renovate 44.23.3 → 44.24.0

package/dist/modules/manager/fingerprint.generated.js

@@ -42,7 +42,7 @@ hashMap.set("fleet", "d73d5d35f10df0599a561d9c8d25f3935350407d0e3bd3a1d1545295f2
 hashMap.set("flux", "70833dd068ea0a746a9392469e7904021562c7629428d0cd554603bad4eb6ce5");
 hashMap.set("fvm", "9b161df0f14bc6e536368952adf373e343630097121a913cea60ee284027fb90");
 hashMap.set("git-submodules", "e95bbc9b69a36dee82e255e8983640b7179cb5f17d24b035c6cf01d9635b35bd");
-hashMap.set("github-actions", "c809c380baf2c73839b016b9ac2cb6b4c8f48494ade5b0a3382343db8e48e563");
+hashMap.set("github-actions", "98ce747393a445efba97f0bcb9266800528520ac30702aaa9866753f11377da3");
 hashMap.set("gitlabci", "33c264edf7837fb8fbc4cf0078c8bd2d5a75431039b1db65bf47356df7753125");
 hashMap.set("gitlabci-include", "ef696c478c2ac1723b3aca070ba9779be0e702fff0844054251ba0029523d0eb");
 hashMap.set("glasskube", "93e7b9000a17efa15a1abaaf320b5af9169b1ecd828fc0c881d98570ef9d9e30");

