renovate 44.42.2 → 44.43.0

package/dist/config/presets/internal/helpers.preset.js

@@ -94,7 +94,7 @@ const presets = {
 	pinGitHubActionDigests: {
 		description: "Pin `github-action` digests.",
 		packageRules: [{
-			matchDepTypes: ["action"],
+			matchDepTypes: ["action", "workflow"],
 			pinDigests: true
 		}]
 	},
@@ -103,7 +103,7 @@ const presets = {
 		extends: ["helpers:pinGitHubActionDigests"],
 		packageRules: [{
 			extractVersion: "^(?<version>v?\\d+\\.\\d+\\.\\d+)$",
-			matchDepTypes: ["action"],
+			matchDepTypes: ["action", "workflow"],
 			versioning: "regex:^v?(?<major>\\d+)(\\.(?<minor>\\d+)\\.(?<patch>\\d+))?$"
 		}]
 	},

package/dist/config/presets/internal/helpers.preset.js.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.preset.js","names":[],"sources":["../../../../lib/config/presets/internal/helpers.preset.ts"],"sourcesContent":["import type { Preset } from '../types.ts';\n\nexport const presets: Record<string, Preset> = {\n  disableTypesNodeMajor: {\n    description: 'Disable `major` updates to `@types/node`.',\n    packageRules: [\n      {\n        enabled: false,\n        matchPackageNames: ['@types/node'],\n        matchUpdateTypes: ['major'],\n      },\n    ],\n  },\n  followTypescriptNext: {\n    description: 'Keep `typescript` version in sync with the `next` tag.',\n    extends: [':followTag(typescript, next)'],\n  },\n  followTypescriptRc: {\n    description: 'Keep `typescript` version in sync with the `rc` tag.',\n    extends: [':followTag(typescript, rc)'],\n  },\n  forgejoDigestChangelogs: {\n    description:\n      'Ensure that every dependency pinned by digest and sourced from Forgejo contains a link to the commit-to-commit diff',\n    packageRules: [\n      {\n        changelogUrl: '{{sourceUrl}}/compare/{{currentDigest}}..{{newDigest}}',\n        matchDatasources: ['forgejo-releases', 'forgejo-tags'],\n        matchUpdateTypes: ['digest'],\n      },\n      {\n        changelogUrl: '{{sourceUrl}}/compare/{{currentDigest}}..{{newDigest}}',\n        matchDatasources: ['git-refs', 'git-tags'],\n        matchJsonata: [\"$detectPlatform(sourceUrl) = 'forgejo'\"],\n        matchUpdateTypes: ['digest'],\n      },\n    ],\n  },\n  giteaDigestChangelogs: {\n    description:\n      'Ensure that every dependency pinned by digest and sourced from Gitea contains a link to the commit-to-commit diff',\n    packageRules: [\n      {\n        changelogUrl: '{{sourceUrl}}/compare/{{currentDigest}}..{{newDigest}}',\n        matchDatasources: ['gitea-releases', 'gitea-tags'],\n        matchUpdateTypes: ['digest'],\n      },\n      {\n        changelogUrl: '{{sourceUrl}}/compare/{{currentDigest}}..