJobsRunner = class extends LocalJobsRunner {
 				}));
 				({jobToken, credentialsToken} = this.makeTokens());
 				server.add({
-					id: job.id,
+					id,
 					update,
 					job,
 					jobToken,
@@ -412,17 +442,18 @@ var AzureLocalJobsRunner = class extends LocalJobsRunner {
 				const { success, message } = await runJob({
 					dependabotApiUrl,
 					dependabotApiDockerUrl,
-					jobId: job.id,
+					jobId: id,
 					jobToken,
 					credentialsToken,
 					updaterImage,
 					secretMasker,
+					debug,
 					usage: makeUsageData(job)
 				});
-				const affectedPrs = server.allAffectedPrs(job.id);
-				server.clear(job.id);
+				const affectedPrs = server.allAffectedPrs(id);
+				server.clear(id);
 				results.push({
-					id: job.id,
+					id,
 					success,
 					message,
 					affectedPrs