package/dist/modules/manager/fingerprint.generated.js.map

@@ -1 +1 @@
-{"version":3,"file":"fingerprint.generated.js","names":[],"sources":["../../../lib/modules/manager/fingerprint.generated.ts"],"sourcesContent":["export const hashMap = new Map<string, string>();\n\nhashMap.set('ansible','1d3568f42393d697f8f96d461b72077ee7a1044b654e87667a12f861b3083111');\nhashMap.set('ansible-galaxy','8226d47128f2018825d4d6f84794e3183eb79c706045fa7e88491edd5e64106f');\nhashMap.set('ant','2df5943cf0ed19a21b94df13729dbb925655548130caf37e3e22bebaed518e17');\nhashMap.set('argocd','5d35b1992e53130bf83b0e59a0f90ccd3a78919974c69044f306dc5d162f48ce');\nhashMap.set('asdf','b2acfc0a6164e9a279daa724777c423f84572dafb0df09b1b0cf6f205f9eb6d0');\nhashMap.set('azure-pipelines','4f635b0ecd388ee266d992e8281fd40e3db2f5867d86fc1cbce72dc33a66e796');\nhashMap.set('batect','bd9208444eff1a4958061484db66a47b616c31f15a8d49d23b75c4560fcee83e');\nhashMap.set('batect-wrapper','d999355511ea7f4053325a18b8cfc8d2b586c61e6760c35e557d383a673e3939');\nhashMap.set('bazel','4994a8bd86d5bfb169d67c08efd8509b58c368c2bf3dd9bbe42553c0fabc3f1a');\nhashMap.set('bazel-module','40f6a862b4e72fcc7262ee41f8b570ea3fd5600d6d552b94ed3301bb201f5db5');\nhashMap.set('bazelisk','d71489650feefb0dbbe7461f924cb50e41c8eef8fe2e11acdec2d42d0212c8ef');\nhashMap.set('bicep','7246e0bfc06e0e28cbb03ac088c5591f648956b086e106aeb251fe5d628329db');\nhashMap.set('bitbucket-pipelines','59c0503494ab1442b127914503c01b97ac17b6742b19c632292d5aa24de115cd');\nhashMap.set('bitrise','478dfd316221fad7c29e177c70d1018d832fb2626b53308a5d0f1f0380e69f42');\nhashMap.set('buildkite','a93effb1f1c5d65b3277c3b4709924eacde282e8efd028a8e3d8c1ce3ef69407');\nhashMap.set('buildpacks','6bef3cb04d66b5cfbb195adb4829bcbccae6408518706744d291bacf0610421f');\nhashMap.set('bun','f2d5b0a7c0c724d30e79e12688b1fc8ff8e344db0cc6389553e2f6001ddf8345');\nhashMap.set('bun-version','df3ae8e4a5de1fa1b4544f3d7fc8117e80adb1e151c46d1ede54a4dbea6521e4');\nhashMap.set('bundler','4f70ac0377893683eb30013bf4d23a8bd7213a883847c9eaadf1217f5f190ee1');\nhashMap.set('cake','ed6d14c96161f1d3d927adc7e333b96585164e1f25151a87990914d57ae17fe1');\nhashMap.set('cargo','13377c53df158cdfc58330f73682fadc3e88e57f0d22c9245c0ffd62a495edf1');\nhashMap.set('cdnurl','d3edf6cdc38e92eb43ff5a2b4e8df6a6a13154cf83244725c39e28d7e6ea9177');\nhashMap.set('circleci','91cbeb33ea20f9838e2c81a1195eb806f0b38fa282bc3679f62552f20575ca85');\nhashMap.set('cloudbuild','8c0c739f7e4082bbfe8e3fdffebaf43e26f70a1314d95b306e9b93e4f4297886');\nhashMap.set('cocoapods','cf48ab5a573a28bf14d5e6c84eed9ca08b7f0cb5b7fc51d795c21c7254bb9dd1');\nhashMap.set('composer','869aab556d9b2ca2b743a790a7c0d7d104d62bbcbcc2185c44c64543d70413ba');\nhashMap.set('conan','74ca922a0ffdf1a9dd44b83eb2b3a36c56c7d792031e3a4a484f293046be3ecd');\nhashMap.set('copier','06a52206ba5542f99f056c832245196afd4b78bffeca088f710a5df958a9693d');\nhashMap.set('cpanfile','07813fec3f3c2197056500e9266a0553b9774c02f2c74d5ca2e213188c7c12d3');\nhashMap.set('crossplane','5c26b1201a1a51454ffb94d829e223a76a781569bf79cdb1e47087c30233ec40');\nhashMap.set('crow','eb9a5f9f95041855dded67bcce3dd54724f690995ed6268d272e8a666ff28fd0');\nhashMap.set('deno','8a161cacb3563a8249c6bf5956a2c1015d4c525946ae61d4fdcec7311f90b2ea');\nhashMap.set('deps-edn','c87dd5e88587147ad1a78f047b814f3c4aa60d6de30d0c49d849391eeaf1b64c');\nhashMap.set('devbox','a608d1e6db93a8f997d41f8dee7b67533452a956057865978342e2819272e0a9');\nhashMap.set('devcontainer','24320ed1cb6191d04cb8b2707214d82c08c682597aed1d84f250aa00ad1632ec');\nhashMap.set('docker-compose','5441af5b5abf8d347e46002d47f02f85743401bda28232f49fb7b3bbb772a4fb');\nhashMap.set('dockerfile','54122792bf8ea0be98e0a0716e627e3115b40a5f0155ccd7ae0cfc52424a3478');\nhashMap.set('droneci','237c8de87b9bf653fb943b56e84e99c45f6d86ae27d86e599b3f3f99c35ba8ee');\nhashMap.set('fleet','d73d5d35f10df0599a561d9c8d25f3935350407d0e3bd3a1d1545295f278912e');\nhashMap.set('flux','70833dd068ea0a746a9392469e7904021562c7629428d0cd554603bad4eb6ce5');\nhashMap.set('fvm','9b161df0f14bc6e536368952adf373e343630097121a913cea60ee284027fb90');\nhashMap.set('git-submodules','e95bbc9b69a36dee82e255e8983640b7179cb5f17d24b035c6cf01d9635b35bd');\nhashMap.set('github-actions','c809c380baf2c73839b016b9ac2cb6b4c8f48494ade5b0a3382343db8e48e563');\nhashMap.set('gitlabci','33c264edf7837fb8fbc4cf0078c8bd2d5a75431039b1db65bf47356df7753125');\nhashMap.set('gitlabci-include','ef696c478c2ac1723b3aca070ba9779be0e702fff0844054251ba0029523d0eb');\nhashMap.set('glasskube','93e7b9000a17efa15a1abaaf320b5af9169b1ecd828fc0c881d98570ef9d9e30');\nhashMap.set('gleam','02389785183c39d2896d7893414c5e1060023f95c1fe7b595bd06cc5c1186d39');\nhashMap.set('gomod','073cf874c14d8f323aa7dc467e757b39e249e4617be1ce10926ee68763f89381');\nhashMap.set('gradle','550f1107f0ac27d18fa76a7d5c0c0b317b5df4156fc12cfd378573ccfe26fca0');\nhashMap.set('gradle-wrapper','799d9bb8d9dead673fb513ba4936395f14da30897d33a9df46b3266e1b835d5d');\nhashMap.set('haskell-cabal','f232d0e883235f74ed71fd9de4a7468e5fcbda9a1af5beb56c24657f7bf2e891');\nhashMap.set('helm-requirements','4d90e5e18a380876ad48e21e1ad88ea62e25d973a1ddaa3763447fc0a9f9915b');\nhashMap.set('helm-values','b5c52c6a27d805557418c585c5d3030c95ee641d53057021f3fe060f81b6e1af');\nhashMap.set('helmfile','ab828a1877cfe029ed5f8dd2a026409cd5e6431705af3aac3f56a3bc4f827508');\nhashMap.set('helmsman','ef9680c612f702c7f07aea9b6e5d811e91214dcfa5755c9f3803e9528090935e');\nhashMap.set('helmv3','4088a90bd8be4ae1bcb85dc4d34d3fbbb75e72bd33d144284e7e1f0e726c8d3b');\nhashMap.set('hermit','61e132cfccbe4e3884801a3728f3391455c214811a33c1f733b0dea7122bbbb6');\nhashMap.set('homeassistant-manifest','05043c6db870cffbb6f8f3e351c025e3de227eaae0b24134b796aec46f84b65f');\nhashMap.set('homebrew','9c64a4f1475b1c2052372e566c9190f32ae8acd1c54313031d55ae8772388367');\nhashMap.set('html','67c5f3c5c58e96f5dd257ba5987d900cf7fef81d667c3640e96c847b37de35a8');\nhashMap.set('jenkins','268ebfc8a1caf3edeb2192c2b1b2fa4bf18a78a3e731ba20a6c104940a5539f3');\nhashMap.set('jsonnet-bundler','4023ef4cac55fe58f8d9744ae86b13532298926e35e22d250334cde55c3386ff');\nhashMap.set('kotlin-script','99ef296792a0ca575ed31d3defb514b05a58083dc01c52ea0890c69d867ba1dd');\nhashMap.set('kubernetes','321e7d77fb3600dd4c00a86eaa1294927e7f92300b74fa2977d813dcaa3bb4de');\nhashMap.set('kustomize','fb5f6fbf45b318ca277d6d9f7fee22680f4b99c7ff9170a50315122918d2e007');\nhashMap.set('leiningen','133fca2c3423f53f2ccc22518153ddbcafbf0f4812376c77e952eb3d24d81f85');\nhashMap.set('maven','f084cdc88320ca1e82af957d0008e7c9ce991d3282cb428f3108a5722239cead');\nhashMap.set('maven-wrapper','779344a4e259e0c28bfadfeb435dd72feb7224d7346d038a1c35f02deb1357bc');\nhashMap.set('meteor','4a93a326b27bedfe52118e27e06f39fecd7c55bd4cd7fccec4cb120cac14cec4');\nhashMap.set('mint','248fe4f1ea5c985921c286785792c97e06fc41f402b2d45df82f6aecd17f710e');\nhashMap.set('mise','8463d355091f5f167e3f4a8adbebfe49310ad9ac45c89d60455ef8e110df4a49');\nhashMap.set('mix','5eb001e2af7cd664d811ad2d9928bf785527ed292de1e567de57f7e2cecc1ecc');\nhashMap.set('nix','d3283c2b948695a16c1089da4e2689faacd50eaa7d734d6fa5d6661aef6db7e7');\nhashMap.set('nodenv','ac652c28481b001f7471f4183eac07b45d98ecbe83efc275830b0a1b2e0459b8');\nhashMap.set('npm','0adc3d37562671986c36891105e71cdf973573815050ee2d6e0df404046cfe39');\nhashMap.set('nuget','0cce80e43ab9b21a98a8ecff8a835adf0ccc1c003cf71e7cf9c1e64293884464');\nhashMap.set('nvm','3eb77c7b0acf6d64753de78fad2499b352719853aa6872878c40675d14152322');\nhashMap.set('ocb','032b216684c14b0954e0bb019513a2aca3faaee5748587acb668d377d7c891ca');\nhashMap.set('osgi','32233a1a8a2725699d7448ba438e3d0b78141f7799cd2b588de278d41e26ed10');\nhashMap.set('pep621','f5dc3c8434845dd814bc649c619323dcb69e3ec5da2d361d353bdf6ae3cc5d88');\nhashMap.set('pep723','b96683163de63ed93207ec0538066705b1e58a1cd5b8bd11c63fc28b26bddba1');\nhashMap.set('pip-compile','9711b1c00da18ff785e624c50e4b042519e7ad615c5f018f08459fac8394fec5');\nhashMap.set('pip_requirements','537ef9d7b43b5adcfbfbb86392e0c7a8a0ee91c804118af83cf92e1868949e1a');\nhashMap.set('pip_setup','0175fe550c19d9bd31c978bd83fdc088cb40fcacd5d6751f640164274ae64e61');\nhashMap.set('pipenv','3b8a32a7879ac9798bd119315113e151bd843cae8f25bd1fbd376d574c9a726b');\nhashMap.set('pixi','3732f052617efd5007ddbe31091a2ba026909288bac4cbbe6d2bd6ac64d85393');\nhashMap.set('poetry','6cf6bc5116458761b2d6779caf465d6e26768fbe6e2ffba54b5da981aa8c385f');\nhashMap.set('pre-commit','17a5f183985ebffe98785a541d3609bf25efedc387deb3d50e9f00f02b25f615');\nhashMap.set('proto','412053d4550026b4ace490b46e970915b87ec1abf0b0a0c6c8c58ccf1fc16843');\nhashMap.set('pub','a2ded51959d48e053b811b3b9330b2460fc61d0fc2e74a400a546e4f82d25767');\nhashMap.set('puppet','ba58ab689e44acc8f61c3569ab8b40fde01b8a9d3aad712708e2a419e57d8b45');\nhashMap.set('pyenv','9ede8becc97774f9040b40f4472d3e933534b596e04c360bfe0f3c6f95f25182');\nhashMap.set('quadlet','e1fc88a4e14cd595e89bb3d79b4adf2add3ce5eb80f75276e712c32598cca53d');\nhashMap.set('renovate-config','2a4e4fb671aed5d0c900b8d54c31bfef46ca36d0f4e16b00ff73377b9c09fb69');\nhashMap.set('ruby-version','2db2140d9eee8c555e729a4de0396fa2d78846d3149890ee12fa515bd654be97');\nhashMap.set('runtime-version','b582b168c0cc595e39010feb10f4b97a82683eb269e9598216fbb11cc186e160');\nhashMap.set('rust-toolchain','6ace53db02874d73620d2d872291839820a512a9529c42d174358c692e5db720');\nhashMap.set('sbt','e508c2e2fb8d44e6cbec20f449c8eed096728566e6058187269c637930d388fb');\nhashMap.set('scalafmt','9d36159b56835e96498af026a1fb0543200db0581681ef95ec54988f411e180f');\nhashMap.set('setup-cfg','7dea08c5708625e753bd56918bc214df7fb4d8543a26e936926a21ab43b5f785');\nhashMap.set('smithy','9641b91d065ffb63be0dd888139a0402dba41e550f8b44c592db9daf52109100');\nhashMap.set('sveltos','05b3158e88771ed4629e171592cf4f1bf0ff342f8aeae89be0b340c630cc6d8e');\nhashMap.set('swift','eb5f7c3c4dabf28eed36916269ca9be16ab9ddb83993db03ea66b9195ad7bdc6');\nhashMap.set('tekton','fdc5b9b5edec2a90cda2f858f3ebc532aa8efb1187d1e0b7c89b07796e9cb6cd');\nhashMap.set('terraform','3dc2e8342e5e4ddf0f1cf1910567f13c4cfb20b9eaf375ee522f67946fe3e368');\nhashMap.set('terraform-version','ec8f786b9731d47f2c2fe0307caf64d7ddd83046fe7ff1f7d8423239f8b0f2aa');\nhashMap.set('terragrunt','ffcbaa67dd65f064d43f8c121c1006115eab1879c4bd38de263b9b90a009c118');\nhashMap.set('terragrunt-version','eea6087b33717d22ede2fc68c2f64df8390b75abe82110ed831a180648feb51d');\nhashMap.set('tflint-plugin','31247d37bc80aae17039bfa21bd989c5717730c5ef10cf2a6f09841576d012ec');\nhashMap.set('travis','bb482a0195cd009ec3896a6227bb95617f5c84bedb518c7d971e50c62235d9ca');\nhashMap.set('typst','d080a79fbd961c6e21fcc505d544b7e0ff2126142acb1dcabdf6abbcd9339248');\nhashMap.set('unity3d','f13e25e115e3443f4e16cf31578acffa78fb1a5e23339680a92d8d6de6052920');\nhashMap.set('velaci','fda00ddb7cc23e9a37e0a8a253151df0a6930b4276d3e4f78cc54b9ac09af7de');\nhashMap.set('vendir','ee9cc316c73ab0944da494bf36cfeafba8e79a36ec77753b9f341c8e80f1d602');\nhashMap.set('woodpecker','6110d3bec33aaeb3511d4bbfa896cec3c8e02fb04a6cff50c9ba81061c851045');\nhashMap.set('xcodegen','dad511d88a9ce1dbdde8b9731f3da7f2bdaa4ca8a083294ee58d56da62ab1683');\nhashMap.set('jsonata','efd520a9f674c6dcd4edde61e8d14ddbb29a60bcfd6a92e6179197faebf63e84');\nhashMap.set('regex','dbe6889ea021a05127fed06226d73366fdada2ae577147a5c027996fd325416e');"],"mappings":";AAAA,MAAa,0BAAU,IAAI,IAAoB;AAE/C,QAAQ,IAAI,WAAU,kEAAkE;AACxF,QAAQ,IAAI,kBAAiB,kEAAkE;AAC/F,QAAQ,IAAI,OAAM,kEAAkE;AACpF,QAAQ,IAAI,UAAS,kEAAkE;AACvF,QAAQ,IAAI,QAAO,kEAAkE;AACrF,QAAQ,IAAI,mBAAkB,kEAAkE;AAChG,QAAQ,IAAI,UAAS,kEAAkE;AACvF,QAAQ,IAAI,kBAAiB,kEAAkE;AAC/F,QAAQ,IAAI,SAAQ,kEAAkE;AACtF,QAAQ,IAAI,gBAAe,kEAAkE;AAC7F,QAAQ,IAAI,YAAW,kEAAkE;AACzF,QAAQ,IAAI,SAAQ,kEAAkE;AACtF,QAAQ,IAAI,uBAAsB,kEAAkE;AACpG,QAAQ,IAAI,WAAU,kEAAkE;AACxF,QAAQ,IAAI,aAAY,kEAAkE;AAC1F,QAAQ,IAAI,cAAa,kEAAkE;AAC3F,QAAQ,IAAI,OAAM,kEAAkE;AACpF,QAAQ,IAAI,eAAc,kEAAkE;AAC5F,QAAQ,IAAI,WAAU,kEAAkE;AACxF,QAAQ,IAAI,QAAO,kEAAkE;AACrF,QAAQ,IAAI,SAAQ,kEAAkE;AACtF,QAAQ,IAAI,UAAS,kEAAkE;AACvF,QAAQ,IAAI,YAAW,kEAAkE;AACzF,QAAQ,IAAI,cAAa,kEAAkE;AAC3F,QAAQ,IAAI,aAAY,kEAAkE;AAC1F,QAAQ,IAAI,YAAW,kEAAkE;AACzF,QAAQ,IAAI,SAAQ,kEAAkE;AACtF,QAAQ,IAAI,UAAS,kEAAkE;AACvF,QAAQ,IAAI,YAAW,kEAAkE;AACzF,QAAQ,IAAI,cAAa,kEAAkE;AAC3F,QAAQ,IAAI,QAAO,kEAAkE;AACrF,QAAQ,IAAI,QAAO,kEAAkE;AACrF,QAAQ,IAAI,YAAW,kEAAkE;AACzF,QAAQ,IAAI,UAAS,kEAAkE;AACvF,QAAQ,IAAI,gBAAe,kEAAkE;AAC7F,QAAQ,IAAI,kBAAiB,kEAAkE;AAC/F,QAAQ,IAAI,cAAa,kEAAkE;AAC3F,QAAQ,IAAI,WAAU,kEAAkE;AACxF,QAAQ,IAAI,SAAQ,kEAAkE;AACtF,QAAQ,IAAI,QAAO,kEAAkE;AACrF,QAAQ,IAAI,OAAM,kEAAkE;AACpF,QAAQ,IAAI,kBAAiB,kEAAkE;AAC/F,QAAQ,IAAI,kBAAiB,kEAAkE;AAC/F,QAAQ,IAAI,YAAW,kEAAkE;AACzF,QAAQ,IAAI,oBAAmB,kEAAkE;AACjG,QAAQ,IAAI,aAAY,kEAAkE;AAC1F,QAAQ,IAAI,SAAQ,kEAAkE;AACtF,QAAQ,IAAI,SAAQ,kEAAkE;AACtF,QAAQ,IAAI,UAAS,kEAAkE;AACvF,QAAQ,IAAI,kBAAiB,kEAAkE;AAC/F,QAAQ,IAAI,iBAAgB,kEAAkE;AAC9F,QAAQ,IAAI,qBAAoB,kEAAkE;AAClG,QAAQ,IAAI,eAAc,kEAAkE;AAC5F,QAAQ,IAAI,YAAW,kEAAkE;AACzF,QAAQ,IAAI,YAAW,kEAAkE;AACzF,QAAQ,IAAI,UAAS,kEAAkE;AACvF,QAAQ,IAAI,UAAS,kEAAkE;AACvF,QAAQ,IAAI,0BAAyB,kEAAkE;AACvG,QAAQ,IAAI,YAAW,kEAAkE;AACzF,QAAQ,IAAI,QAAO,kEAAkE;AACrF,QAAQ,IAAI,WAAU,kEAAkE;AACxF,QAAQ,IAAI,mBAAkB,kEAAkE;AAChG,QAAQ,IAAI,iBAAgB,kEAAkE;AAC9F,QAAQ,IAAI,cAAa,kEAAkE;AAC3F,QAAQ,IAAI,aAAY,kEAAkE;AAC1F,QAAQ,IAAI,aAAY,kEAAkE;AAC1F,QAAQ,IAAI,SAAQ,kEAAkE;AACtF,QAAQ,IAAI,iBAAgB,kEAAkE;AAC9F,QAAQ,IAAI,UAAS,kEAAkE;AACvF,QAAQ,IAAI,QAAO,kEAAkE;AACrF,QAAQ,IAAI,QAAO,kEAAkE;AACrF,QAAQ,IAAI,OAAM,kEAAkE;AACpF,QAAQ,IAAI,OAAM,kEAAkE;AACpF,QAAQ,IAAI,UAAS,kEAAkE;AACvF,QAAQ,IAAI,OAAM,kEAAkE;AACpF,QAAQ,IAAI,SAAQ,kEAAkE;AACtF,QAAQ,IAAI,OAAM,kEAAkE;AACpF,QAAQ,IAAI,OAAM,kEAAkE;AACpF,QAAQ,IAAI,QAAO,kEAAkE;AACrF,QAAQ,IAAI,UAAS,kEAAkE;AACvF,QAAQ,IAAI,UAAS,kEAAkE;AACvF,QAAQ,IAAI,eAAc,kEAAkE;AAC5F,QAAQ,IAAI,oBAAmB,kEAAkE;AACjG,QAAQ,IAAI,aAAY,kEAAkE;AAC1F,QAAQ,IAAI,UAAS,kEAAkE;AACvF,QAAQ,IAAI,QAAO,kEAAkE;AACrF,QAAQ,IAAI,UAAS,kEAAkE;AACvF,QAAQ,IAAI,cAAa,kEAAkE;AAC3F,QAAQ,IAAI,SAAQ,kEAAkE;AACtF,QAAQ,IAAI,OAAM,kEAAkE;AACpF,QAAQ,IAAI,UAAS,kEAAkE;AACvF,QAAQ,IAAI,SAAQ,kEAAkE;AACtF,QAAQ,IAAI,WAAU,kEAAkE;AACxF,QAAQ,IAAI,mBAAkB,kEAAkE;AAChG,QAAQ,IAAI,gBAAe,kEAAkE;AAC7F,QAAQ,IAAI,mBAAkB,kEAAkE;AAChG,QAAQ,IAAI,kBAAiB,kEAAkE;AAC/F,QAAQ,IAAI,OAAM,kEAAkE;AACpF,QAAQ,IAAI,YAAW,kEAAkE;AACzF,QAAQ,IAAI,aAAY,kEAAkE;AAC1F,QAAQ,IAAI,UAAS,kEAAkE;AACvF,QAAQ,IAAI,WAAU,kEAAkE;AACxF,QAAQ,IAAI,SAAQ,kEAAkE;AACtF,QAAQ,IAAI,UAAS,kEAAkE;AACvF,QAAQ,IAAI,aAAY,kEAAkE;AAC1F,QAAQ,IAAI,qBAAoB,kEAAkE;AAClG,QAAQ,IAAI,cAAa,kEAAkE;AAC3F,QAAQ,IAAI,sBAAqB,kEAAkE;AACnG,QAAQ,IAAI,iBAAgB,kEAAkE;AAC9F,QAAQ,IAAI,UAAS,kEAAkE;AACvF,QAAQ,IAAI,SAAQ,kEAAkE;AACtF,QAAQ,IAAI,WAAU,kEAAkE;AACxF,QAAQ,IAAI,UAAS,kEAAkE;AACvF,QAAQ,IAAI,UAAS,kEAAkE;AACvF,QAAQ,IAAI,cAAa,kEAAkE;AAC3F,QAAQ,IAAI,YAAW,kEAAkE;AACzF,QAAQ,IAAI,WAAU,kEAAkE;AACxF,QAAQ,IAAI,SAAQ,kEAAkE"}
+{"version":3,"file":"fingerprint.generated.js","names":[],"sources":["../../../lib/modules/manager/fingerprint.generated.ts"],"sourcesContent":["export const hashMap = new Map<string, string>();\n\nhashMap.set('ansible','1d3568f42393d697f8f96d461b72077ee7a1044b654e87667a12f861b3083111');\nhashMap.set('ansible-galaxy','8226d47128f2018825d4d6f84794e3183eb79c706045fa7e88491edd5e64106f');\nhashMap.set('ant','2df5943cf0ed19a21b94df13729dbb925655548130caf37e3e22bebaed518e17');\nhashMap.set('argocd','5d35b1992e53130bf83b0e59a0f90ccd3a78919974c69044f306dc5d162f48ce');\nhashMap.set('asdf','b2acfc0a6164e9a279daa724777c423f84572dafb0df09b1b0cf6f205f9eb6d0');\nhashMap.set('azure-pipelines','4f635b0ecd388ee266d992e8281fd40e3db2f5867d86fc1cbce72dc33a66e796');\nhashMap.set('batect','bd9208444eff1a4958061484db66a47b616c31f15a8d49d23b75c4560fcee83e');\nhashMap.set('batect-wrapper','d999355511ea7f4053325a18b8cfc8d2b586c61e6760c35e557d383a673e3939');\nhashMap.set('bazel','4994a8bd86d5bfb169d67c08efd8509b58c368c2bf3dd9bbe42553c0fabc3f1a');\nhashMap.set('bazel-module','40f6a862b4e72fcc7262ee41f8b570ea3fd5600d6d552b94ed3301bb201f5db5');\nhashMap.set('bazelisk','d71489650feefb0dbbe7461f924cb50e41c8eef8fe2e11acdec2d42d0212c8ef');\nhashMap.set('bicep','7246e0bfc06e0e28cbb03ac088c5591f648956b086e106aeb251fe5d628329db');\nhashMap.set('bitbucket-pipelines','59c0503494ab1442b127914503c01b97ac17b6742b19c632292d5aa24de115cd');\nhashMap.set('bitrise','478dfd316221fad7c29e177c70d1018d832fb2626b53308a5d0f1f0380e69f42');\nhashMap.set('buildkite','a93effb1f1c5d65b3277c3b4709924eacde282e8efd028a8e3d8c1ce3ef69407');\nhashMap.set('buildpacks','6bef3cb04d66b5cfbb195adb4829bcbccae6408518706744d291bacf0610421f');\nhashMap.set('bun','f2d5b0a7c0c724d30e79e12688b1fc8ff8e344db0cc6389553e2f6001ddf8345');\nhashMap.set('bun-version','df3ae8e4a5de1fa1b4544f3d7fc8117e80adb1e151c46d1ede54a4dbea6521e4');\nhashMap.set('bundler','4f70ac0377893683eb30013bf4d23a8bd7213a883847c9eaadf1217f5f190ee1');\nhashMap.set('cake','ed6d14c96161f1d3d927adc7e333b96585164e1f25151a87990914d57ae17fe1');\nhashMap.set('cargo','13377c53df158cdfc58330f73682fadc3e88e57f0d22c9245c0ffd62a495edf1');\nhashMap.set('cdnurl','d3edf6cdc38e92eb43ff5a2b4e8df6a6a13154cf83244725c39e28d7e6ea9177');\nhashMap.set('circleci','91cbeb33ea20f9838e2c81a1195eb806f0b38fa282bc3679f62552f20575ca85');\nhashMap.set('cloudbuild','8c0c739f7e4082bbfe8e3fdffebaf43e26f70a1314d95b306e9b93e4f4297886');\nhashMap.set('cocoapods','cf48ab5a573a28bf14d5e6c84eed9ca08b7f0cb5b7fc51d795c21c7254bb9dd1');\nhashMap.set('composer','869aab556d9b2ca2b743a790a7c0d7d104d62bbcbcc2185c44c64543d70413ba');\nhashMap.set('conan','74ca922a0ffdf1a9dd44b83eb2b3a36c56c7d792031e3a4a484f293046be3ecd');\nhashMap.set('copier','06a52206ba5542f99f056c832245196afd4b78bffeca088f710a5df958a9693d');\nhashMap.set('cpanfile','07813fec3f3c2197056500e9266a0553b9774c02f2c74d5ca2e213188c7c12d3');\nhashMap.set('crossplane','5c26b1201a1a51454ffb94d829e223a76a781569bf79cdb1e47087c30233ec40');\nhashMap.set('crow','eb9a5f9f95041855dded67bcce3dd54724f690995ed6268d272e8a666ff28fd0');\nhashMap.set('deno','8a161cacb3563a8249c6bf5956a2c1015d4c525946ae61d4fdcec7311f90b2ea');\nhashMap.set('deps-edn','c87dd5e88587147ad1a78f047b814f3c4aa60d6de30d0c49d849391eeaf1b64c');\nhashMap.set('devbox','a608d1e6db93a8f997d41f8dee7b67533452a956057865978342e2819272e0a9');\nhashMap.set('devcontainer','24320ed1cb6191d04cb8b2707214d82c08c682597aed1d84f250aa00ad1632ec');\nhashMap.set('docker-compose','5441af5b5abf8d347e46002d47f02f85743401bda28232f49fb7b3bbb772a4fb');\nhashMap.set('dockerfile','54122792bf8ea0be98e0a0716e627e3115b40a5f0155ccd7ae0cfc52424a3478');\nhashMap.set('droneci','237c8de87b9bf653fb943b56e84e99c45f6d86ae27d86e599b3f3f99c35ba8ee');\nhashMap.set('fleet','d73d5d35f10df0599a561d9c8d25f3935350407d0e3bd3a1d1545295f278912e');\nhashMap.set('flux','70833dd068ea0a746a9392469e7904021562c7629428d0cd554603bad4eb6ce5');\nhashMap.set('fvm','9b161df0f14bc6e536368952adf373e343630097121a913cea60ee284027fb90');\nhashMap.set('git-submodules','e95bbc9b69a36dee82e255e8983640b7179cb5f17d24b035c6cf01d9635b35bd');\nhashMap.set('github-actions','98ce747393a445efba97f0bcb9266800528520ac30702aaa9866753f11377da3');\nhashMap.set('gitlabci','33c264edf7837fb8fbc4cf0078c8bd2d5a75431039b1db65bf47356df7753125');\nhashMap.set('gitlabci-include','ef696c478c2ac1723b3aca070ba9779be0e702fff0844054251ba0029523d0eb');\nhashMap.set('glasskube','93e7b9000a17efa15a1abaaf320b5af9169b1ecd828fc0c881d98570ef9d9e30');\nhashMap.set('gleam','02389785183c39d2896d7893414c5e1060023f95c1fe7b595bd06cc5c1186d39');\nhashMap.set('gomod','073cf874c14d8f323aa7dc467e757b39e249e4617be1ce10926ee68763f89381');\nhashMap.set('gradle','550f1107f0ac27d18fa76a7d5c0c0b317b5df4156fc12cfd378573ccfe26fca0');\nhashMap.set('gradle-wrapper','799d9bb8d9dead673fb513ba4936395f14da30897d33a9df46b3266e1b835d5d');\nhashMap.set('haskell-cabal','f232d0e883235f74ed71fd9de4a7468e5fcbda9a1af5beb56c24657f7bf2e891');\nhashMap.set('helm-requirements','4d90e5e18a380876ad48e21e1ad88ea62e25d973a1ddaa3763447fc0a9f9915b');\nhashMap.set('helm-values','b5c52c6a27d805557418c585c5d3030c95ee641d53057021f3fe060f81b6e1af');\nhashMap.set('helmfile','ab828a1877cfe029ed5f8dd2a026409cd5e6431705af3aac3f56a3bc4f827508');\nhashMap.set('helmsman','ef9680c612f702c7f07aea9b6e5d811e91214dcfa5755c9f3803e9528090935e');\nhashMap.set('helmv3','4088a90bd8be4ae1bcb85dc4d34d3fbbb75e72bd33d144284e7e1f0e726c8d3b');\nhashMap.set('hermit','61e132cfccbe4e3884801a3728f3391455c214811a33c1f733b0dea7122bbbb6');\nhashMap.set('homeassistant-manifest','05043c6db870cffbb6f8f3e351c025e3de227eaae0b24134b796aec46f84b65f');\nhashMap.set('homebrew','9c64a4f1475b1c2052372e566c9190f32ae8acd1c54313031d55ae8772388367');\nhashMap.set('html','67c5f3c5c58e96f5dd257ba5987d900cf7fef81d667c3640e96c847b37de35a8');\nhashMap.set('jenkins','268ebfc8a1caf3edeb2192c2b1b2fa4bf18a78a3e731ba20a6c104940a5539f3');\nhashMap.set('jsonnet-bundler','4023ef4cac55fe58f8d9744ae86b13532298926e35e22d250334cde55c3386ff');\nhashMap.set('kotlin-script','99ef296792a0ca575ed31d3defb514b05a58083dc01c52ea0890c69d867ba1dd');\nhashMap.set('kubernetes','321e7d77fb3600dd4c00a86eaa1294927e7f92300b74fa2977d813dcaa3bb4de');\nhashMap.set('kustomize','fb5f6fbf45b318ca277d6d9f7fee22680f4b99c7ff9170a50315122918d2e007');\nhashMap.set('leiningen','133fca2c3423f53f2ccc22518153ddbcafbf0f4812376c77e952eb3d24d81f85');\nhashMap.set('maven','f084cdc88320ca1e82af957d0008e7c9ce991d3282cb428f3108a5722239cead');\nhashMap.set('maven-wrapper','779344a4e259e0c28bfadfeb435dd72feb7224d7346d038a1c35f02deb1357bc');\nhashMap.set('meteor','4a93a326b27bedfe52118e27e06f39fecd7c55bd4cd7fccec4cb120cac14cec4');\nhashMap.set('mint','248fe4f1ea5c985921c286785792c97e06fc41f402b2d45df82f6aecd17f710e');\nhashMap.set('mise','8463d355091f5f167e3f4a8adbebfe49310ad9ac45c89d60455ef8e110df4a49');\nhashMap.set('mix','5eb001e2af7cd664d811ad2d9928bf785527ed292de1e567de57f7e2cecc1ecc');\nhashMap.set('nix','d3283c2b948695a16c1089da4e2689faacd50eaa7d734d6fa5d6661aef6db7e7');\nhashMap.set('nodenv','ac652c28481b001f7471f4183eac07b45d98ecbe83efc275830b0a1b2e0459b8');\nhashMap.set('npm','0adc3d37562671986c36891105e71cdf973573815050ee2d6e0df404046cfe39');\nhashMap.set('nuget','0cce80e43ab9b21a98a8ecff8a835adf0ccc1c003cf71e7cf9c1e64293884464');\nhashMap.set('nvm','3eb77c7b0acf6d64753de78fad2499b352719853aa6872878c40675d14152322');\nhashMap.set('ocb','032b216684c14b0954e0bb019513a2aca3faaee5748587acb668d377d7c891ca');\nhashMap.set('osgi','32233a1a8a2725699d7448ba438e3d0b78141f7799cd2b588de278d41e26ed10');\nhashMap.set('pep621','f5dc3c8434845dd814bc649c619323dcb69e3ec5da2d361d353bdf6ae3cc5d88');\nhashMap.set('pep723','b96683163de63ed93207ec0538066705b1e58a1cd5b8bd11c63fc28b26bddba1');\nhashMap.set('pip-compile','9711b1c00da18ff785e624c50e4b042519e7ad615c5f018f08459fac8394fec5');\nhashMap.set('pip_requirements','537ef9d7b43b5adcfbfbb86392e0c7a8a0ee91c804118af83cf92e1868949e1a');\nhashMap.set('pip_setup','0175fe550c19d9bd31c978bd83fdc088cb40fcacd5d6751f640164274ae64e61');\nhashMap.set('pipenv','3b8a32a7879ac9798bd119315113e151bd843cae8f25bd1fbd376d574c9a726b');\nhashMap.set('pixi','3732f052617efd5007ddbe31091a2ba026909288bac4cbbe6d2bd6ac64d85393');\nhashMap.set('poetry','6cf6bc5116458761b2d6779caf465d6e26768fbe6e2ffba54b5da981aa8c385f');\nhashMap.set('pre-commit','17a5f183985ebffe98785a541d3609bf25efedc387deb3d50e9f00f02b25f615');\nhashMap.set('proto','412053d4550026b4ace490b46e970915b87ec1abf0b0a0c6c8c58ccf1fc16843');\nhashMap.set('pub','a2ded51959d48e053b811b3b9330b2460fc61d0fc2e74a400a546e4f82d25767');\nhashMap.set('puppet','ba58ab689e44acc8f61c3569ab8b40fde01b8a9d3aad712708e2a419e57d8b45');\nhashMap.set('pyenv','9ede8becc97774f9040b40f4472d3e933534b596e04c360bfe0f3c6f95f25182');\nhashMap.set('quadlet','e1fc88a4e14cd595e89bb3d79b4adf2add3ce5eb80f75276e712c32598cca53d');\nhashMap.set('renovate-config','2a4e4fb671aed5d0c900b8d54c31bfef46ca36d0f4e16b00ff73377b9c09fb69');\nhashMap.set('ruby-version','2db2140d9eee8c555e729a4de0396fa2d78846d3149890ee12fa515bd654be97');\nhashMap.set('runtime-version','b582b168c0cc595e39010feb10f4b97a82683eb269e9598216fbb11cc186e160');\nhashMap.set('rust-toolchain','6ace53db02874d73620d2d872291839820a512a9529c42d174358c692e5db720');\nhashMap.set('sbt','e508c2e2fb8d44e6cbec20f449c8eed096728566e6058187269c637930d388fb');\nhashMap.set('scalafmt','9d36159b56835e96498af026a1fb0543200db0581681ef95ec54988f411e180f');\nhashMap.set('setup-cfg','7dea08c5708625e753bd56918bc214df7fb4d8543a26e936926a21ab43b5f785');\nhashMap.set('smithy','9641b91d065ffb63be0dd888139a0402dba41e550f8b44c592db9daf52109100');\nhashMap.set('sveltos','05b3158e88771ed4629e171592cf4f1bf0ff342f8aeae89be0b340c630cc6d8e');\nhashMap.set('swift','eb5f7c3c4dabf28eed36916269ca9be16ab9ddb83993db03ea66b9195ad7bdc6');\nhashMap.set('tekton','fdc5b9b5edec2a90cda2f858f3ebc532aa8efb1187d1e0b7c89b07796e9cb6cd');\nhashMap.set('terraform','3dc2e8342e5e4ddf0f1cf1910567f13c4cfb20b9eaf375ee522f67946fe3e368');\nhashMap.set('terraform-version','ec8f786b9731d47f2c2fe0307caf64d7ddd83046fe7ff1f7d8423239f8b0f2aa');\nhashMap.set('terragrunt','ffcbaa67dd65f064d43f8c121c1006115eab1879c4bd38de263b9b90a009c118');\nhashMap.set('terragrunt-version','eea6087b33717d22ede2fc68c2f64df8390b75abe82110ed831a180648feb51d');\nhashMap.set('tflint-plugin','31247d37bc80aae17039bfa21bd989c5717730c5ef10cf2a6f09841576d012ec');\nhashMap.set('travis','bb482a0195cd009ec3896a6227bb95617f5c84bedb518c7d971e50c62235d9ca');\nhashMap.set('typst','d080a79fbd961c6e21fcc505d544b7e0ff2126142acb1dcabdf6abbcd9339248');\nhashMap.set('unity3d','f13e25e115e3443f4e16cf31578acffa78fb1a5e23339680a92d8d6de6052920');\nhashMap.set('velaci','fda00ddb7cc23e9a37e0a8a253151df0a6930b4276d3e4f78cc54b9ac09af7de');\nhashMap.set('vendir','ee9cc316c73ab0944da494bf36cfeafba8e79a36ec77753b9f341c8e80f1d602');\nhashMap.set('woodpecker','6110d3bec33aaeb3511d4bbfa896cec3c8e02fb04a6cff50c9ba81061c851045');\nhashMap.set('xcodegen','dad511d88a9ce1dbdde8b9731f3da7f2bdaa4ca8a083294ee58d56da62ab1683');\nhashMap.set('jsonata','efd520a9f674c6dcd4edde61e8d14ddbb29a60bcfd6a92e6179197faebf63e84');\nhashMap.set('regex','dbe6889ea021a05127fed06226d73366fdada2ae577147a5c027996fd325416e');"],"mappings":";AAAA,MAAa,0BAAU,IAAI,IAAoB;AAE/C,QAAQ,IAAI,WAAU,kEAAkE;AACxF,QAAQ,IAAI,kBAAiB,kEAAkE;AAC/F,QAAQ,IAAI,OAAM,kEAAkE;AACpF,QAAQ,IAAI,UAAS,kEAAkE;AACvF,QAAQ,IAAI,QAAO,kEAAkE;AACrF,QAAQ,IAAI,mBAAkB,kEAAkE;AAChG,QAAQ,IAAI,UAAS,kEAAkE;AACvF,QAAQ,IAAI,kBAAiB,kEAAkE;AAC/F,QAAQ,IAAI,SAAQ,kEAAkE;AACtF,QAAQ,IAAI,gBAAe,kEAAkE;AAC7F,QAAQ,IAAI,YAAW,kEAAkE;AACzF,QAAQ,IAAI,SAAQ,kEAAkE;AACtF,QAAQ,IAAI,uBAAsB,kEAAkE;AACpG,QAAQ,IAAI,WAAU,kEAAkE;AACxF,QAAQ,IAAI,aAAY,kEAAkE;AAC1F,QAAQ,IAAI,cAAa,kEAAkE;AAC3F,QAAQ,IAAI,OAAM,kEAAkE;AACpF,QAAQ,IAAI,eAAc,kEAAkE;AAC5F,QAAQ,IAAI,WAAU,kEAAkE;AACxF,QAAQ,IAAI,QAAO,kEAAkE;AACrF,QAAQ,IAAI,SAAQ,kEAAkE;AACtF,QAAQ,IAAI,UAAS,kEAAkE;AACvF,QAAQ,IAAI,YAAW,kEAAkE;AACzF,QAAQ,IAAI,cAAa,kEAAkE;AAC3F,QAAQ,IAAI,aAAY,kEAAkE;AAC1F,QAAQ,IAAI,YAAW,kEAAkE;AACzF,QAAQ,IAAI,SAAQ,kEAAkE;AACtF,QAAQ,IAAI,UAAS,kEAAkE;AACvF,QAAQ,IAAI,YAAW,kEAAkE;AACzF,QAAQ,IAAI,cAAa,kEAAkE;AAC3F,QAAQ,IAAI,QAAO,kEAAkE;AACrF,QAAQ,IAAI,QAAO,kEAAkE;AACrF,QAAQ,IAAI,YAAW,kEAAkE;AACzF,QAAQ,IAAI,UAAS,kEAAkE;AACvF,QAAQ,IAAI,gBAAe,kEAAkE;AAC7F,QAAQ,IAAI,kBAAiB,kEAAkE;AAC/F,QAAQ,IAAI,cAAa,kEAAkE;AAC3F,QAAQ,IAAI,WAAU,kEAAkE;AACxF,QAAQ,IAAI,SAAQ,kEAAkE;AACtF,QAAQ,IAAI,QAAO,kEAAkE;AACrF,QAAQ,IAAI,OAAM,kEAAkE;AACpF,QAAQ,IAAI,kBAAiB,kEAAkE;AAC/F,QAAQ,IAAI,kBAAiB,kEAAkE;AAC/F,QAAQ,IAAI,YAAW,kEAAkE;AACzF,QAAQ,IAAI,oBAAmB,kEAAkE;AACjG,QAAQ,IAAI,aAAY,kEAAkE;AAC1F,QAAQ,IAAI,SAAQ,kEAAkE;AACtF,QAAQ,IAAI,SAAQ,kEAAkE;AACtF,QAAQ,IAAI,UAAS,kEAAkE;AACvF,QAAQ,IAAI,kBAAiB,kEAAkE;AAC/F,QAAQ,IAAI,iBAAgB,kEAAkE;AAC9F,QAAQ,IAAI,qBAAoB,kEAAkE;AAClG,QAAQ,IAAI,eAAc,kEAAkE;AAC5F,QAAQ,IAAI,YAAW,kEAAkE;AACzF,QAAQ,IAAI,YAAW,kEAAkE;AACzF,QAAQ,IAAI,UAAS,kEAAkE;AACvF,QAAQ,IAAI,UAAS,kEAAkE;AACvF,QAAQ,IAAI,0BAAyB,kEAAkE;AACvG,QAAQ,IAAI,YAAW,kEAAkE;AACzF,QAAQ,IAAI,QAAO,kEAAkE;AACrF,QAAQ,IAAI,WAAU,kEAAkE;AACxF,QAAQ,IAAI,mBAAkB,kEAAkE;AAChG,QAAQ,IAAI,iBAAgB,kEAAkE;AAC9F,QAAQ,IAAI,cAAa,kEAAkE;AAC3F,QAAQ,IAAI,aAAY,kEAAkE;AAC1F,QAAQ,IAAI,aAAY,kEAAkE;AAC1F,QAAQ,IAAI,SAAQ,kEAAkE;AACtF,QAAQ,IAAI,iBAAgB,kEAAkE;AAC9F,QAAQ,IAAI,UAAS,kEAAkE;AACvF,QAAQ,IAAI,QAAO,kEAAkE;AACrF,QAAQ,IAAI,QAAO,kEAAkE;AACrF,QAAQ,IAAI,OAAM,kEAAkE;AACpF,QAAQ,IAAI,OAAM,kEAAkE;AACpF,QAAQ,IAAI,UAAS,kEAAkE;AACvF,QAAQ,IAAI,OAAM,kEAAkE;AACpF,QAAQ,IAAI,SAAQ,kEAAkE;AACtF,QAAQ,IAAI,OAAM,kEAAkE;AACpF,QAAQ,IAAI,OAAM,kEAAkE;AACpF,QAAQ,IAAI,QAAO,kEAAkE;AACrF,QAAQ,IAAI,UAAS,kEAAkE;AACvF,QAAQ,IAAI,UAAS,kEAAkE;AACvF,QAAQ,IAAI,eAAc,kEAAkE;AAC5F,QAAQ,IAAI,oBAAmB,kEAAkE;AACjG,QAAQ,IAAI,aAAY,kEAAkE;AAC1F,QAAQ,IAAI,UAAS,kEAAkE;AACvF,QAAQ,IAAI,QAAO,kEAAkE;AACrF,QAAQ,IAAI,UAAS,kEAAkE;AACvF,QAAQ,IAAI,cAAa,kEAAkE;AAC3F,QAAQ,IAAI,SAAQ,kEAAkE;AACtF,QAAQ,IAAI,OAAM,kEAAkE;AACpF,QAAQ,IAAI,UAAS,kEAAkE;AACvF,QAAQ,IAAI,SAAQ,kEAAkE;AACtF,QAAQ,IAAI,WAAU,kEAAkE;AACxF,QAAQ,IAAI,mBAAkB,kEAAkE;AAChG,QAAQ,IAAI,gBAAe,kEAAkE;AAC7F,QAAQ,IAAI,mBAAkB,kEAAkE;AAChG,QAAQ,IAAI,kBAAiB,kEAAkE;AAC/F,QAAQ,IAAI,OAAM,kEAAkE;AACpF,QAAQ,IAAI,YAAW,kEAAkE;AACzF,QAAQ,IAAI,aAAY,kEAAkE;AAC1F,QAAQ,IAAI,UAAS,kEAAkE;AACvF,QAAQ,IAAI,WAAU,kEAAkE;AACxF,QAAQ,IAAI,SAAQ,kEAAkE;AACtF,QAAQ,IAAI,UAAS,kEAAkE;AACvF,QAAQ,IAAI,aAAY,kEAAkE;AAC1F,QAAQ,IAAI,qBAAoB,kEAAkE;AAClG,QAAQ,IAAI,cAAa,kEAAkE;AAC3F,QAAQ,IAAI,sBAAqB,kEAAkE;AACnG,QAAQ,IAAI,iBAAgB,kEAAkE;AAC9F,QAAQ,IAAI,UAAS,kEAAkE;AACvF,QAAQ,IAAI,SAAQ,kEAAkE;AACtF,QAAQ,IAAI,WAAU,kEAAkE;AACxF,QAAQ,IAAI,UAAS,kEAAkE;AACvF,QAAQ,IAAI,UAAS,kEAAkE;AACvF,QAAQ,IAAI,cAAa,kEAAkE;AAC3F,QAAQ,IAAI,YAAW,kEAAkE;AACzF,QAAQ,IAAI,WAAU,kEAAkE;AACxF,QAAQ,IAAI,SAAQ,kEAAkE"}