{{newDigest}}',\n        matchDatasources: ['git-refs', 'git-tags'],\n        matchJsonata: [\"$detectPlatform(sourceUrl) = 'gitea'\"],\n        matchUpdateTypes: ['digest'],\n      },\n    ],\n  },\n  githubDigestChangelogs: {\n    description:\n      'Ensure that every dependency pinned by digest and sourced from GitHub.com and Github enterprise contains a link to the commit-to-commit diff',\n    packageRules: [\n      {\n        changelogUrl: '{{sourceUrl}}/compare/{{currentDigest}}..{{newDigest}}',\n        matchDatasources: ['github-digest', 'github-releases', 'github-tags'],\n        matchUpdateTypes: ['digest'],\n      },\n      {\n        changelogUrl: '{{sourceUrl}}/compare/{{currentDigest}}..{{newDigest}}',\n        matchDatasources: ['git-refs', 'git-tags'],\n        matchJsonata: [\"$detectPlatform(sourceUrl) = 'github'\"],\n        matchUpdateTypes: ['digest'],\n      },\n    ],\n  },\n  gitlabDigestChangelogs: {\n    description:\n      'Ensure that every dependency pinned by digest and sourced from GitLab.com contains a link to the commit-to-commit diff',\n    packageRules: [\n      {\n        changelogUrl:\n          '{{sourceUrl}}/-/compare/{{currentDigest}}...{{newDigest}}',\n        matchDatasources: ['git-refs', 'git-tags'],\n        matchJsonata: [\"$detectPlatform(sourceUrl) = 'gitlab'\"],\n        matchUpdateTypes: ['digest'],\n      },\n      {\n        changelogUrl:\n          '{{sourceUrl}}/-/compare/{{currentDigest}}...{{newDigest}}',\n        matchDatasources: ['gitlab-releases', 'gitlab-tags'],\n        matchUpdateTypes: ['digest'],\n      },\n    ],\n  },\n  goXPackagesChangelogLink: {\n    description: 'Correctly link to the source code for golang.org/x packages',\n    packageRules: [\n      {\n        matchManagers: ['gomod'],\n        // NOTE that digests are not supported with the below diff view\n        matchUpdateTypes: ['major', 'minor', 'patch'],\n        prBodyDefinitions: {\n          Change:\n            \"{{#if (containsString depName 'golang.org/x/')}}[`{{{displayFrom}}}` → `{{{displayTo}}}`](https://cs.opensource.google/{{{replace '^golang\\\\.org' 'go' depName}}}/+/refs/tags/{{{currentValue}}}...refs/tags/{{{newValue}}}){{else}}`{{{displayFrom}}}` → `{{{displayTo}}}`{{/if}}\",\n        },\n      },\n    ],\n  },\n  goXPackagesNameLink: {\n    description: \"Link to pkg.go.dev/... for golang.org/x packages' title\",\n    packageRules: [\n      {\n        matchManagers: ['gomod'],\n        prBodyDefinitions: {\n          Package:\n            \"{{#if (containsString depName 'golang.org/x/')}}[{{{depName}}}](https://pkg.go.dev/{{{depName}}}){{else}}{{{depNameLinked}}}{{/if}}\",\n        },\n      },\n    ],\n  },\n  pinGitHubActionDigests: {\n    description: 'Pin `github-action` digests.',\n    packageRules: [\n      {\n        matchDepTypes: ['action'],\n        pinDigests: true,\n      },\n    ],\n  },\n  pinGitHubActionDigestsToSemver: {\n    description: 'Convert pinned GitHub Action digests to SemVer.',\n    extends: ['helpers:pinGitHubActionDigests'],\n    packageRules: [\n      {\n        extractVersion: '^(?<version>v?\\\\d+\\\\.\\\\d+\\\\.\\\\d+)$',\n        matchDepTypes: ['action'],\n        versioning:\n          'regex:^v?(?<major>\\\\d+)(\\\\.(?<minor>\\\\d+)\\\\.(?<patch>\\\\d+))?$',\n      },\n    ],\n  },\n  renovateChangelog: {\n    description:\n      \"Provide a link to octochangelog's improved breakdown for Renovate's changelogs\",\n    packageRules: [\n      {\n        matchSourceUrls: ['https://github.com/renovatebot/renovate'],\n        matchUpdateTypes: ['major', 'minor', 'patch'],\n        prBodyDefinitions: {\n          Change:\n            '[`{{{displayFrom}}}` → `{{{displayTo}}}`](https://octochangelog.com/compare?repo=renovatebot%2Frenovate&from={{ currentVersion }}&to={{ newVersion }})',\n        },\n      },\n    ],\n  },\n};\n"],"mappings":";AAEA,MAAa,UAAkC;CAC7C,uBAAuB;EACrB,aAAa;EACb,cAAc,CACZ;GACE,SAAS;GACT,mBAAmB,CAAC,aAAa;GACjC,kBAAkB,CAAC,OAAO;EAC5B,CACF;CACF;CACA,sBAAsB;EACpB,aAAa;EACb,SAAS,CAAC,8BAA8B;CAC1C;CACA,oBAAoB;EAClB,aAAa;EACb,SAAS,CAAC,4BAA4B;CACxC;CACA,yBAAyB;EACvB,aACE;EACF,cAAc,CACZ;GACE,cAAc;GACd,kBAAkB,CAAC,oBAAoB,cAAc;GACrD,kBAAkB,CAAC,QAAQ;EAC7B,GACA;GACE,cAAc;GACd,kBAAkB,CAAC,YAAY,UAAU;GACzC,cAAc,CAAC,wCAAwC;GACvD,kBAAkB,CAAC,QAAQ;EAC7B,CACF;CACF;CACA,uBAAuB;EACrB,aACE;EACF,cAAc,CACZ;GACE,cAAc;GACd,kBAAkB,CAAC,kBAAkB,YAAY;GACjD,kBAAkB,CAAC,QAAQ;EAC7B,GACA;GACE,cAAc;GACd,kBAAkB,CAAC,YAAY,UAAU;GACzC,cAAc,CAAC,sCAAsC;GACrD,kBAAkB,CAAC,QAAQ;EAC7B,CACF;CACF;CACA,wBAAwB;EACtB,aACE;EACF,cAAc,CACZ;GACE,cAAc;GACd,kBAAkB;IAAC;IAAiB;IAAmB;GAAa;GACpE,kBAAkB,CAAC,QAAQ;EAC7B,GACA;GACE,cAAc;GACd,kBAAkB,CAAC,YAAY,UAAU;GACzC,cAAc,CAAC,uCAAuC;GACtD,kBAAkB,CAAC,QAAQ;EAC7B,CACF;CACF;CACA,wBAAwB;EACtB,aACE;EACF,cAAc,CACZ;GACE,cACE;GACF,kBAAkB,CAAC,YAAY,UAAU;GACzC,cAAc,CAAC,uCAAuC;GACtD,kBAAkB,CAAC,QAAQ;EAC7B,GACA;GACE,cACE;GACF,kBAAkB,CAAC,mBAAmB,aAAa;GACnD,kBAAkB,CAAC,QAAQ;EAC7B,CACF;CACF;CACA,0BAA0B;EACxB,aAAa;EACb,cAAc,CACZ;GACE,eAAe,CAAC,OAAO;GAEvB,kBAAkB;IAAC;IAAS;IAAS;GAAO;GAC5C,mBAAmB,EACjB,QACE,qRACJ;EACF,CACF;CACF;CACA,qBAAqB;EACnB,aAAa;EACb,cAAc,CACZ;GACE,eAAe,CAAC,OAAO;GACvB,mBAAmB,EACjB,SACE,sIACJ;EACF,CACF;CACF;CACA,wBAAwB;EACtB,aAAa;EACb,cAAc,CACZ;GACE,eAAe,CAAC,QAAQ;GACxB,YAAY;EACd,CACF;CACF;CACA,gCAAgC;EAC9B,aAAa;EACb,SAAS,CAAC,gCAAgC;EAC1C,cAAc,CACZ;GACE,gBAAgB;GAChB,eAAe,CAAC,QAAQ;GACxB,YACE;EACJ,CACF;CACF;CACA,mBAAmB;EACjB,aACE;EACF,cAAc,CACZ;GACE,iBAAiB,CAAC,yCAAyC;GAC3D,kBAAkB;IAAC;IAAS;IAAS;GAAO;GAC5C,mBAAmB,EACjB,QACE,yJACJ;EACF,CACF;CACF;AACF"}