package/dist/modules/manager/github-actions/artifacts.js

@@ -0,0 +1,161 @@
+import "../../../constants/error-messages.js";
+import { GlobalConfig } from "../../../config/global.js";
+import { logger } from "../../../logger/index.js";
+import { parseUrl } from "../../../util/url.js";
+import { find } from "../../../util/host-rules.js";
+import { detectPlatform } from "../../../util/common.js";
+import { coerceArray } from "../../../util/array.js";
+import { readLocalFile, writeLocalFile } from "../../../util/fs/index.js";
+import { exec } from "../../../util/exec/index.js";
+import { getRepoStatus } from "../../../util/git/index.js";
+import { artifactErrorMessageFromExecError } from "../util.js";
+import { findGithubToken } from "../../../util/check-token.js";
+import { actionsLockFile, isLockfileManaged } from "./common.js";
+import { ActionsLockfile } from "./schema.js";
+import { quote } from "shlex";
+//#region lib/modules/manager/github-actions/artifacts.ts
+/** The `gh` CLI extension that generates and verifies the lockfile. */
+const extensionName = "github/gh-actions-lock";
+/** The `uses:` dep types the lockfile graph is built from. */
+const lockedDepTypes = ["action", "docker"];
+function findToken(url) {
+	return findGithubToken(find({
+		hostType: "github",
+		url
+	}));
+}
+/**
+* `gh` takes the token from a different variable for GitHub Enterprise Server, and has to be told which host to talk to.
+*
+* Public actions are still resolved against github.com from there, so pass a token for both hosts.
+*/
+function getTokenEnv() {
+	const githubComEndpoint = "https://api.github.com/";
+	const configuredEndpoint = GlobalConfig.get("endpoint");
+	const endpoint = configuredEndpoint && detectPlatform(configuredEndpoint) === "github" ? configuredEndpoint : githubComEndpoint;
+	const hostname = parseUrl(endpoint)?.hostname;
+	const isEnterprise = !!hostname && hostname !== "api.github.com" && hostname !== "github.com";
+	const env = {};
+	if (isEnterprise) {
+		const enterpriseToken = findToken(endpoint);
+		if (enterpriseToken) {
+			env.GH_HOST = hostname;
+			env.GH_ENTERPRISE_TOKEN = enterpriseToken;
+		}
+	}
+	const token = findToken(githubComEndpoint);
+	if (token) env.GH_TOKEN = token;
+	if (!Object.keys(env).length) logger.debug("No GitHub token found for `gh actions-lock`");
+	return env;
+}
+/**
+* Whether any updated dependency is one the lockfile records an edge for, and sits in a file `gh actions-lock` will look at.
+*/
+function hasLockedUpdate(config, onboardedWorkflows) {
+	return config.upgrades.some((upgrade) => {
+		if (upgrade.manager !== "github-actions") return false;
+		if (!upgrade.depType || !lockedDepTypes.includes(upgrade.depType)) return false;
+		const packageFile = upgrade.packageFile;
+		if (!packageFile) return false;
+		return isLockfileManaged(packageFile, onboardedWorkflows);
+	});
+}
+/**
+* Regenerate `.github/workflows/actions.lock` once per branch.
+*
+* The lockfile records a transitive graph - resolved commits, numeric owner and repository IDs, and each composite action's own `uses:` edges - so it is regenerated by its own tool rather than patched here.
+* `gh actions-lock` re-reads every workflow from disk and rewrites the whole file, so this runs after all of the branch's package file updates have been flushed, in the same shape as npm's `getAdditionalFiles`.
+*/
+async function updateActionsLockfile(config, packageFiles) {
+	const empty = {
+		updatedArtifacts: [],
+		artifactErrors: []
+	};
+	const ghaPackageFiles = packageFiles?.["github-actions"];
+	if (!ghaPackageFiles?.length) return empty;
+	if (config.skipArtifactsUpdate) {
+		logger.debug(`Skipping ${actionsLockFile} generation`);
+		return empty;
+	}
+	const existingLockFileContent = await readLocalFile(actionsLockFile, "utf8");
+	if (!existingLockFileContent) {
+		logger.debug(`No ${actionsLockFile} found`);
+		return empty;
+	}
+	const parsedLockfile = ActionsLockfile.safeParse(existingLockFileContent);
+	if (!parsedLockfile.success) {
+		logger.warn({
+			err: parsedLockfile.error,
+			lockFile: actionsLockFile
+		}, "Failed to parse the GitHub Actions lockfile, so not regenerating it");
+		return empty;
+	}
+	if (!hasLockedUpdate(config, parsedLockfile.data.workflows)) {
+		logger.debug(`No locked dependencies updated for ${actionsLockFile}`);
+		return empty;
+	}
+	logger.debug(`Regenerating ${actionsLockFile}`);
+	const ghaPackageFilePaths = new Set(ghaPackageFiles.map((file) => file.packageFile));
+	const writtenContent = /* @__PURE__ */ new Map();
+	for (const file of coerceArray(config.updatedPackageFiles)) if (file.type === "addition" && ghaPackageFilePaths.has(file.path)) {
+		const contents = file.contents.toString();
+		await writeLocalFile(file.path, contents);
+		writtenContent.set(file.path, contents);
+	}
+	const tokenEnv = getTokenEnv();
+	const execOptions = {
+		cwd: GlobalConfig.get("localDir"),
+		extraEnv: tokenEnv,
+		env: tokenEnv,
+		toolConstraints: [{
+			toolName: "gh",
+			constraint: config.constraints?.gh
+		}],
+		docker: {}
+	};
+	const commands = ["gh actions-lock --no-interactive --no-narrow --no-migrate-local-actions"];
+	if (GlobalConfig.get("binarySource") === "global") logger.once.debug({ constraint: config.constraints?.ghActionsLock }, "Not installing the `gh-actions-lock` extension, and ignoring `constraints.ghActionsLock`, because `binarySource=global` leaves tooling to the administrator");
+	else if (config.constraints?.ghActionsLock) commands.unshift(`gh extension install ${extensionName} --force --pin ${quote(config.constraints?.ghActionsLock)}`);
+	else commands.unshift(`gh extension install ${extensionName} --force`);
+	try {
+		await exec(commands, execOptions);
+	} catch (err) {
+		if (err.message === "temporary-error") throw err;
+		logger.debug({ err }, `Error updating ${actionsLockFile}`);
+		return {
+			updatedArtifacts: [],
+			artifactErrors: [{
+				fileName: actionsLockFile,
+				stderr: artifactErrorMessageFromExecError(err, err.message)
+			}]
+		};
+	}
+	const updatedArtifacts = [];
+	const newLockFileContent = await readLocalFile(actionsLockFile, "utf8");
+	if (newLockFileContent && newLockFileContent !== existingLockFileContent) updatedArtifacts.push({
+		type: "addition",
+		path: actionsLockFile,
+		contents: newLockFileContent
+	});
+	const status = await getRepoStatus();
+	for (const path of status.modified) {
+		if (path === ".github/workflows/actions.lock" || !ghaPackageFilePaths.has(path)) continue;
+		const newContent = await readLocalFile(path, "utf8");
+		if (!newContent || newContent === writtenContent.get(path)) continue;
+		logger.debug(`\`gh actions-lock\` annotated ${path}`);
+		updatedArtifacts.push({
+			type: "addition",
+			path,
+			contents: newContent
+		});
+	}
+	if (!updatedArtifacts.length) logger.debug(`${actionsLockFile} is unchanged`);
+	return {
+		updatedArtifacts,
+		artifactErrors: []
+	};
+}
+//#endregion
+export { updateActionsLockfile };
+
+//# sourceMappingURL=artifacts.js.map

package/dist/modules/manager/github-actions/artifacts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifacts.js","names":["hostRules.find"],"sources":["../../../../lib/modules/manager/github-actions/artifacts.ts"],"sourcesContent":["import { quote } from 'shlex';\nimport { GlobalConfig } from '../../../config/global.ts';\nimport { TEMPORARY_ERROR } from '../../../constants/error-messages.ts';\nimport { logger } from '../../../logger/index.ts';\nimport { coerceArray } from '../../../util/array.ts';\nimport { findGithubToken } from '../../../util/check-token.ts';\nimport { detectPlatform } from '../../../util/common.ts';\nimport { exec } from '../../../util/exec/index.ts';\nimport type { ExecOptions, ExtraEnv } from '../../../util/exec/types.ts';\nimport { readLocalFile, writeLocalFile } from '../../../util/fs/index.ts';\nimport { getRepoStatus } from '../../../util/git/index.ts';\nimport type { FileChange } from '../../../util/git/types.ts';\nimport * as hostRules from '../../../util/host-rules.ts';\nimport { parseUrl } from '../../../util/url.ts';\nimport type { PackageFile, PostUpdateConfig } from '../types.ts';\nimport { artifactErrorMessageFromExecError } from '../util.ts';\nimport { actionsLockFile, isLockfileManaged } from './common.ts';\nimport { ActionsLockfile } from './schema.ts';\nimport type { ActionsLockfileResult, OnboardedWorkflows } from './types.ts';\n\n/** The `gh` CLI extension that generates and verifies the lockfile. */\nconst extensionName = 'github/gh-actions-lock';\n\n/** The `uses:` dep types the lockfile graph is built from. */\nconst lockedDepTypes = ['action', 'docker'];\n\nfunction findToken(url: string): string | undefined {\n  return findGithubToken(hostRules.find({ hostType: 'github', url }));\n}\n\n/**\n * `gh` takes the token from a different variable for GitHub Enterprise Server, and has to be told which host to talk to.\n *\n * Public actions are still resolved against github.com from there, so pass a token for both hosts.\n */\nfunction getTokenEnv(): ExtraEnv {\n  const githubComEndpoint = 'https://api.github.com/';\n  const configuredEndpoint = GlobalConfig.get('endpoint');\n  // The configured endpoint only says where GitHub lives when Renovate is talking to GitHub: workflows mirrored onto another platform still resolve their actions against github.com.\n  const endpoint =\n    configuredEndpoint && detectPlatform(configuredEndpoint) === 'github'\n      ? configuredEndpoint\n      : githubComEndpoint;\n\n  const hostname = parseUrl(endpoint)?.hostname;\n  const isEnterprise =\n    !!hostname && hostname !== 'api.github.com' && hostname !== 'github.com';\n\n  const env: ExtraEnv = {};\n\n  if (isEnterprise) {\n    const enterpriseToken = findToken(endpoint);\n    if (enterpriseToken) {\n      env.GH_HOST = hostname;\n      env.GH_ENTERPRISE_TOKEN = enterpriseToken;\n    }\n  }\n\n  const token = findToken(githubComEndpoint);\n  if (token) {\n    env.GH_TOKEN = token;\n  }\n\n  if (!Object.keys(env).length) {\n    logger.debug('No GitHub token found for `gh actions-lock`');\n  }\n\n  return env;\n}\n\n/**\n * Whether any updated dependency is one the lockfile records an edge for, and sits in a file `gh actions-lock` will look at.\n */\nfunction hasLockedUpdate(\n  config: PostUpdateConfig,\n  onboardedWorkflows: OnboardedWorkflows,\n): boolean {\n  return config.upgrades.some((upgrade) => {\n    if (upgrade.manager !== 'github-actions') {\n      return false;\n    }\n\n    if (!upgrade.depType || !lockedDepTypes.includes(upgrade.depType)) {\n      return false;\n    }\n\n    const packageFile = upgrade.packageFile;\n    if (!packageFile) {\n      return false;\n    }\n\n    return isLockfileManaged(packageFile, onboardedWorkflows);\n  });\n}\n\n/**\n * Regenerate `.github/workflows/actions.lock` once per branch.\n *\n * The lockfile records a transitive graph - resolved commits, numeric owner and repository IDs, and each composite action's own `uses:` edges - so it is regenerated by its own tool rather than patched here.\n * `gh actions-lock` re-reads every workflow from disk and rewrites the whole file, so this runs after all of the branch's package file updates have been flushed, in the same shape as npm's `getAdditionalFiles`.\n */\nexport async function updateActionsLockfile(\n  config: PostUpdateConfig,\n  packageFiles: Record<string, PackageFile[]> | undefined,\n): Promise<ActionsLockfileResult> {\n  const empty: ActionsLockfileResult = {\n    updatedArtifacts: [],\n    artifactErrors: [],\n  };\n\n  const ghaPackageFiles = packageFiles?.['github-actions'];\n  if (!ghaPackageFiles?.length) {\n    return empty;\n  }\n\n  if (config.skipArtifactsUpdate) {\n    logger.debug(`Skipping ${actionsLockFile} generation`);\n    return empty;\n  }\n\n  const existingLockFileContent = await readLocalFile(actionsLockFile, 'utf8');\n  if (!existingLockFileContent) {\n    logger.debug(`No ${actionsLockFile} found`);\n    return empty;\n  }\n\n  const parsedLockfile = ActionsLockfile.safeParse(existingLockFileContent);\n  if (!parsedLockfile.success) {\n    logger.warn(\n      { err: parsedLockfile.error, lockFile: actionsLockFile },\n      'Failed to parse the GitHub Actions lockfile, so not regenerating it',\n    );\n    return empty;\n  }\n\n  if (!hasLockedUpdate(config, parsedLockfile.data.workflows)) {\n    logger.debug(`No locked dependencies updated for ${actionsLockFile}`);\n    return empty;\n  }\n\n  logger.debug(`Regenerating ${actionsLockFile}`);\n\n  const ghaPackageFilePaths = new Set(\n    ghaPackageFiles.map((file) => file.packageFile),\n  );\n\n  // Ensure that in-memory file contents are flushed to disk, so `actions-lock` can run against it.\n  // A branch can group updates from other managers, whose contents may be binary - a Gradle wrapper JAR, say - so only write the workflows which the tool actually reads.\n  const writtenContent = new Map<string, string>();\n  for (const file of coerceArray(config.updatedPackageFiles)) {\n    if (file.type === 'addition' && ghaPackageFilePaths.has(file.path)) {\n      const contents = file.contents!.toString();\n      await writeLocalFile(file.path, contents);\n      writtenContent.set(file.path, contents);\n    }\n  }\n\n  const tokenEnv = getTokenEnv();\n\n  const execOptions: ExecOptions = {\n    // The tool rescans every workflow, so it runs from the repository root\n    cwd: GlobalConfig.get('localDir'),\n    // `extraEnv` is what forwards a variable into the Docker sidecar, but on its own it is only a default: `getChildEnv` lets a same-named variable in Renovate's own environment win.\n    // The token we resolved from the host rules must not be shadowed by an ambient `GH_TOKEN`, so force it as well.\n    extraEnv: tokenEnv,\n    env: tokenEnv,\n    toolConstraints: [{ toolName: 'gh', constraint: config.constraints?.gh }],\n    docker: {},\n  };\n\n  // `--no-interactive`: we have no terminal to answer prompts with\n  // `--no-narrow`: keep the ref that we wrote, to avoid a `@v4` being rewritten as `@v4.2.1`\n  // `--no-migrate-local-actions`: on-by-default, but unrelated to our lockfile updates\n  const commands = [\n    'gh actions-lock --no-interactive --no-narrow --no-migrate-local-actions',\n  ];\n\n  // `binarySource=global` means the administrator provisions tooling, so we must not reach into their `gh` install to add or re-pin an extension.\n  // They own the extension version, and `constraints.ghActionsLock` does not apply.\n  // TODO replace once containerbase/base#7279 is available\n  if (GlobalConfig.get('binarySource') === 'global') {\n    // Debug rather than warn: `constraints.ghActionsLock` ships with a default, so we cannot tell an explicit override from the default here, and warning would fire for every repository on this `binarySource`.\n    logger.once.debug(\n      { constraint: config.constraints?.ghActionsLock },\n      'Not installing the `gh-actions-lock` extension, and ignoring `constraints.ghActionsLock`, because `binarySource=global` leaves tooling to the administrator',\n    );\n  } else {\n    // `--force` makes an install a no-op when the specified version is already installed\n    if (config.constraints?.ghActionsLock) {\n      commands.unshift(\n        `gh extension install ${extensionName} --force --pin ${quote(config.constraints?.ghActionsLock)}`,\n      );\n    } else {\n      commands.unshift(`gh extension install ${extensionName} --force`);\n    }\n  }\n\n  try {\n    await exec(commands, execOptions);\n  } catch (err) {\n    if (err.message === TEMPORARY_ERROR) {\n      throw err;\n    }\n    logger.debug({ err }, `Error updating ${actionsLockFile}`);\n    return {\n      updatedArtifacts: [],\n      artifactErrors: [\n        {\n          fileName: actionsLockFile,\n          // an `ExecError` always carries a `stderr`, so fall back to the message rather than rendering an artifact error with nothing in it\n          stderr: artifactErrorMessageFromExecError(err, err.message),\n        },\n      ],\n    };\n  }\n\n  const updatedArtifacts: FileChange[] = [];\n\n  const newLockFileContent = await readLocalFile(actionsLockFile, 'utf8');\n  if (newLockFileContent && newLockFileContent !== existingLockFileContent) {\n    updatedArtifacts.push({\n      type: 'addition',\n      path: actionsLockFile,\n      contents: newLockFileContent,\n    });\n  }\n\n  // `actions-lock` may annotate workflows being managed with i.e. `# This workflow is managed by gh actions-lock.`, even if there were no updates to that workflow in this branch.\n  // We should diff against Git, rather than against the branch's own updated package files, otherwise those annotations are left behind as uncommitted changes\n  const status = await getRepoStatus();\n  for (const path of status.modified) {\n    // ignore the lockfile, as we've already committed it above, and any file which another manager owns\n    if (path === actionsLockFile || !ghaPackageFilePaths.has(path)) {\n      continue;\n    }\n\n    const newContent = await readLocalFile(path, 'utf8');\n    // Whatever this branch wrote is committed as a package file update already, so only content which the tool changed on top of it is an artifact\n    if (!newContent || newContent === writtenContent.get(path)) {\n      continue;\n    }\n    logger.debug(`\\`gh actions-lock\\` annotated ${path}`);\n    updatedArtifacts.push({\n      type: 'addition',\n      path,\n      contents: newContent,\n    });\n  }\n\n  if (!updatedArtifacts.length) {\n    logger.debug(`${actionsLockFile} is unchanged`);\n  }\n\n  return { updatedArtifacts, artifactErrors: [] };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAqBA,MAAM,gBAAgB;;AAGtB,MAAM,iBAAiB,CAAC,UAAU,QAAQ;AAE1C,SAAS,UAAU,KAAiC;CAClD,OAAO,gBAAgBA,KAAe;EAAE,UAAU;EAAU;CAAI,CAAC,CAAC;AACpE;;;;;;AAOA,SAAS,cAAwB;CAC/B,MAAM,oBAAoB;CAC1B,MAAM,qBAAqB,aAAa,IAAI,UAAU;CAEtD,MAAM,WACJ,sBAAsB,eAAe,kBAAkB,MAAM,WACzD,qBACA;CAEN,MAAM,WAAW,SAAS,QAAQ,CAAC,EAAE;CACrC,MAAM,eACJ,CAAC,CAAC,YAAY,aAAa,oBAAoB,aAAa;CAE9D,MAAM,MAAgB,CAAC;CAEvB,IAAI,cAAc;EAChB,MAAM,kBAAkB,UAAU,QAAQ;EAC1C,IAAI,iBAAiB;GACnB,IAAI,UAAU;GACd,IAAI,sBAAsB;EAC5B;CACF;CAEA,MAAM,QAAQ,UAAU,iBAAiB;CACzC,IAAI,OACF,IAAI,WAAW;CAGjB,IAAI,CAAC,OAAO,KAAK,GAAG,CAAC,CAAC,QACpB,OAAO,MAAM,6CAA6C;CAG5D,OAAO;AACT;;;;AAKA,SAAS,gBACP,QACA,oBACS;CACT,OAAO,OAAO,SAAS,MAAM,YAAY;EACvC,IAAI,QAAQ,YAAY,kBACtB,OAAO;EAGT,IAAI,CAAC,QAAQ,WAAW,CAAC,eAAe,SAAS,QAAQ,OAAO,GAC9D,OAAO;EAGT,MAAM,cAAc,QAAQ;EAC5B,IAAI,CAAC,aACH,OAAO;EAGT,OAAO,kBAAkB,aAAa,kBAAkB;CAC1D,CAAC;AACH;;;;;;;AAQA,eAAsB,sBACpB,QACA,cACgC;CAChC,MAAM,QAA+B;EACnC,kBAAkB,CAAC;EACnB,gBAAgB,CAAC;CACnB;CAEA,MAAM,kBAAkB,eAAe;CACvC,IAAI,CAAC,iBAAiB,QACpB,OAAO;CAGT,IAAI,OAAO,qBAAqB;EAC9B,OAAO,MAAM,YAAY,gBAAgB,YAAY;EACrD,OAAO;CACT;CAEA,MAAM,0BAA0B,MAAM,cAAc,iBAAiB,MAAM;CAC3E,IAAI,CAAC,yBAAyB;EAC5B,OAAO,MAAM,MAAM,gBAAgB,OAAO;EAC1C,OAAO;CACT;CAEA,MAAM,iBAAiB,gBAAgB,UAAU,uBAAuB;CACxE,IAAI,CAAC,eAAe,SAAS;EAC3B,OAAO,KACL;GAAE,KAAK,eAAe;GAAO,UAAU;EAAgB,GACvD,qEACF;EACA,OAAO;CACT;CAEA,IAAI,CAAC,gBAAgB,QAAQ,eAAe,KAAK,SAAS,GAAG;EAC3D,OAAO,MAAM,sCAAsC,iBAAiB;EACpE,OAAO;CACT;CAEA,OAAO,MAAM,gBAAgB,iBAAiB;CAE9C,MAAM,sBAAsB,IAAI,IAC9B,gBAAgB,KAAK,SAAS,KAAK,WAAW,CAChD;CAIA,MAAM,iCAAiB,IAAI,IAAoB;CAC/C,KAAK,MAAM,QAAQ,YAAY,OAAO,mBAAmB,GACvD,IAAI,KAAK,SAAS,cAAc,oBAAoB,IAAI,KAAK,IAAI,GAAG;EAClE,MAAM,WAAW,KAAK,SAAU,SAAS;EACzC,MAAM,eAAe,KAAK,MAAM,QAAQ;EACxC,eAAe,IAAI,KAAK,MAAM,QAAQ;CACxC;CAGF,MAAM,WAAW,YAAY;CAE7B,MAAM,cAA2B;EAE/B,KAAK,aAAa,IAAI,UAAU;EAGhC,UAAU;EACV,KAAK;EACL,iBAAiB,CAAC;GAAE,UAAU;GAAM,YAAY,OAAO,aAAa;EAAG,CAAC;EACxE,QAAQ,CAAC;CACX;CAKA,MAAM,WAAW,CACf,yEACF;CAKA,IAAI,aAAa,IAAI,cAAc,MAAM,UAEvC,OAAO,KAAK,MACV,EAAE,YAAY,OAAO,aAAa,cAAc,GAChD,6JACF;MAGA,IAAI,OAAO,aAAa,eACtB,SAAS,QACP,wBAAwB,cAAc,iBAAiB,MAAM,OAAO,aAAa,aAAa,GAChG;MAEA,SAAS,QAAQ,wBAAwB,cAAc,SAAS;CAIpE,IAAI;EACF,MAAM,KAAK,UAAU,WAAW;CAClC,SAAS,KAAK;EACZ,IAAI,IAAI,YAAA,mBACN,MAAM;EAER,OAAO,MAAM,EAAE,IAAI,GAAG,kBAAkB,iBAAiB;EACzD,OAAO;GACL,kBAAkB,CAAC;GACnB,gBAAgB,CACd;IACE,UAAU;IAEV,QAAQ,kCAAkC,KAAK,IAAI,OAAO;GAC5D,CACF;EACF;CACF;CAEA,MAAM,mBAAiC,CAAC;CAExC,MAAM,qBAAqB,MAAM,cAAc,iBAAiB,MAAM;CACtE,IAAI,sBAAsB,uBAAuB,yBAC/C,iBAAiB,KAAK;EACpB,MAAM;EACN,MAAM;EACN,UAAU;CACZ,CAAC;CAKH,MAAM,SAAS,MAAM,cAAc;CACnC,KAAK,MAAM,QAAQ,OAAO,UAAU;EAElC,IAAI,SAAA,oCAA4B,CAAC,oBAAoB,IAAI,IAAI,GAC3D;EAGF,MAAM,aAAa,MAAM,cAAc,MAAM,MAAM;EAEnD,IAAI,CAAC,cAAc,eAAe,eAAe,IAAI,IAAI,GACvD;EAEF,OAAO,MAAM,iCAAiC,MAAM;EACpD,iBAAiB,KAAK;GACpB,MAAM;GACN;GACA,UAAU;EACZ,CAAC;CACH;CAEA,IAAI,CAAC,iBAAiB,QACpB,OAAO,MAAM,GAAG,gBAAgB,cAAc;CAGhD,OAAO;EAAE;EAAkB,gBAAgB,CAAC;CAAE;AAChD"}