+{"version":3,"file":"helpers.preset.js","names":[],"sources":["../../../../lib/config/presets/internal/helpers.preset.ts"],"sourcesContent":["import type { Preset } from '../types.ts';\n\nexport const presets: Record<string, Preset> = {\n  disableTypesNodeMajor: {\n    description: 'Disable `major` updates to `@types/node`.',\n    packageRules: [\n      {\n        enabled: false,\n        matchPackageNames: ['@types/node'],\n        matchUpdateTypes: ['major'],\n      },\n    ],\n  },\n  followTypescriptNext: {\n    description: 'Keep `typescript` version in sync with the `next` tag.',\n    extends: [':followTag(typescript, next)'],\n  },\n  followTypescriptRc: {\n    description: 'Keep `typescript` version in sync with the `rc` tag.',\n    extends: [':followTag(typescript, rc)'],\n  },\n  forgejoDigestChangelogs: {\n    description:\n      'Ensure that every dependency pinned by digest and sourced from Forgejo contains a link to the commit-to-commit diff',\n    packageRules: [\n      {\n        changelogUrl: '{{sourceUrl}}/compare/{{currentDigest}}..{{newDigest}}',\n        matchDatasources: ['forgejo-releases', 'forgejo-tags'],\n        matchUpdateTypes: ['digest'],\n      },\n      {\n        changelogUrl: '{{sourceUrl}}/compare/{{currentDigest}}..{{newDigest}}',\n        matchDatasources: ['git-refs', 'git-tags'],\n        matchJsonata: [\"$detectPlatform(sourceUrl) = 'forgejo'\"],\n        matchUpdateTypes: ['digest'],\n      },\n    ],\n  },\n  giteaDigestChangelogs: {\n    description:\n      'Ensure that every dependency pinned by digest and sourced from Gitea contains a link to the commit-to-commit diff',\n    packageRules: [\n      {\n        changelogUrl: '{{sourceUrl}}/compare/{{currentDigest}}..{{newDigest}}',\n        matchDatasources: ['gitea-releases', 'gitea-tags'],\n        matchUpdateTypes: ['digest'],\n      },\n      {\n        changelogUrl: '{{sourceUrl}}/compare/{{currentDigest}}..{{newDigest}}',\n        matchDatasources: ['git-refs', 'git-tags'],\n        matchJsonata: [\"$detectPlatform(sourceUrl) = 'gitea'\"],\n        matchUpdateTypes: ['digest'],\n      },\n    ],\n  },\n  githubDigestChangelogs: {\n    description:\n      'Ensure that every dependency pinned by digest and sourced from GitHub.com and Github enterprise contains a link to the commit-to-commit diff',\n    packageRules: [\n      {\n        changelogUrl: '{{sourceUrl}}/compare/{{currentDigest}}..{{newDigest}}',\n        matchDatasources: ['github-digest', 'github-releases', 'github-tags'],\n        matchUpdateTypes: ['digest'],\n      },\n      {\n        changelogUrl: '{{sourceUrl}}/compare/{{currentDigest}}..{{newDigest}}',\n        matchDatasources: ['git-refs', 'git-tags'],\n        matchJsonata: [\"$detectPlatform(sourceUrl) = 'github'\"],\n        matchUpdateTypes: ['digest'],\n      },\n    ],\n  },\n  gitlabDigestChangelogs: {\n    description:\n      'Ensure that every dependency pinned by digest and sourced from GitLab.com contains a link to the commit-to-commit diff',\n    packageRules: [\n      {\n        changelogUrl:\n          '{{sourceUrl}}/-/compare/{{currentDigest}}...