package/dist/modules/manager/github-actions/common.js

@@ -0,0 +1,29 @@
+import { regEx } from "../../../util/regex.js";
+//#region lib/modules/manager/github-actions/common.ts
+/**
+* `gh actions-lock` writes the locked graph of all onboarded workflows, including transitive dependencies of local composite actions, to a single lock file at a fixed location.
+*
+* It is therefore not necessarily a sibling of the package file(s) that are updated.
+*/
+const actionsLockFile = ".github/workflows/actions.lock";
+/** Matches GitHub workflow files, not Gitea/Forgejo workflows, `workflow-templates/` or composite action manifests. */
+const githubWorkflowFileRe = regEx(/(^|\/)\.github\/workflows\/[^/]+\.ya?ml$/);
+/** Matches a composite action manifest, which GitHub requires to be named `action.yml` or `action.yaml`. */
+const compositeActionFileRe = regEx(/(^|\/)action\.ya?ml$/);
+/** Matches anything below a Gitea or Forgejo directory, which `gh actions-lock` never reads. */
+const giteaOrForgejoFileRe = regEx(/(^|\/)\.(?:gitea|forgejo)\//);
+/**
+* Whether `gh actions-lock` owns the digests in this file, given the workflows which the lock file has onboarded.
+*
+* A repository can deliberately keep a workflow out of the lock file, and those stay ours to pin.
+* A local composite action is never keyed by the lock file, but can be a transitive dependency of a workflow which is onboarded, so the tool rewrites it too.
+* Everything else this manager extracts - Gitea and Forgejo workflows and actions, `workflow-templates/` - is invisible to the tool, so stays ours as well.
+*/
+function isLockfileManaged(packageFile, onboardedWorkflows) {
+	if (githubWorkflowFileRe.test(packageFile)) return packageFile in onboardedWorkflows;
+	return compositeActionFileRe.test(packageFile) && !giteaOrForgejoFileRe.test(packageFile);
+}
+//#endregion
+export { actionsLockFile, githubWorkflowFileRe, isLockfileManaged };
+
+//# sourceMappingURL=common.js.map

package/dist/modules/manager/github-actions/common.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"common.js","names":[],"sources":["../../../../lib/modules/manager/github-actions/common.ts"],"sourcesContent":["import { regEx } from '../../../util/regex.ts';\nimport type { OnboardedWorkflows } from './types.ts';\n\n/**\n * `gh actions-lock` writes the locked graph of all onboarded workflows, including transitive dependencies of local composite actions, to a single lock file at a fixed location.\n *\n * It is therefore not necessarily a sibling of the package file(s) that are updated.\n */\nexport const actionsLockFile = '.github/workflows/actions.lock';\n\n/** Matches GitHub workflow files, not Gitea/Forgejo workflows, `workflow-templates/` or composite action manifests. */\nexport const githubWorkflowFileRe = regEx(\n  /(^|\\/)\\.github\\/workflows\\/[^/]+\\.ya?ml$/,\n);\n\n/** Matches a composite action manifest, which GitHub requires to be named `action.yml` or `action.yaml`. */\nconst compositeActionFileRe = regEx(/(^|\\/)action\\.ya?ml$/);\n\n/** Matches anything below a Gitea or Forgejo directory, which `gh actions-lock` never reads. */\nconst giteaOrForgejoFileRe = regEx(/(^|\\/)\\.(?:gitea|forgejo)\\//);\n\n/**\n * Whether `gh actions-lock` owns the digests in this file, given the workflows which the lock file has onboarded.\n *\n * A repository can deliberately keep a workflow out of the lock file, and those stay ours to pin.\n * A local composite action is never keyed by the lock file, but can be a transitive dependency of a workflow which is onboarded, so the tool rewrites it too.\n * Everything else this manager extracts - Gitea and Forgejo workflows and actions, `workflow-templates/` - is invisible to the tool, so stays ours as well.\n */\nexport function isLockfileManaged(\n  packageFile: string,\n  onboardedWorkflows: OnboardedWorkflows,\n): boolean {\n  if (githubWorkflowFileRe.test(packageFile)) {\n    return packageFile in onboardedWorkflows;\n  }\n\n  return (\n    compositeActionFileRe.test(packageFile) &&\n    !giteaOrForgejoFileRe.test(packageFile)\n  );\n}\n"],"mappings":";;;;;;;AAQA,MAAa,kBAAkB;;AAG/B,MAAa,uBAAuB,MAClC,0CACF;;AAGA,MAAM,wBAAwB,MAAM,sBAAsB;;AAG1D,MAAM,uBAAuB,MAAM,6BAA6B;;;;;;;;AAShE,SAAgB,kBACd,aACA,oBACS;CACT,IAAI,qBAAqB,KAAK,WAAW,GACvC,OAAO,eAAe;CAGxB,OACE,sBAAsB,KAAK,WAAW,KACtC,CAAC,qBAAqB,KAAK,WAAW;AAE1C"}

package/dist/modules/manager/github-actions/extract.js

@@ -1,8 +1,10 @@
+import { get, set } from "../../../util/cache/memory/index.js";
 import { newlineRegex, regEx } from "../../../util/regex.js";
 import { GlobalConfig } from "../../../config/global.js";
 import { logger, withMeta } from "../../../logger/index.js";
 import { parseUrl } from "../../../util/url.js";
 import { detectPlatform } from "../../../util/common.js";
+import { readLocalFile } from "../../../util/fs/index.js";
 import "../../versioning/npm/index.js";
 import { api } from "../../versioning/docker/index.js";
 import { id } from "../../versioning/exact/index.js";
@@ -15,8 +17,9 @@ import { GithubReleasesDatasource } from "../../datasource/github-releases/index
 import { GithubRunnersDatasource } from "../../datasource/github-runners/index.js";
 import { GithubTagsDatasource } from "../../datasource/github-tags/index.js";
 import { getDep } from "../dockerfile/extract.js";
+import { actionsLockFile, isLockfileManaged } from "./common.js";
 import { isSha, isShortSha, parseUsesLine, versionLikeRe } from "./parse.js";
-import { CommunityActions, Workflow } from "./schema.js";
+import { ActionsLockfile, CommunityActions, Workflow } from "./schema.js";
 import is from "@sindresorhus/is";
 //#region lib/modules/manager/github-actions/extract.ts
 function detectCustomGitHubRegistryUrlsForActions() {
@@ -197,11 +200,52 @@ function extractWithYAMLParser(content, packageFile, config) {
 	}
 	return deps;
 }
-function extractPackageFile(content, packageFile, config = {}) {
+async function readLockfile() {
+	const content = await readLocalFile(actionsLockFile, "utf8");
+	if (!content) return { type: "missing" };
+	const parsed = ActionsLockfile.safeParse(content);
+	if (!parsed.success) {
+		logger.debug(`Failed to parse ${actionsLockFile}`);
+		return { type: "unparseable" };
+	}
+	return {
+		type: "parsed",
+		onboardedWorkflows: parsed.data.workflows
+	};
+}
+/**
+* A repository has a single lock file, but can have any number of package files, so read and parse it only once.
+*/
+function getLockfile() {
+	const cacheKey = `github-actions:${actionsLockFile}`;
+	const cached = get(cacheKey);
+	if (cached !== void 0) return cached;
+	const result = readLockfile();
+	set(cacheKey, result);
+	return result;
+}
+/**
+* Whether `gh actions-lock` owns the digests in this file.
+*
+* It rewrites the workflows it manages back to plain refs when regenerating, so an inline digest pin would be stripped straight back out.
+*/
+async function isManagedByLockfile(packageFile) {
+	const lockfile = await getLockfile();
+	switch (lockfile.type) {
+		case "missing": return false;
+		case "unparseable": return true;
+		case "parsed": return isLockfileManaged(packageFile, lockfile.onboardedWorkflows);
+	}
+}
+async function extractPackageFile(content, packageFile, config = {}) {
 	logger.trace(`github-actions.extractPackageFile(${packageFile})`);
 	const deps = [...extractWithRegex(content, config), ...extractWithYAMLParser(content, packageFile, config)];
 	if (!deps.length) return null;
-	return { deps };
+	const res = { deps };
+	if (await isManagedByLockfile(packageFile)) {
+		for (const dep of deps) if (dep.depType === "action") dep.digestManagedExternally = true;
+	}
+	return res;
 }
 //#endregion
 export { extractPackageFile };

package/dist/modules/manager/github-actions/extract.js.map

@@ -1 +1 @@
-{"version":3,"file":"extract.js","names":["githubActionsVersioning.id","exactVersioning.id","nodeVersioning.id"],"sources":["../../../../lib/modules/manager/github-actions/extract.ts"],"sourcesContent":["import is from '@sindresorhus/is';\nimport { GlobalConfig } from '../../../config/global.ts';\nimport { logger, withMeta } from '../../../logger/index.ts';\nimport { detectPlatform } from '../../../util/common.ts';\nimport { newlineRegex, regEx } from '../../../util/regex.ts';\nimport { parseUrl } from '../../../util/url.ts';\nimport { ForgejoTagsDatasource } from '../../datasource/forgejo-tags/index.ts';\nimport { GiteaTagsDatasource } from '../../datasource/gitea-tags/index.ts';\nimport { GithubDigestDatasource } from '../../datasource/github-digest/index.ts';\nimport { GithubReleasesDatasource } from '../../datasource/github-releases/index.ts';\nimport { GithubRunnersDatasource } from '../../datasource/github-runners/index.ts';\nimport { GithubTagsDatasource } from '../../datasource/github-tags/index.ts';\nimport * as dockerVersioning from '../../versioning/docker/index.ts';\nimport * as exactVersioning from '../../versioning/exact/index.ts';\nimport * as githubActionsVersioning from '../../versioning/github-actions/index.ts';\nimport * as nodeVersioning from '../../versioning/node/index.ts';\nimport * as npmVersioning from '../../versioning/npm/index.ts';\nimport { getDep } from '../dockerfile/extract.ts';\nimport type {\n  ExtractConfig,\n  PackageDependency,\n  PackageFileContent,\n} from '../types.ts';\nimport type { DockerReference, RepositoryReference } from './parse.ts';\nimport { isSha, isShortSha, parseUsesLine, versionLikeRe } from './parse.ts';\nimport type { UsesStep } from './schema.ts';\nimport { CommunityActions, Workflow } from './schema.ts';\n\n// detects if we run against a Github Enterprise Server and adds the URL to the beginning of the registryURLs for looking up Actions\n// This reflects the behavior of how GitHub looks up Actions\n// First on the Enterprise Server, then on GitHub.com\nfunction detectCustomGitHubRegistryUrlsForActions(): PackageDependency {\n  const endpoint = GlobalConfig.get('endpoint');\n  const registryUrls = ['https://github.com'];\n  if (endpoint && GlobalConfig.get('platform') === 'github') {\n    const parsedEndpoint = parseUrl(endpoint);\n    if (!parsedEndpoint) {\n      logger.warn({ endpoint }, 'Failed to parse endpoint url');\n      return {};\n    }\n\n    if (\n      parsedEndpoint.host !== 'github.com' &&\n      parsedEndpoint.host !== 'api.github.com'\n    ) {\n      registryUrls.unshift(\n        `${parsedEndpoint.protocol}//${parsedEndpoint.host}`,\n      );\n      return { registryUrls };\n    }\n  }\n  return {};\n}\n\nfunction extractDockerAction(\n  actionRef: DockerReference,\n  config: ExtractConfig,\n): PackageDependency {\n  const dep = getDep(actionRef.originalRef, true, config.registryAliases);\n  dep.depType = 'docker';\n  dep.replaceString = actionRef.originalRef;\n  return dep;\n}\n\nfunction extractRepositoryAction(\n  actionRef: RepositoryReference,\n  parsed: ReturnType<typeof parseUsesLine> & object,\n  customRegistryUrlsPackageDependency: PackageDependency,\n): PackageDependency {\n  const {\n    replaceString: valueString,\n    quote,\n    commentData,\n    commentPrecedingWhitespace,\n  } = parsed;\n  const {\n    owner,\n    repo,\n    path: subPath,\n    ref,\n    hostname,\n    isExplicitHostname,\n  } = actionRef;\n\n  const registryUrl = isExplicitHostname ? `https://${hostname}/` : '';\n  const packageName = `${owner}/${repo}`;\n  const depName = `${registryUrl}${packageName}`;\n  const pathSuffix = subPath ? `/${subPath}` : '';\n  const commentWs = commentPrecedingWhitespace || ' ';\n\n  const dep: PackageDependency = {\n    depName,\n    commitMessageTopic: '{{{depName}}} action',\n    versioning: githubActionsVersioning.id,\n    depType: 'action',\n    replaceString: valueString,\n    autoReplaceStringTemplate: `${quote}{{depName}}${pathSuffix}@{{#if newDigest}}{{newDigest}}${quote}{{#if newValue}}${commentWs}# {{newValue}}{{/if}}{{/if}}{{#unless newDigest}}{{newValue}}${quote}{{/unless}}`,\n    ...(isExplicitHostname\n      ? detectDatasource(registryUrl)\n      : customRegistryUrlsPackageDependency),\n  };\n\n  if (packageName !== depName) {\n    dep.packageName = packageName;\n  }\n\n  // Extend replaceString to include relevant comment portions:\n  // - Pinned version or ref: include only up to the matched token (truncate trailing text)\n  // - Ratchet exclude: include the full comment to preserve the marker\n  const pinComment =\n    commentData.pinnedVersion ??\n    (isSha(ref) || isShortSha(ref) ? commentData.ref : undefined);\n  if (\n    pinComment &&\n    !is.undefined(commentData.index) &&\n    !is.undefined(commentData.matchedString)\n  ) {\n    const cleanComment = parsed.commentString.slice(1);\n    const matchEndIndex = commentData.index + commentData.matchedString.length;\n    const commentSuffix = cleanComment.slice(0, matchEndIndex);\n    dep.replaceString = `${valueString}${commentPrecedingWhitespace}#${commentSuffix}`;\n  } else if (commentData.ratchetExclude) {\n    dep.replaceString =\n      valueString + commentPrecedingWhitespace + parsed.commentString;\n  }\n\n  if (isSha(ref)) {\n    dep.currentValue = commentData.pinnedVersion ?? commentData.ref;\n    dep.currentDigest = ref;\n  } else if (isShortSha(ref)) {\n    dep.currentValue = commentData.pinnedVersion ?? commentData.ref;\n    dep.currentDigestShort = ref;\n  } else {\n    dep.currentValue = ref;\n  }\n\n  if (!dep.currentValue) {\n    dep.enabled = false;\n    dep.skipReason = 'unversioned-reference';\n  }\n\n  const isVersionLike =\n    dep.currentValue && versionLikeRe.test(dep.currentValue);\n  if (!dep.datasource && dep.currentValue && !isVersionLike) {\n    dep.datasource = GithubDigestDatasource.id;\n    dep.versioning = exactVersioning.id;\n  }\n\n  dep.datasource ??= GithubTagsDatasource.id;\n\n  return dep;\n}\n\nfunction extractWithRegex(\n  content: string,\n  config: ExtractConfig,\n): PackageDependency[] {\n  const customRegistryUrlsPackageDependency =\n    detectCustomGitHubRegistryUrlsForActions();\n  logger.trace('github-actions.extractWithRegex()');\n  const deps: PackageDependency[] = [];\n\n  for (const line of content.split(newlineRegex)) {\n    if (line.trim().startsWith('#')) {\n      continue;\n    }\n\n    const parsed = parseUsesLine(line);\n    if (!parsed?.actionRef) {\n      continue;\n    }\n\n    const { actionRef } = parsed;\n\n    if (actionRef.kind === 'docker') {\n      deps.push(extractDockerAction(actionRef, config));\n      continue;\n    }\n\n    if (actionRef.kind === 'repository') {\n      deps.push(\n        extractRepositoryAction(\n          actionRef,\n          parsed,\n          customRegistryUrlsPackageDependency,\n        ),\n      );\n    }\n  }\n\n  return deps;\n}\n\nfunction detectDatasource(registryUrl: string): PackageDependency {\n  const platform = detectPlatform(registryUrl);\n\n  switch (platform) {\n    case 'forgejo':\n      return {\n        registryUrls: [registryUrl],\n        datasource: ForgejoTagsDatasource.id,\n      };\n    case 'gitea':\n      return {\n        registryUrls: [registryUrl],\n        datasource: GiteaTagsDatasource.id,\n      };\n    case 'github':\n      return { registryUrls: [registryUrl] };\n  }\n\n  return {\n    skipReason: 'unsupported-url',\n  };\n}\n\nconst runnerVersionRegex = regEx(\n  /^\\s*(?<depName>[a-zA-Z]+)-(?<currentValue>[^\\s]+)/,\n);\n\nfunction extractRunner(runner: string): PackageDependency | null {\n  const runnerVersionGroups = runnerVersionRegex.exec(runner)?.groups;\n  if (!runnerVersionGroups) {\n    return null;\n  }\n\n  const { depName, currentValue } = runnerVersionGroups;\n\n  if (!GithubRunnersDatasource.isValidRunner(depName, currentValue)) {\n    return null;\n  }\n\n  const dependency: PackageDependency = {\n    depName,\n    currentValue,\n    replaceString: `${depName}-${currentValue}`,\n    depType: 'github-runner',\n    datasource: GithubRunnersDatasource.id,\n    autoReplaceStringTemplate: '{{depName}}-{{newValue}}',\n  };\n\n  if (!dockerVersioning.api.isValid(currentValue)) {\n    dependency.skipReason = 'invalid-version';\n  }\n\n  return dependency;\n}\n\n// For official https://github.com/actions\nconst versionedActions: Record<string, string> = {\n  go: npmVersioning.id,\n  node: nodeVersioning.id,\n  python: npmVersioning.id,\n\n  // Not covered yet because they use different datasources/packageNames:\n  // - dotnet\n  // - java\n};\n\nfunction extractVersionedAction(step: UsesStep): PackageDependency | null {\n  for (const [action, versioning] of Object.entries(versionedActions)) {\n    const actionName = `actions/setup-${action}`;\n    if (step.uses !== actionName && !step.uses?.startsWith(`${actionName}@`)) {\n      continue;\n    }\n\n    const fieldName = `${action}-version`;\n    const currentValue = step.with?.[fieldName];\n    if (!currentValue) {\n      return null;\n    }\n\n    return {\n      datasource: GithubReleasesDatasource.id,\n      depName: action,\n      packageName: `actions/${action}-versions`,\n      versioning,\n      extractVersion: '^(?<version>\\\\d+\\\\.\\\\d+\\\\.\\\\d+)(-\\\\d+)?$',\n      currentValue,\n      depType: 'uses-with',\n    };\n  }\n  return null;\n}\n\nfunction extractSteps(steps: UsesStep[]): PackageDependency[] {\n  const deps: PackageDependency[] = [];\n\n  for (const step of steps) {\n    const res = CommunityActions.safeParse(step);\n    if (res.success) {\n      deps.push(...res.data);\n      continue;\n    }\n\n    const versionedDep = extractVersionedAction(step);\n    if (versionedDep) {\n      deps.push(versionedDep);\n    }\n  }\n\n  return deps;\n}\n\nfunction extractWithYAMLParser(\n  content: string,\n  packageFile: string,\n  config: ExtractConfig,\n): PackageDependency[] {\n  logger.trace('github-actions.extractWithYAMLParser()');\n\n  const obj = withMeta({ packageFile }, () => Workflow.parse(content));\n  if (!obj) {\n    return [];\n  }\n\n  if ('runs' in obj && obj.runs.steps) {\n    return extractSteps(obj.runs.steps);\n  }\n\n  if (!('jobs' in obj)) {\n    return [];\n  }\n\n  const deps: PackageDependency[] = [];\n\n  for (const job of Object.values(obj.jobs)) {\n    if (job.container) {\n      const dep = getDep(job.container, true, config.registryAliases);\n      if (dep) {\n        dep.depType = 'container';\n        deps.push(dep);\n      }\n    }\n\n    for (const service of job.services) {\n      const dep = getDep(service, true, config.registryAliases);\n      if (dep) {\n        dep.depType = 'service';\n        deps.push(dep);\n      }\n    }\n\n    for (const runner of job['runs-on']) {\n      const dep = extractRunner(runner);\n      if (dep) {\n        deps.push(dep);\n      }\n    }\n\n    deps.push(...extractSteps(job.steps));\n  }\n\n  return deps;\n}\n\nexport function extractPackageFile(\n  content: string,\n  packageFile: string,\n  config: ExtractConfig = {}, // TODO: enforce ExtractConfig\n): PackageFileContent | null {\n  logger.trace(`github-actions.extractPackageFile(${packageFile})`);\n\n  const deps = [\n    ...extractWithRegex(content, config),\n    ...extractWithYAMLParser(content, packageFile, config),\n  ];\n\n  if (!deps.length) {\n    return null;\n  }\n\n  return { deps };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AA+BA,SAAS,2CAA8D;CACrE,MAAM,WAAW,aAAa,IAAI,UAAU;CAC5C,MAAM,eAAe,CAAC,oBAAoB;CAC1C,IAAI,YAAY,aAAa,IAAI,UAAU,MAAM,UAAU;EACzD,MAAM,iBAAiB,SAAS,QAAQ;EACxC,IAAI,CAAC,gBAAgB;GACnB,OAAO,KAAK,EAAE,SAAS,GAAG,8BAA8B;GACxD,OAAO,CAAC;EACV;EAEA,IACE,eAAe,SAAS,gBACxB,eAAe,SAAS,kBACxB;GACA,aAAa,QACX,GAAG,eAAe,SAAS,IAAI,eAAe,MAChD;GACA,OAAO,EAAE,aAAa;EACxB;CACF;CACA,OAAO,CAAC;AACV;AAEA,SAAS,oBACP,WACA,QACmB;CACnB,MAAM,MAAM,OAAO,UAAU,aAAa,MAAM,OAAO,eAAe;CACtE,IAAI,UAAU;CACd,IAAI,gBAAgB,UAAU;CAC9B,OAAO;AACT;AAEA,SAAS,wBACP,WACA,QACA,qCACmB;CACnB,MAAM,EACJ,eAAe,aACf,OACA,aACA,+BACE;CACJ,MAAM,EACJ,OACA,MACA,MAAM,SACN,KACA,UACA,uBACE;CAEJ,MAAM,cAAc,qBAAqB,WAAW,SAAS,KAAK;CAClE,MAAM,cAAc,GAAG,MAAM,GAAG;CAChC,MAAM,UAAU,GAAG,cAAc;CACjC,MAAM,aAAa,UAAU,IAAI,YAAY;CAG7C,MAAM,MAAyB;EAC7B;EACA,oBAAoB;EACpB,YAAYA;EACZ,SAAS;EACT,eAAe;EACf,2BAA2B,GAAG,MAAM,aAAa,WAAW,iCAAiC,MAAM,kBARnF,8BAA8B,IAQiF,+DAA+D,MAAM;EACpM,GAAI,qBACA,iBAAiB,WAAW,IAC5B;CACN;CAEA,IAAI,gBAAgB,SAClB,IAAI,cAAc;CASpB,KAFE,YAAY,kBACX,MAAM,GAAG,KAAK,WAAW,GAAG,IAAI,YAAY,MAAM,KAAA,OAGnD,CAAC,GAAG,UAAU,YAAY,KAAK,KAC/B,CAAC,GAAG,UAAU,YAAY,aAAa,GACvC;EACA,MAAM,eAAe,OAAO,cAAc,MAAM,CAAC;EACjD,MAAM,gBAAgB,YAAY,QAAQ,YAAY,cAAc;EAEpE,IAAI,gBAAgB,GAAG,cAAc,2BAA2B,GAD1C,aAAa,MAAM,GAAG,aACmC;CACjF,OAAO,IAAI,YAAY,gBACrB,IAAI,gBACF,cAAc,6BAA6B,OAAO;CAGtD,IAAI,MAAM,GAAG,GAAG;EACd,IAAI,eAAe,YAAY,iBAAiB,YAAY;EAC5D,IAAI,gBAAgB;CACtB,OAAO,IAAI,WAAW,GAAG,GAAG;EAC1B,IAAI,eAAe,YAAY,iBAAiB,YAAY;EAC5D,IAAI,qBAAqB;CAC3B,OACE,IAAI,eAAe;CAGrB,IAAI,CAAC,IAAI,cAAc;EACrB,IAAI,UAAU;EACd,IAAI,aAAa;CACnB;CAEA,MAAM,gBACJ,IAAI,gBAAgB,cAAc,KAAK,IAAI,YAAY;CACzD,IAAI,CAAC,IAAI,cAAc,IAAI,gBAAgB,CAAC,eAAe;EACzD,IAAI,aAAa,uBAAuB;EACxC,IAAI,aAAaC;CACnB;CAEA,IAAI,eAAe,qBAAqB;CAExC,OAAO;AACT;AAEA,SAAS,iBACP,SACA,QACqB;CACrB,MAAM,sCACJ,yCAAyC;CAC3C,OAAO,MAAM,mCAAmC;CAChD,MAAM,OAA4B,CAAC;CAEnC,KAAK,MAAM,QAAQ,QAAQ,MAAM,YAAY,GAAG;EAC9C,IAAI,KAAK,KAAK,CAAC,CAAC,WAAW,GAAG,GAC5B;EAGF,MAAM,SAAS,cAAc,IAAI;EACjC,IAAI,CAAC,QAAQ,WACX;EAGF,MAAM,EAAE,cAAc;EAEtB,IAAI,UAAU,SAAS,UAAU;GAC/B,KAAK,KAAK,oBAAoB,WAAW,MAAM,CAAC;GAChD;EACF;EAEA,IAAI,UAAU,SAAS,cACrB,KAAK,KACH,wBACE,WACA,QACA,mCACF,CACF;CAEJ;CAEA,OAAO;AACT;AAEA,SAAS,iBAAiB,aAAwC;CAGhE,QAFiB,eAAe,WAEjB,GAAf;EACE,KAAK,WACH,OAAO;GACL,cAAc,CAAC,WAAW;GAC1B,YAAY,sBAAsB;EACpC;EACF,KAAK,SACH,OAAO;GACL,cAAc,CAAC,WAAW;GAC1B,YAAY,oBAAoB;EAClC;EACF,KAAK,UACH,OAAO,EAAE,cAAc,CAAC,WAAW,EAAE;CACzC;CAEA,OAAO,EACL,YAAY,kBACd;AACF;AAEA,MAAM,qBAAqB,MACzB,mDACF;AAEA,SAAS,cAAc,QAA0C;CAC/D,MAAM,sBAAsB,mBAAmB,KAAK,MAAM,CAAC,EAAE;CAC7D,IAAI,CAAC,qBACH,OAAO;CAGT,MAAM,EAAE,SAAS,iBAAiB;CAElC,IAAI,CAAC,wBAAwB,cAAc,SAAS,YAAY,GAC9D,OAAO;CAGT,MAAM,aAAgC;EACpC;EACA;EACA,eAAe,GAAG,QAAQ,GAAG;EAC7B,SAAS;EACT,YAAY,wBAAwB;EACpC,2BAA2B;CAC7B;CAEA,IAAI,CAAA,IAAsB,QAAQ,YAAY,GAC5C,WAAW,aAAa;CAG1B,OAAO;AACT;AAGA,MAAM,mBAA2C;CAC/C,IAAI;CACJ,MAAMC;CACN,QAAQ;AAKV;AAEA,SAAS,uBAAuB,MAA0C;CACxE,KAAK,MAAM,CAAC,QAAQ,eAAe,OAAO,QAAQ,gBAAgB,GAAG;EACnE,MAAM,aAAa,iBAAiB;EACpC,IAAI,KAAK,SAAS,cAAc,CAAC,KAAK,MAAM,WAAW,GAAG,WAAW,EAAE,GACrE;EAGF,MAAM,YAAY,GAAG,OAAO;EAC5B,MAAM,eAAe,KAAK,OAAO;EACjC,IAAI,CAAC,cACH,OAAO;EAGT,OAAO;GACL,YAAY,yBAAyB;GACrC,SAAS;GACT,aAAa,WAAW,OAAO;GAC/B;GACA,gBAAgB;GAChB;GACA,SAAS;EACX;CACF;CACA,OAAO;AACT;AAEA,SAAS,aAAa,OAAwC;CAC5D,MAAM,OAA4B,CAAC;CAEnC,KAAK,MAAM,QAAQ,OAAO;EACxB,MAAM,MAAM,iBAAiB,UAAU,IAAI;EAC3C,IAAI,IAAI,SAAS;GACf,KAAK,KAAK,GAAG,IAAI,IAAI;GACrB;EACF;EAEA,MAAM,eAAe,uBAAuB,IAAI;EAChD,IAAI,cACF,KAAK,KAAK,YAAY;CAE1B;CAEA,OAAO;AACT;AAEA,SAAS,sBACP,SACA,aACA,QACqB;CACrB,OAAO,MAAM,wCAAwC;CAErD,MAAM,MAAM,SAAS,EAAE,YAAY,SAAS,SAAS,MAAM,OAAO,CAAC;CACnE,IAAI,CAAC,KACH,OAAO,CAAC;CAGV,IAAI,UAAU,OAAO,IAAI,KAAK,OAC5B,OAAO,aAAa,IAAI,KAAK,KAAK;CAGpC,IAAI,EAAE,UAAU,MACd,OAAO,CAAC;CAGV,MAAM,OAA4B,CAAC;CAEnC,KAAK,MAAM,OAAO,OAAO,OAAO,IAAI,IAAI,GAAG;EACzC,IAAI,IAAI,WAAW;GACjB,MAAM,MAAM,OAAO,IAAI,WAAW,MAAM,OAAO,eAAe;GAC9D,IAAI,KAAK;IACP,IAAI,UAAU;IACd,KAAK,KAAK,GAAG;GACf;EACF;EAEA,KAAK,MAAM,WAAW,IAAI,UAAU;GAClC,MAAM,MAAM,OAAO,SAAS,MAAM,OAAO,eAAe;GACxD,IAAI,KAAK;IACP,IAAI,UAAU;IACd,KAAK,KAAK,GAAG;GACf;EACF;EAEA,KAAK,MAAM,UAAU,IAAI,YAAY;GACnC,MAAM,MAAM,cAAc,MAAM;GAChC,IAAI,KACF,KAAK,KAAK,GAAG;EAEjB;EAEA,KAAK,KAAK,GAAG,aAAa,IAAI,KAAK,CAAC;CACtC;CAEA,OAAO;AACT;AAEA,SAAgB,mBACd,SACA,aACA,SAAwB,CAAC,GACE;CAC3B,OAAO,MAAM,qCAAqC,YAAY,EAAE;CAEhE,MAAM,OAAO,CACX,GAAG,iBAAiB,SAAS,MAAM,GACnC,GAAG,sBAAsB,SAAS,aAAa,MAAM,CACvD;CAEA,IAAI,CAAC,KAAK,QACR,OAAO;CAGT,OAAO,EAAE,KAAK;AAChB"}