{{newDigest}}',\n        matchDatasources: ['git-refs', 'git-tags'],\n        matchJsonata: [\"$detectPlatform(sourceUrl) = 'gitlab'\"],\n        matchUpdateTypes: ['digest'],\n      },\n      {\n        changelogUrl:\n          '{{sourceUrl}}/-/compare/{{currentDigest}}...{{newDigest}}',\n        matchDatasources: ['gitlab-releases', 'gitlab-tags'],\n        matchUpdateTypes: ['digest'],\n      },\n    ],\n  },\n  goXPackagesChangelogLink: {\n    description: 'Correctly link to the source code for golang.org/x packages',\n    packageRules: [\n      {\n        matchManagers: ['gomod'],\n        // NOTE that digests are not supported with the below diff view\n        matchUpdateTypes: ['major', 'minor', 'patch'],\n        prBodyDefinitions: {\n          Change:\n            \"{{#if (containsString depName 'golang.org/x/')}}[`{{{displayFrom}}}` → `{{{displayTo}}}`](https://cs.opensource.google/{{{replace '^golang\\\\.org' 'go' depName}}}/+/refs/tags/{{{currentValue}}}...refs/tags/{{{newValue}}}){{else}}`{{{displayFrom}}}` → `{{{displayTo}}}`{{/if}}\",\n        },\n      },\n    ],\n  },\n  goXPackagesNameLink: {\n    description: \"Link to pkg.go.dev/... for golang.org/x packages' title\",\n    packageRules: [\n      {\n        matchManagers: ['gomod'],\n        prBodyDefinitions: {\n          Package:\n            \"{{#if (containsString depName 'golang.org/x/')}}[{{{depName}}}](https://pkg.go.dev/{{{depName}}}){{else}}{{{depNameLinked}}}{{/if}}\",\n        },\n      },\n    ],\n  },\n  pinGitHubActionDigests: {\n    description: 'Pin `github-action` digests.',\n    packageRules: [\n      {\n        matchDepTypes: ['action', 'workflow'],\n        pinDigests: true,\n      },\n    ],\n  },\n  pinGitHubActionDigestsToSemver: {\n    description: 'Convert pinned GitHub Action digests to SemVer.',\n    extends: ['helpers:pinGitHubActionDigests'],\n    packageRules: [\n      {\n        extractVersion: '^(?<version>v?\\\\d+\\\\.\\\\d+\\\\.\\\\d+)$',\n        matchDepTypes: ['action', 'workflow'],\n        versioning:\n          'regex:^v?(?<major>\\\\d+)(\\\\.(?<minor>\\\\d+)\\\\.(?<patch>\\\\d+))?$',\n      },\n    ],\n  },\n  renovateChangelog: {\n    description:\n      \"Provide a link to octochangelog's improved breakdown for Renovate's changelogs\",\n    packageRules: [\n      {\n        matchSourceUrls: ['https://github.com/renovatebot/renovate'],\n        matchUpdateTypes: ['major', 'minor', 'patch'],\n        prBodyDefinitions: {\n          Change:\n            '[`{{{displayFrom}}}` → `{{{displayTo}}}`](https://octochangelog.com/compare?repo=renovatebot%2Frenovate&from={{ currentVersion }}&to={{ newVersion }})',\n        },\n      },\n    ],\n  },\n};\n"],"mappings":";AAEA,MAAa,UAAkC;CAC7C,uBAAuB;EACrB,aAAa;EACb,cAAc,CACZ;GACE,SAAS;GACT,mBAAmB,CAAC,aAAa;GACjC,kBAAkB,CAAC,OAAO;EAC5B,CACF;CACF;CACA,sBAAsB;EACpB,aAAa;EACb,SAAS,CAAC,8BAA8B;CAC1C;CACA,oBAAoB;EAClB,aAAa;EACb,SAAS,CAAC,4BAA4B;CACxC;CACA,yBAAyB;EACvB,aACE;EACF,cAAc,CACZ;GACE,cAAc;GACd,kBAAkB,CAAC,oBAAoB,cAAc;GACrD,kBAAkB,CAAC,QAAQ;EAC7B,GACA;GACE,cAAc;GACd,kBAAkB,CAAC,YAAY,UAAU;GACzC,cAAc,CAAC,wCAAwC;GACvD,kBAAkB,CAAC,QAAQ;EAC7B,CACF;CACF;CACA,uBAAuB;EACrB,aACE;EACF,cAAc,CACZ;GACE,cAAc;GACd,kBAAkB,CAAC,kBAAkB,YAAY;GACjD,kBAAkB,CAAC,QAAQ;EAC7B,GACA;GACE,cAAc;GACd,kBAAkB,CAAC,YAAY,UAAU;GACzC,cAAc,CAAC,sCAAsC;GACrD,kBAAkB,CAAC,QAAQ;EAC7B,CACF;CACF;CACA,wBAAwB;EACtB,aACE;EACF,cAAc,CACZ;GACE,cAAc;GACd,kBAAkB;IAAC;IAAiB;IAAmB;GAAa;GACpE,kBAAkB,CAAC,QAAQ;EAC7B,GACA;GACE,cAAc;GACd,kBAAkB,CAAC,YAAY,UAAU;GACzC,cAAc,CAAC,uCAAuC;GACtD,kBAAkB,CAAC,QAAQ;EAC7B,CACF;CACF;CACA,wBAAwB;EACtB,aACE;EACF,cAAc,CACZ;GACE,cACE;GACF,kBAAkB,CAAC,YAAY,UAAU;GACzC,cAAc,CAAC,uCAAuC;GACtD,kBAAkB,CAAC,QAAQ;EAC7B,GACA;GACE,cACE;GACF,kBAAkB,CAAC,mBAAmB,aAAa;GACnD,kBAAkB,CAAC,QAAQ;EAC7B,CACF;CACF;CACA,0BAA0B;EACxB,aAAa;EACb,cAAc,CACZ;GACE,eAAe,CAAC,OAAO;GAEvB,kBAAkB;IAAC;IAAS;IAAS;GAAO;GAC5C,mBAAmB,EACjB,QACE,qRACJ;EACF,CACF;CACF;CACA,qBAAqB;EACnB,aAAa;EACb,cAAc,CACZ;GACE,eAAe,CAAC,OAAO;GACvB,mBAAmB,EACjB,SACE,sIACJ;EACF,CACF;CACF;CACA,wBAAwB;EACtB,aAAa;EACb,cAAc,CACZ;GACE,eAAe,CAAC,UAAU,UAAU;GACpC,YAAY;EACd,CACF;CACF;CACA,gCAAgC;EAC9B,aAAa;EACb,SAAS,CAAC,gCAAgC;EAC1C,cAAc,CACZ;GACE,gBAAgB;GAChB,eAAe,CAAC,UAAU,UAAU;GACpC,YACE;EACJ,CACF;CACF;CACA,mBAAmB;EACjB,aACE;EACF,cAAc,CACZ;GACE,iBAAiB,CAAC,yCAAyC;GAC3D,kBAAkB;IAAC;IAAS;IAAS;GAAO;GAC5C,mBAAmB,EACjB,QACE,yJACJ;EACF,CACF;CACF;AACF"}

package/dist/modules/manager/fingerprint.generated.js

@@ -42,7 +42,7 @@ hashMap.set("fleet", "d73d5d35f10df0599a561d9c8d25f3935350407d0e3bd3a1d1545295f2
 hashMap.set("flux", "70833dd068ea0a746a9392469e7904021562c7629428d0cd554603bad4eb6ce5");
 hashMap.set("fvm", "9b161df0f14bc6e536368952adf373e343630097121a913cea60ee284027fb90");
 hashMap.set("git-submodules", "e95bbc9b69a36dee82e255e8983640b7179cb5f17d24b035c6cf01d9635b35bd");
-hashMap.set("github-actions", "0a77751d4307d7e923bf2d05bf49084e77a23d7f1e498a1373202dd1ebdcc48a");
+hashMap.set("github-actions", "3dea0c91977c92d9c225c16cf27ce04a2dd7a1b652f0382c59d19b4685312cb3");
 hashMap.set("gitlabci", "33c264edf7837fb8fbc4cf0078c8bd2d5a75431039b1db65bf47356df7753125");
 hashMap.set("gitlabci-include", "ef696c478c2ac1723b3aca070ba9779be0e702fff0844054251ba0029523d0eb");
 hashMap.set("glasskube", "93e7b9000a17efa15a1abaaf320b5af9169b1ecd828fc0c881d98570ef9d9e30");

package/dist/modules/manager/fingerprint.generated.js.map

@@ -1 +1 @@