+{"version":3,"file":"extract.js","names":["githubActionsVersioning.id","exactVersioning.id","nodeVersioning.id","memCache.get"],"sources":["../../../../lib/modules/manager/github-actions/extract.ts"],"sourcesContent":["import is from '@sindresorhus/is';\nimport { GlobalConfig } from '../../../config/global.ts';\nimport { logger, withMeta } from '../../../logger/index.ts';\nimport * as memCache from '../../../util/cache/memory/index.ts';\nimport { detectPlatform } from '../../../util/common.ts';\nimport { readLocalFile } from '../../../util/fs/index.ts';\nimport { newlineRegex, regEx } from '../../../util/regex.ts';\nimport { parseUrl } from '../../../util/url.ts';\nimport { ForgejoTagsDatasource } from '../../datasource/forgejo-tags/index.ts';\nimport { GiteaTagsDatasource } from '../../datasource/gitea-tags/index.ts';\nimport { GithubDigestDatasource } from '../../datasource/github-digest/index.ts';\nimport { GithubReleasesDatasource } from '../../datasource/github-releases/index.ts';\nimport { GithubRunnersDatasource } from '../../datasource/github-runners/index.ts';\nimport { GithubTagsDatasource } from '../../datasource/github-tags/index.ts';\nimport * as dockerVersioning from '../../versioning/docker/index.ts';\nimport * as exactVersioning from '../../versioning/exact/index.ts';\nimport * as githubActionsVersioning from '../../versioning/github-actions/index.ts';\nimport * as nodeVersioning from '../../versioning/node/index.ts';\nimport * as npmVersioning from '../../versioning/npm/index.ts';\nimport { getDep } from '../dockerfile/extract.ts';\nimport type {\n  ExtractConfig,\n  PackageDependency,\n  PackageFileContent,\n} from '../types.ts';\nimport { actionsLockFile, isLockfileManaged } from './common.ts';\nimport type { DockerReference, RepositoryReference } from './parse.ts';\nimport { isSha, isShortSha, parseUsesLine, versionLikeRe } from './parse.ts';\nimport type { UsesStep } from './schema.ts';\nimport { ActionsLockfile, CommunityActions, Workflow } from './schema.ts';\nimport type { LockfileState } from './types.ts';\n\n// detects if we run against a Github Enterprise Server and adds the URL to the beginning of the registryURLs for looking up Actions\n// This reflects the behavior of how GitHub looks up Actions\n// First on the Enterprise Server, then on GitHub.com\nfunction detectCustomGitHubRegistryUrlsForActions(): PackageDependency {\n  const endpoint = GlobalConfig.get('endpoint');\n  const registryUrls = ['https://github.com'];\n  if (endpoint && GlobalConfig.get('platform') === 'github') {\n    const parsedEndpoint = parseUrl(endpoint);\n    if (!parsedEndpoint) {\n      logger.warn({ endpoint }, 'Failed to parse endpoint url');\n      return {};\n    }\n\n    if (\n      parsedEndpoint.host !== 'github.com' &&\n      parsedEndpoint.host !== 'api.github.com'\n    ) {\n      registryUrls.unshift(\n        `${parsedEndpoint.protocol}//${parsedEndpoint.host}`,\n      );\n      return { registryUrls };\n    }\n  }\n  return {};\n}\n\nfunction extractDockerAction(\n  actionRef: DockerReference,\n  config: ExtractConfig,\n): PackageDependency {\n  const dep = getDep(actionRef.originalRef, true, config.registryAliases);\n  dep.depType = 'docker';\n  dep.replaceString = actionRef.originalRef;\n  return dep;\n}\n\nfunction extractRepositoryAction(\n  actionRef: RepositoryReference,\n  parsed: ReturnType<typeof parseUsesLine> & object,\n  customRegistryUrlsPackageDependency: PackageDependency,\n): PackageDependency {\n  const {\n    replaceString: valueString,\n    quote,\n    commentData,\n    commentPrecedingWhitespace,\n  } = parsed;\n  const {\n    owner,\n    repo,\n    path: subPath,\n    ref,\n    hostname,\n    isExplicitHostname,\n  } = actionRef;\n\n  const registryUrl = isExplicitHostname ? `https://${hostname}/` : '';\n  const packageName = `${owner}/${repo}`;\n  const depName = `${registryUrl}${packageName}`;\n  const pathSuffix = subPath ? `/${subPath}` : '';\n  const commentWs = commentPrecedingWhitespace || ' ';\n\n  const dep: PackageDependency = {\n    depName,\n    commitMessageTopic: '{{{depName}}} action',\n    versioning: githubActionsVersioning.id,\n    depType: 'action',\n    replaceString: valueString,\n    autoReplaceStringTemplate: `${quote}{{depName}}${pathSuffix}@{{#if newDigest}}{{newDigest}}${quote}{{#if newValue}}${commentWs}# {{newValue}}{{/if}}{{/if}}{{#unless newDigest}}{{newValue}}${quote}{{/unless}}`,\n    ...(isExplicitHostname\n      ? detectDatasource(registryUrl)\n      : customRegistryUrlsPackageDependency),\n  };\n\n  if (packageName !== depName) {\n    dep.packageName = packageName;\n  }\n\n  // Extend replaceString to include relevant comment portions:\n  // - Pinned version or ref: include only up to the matched token (truncate trailing text)\n  // - Ratchet exclude: include the full comment to preserve the marker\n  const pinComment =\n    commentData.pinnedVersion ??\n    (isSha(ref) || isShortSha(ref) ? commentData.ref : undefined);\n  if (\n    pinComment &&\n    !is.undefined(commentData.index) &&\n    !is.undefined(commentData.matchedString)\n  ) {\n    const cleanComment = parsed.commentString.slice(1);\n    const matchEndIndex = commentData.index + commentData.matchedString.length;\n    const commentSuffix = cleanComment.slice(0, matchEndIndex);\n    dep.replaceString = `${valueString}${commentPrecedingWhitespace}#${commentSuffix}`;\n  } else if (commentData.ratchetExclude) {\n    dep.replaceString =\n      valueString + commentPrecedingWhitespace + parsed.commentString;\n  }\n\n  if (isSha(ref)) {\n    dep.currentValue = commentData.pinnedVersion ?? commentData.ref;\n    dep.currentDigest = ref;\n  } else if (isShortSha(ref)) {\n    dep.currentValue = commentData.pinnedVersion ?? commentData.ref;\n    dep.currentDigestShort = ref;\n  } else {\n    dep.currentValue = ref;\n  }\n\n  if (!dep.currentValue) {\n    dep.enabled = false;\n    dep.skipReason = 'unversioned-reference';\n  }\n\n  const isVersionLike =\n    dep.currentValue && versionLikeRe.test(dep.currentValue);\n  if (!dep.datasource && dep.currentValue && !isVersionLike) {\n    dep.datasource = GithubDigestDatasource.id;\n    dep.versioning = exactVersioning.id;\n  }\n\n  dep.datasource ??= GithubTagsDatasource.id;\n\n  return dep;\n}\n\nfunction extractWithRegex(\n  content: string,\n  config: ExtractConfig,\n): PackageDependency[] {\n  const customRegistryUrlsPackageDependency =\n    detectCustomGitHubRegistryUrlsForActions();\n  logger.trace('github-actions.extractWithRegex()');\n  const deps: PackageDependency[] = [];\n\n  for (const line of content.split(newlineRegex)) {\n    if (line.trim().startsWith('#')) {\n      continue;\n    }\n\n    const parsed = parseUsesLine(line);\n    if (!parsed?.actionRef) {\n      continue;\n    }\n\n    const { actionRef } = parsed;\n\n    if (actionRef.kind === 'docker') {\n      deps.push(extractDockerAction(actionRef, config));\n      continue;\n    }\n\n    if (actionRef.kind === 'repository') {\n      deps.push(\n        extractRepositoryAction(\n          actionRef,\n          parsed,\n          customRegistryUrlsPackageDependency,\n        ),\n      );\n    }\n  }\n\n  return deps;\n}\n\nfunction detectDatasource(registryUrl: string): PackageDependency {\n  const platform = detectPlatform(registryUrl);\n\n  switch (platform) {\n    case 'forgejo':\n      return {\n        registryUrls: [registryUrl],\n        datasource: ForgejoTagsDatasource.id,\n      };\n    case 'gitea':\n      return {\n        registryUrls: [registryUrl],\n        datasource: GiteaTagsDatasource.id,\n      };\n    case 'github':\n      return { registryUrls: [registryUrl] };\n  }\n\n  return {\n    skipReason: 'unsupported-url',\n  };\n}\n\nconst runnerVersionRegex = regEx(\n  /^\\s*(?<depName>[a-zA-Z]+)-(?<currentValue>[^\\s]+)/,\n);\n\nfunction extractRunner(runner: string): PackageDependency | null {\n  const runnerVersionGroups = runnerVersionRegex.exec(runner)?.groups;\n  if (!runnerVersionGroups) {\n    return null;\n  }\n\n  const { depName, currentValue } = runnerVersionGroups;\n\n  if (!GithubRunnersDatasource.isValidRunner(depName, currentValue)) {\n    return null;\n  }\n\n  const dependency: PackageDependency = {\n    depName,\n    currentValue,\n    replaceString: `${depName}-${currentValue}`,\n    depType: 'github-runner',\n    datasource: GithubRunnersDatasource.id,\n    autoReplaceStringTemplate: '{{depName}}-{{newValue}}',\n  };\n\n  if (!dockerVersioning.api.isValid(currentValue)) {\n    dependency.skipReason = 'invalid-version';\n  }\n\n  return dependency;\n}\n\n// For official https://github.com/actions\nconst versionedActions: Record<string, string> = {\n  go: npmVersioning.id,\n  node: nodeVersioning.id,\n  python: npmVersioning.id,\n\n  // Not covered yet because they use different datasources/packageNames:\n  // - dotnet\n  // - java\n};\n\nfunction extractVersionedAction(step: UsesStep): PackageDependency | null {\n  for (const [action, versioning] of Object.entries(versionedActions)) {\n    const actionName = `actions/setup-${action}`;\n    if (step.uses !== actionName && !step.uses?.startsWith(`${actionName}@`)) {\n      continue;\n    }\n\n    const fieldName = `${action}-version`;\n    const currentValue = step.with?.[fieldName];\n    if (!currentValue) {\n      return null;\n    }\n\n    return {\n      datasource: GithubReleasesDatasource.id,\n      depName: action,\n      packageName: `actions/${action}-versions`,\n      versioning,\n      extractVersion: '^(?<version>\\\\d+\\\\.\\\\d+\\\\.\\\\d+)(-\\\\d+)?$',\n      currentValue,\n      depType: 'uses-with',\n    };\n  }\n  return null;\n}\n\nfunction extractSteps(steps: UsesStep[]): PackageDependency[] {\n  const deps: PackageDependency[] = [];\n\n  for (const step of steps) {\n    const res = CommunityActions.safeParse(step);\n    if (res.success) {\n      deps.push(...res.data);\n      continue;\n    }\n\n    const versionedDep = extractVersionedAction(step);\n    if (versionedDep) {\n      deps.push(versionedDep);\n    }\n  }\n\n  return deps;\n}\n\nfunction extractWithYAMLParser(\n  content: string,\n  packageFile: string,\n  config: ExtractConfig,\n): PackageDependency[] {\n  logger.trace('github-actions.extractWithYAMLParser()');\n\n  const obj = withMeta({ packageFile }, () => Workflow.parse(content));\n  if (!obj) {\n    return [];\n  }\n\n  if ('runs' in obj && obj.runs.steps) {\n    return extractSteps(obj.runs.steps);\n  }\n\n  if (!('jobs' in obj)) {\n    return [];\n  }\n\n  const deps: PackageDependency[] = [];\n\n  for (const job of Object.values(obj.jobs)) {\n    if (job.container) {\n      const dep = getDep(job.container, true, config.registryAliases);\n      if (dep) {\n        dep.depType = 'container';\n        deps.push(dep);\n      }\n    }\n\n    for (const service of job.services) {\n      const dep = getDep(service, true, config.registryAliases);\n      if (dep) {\n        dep.depType = 'service';\n        deps.push(dep);\n      }\n    }\n\n    for (const runner of job['runs-on']) {\n      const dep = extractRunner(runner);\n      if (dep) {\n        deps.push(dep);\n      }\n    }\n\n    deps.push(...extractSteps(job.steps));\n  }\n\n  return deps;\n}\n\nasync function readLockfile(): Promise<LockfileState> {\n  const content = await readLocalFile(actionsLockFile, 'utf8');\n  if (!content) {\n    return { type: 'missing' };\n  }\n\n  const parsed = ActionsLockfile.safeParse(content);\n  if (!parsed.success) {\n    // `updateActionsLockfile` warns about this once per branch, so stay quiet\n    logger.debug(`Failed to parse ${actionsLockFile}`);\n    return { type: 'unparseable' };\n  }\n\n  return { type: 'parsed', onboardedWorkflows: parsed.data.workflows };\n}\n\n/**\n * A repository has a single lock file, but can have any number of package files, so read and parse it only once.\n */\nfunction getLockfile(): Promise<LockfileState> {\n  const cacheKey = `github-actions:${actionsLockFile}`;\n  const cached = memCache.get<Promise<LockfileState> | undefined>(cacheKey);\n  if (cached !== undefined) {\n    return cached;\n  }\n\n  const result = readLockfile();\n  memCache.set(cacheKey, result);\n  return result;\n}\n\n/**\n * Whether `gh actions-lock` owns the digests in this file.\n *\n * It rewrites the workflows it manages back to plain refs when regenerating, so an inline digest pin would be stripped straight back out.\n */\nasync function isManagedByLockfile(packageFile: string): Promise<boolean> {\n  const lockfile = await getLockfile();\n\n  switch (lockfile.type) {\n    case 'missing':\n      return false;\n    case 'unparseable':\n      // The tool refuses to regenerate a lock file which it cannot parse, so treat everything as managed: pinning inline here would raise a PR which pins the digests the tool owns and leaves the lock file stale.\n      return true;\n    case 'parsed':\n      return isLockfileManaged(packageFile, lockfile.onboardedWorkflows);\n  }\n}\n\nexport async function extractPackageFile(\n  content: string,\n  packageFile: string,\n  config: ExtractConfig = {}, // TODO: enforce ExtractConfig\n): Promise<PackageFileContent | null> {\n  logger.trace(`github-actions.extractPackageFile(${packageFile})`);\n\n  const deps = [\n    ...extractWithRegex(content, config),\n    ...extractWithYAMLParser(content, packageFile, config),\n  ];\n\n  if (!deps.length) {\n    return null;\n  }\n\n  const res: PackageFileContent = { deps };\n\n  if (await isManagedByLockfile(packageFile)) {\n    // Deliberately no `lockFiles`: nothing here goes through `updateArtifacts`, and `matchFileNames` also tests `lockFiles`, so declaring it would make a negated rule such as `!.github/workflows/release.yml` match every workflow through the lock file path.\n    for (const dep of deps) {\n      // The lock file only records `OWNER/REPO@REF` pins, so a `docker://` image in a `uses:` is still ours to pin.\n      if (dep.depType === 'action') {\n        dep.digestManagedExternally = true;\n      }\n    }\n  }\n\n  return res;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAmCA,SAAS,2CAA8D;CACrE,MAAM,WAAW,aAAa,IAAI,UAAU;CAC5C,MAAM,eAAe,CAAC,oBAAoB;CAC1C,IAAI,YAAY,aAAa,IAAI,UAAU,MAAM,UAAU;EACzD,MAAM,iBAAiB,SAAS,QAAQ;EACxC,IAAI,CAAC,gBAAgB;GACnB,OAAO,KAAK,EAAE,SAAS,GAAG,8BAA8B;GACxD,OAAO,CAAC;EACV;EAEA,IACE,eAAe,SAAS,gBACxB,eAAe,SAAS,kBACxB;GACA,aAAa,QACX,GAAG,eAAe,SAAS,IAAI,eAAe,MAChD;GACA,OAAO,EAAE,aAAa;EACxB;CACF;CACA,OAAO,CAAC;AACV;AAEA,SAAS,oBACP,WACA,QACmB;CACnB,MAAM,MAAM,OAAO,UAAU,aAAa,MAAM,OAAO,eAAe;CACtE,IAAI,UAAU;CACd,IAAI,gBAAgB,UAAU;CAC9B,OAAO;AACT;AAEA,SAAS,wBACP,WACA,QACA,qCACmB;CACnB,MAAM,EACJ,eAAe,aACf,OACA,aACA,+BACE;CACJ,MAAM,EACJ,OACA,MACA,MAAM,SACN,KACA,UACA,uBACE;CAEJ,MAAM,cAAc,qBAAqB,WAAW,SAAS,KAAK;CAClE,MAAM,cAAc,GAAG,MAAM,GAAG;CAChC,MAAM,UAAU,GAAG,cAAc;CACjC,MAAM,aAAa,UAAU,IAAI,YAAY;CAG7C,MAAM,MAAyB;EAC7B;EACA,oBAAoB;EACpB,YAAYA;EACZ,SAAS;EACT,eAAe;EACf,2BAA2B,GAAG,MAAM,aAAa,WAAW,iCAAiC,MAAM,kBARnF,8BAA8B,IAQiF,+DAA+D,MAAM;EACpM,GAAI,qBACA,iBAAiB,WAAW,IAC5B;CACN;CAEA,IAAI,gBAAgB,SAClB,IAAI,cAAc;CASpB,KAFE,YAAY,kBACX,MAAM,GAAG,KAAK,WAAW,GAAG,IAAI,YAAY,MAAM,KAAA,OAGnD,CAAC,GAAG,UAAU,YAAY,KAAK,KAC/B,CAAC,GAAG,UAAU,YAAY,aAAa,GACvC;EACA,MAAM,eAAe,OAAO,cAAc,MAAM,CAAC;EACjD,MAAM,gBAAgB,YAAY,QAAQ,YAAY,cAAc;EAEpE,IAAI,gBAAgB,GAAG,cAAc,2BAA2B,GAD1C,aAAa,MAAM,GAAG,aACmC;CACjF,OAAO,IAAI,YAAY,gBACrB,IAAI,gBACF,cAAc,6BAA6B,OAAO;CAGtD,IAAI,MAAM,GAAG,GAAG;EACd,IAAI,eAAe,YAAY,iBAAiB,YAAY;EAC5D,IAAI,gBAAgB;CACtB,OAAO,IAAI,WAAW,GAAG,GAAG;EAC1B,IAAI,eAAe,YAAY,iBAAiB,YAAY;EAC5D,IAAI,qBAAqB;CAC3B,OACE,IAAI,eAAe;CAGrB,IAAI,CAAC,IAAI,cAAc;EACrB,IAAI,UAAU;EACd,IAAI,aAAa;CACnB;CAEA,MAAM,gBACJ,IAAI,gBAAgB,cAAc,KAAK,IAAI,YAAY;CACzD,IAAI,CAAC,IAAI,cAAc,IAAI,gBAAgB,CAAC,eAAe;EACzD,IAAI,aAAa,uBAAuB;EACxC,IAAI,aAAaC;CACnB;CAEA,IAAI,eAAe,qBAAqB;CAExC,OAAO;AACT;AAEA,SAAS,iBACP,SACA,QACqB;CACrB,MAAM,sCACJ,yCAAyC;CAC3C,OAAO,MAAM,mCAAmC;CAChD,MAAM,OAA4B,CAAC;CAEnC,KAAK,MAAM,QAAQ,QAAQ,MAAM,YAAY,GAAG;EAC9C,IAAI,KAAK,KAAK,CAAC,CAAC,WAAW,GAAG,GAC5B;EAGF,MAAM,SAAS,cAAc,IAAI;EACjC,IAAI,CAAC,QAAQ,WACX;EAGF,MAAM,EAAE,cAAc;EAEtB,IAAI,UAAU,SAAS,UAAU;GAC/B,KAAK,KAAK,oBAAoB,WAAW,MAAM,CAAC;GAChD;EACF;EAEA,IAAI,UAAU,SAAS,cACrB,KAAK,KACH,wBACE,WACA,QACA,mCACF,CACF;CAEJ;CAEA,OAAO;AACT;AAEA,SAAS,iBAAiB,aAAwC;CAGhE,QAFiB,eAAe,WAEjB,GAAf;EACE,KAAK,WACH,OAAO;GACL,cAAc,CAAC,WAAW;GAC1B,YAAY,sBAAsB;EACpC;EACF,KAAK,SACH,OAAO;GACL,cAAc,CAAC,WAAW;GAC1B,YAAY,oBAAoB;EAClC;EACF,KAAK,UACH,OAAO,EAAE,cAAc,CAAC,WAAW,EAAE;CACzC;CAEA,OAAO,EACL,YAAY,kBACd;AACF;AAEA,MAAM,qBAAqB,MACzB,mDACF;AAEA,SAAS,cAAc,QAA0C;CAC/D,MAAM,sBAAsB,mBAAmB,KAAK,MAAM,CAAC,EAAE;CAC7D,IAAI,CAAC,qBACH,OAAO;CAGT,MAAM,EAAE,SAAS,iBAAiB;CAElC,IAAI,CAAC,wBAAwB,cAAc,SAAS,YAAY,GAC9D,OAAO;CAGT,MAAM,aAAgC;EACpC;EACA;EACA,eAAe,GAAG,QAAQ,GAAG;EAC7B,SAAS;EACT,YAAY,wBAAwB;EACpC,2BAA2B;CAC7B;CAEA,IAAI,CAAA,IAAsB,QAAQ,YAAY,GAC5C,WAAW,aAAa;CAG1B,OAAO;AACT;AAGA,MAAM,mBAA2C;CAC/C,IAAI;CACJ,MAAMC;CACN,QAAQ;AAKV;AAEA,SAAS,uBAAuB,MAA0C;CACxE,KAAK,MAAM,CAAC,QAAQ,eAAe,OAAO,QAAQ,gBAAgB,GAAG;EACnE,MAAM,aAAa,iBAAiB;EACpC,IAAI,KAAK,SAAS,cAAc,CAAC,KAAK,MAAM,WAAW,GAAG,WAAW,EAAE,GACrE;EAGF,MAAM,YAAY,GAAG,OAAO;EAC5B,MAAM,eAAe,KAAK,OAAO;EACjC,IAAI,CAAC,cACH,OAAO;EAGT,OAAO;GACL,YAAY,yBAAyB;GACrC,SAAS;GACT,aAAa,WAAW,OAAO;GAC/B;GACA,gBAAgB;GAChB;GACA,SAAS;EACX;CACF;CACA,OAAO;AACT;AAEA,SAAS,aAAa,OAAwC;CAC5D,MAAM,OAA4B,CAAC;CAEnC,KAAK,MAAM,QAAQ,OAAO;EACxB,MAAM,MAAM,iBAAiB,UAAU,IAAI;EAC3C,IAAI,IAAI,SAAS;GACf,KAAK,KAAK,GAAG,IAAI,IAAI;GACrB;EACF;EAEA,MAAM,eAAe,uBAAuB,IAAI;EAChD,IAAI,cACF,KAAK,KAAK,YAAY;CAE1B;CAEA,OAAO;AACT;AAEA,SAAS,sBACP,SACA,aACA,QACqB;CACrB,OAAO,MAAM,wCAAwC;CAErD,MAAM,MAAM,SAAS,EAAE,YAAY,SAAS,SAAS,MAAM,OAAO,CAAC;CACnE,IAAI,CAAC,KACH,OAAO,CAAC;CAGV,IAAI,UAAU,OAAO,IAAI,KAAK,OAC5B,OAAO,aAAa,IAAI,KAAK,KAAK;CAGpC,IAAI,EAAE,UAAU,MACd,OAAO,CAAC;CAGV,MAAM,OAA4B,CAAC;CAEnC,KAAK,MAAM,OAAO,OAAO,OAAO,IAAI,IAAI,GAAG;EACzC,IAAI,IAAI,WAAW;GACjB,MAAM,MAAM,OAAO,IAAI,WAAW,MAAM,OAAO,eAAe;GAC9D,IAAI,KAAK;IACP,IAAI,UAAU;IACd,KAAK,KAAK,GAAG;GACf;EACF;EAEA,KAAK,MAAM,WAAW,IAAI,UAAU;GAClC,MAAM,MAAM,OAAO,SAAS,MAAM,OAAO,eAAe;GACxD,IAAI,KAAK;IACP,IAAI,UAAU;IACd,KAAK,KAAK,GAAG;GACf;EACF;EAEA,KAAK,MAAM,UAAU,IAAI,YAAY;GACnC,MAAM,MAAM,cAAc,MAAM;GAChC,IAAI,KACF,KAAK,KAAK,GAAG;EAEjB;EAEA,KAAK,KAAK,GAAG,aAAa,IAAI,KAAK,CAAC;CACtC;CAEA,OAAO;AACT;AAEA,eAAe,eAAuC;CACpD,MAAM,UAAU,MAAM,cAAc,iBAAiB,MAAM;CAC3D,IAAI,CAAC,SACH,OAAO,EAAE,MAAM,UAAU;CAG3B,MAAM,SAAS,gBAAgB,UAAU,OAAO;CAChD,IAAI,CAAC,OAAO,SAAS;EAEnB,OAAO,MAAM,mBAAmB,iBAAiB;EACjD,OAAO,EAAE,MAAM,cAAc;CAC/B;CAEA,OAAO;EAAE,MAAM;EAAU,oBAAoB,OAAO,KAAK;CAAU;AACrE;;;;AAKA,SAAS,cAAsC;CAC7C,MAAM,WAAW,kBAAkB;CACnC,MAAM,SAASC,IAAiD,QAAQ;CACxE,IAAI,WAAW,KAAA,GACb,OAAO;CAGT,MAAM,SAAS,aAAa;CAC5B,IAAa,UAAU,MAAM;CAC7B,OAAO;AACT;;;;;;AAOA,eAAe,oBAAoB,aAAuC;CACxE,MAAM,WAAW,MAAM,YAAY;CAEnC,QAAQ,SAAS,MAAjB;EACE,KAAK,WACH,OAAO;EACT,KAAK,eAEH,OAAO;EACT,KAAK,UACH,OAAO,kBAAkB,aAAa,SAAS,kBAAkB;CACrE;AACF;AAEA,eAAsB,mBACpB,SACA,aACA,SAAwB,CAAC,GACW;CACpC,OAAO,MAAM,qCAAqC,YAAY,EAAE;CAEhE,MAAM,OAAO,CACX,GAAG,iBAAiB,SAAS,MAAM,GACnC,GAAG,sBAAsB,SAAS,aAAa,MAAM,CACvD;CAEA,IAAI,CAAC,KAAK,QACR,OAAO;CAGT,MAAM,MAA0B,EAAE,KAAK;CAEvC,IAAI,MAAM,oBAAoB,WAAW,GAElC;OAAA,MAAM,OAAO,MAEhB,IAAI,IAAI,YAAY,UAClB,IAAI,0BAA0B;CAAA;CAKpC,OAAO;AACT"}

package/dist/modules/manager/github-actions/schema.js

@@ -24,8 +24,16 @@ const Workflow = Yaml.pipe(z.union([
 	Actions,
 	z.null()
 ])).catch(withDebugMessage(null, "Does not match schema"));
+/**
+* The `actions.lock` schema is owned by the `gh actions-lock` CLI, and is still unstable, so don't rely on the structure too heavily.
+*
+* `workflows` is deliberately required: if the tool renames or reshapes it, we want the parse to fail so that we stop touching the lockfile, rather than silently treating every workflow as un-onboarded.
+*
+* TODO #45191: pin to a version of the schema, once it is v1
+*/
+const ActionsLockfile = Yaml.pipe(z.object({ workflows: z.record(z.string(), z.unknown()) }));
 const CommunityActions = z.union(Object.entries(communityActions).map(([name, cfg]) => actionSchema(name, cfg)));
 //#endregion
-export { CommunityActions, Workflow };
+export { ActionsLockfile, CommunityActions, Workflow };
 
 //# sourceMappingURL=schema.js.map

package/dist/modules/manager/github-actions/schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema.js","names":[],"sources":["../../../../lib/modules/manager/github-actions/schema.ts"],"sourcesContent":["import { z } from 'zod/v4';\nimport {\n  LooseArray,\n  LooseRecord,\n  Yaml,\n  withDebugMessage,\n} from '../../../util/schema-utils/index.ts';\nimport type { ActionSchema } from './community.ts';\nimport { actionSchema, communityActions } from './community.ts';\n\nconst UsesStep = z.object({\n  uses: z.string(),\n  with: LooseRecord(\n    z.union([z.string(), z.number().transform((s) => s.toString())]),\n  ),\n});\nexport type UsesStep = z.infer<typeof UsesStep>;\n\n// A `parallel:` group flattens its (recursively resolved) sub-steps into leaf steps.\n// See: https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#example-running-steps-in-parallel\nconst ParallelStep: z.ZodType<UsesStep[]> = z\n  .object({ parallel: LooseArray(z.lazy(() => Step)) })\n  .transform(({ parallel }) => parallel.flat());\n\n// A step resolves to a flat list of `uses:` steps: a normal step yields itself,\n// a `parallel:` group yields its flattened sub-steps.\nconst Step: z.ZodType<UsesStep[]> = z.union([\n  UsesStep.transform((step) => [step]),\n  ParallelStep,\n]);\n\n// Flatten the per-element `UsesStep[]` groups into a single `UsesStep[]`.\nconst Steps = LooseArray(Step).transform((groups) => groups.flat());\n\nconst WorkFlowJobs = z.object({\n  jobs: LooseRecord(\n    z.object({\n      container: z\n        .union([\n          z.string(),\n          z.object({ image: z.string() }).transform((v) => v.image),\n        ])\n        .optional()\n        .catch(undefined),\n      services: LooseRecord(\n        z.union([\n          z.object({ image: z.string() }).transform((v) => v.image),\n          z.string(),\n        ]),\n      )\n        .catch({})\n        .transform((services) => Object.values(services)),\n      'runs-on': z\n        .union([z.string().transform((v) => [v]), z.array(z.string())])\n        .catch([]),\n      steps: Steps.catch([]),\n    }),\n  ),\n});\n\nconst Actions = z.object({\n  runs: z.object({\n    using: z.string(),\n    steps: Steps.optional().catch([]),\n  }),\n});\nexport const Workflow = Yaml.pipe(\n  z.union([WorkFlowJobs, Actions, z.null()]),\n).catch(withDebugMessage(null, 'Does not match schema'));\n\nexport const CommunityActions = z.union(\n  Object.entries(communityActions).map(([name, cfg]) =>\n    actionSchema(name, cfg),\n  ) as [ActionSchema, ActionSchema, ...ActionSchema[]],\n);\n"],"mappings":";;;;AAUA,MAAM,WAAW,EAAE,OAAO;CACxB,MAAM,EAAE,OAAO;CACf,MAAM,YACJ,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,CAAC,WAAW,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,CACjE;AACF,CAAC;AAKD,MAAM,eAAsC,EACzC,OAAO,EAAE,UAAU,WAAW,EAAE,WAAW,IAAI,CAAC,EAAE,CAAC,CAAC,CACpD,WAAW,EAAE,eAAe,SAAS,KAAK,CAAC;AAI9C,MAAM,OAA8B,EAAE,MAAM,CAC1C,SAAS,WAAW,SAAS,CAAC,IAAI,CAAC,GACnC,YACF,CAAC;AAGD,MAAM,QAAQ,WAAW,IAAI,CAAC,CAAC,WAAW,WAAW,OAAO,KAAK,CAAC;AAElE,MAAM,eAAe,EAAE,OAAO,EAC5B,MAAM,YACJ,EAAE,OAAO;CACP,WAAW,EACR,MAAM,CACL,EAAE,OAAO,GACT,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,WAAW,MAAM,EAAE,KAAK,CAC1D,CAAC,CAAC,CACD,SAAS,CAAC,CACV,MAAM,KAAA,CAAS;CAClB,UAAU,YACR,EAAE,MAAM,CACN,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,WAAW,MAAM,EAAE,KAAK,GACxD,EAAE,OAAO,CACX,CAAC,CACH,CAAC,CACE,MAAM,CAAC,CAAC,CAAC,CACT,WAAW,aAAa,OAAO,OAAO,QAAQ,CAAC;CAClD,WAAW,EACR,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC,WAAW,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAC9D,MAAM,CAAC,CAAC;CACX,OAAO,MAAM,MAAM,CAAC,CAAC;AACvB,CAAC,CACH,EACF,CAAC;AAED,MAAM,UAAU,EAAE,OAAO,EACvB,MAAM,EAAE,OAAO;CACb,OAAO,EAAE,OAAO;CAChB,OAAO,MAAM,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC;AAClC,CAAC,EACH,CAAC;AACD,MAAa,WAAW,KAAK,KAC3B,EAAE,MAAM;CAAC;CAAc;CAAS,EAAE,KAAK;AAAC,CAAC,CAC3C,CAAC,CAAC,MAAM,iBAAiB,MAAM,uBAAuB,CAAC;AAEvD,MAAa,mBAAmB,EAAE,MAChC,OAAO,QAAQ,gBAAgB,CAAC,CAAC,KAAK,CAAC,MAAM,SAC3C,aAAa,MAAM,GAAG,CACxB,CACF"}
+{"version":3,"file":"schema.js","names":[],"sources":["../../../../lib/modules/manager/github-actions/schema.ts"],"sourcesContent":["import { z } from 'zod/v4';\nimport {\n  LooseArray,\n  LooseRecord,\n  Yaml,\n  withDebugMessage,\n} from '../../../util/schema-utils/index.ts';\nimport type { ActionSchema } from './community.ts';\nimport { actionSchema, communityActions } from './community.ts';\n\nconst UsesStep = z.object({\n  uses: z.string(),\n  with: LooseRecord(\n    z.union([z.string(), z.number().transform((s) => s.toString())]),\n  ),\n});\nexport type UsesStep = z.infer<typeof UsesStep>;\n\n// A `parallel:` group flattens its (recursively resolved) sub-steps into leaf steps.\n// See: https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#example-running-steps-in-parallel\nconst ParallelStep: z.ZodType<UsesStep[]> = z\n  .object({ parallel: LooseArray(z.lazy(() => Step)) })\n  .transform(({ parallel }) => parallel.flat());\n\n// A step resolves to a flat list of `uses:` steps: a normal step yields itself,\n// a `parallel:` group yields its flattened sub-steps.\nconst Step: z.ZodType<UsesStep[]> = z.union([\n  UsesStep.transform((step) => [step]),\n  ParallelStep,\n]);\n\n// Flatten the per-element `UsesStep[]` groups into a single `UsesStep[]`.\nconst Steps = LooseArray(Step).transform((groups) => groups.flat());\n\nconst WorkFlowJobs = z.object({\n  jobs: LooseRecord(\n    z.object({\n      container: z\n        .union([\n          z.string(),\n          z.object({ image: z.string() }).transform((v) => v.image),\n        ])\n        .optional()\n        .catch(undefined),\n      services: LooseRecord(\n        z.union([\n          z.object({ image: z.string() }).transform((v) => v.image),\n          z.string(),\n        ]),\n      )\n        .catch({})\n        .transform((services) => Object.values(services)),\n      'runs-on': z\n        .union([z.string().transform((v) => [v]), z.array(z.string())])\n        .catch([]),\n      steps: Steps.catch([]),\n    }),\n  ),\n});\n\nconst Actions = z.object({\n  runs: z.object({\n    using: z.string(),\n    steps: Steps.optional().catch([]),\n  }),\n});\nexport const Workflow = Yaml.pipe(\n  z.union([WorkFlowJobs, Actions, z.null()]),\n).catch(withDebugMessage(null, 'Does not match schema'));\n\n/**\n * The `actions.lock` schema is owned by the `gh actions-lock` CLI, and is still unstable, so don't rely on the structure too heavily.\n *\n * `workflows` is deliberately required: if the tool renames or reshapes it, we want the parse to fail so that we stop touching the lockfile, rather than silently treating every workflow as un-onboarded.\n *\n * TODO #45191: pin to a version of the schema, once it is v1\n */\nexport const ActionsLockfile = Yaml.pipe(\n  z.object({\n    workflows: z.record(z.string(), z.unknown()),\n  }),\n);\nexport type ActionsLockfile = z.infer<typeof ActionsLockfile>;\n\nexport const CommunityActions = z.union(\n  Object.entries(communityActions).map(([name, cfg]) =>\n    actionSchema(name, cfg),\n  ) as [ActionSchema, ActionSchema, ...ActionSchema[]],\n);\n"],"mappings":";;;;AAUA,MAAM,WAAW,EAAE,OAAO;CACxB,MAAM,EAAE,OAAO;CACf,MAAM,YACJ,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,CAAC,WAAW,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,CACjE;AACF,CAAC;AAKD,MAAM,eAAsC,EACzC,OAAO,EAAE,UAAU,WAAW,EAAE,WAAW,IAAI,CAAC,EAAE,CAAC,CAAC,CACpD,WAAW,EAAE,eAAe,SAAS,KAAK,CAAC;AAI9C,MAAM,OAA8B,EAAE,MAAM,CAC1C,SAAS,WAAW,SAAS,CAAC,IAAI,CAAC,GACnC,YACF,CAAC;AAGD,MAAM,QAAQ,WAAW,IAAI,CAAC,CAAC,WAAW,WAAW,OAAO,KAAK,CAAC;AAElE,MAAM,eAAe,EAAE,OAAO,EAC5B,MAAM,YACJ,EAAE,OAAO;CACP,WAAW,EACR,MAAM,CACL,EAAE,OAAO,GACT,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,WAAW,MAAM,EAAE,KAAK,CAC1D,CAAC,CAAC,CACD,SAAS,CAAC,CACV,MAAM,KAAA,CAAS;CAClB,UAAU,YACR,EAAE,MAAM,CACN,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,WAAW,MAAM,EAAE,KAAK,GACxD,EAAE,OAAO,CACX,CAAC,CACH,CAAC,CACE,MAAM,CAAC,CAAC,CAAC,CACT,WAAW,aAAa,OAAO,OAAO,QAAQ,CAAC;CAClD,WAAW,EACR,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC,WAAW,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAC9D,MAAM,CAAC,CAAC;CACX,OAAO,MAAM,MAAM,CAAC,CAAC;AACvB,CAAC,CACH,EACF,CAAC;AAED,MAAM,UAAU,EAAE,OAAO,EACvB,MAAM,EAAE,OAAO;CACb,OAAO,EAAE,OAAO;CAChB,OAAO,MAAM,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC;AAClC,CAAC,EACH,CAAC;AACD,MAAa,WAAW,KAAK,KAC3B,EAAE,MAAM;CAAC;CAAc;CAAS,EAAE,KAAK;AAAC,CAAC,CAC3C,CAAC,CAAC,MAAM,iBAAiB,MAAM,uBAAuB,CAAC;;;;;;;;AASvD,MAAa,kBAAkB,KAAK,KAClC,EAAE,OAAO,EACP,WAAW,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAC7C,CAAC,CACH;AAGA,MAAa,mBAAmB,EAAE,MAChC,OAAO,QAAQ,gBAAgB,CAAC,CAAC,KAAK,CAAC,MAAM,SAC3C,aAAa,MAAM,GAAG,CACxB,CACF"}

package/dist/modules/manager/npm/post-update/index.js

@@ -8,6 +8,7 @@ import { ExternalHostError } from "../../../../types/errors/external-host-error.
 import { ensureCacheDir, getSiblingFileName, readLocalFile, writeLocalFile } from "../../../../util/fs/index.js";
 import { getFile, getRepoStatus } from "../../../../util/git/index.js";
 import { NpmDatasource } from "../../../datasource/npm/index.js";
+import { artifactErrorMessageFromExecError } from "../../util.js";
 import { PNPM_CACHE_BASE_DIR, YARN_CACHE_DIR, YARN_GLOBAL_DIR } from "../constants.js";
 import { processHostRules } from "./rules.js";
 import { composeLockFile, getNpmrcContent, parseLockFile, resetNpmrcContent, updateNpmrcContent } from "../utils.js";
@@ -358,7 +359,7 @@ async function getAdditionalFiles(config, packageFiles) {
 			}
 			artifactErrors.push({
 				fileName: yarnLock,
-				stderr: res.stderr || res.stdout
+				stderr: artifactErrorMessageFromExecError(res, "")
 			});
 		} else {
 			const existingContent = await getFile(lockFileName, config.reuseExistingBranch ? config.branchName : config.baseBranch);
@@ -399,7 +400,7 @@ async function getAdditionalFiles(config, packageFiles) {
 			}
 			artifactErrors.push({
 				fileName: pnpmShrinkwrap,
-				stderr: res.stderr || res.stdout
+				stderr: artifactErrorMessageFromExecError(res, "")
 			});
 		} else {
 			const existingContent = await getFile(pnpmShrinkwrap, config.reuseExistingBranch ? config.branchName : config.baseBranch);