-{"version":3,"file":"fingerprint.generated.js","names":[],"sources":["../../../lib/modules/manager/fingerprint.generated.ts"],"sourcesContent":["export const hashMap = new Map<string, string>();\n\nhashMap.set('ansible','1d3568f42393d697f8f96d461b72077ee7a1044b654e87667a12f861b3083111');\nhashMap.set('ansible-galaxy','8226d47128f2018825d4d6f84794e3183eb79c706045fa7e88491edd5e64106f');\nhashMap.set('ant','2df5943cf0ed19a21b94df13729dbb925655548130caf37e3e22bebaed518e17');\nhashMap.set('argocd','5d35b1992e53130bf83b0e59a0f90ccd3a78919974c69044f306dc5d162f48ce');\nhashMap.set('asdf','b2acfc0a6164e9a279daa724777c423f84572dafb0df09b1b0cf6f205f9eb6d0');\nhashMap.set('azure-pipelines','4f635b0ecd388ee266d992e8281fd40e3db2f5867d86fc1cbce72dc33a66e796');\nhashMap.set('batect','bd9208444eff1a4958061484db66a47b616c31f15a8d49d23b75c4560fcee83e');\nhashMap.set('batect-wrapper','d999355511ea7f4053325a18b8cfc8d2b586c61e6760c35e557d383a673e3939');\nhashMap.set('bazel','4994a8bd86d5bfb169d67c08efd8509b58c368c2bf3dd9bbe42553c0fabc3f1a');\nhashMap.set('bazel-module','40f6a862b4e72fcc7262ee41f8b570ea3fd5600d6d552b94ed3301bb201f5db5');\nhashMap.set('bazelisk','d71489650feefb0dbbe7461f924cb50e41c8eef8fe2e11acdec2d42d0212c8ef');\nhashMap.set('bicep','7246e0bfc06e0e28cbb03ac088c5591f648956b086e106aeb251fe5d628329db');\nhashMap.set('bitbucket-pipelines','59c0503494ab1442b127914503c01b97ac17b6742b19c632292d5aa24de115cd');\nhashMap.set('bitrise','478dfd316221fad7c29e177c70d1018d832fb2626b53308a5d0f1f0380e69f42');\nhashMap.set('buildkite','a93effb1f1c5d65b3277c3b4709924eacde282e8efd028a8e3d8c1ce3ef69407');\nhashMap.set('buildpacks','6bef3cb04d66b5cfbb195adb4829bcbccae6408518706744d291bacf0610421f');\nhashMap.set('bun','691aa0bd20c20f7e05be5d231ed14dccdf81b9399d062448794176403aa53d94');\nhashMap.set('bun-version','df3ae8e4a5de1fa1b4544f3d7fc8117e80adb1e151c46d1ede54a4dbea6521e4');\nhashMap.set('bundler','246899c76663fa66024e19aa18287d364dd0de46febe998cb9c1b1e2b09fe53c');\nhashMap.set('cake','ed6d14c96161f1d3d927adc7e333b96585164e1f25151a87990914d57ae17fe1');\nhashMap.set('cargo','beae41d92d6d321459b1ca6eb80e7ee6906c694fd3c01ffeec32d8053db96e44');\nhashMap.set('cdnurl','d3edf6cdc38e92eb43ff5a2b4e8df6a6a13154cf83244725c39e28d7e6ea9177');\nhashMap.set('circleci','91cbeb33ea20f9838e2c81a1195eb806f0b38fa282bc3679f62552f20575ca85');\nhashMap.set('cloudbuild','8c0c739f7e4082bbfe8e3fdffebaf43e26f70a1314d95b306e9b93e4f4297886');\nhashMap.set('cocoapods','3d3affcaab991e9a27916dfbc8bdddb1066be28303c37be781695bfc0645aa81');\nhashMap.set('composer','d84def5d2f07adb0b5c37195fa115a3a9d86194b57eae014d7b43d2d59fe7d1c');\nhashMap.set('conan','74ca922a0ffdf1a9dd44b83eb2b3a36c56c7d792031e3a4a484f293046be3ecd');\nhashMap.set('copier','3010e0a1f77203b001e4d851dd899d3e23a96f0c25cff8a9c1819837c9972d6a');\nhashMap.set('cpanfile','07813fec3f3c2197056500e9266a0553b9774c02f2c74d5ca2e213188c7c12d3');\nhashMap.set('crossplane','5c26b1201a1a51454ffb94d829e223a76a781569bf79cdb1e47087c30233ec40');\nhashMap.set('crow','eb9a5f9f95041855dded67bcce3dd54724f690995ed6268d272e8a666ff28fd0');\nhashMap.set('deno','a43016a9a469e0472f00855c8db64bb65ef5ffa773e7bbfade02a21400f67690');\nhashMap.set('deps-edn','c87dd5e88587147ad1a78f047b814f3c4aa60d6de30d0c49d849391eeaf1b64c');\nhashMap.set('devbox','a608d1e6db93a8f997d41f8dee7b67533452a956057865978342e2819272e0a9');\nhashMap.set('devcontainer','24320ed1cb6191d04cb8b2707214d82c08c682597aed1d84f250aa00ad1632ec');\nhashMap.set('docker-compose','5441af5b5abf8d347e46002d47f02f85743401bda28232f49fb7b3bbb772a4fb');\nhashMap.set('dockerfile','54122792bf8ea0be98e0a0716e627e3115b40a5f0155ccd7ae0cfc52424a3478');\nhashMap.set('droneci','237c8de87b9bf653fb943b56e84e99c45f6d86ae27d86e599b3f3f99c35ba8ee');\nhashMap.set('fleet','d73d5d35f10df0599a561d9c8d25f3935350407d0e3bd3a1d1545295f278912e');\nhashMap.set('flux','70833dd068ea0a746a9392469e7904021562c7629428d0cd554603bad4eb6ce5');\nhashMap.set('fvm','9b161df0f14bc6e536368952adf373e343630097121a913cea60ee284027fb90');\nhashMap.set('git-submodules','e95bbc9b69a36dee82e255e8983640b7179cb5f17d24b035c6cf01d9635b35bd');\nhashMap.set('github-actions','0a77751d4307d7e923bf2d05bf49084e77a23d7f1e498a1373202dd1ebdcc48a');\nhashMap.set('gitlabci','33c264edf7837fb8fbc4cf0078c8bd2d5a75431039b1db65bf47356df7753125');\nhashMap.set('gitlabci-include','ef696c478c2ac1723b3aca070ba9779be0e702fff0844054251ba0029523d0eb');\nhashMap.set('glasskube','93e7b9000a17efa15a1abaaf320b5af9169b1ecd828fc0c881d98570ef9d9e30');\nhashMap.set('gleam','02389785183c39d2896d7893414c5e1060023f95c1fe7b595bd06cc5c1186d39');\nhashMap.set('gomod','b21d52f02d181eb1dcd252a9fd545e7ac04d76679790b254377a9e077f2d3a8a');\nhashMap.set('gradle','1780fe7560babe735da868a0dd1a013fea76d82abfde62028cd48f9de42fb52c');\nhashMap.set('gradle-wrapper','e16500ce08dd35ecb3ddcc3c79989648087b8249c3a95413a991627d064657ca');\nhashMap.set('haskell-cabal','f232d0e883235f74ed71fd9de4a7468e5fcbda9a1af5beb56c24657f7bf2e891');\nhashMap.set('helm-requirements','4d90e5e18a380876ad48e21e1ad88ea62e25d973a1ddaa3763447fc0a9f9915b');\nhashMap.set('helm-values','b5c52c6a27d805557418c585c5d3030c95ee641d53057021f3fe060f81b6e1af');\nhashMap.set('helmfile','0adc0092400df2075e1c4580ebe35bbc3b638ebee67cc948a4338094cb16a8ae');\nhashMap.set('helmsman','ef9680c612f702c7f07aea9b6e5d811e91214dcfa5755c9f3803e9528090935e');\nhashMap.set('helmv3','572f7b0b746377e0c5d6f5ad5c0b78cbed6782a561be77263cf45620b6fdad0c');\nhashMap.set('hermit','61e132cfccbe4e3884801a3728f3391455c214811a33c1f733b0dea7122bbbb6');\nhashMap.set('homeassistant-manifest','05043c6db870cffbb6f8f3e351c025e3de227eaae0b24134b796aec46f84b65f');\nhashMap.set('homebrew','9c64a4f1475b1c2052372e566c9190f32ae8acd1c54313031d55ae8772388367');\nhashMap.set('html','67c5f3c5c58e96f5dd257ba5987d900cf7fef81d667c3640e96c847b37de35a8');\nhashMap.set('jenkins','268ebfc8a1caf3edeb2192c2b1b2fa4bf18a78a3e731ba20a6c104940a5539f3');\nhashMap.set('jsonnet-bundler','e26b390528f2de43dc572bcee7cb15bb4671d2df75413a56caf1ddcee683a0ee');\nhashMap.set('kotlin-script','8a327ba00370d0df5ee656033f0526b898204ef6805cc5692221a71ca2ad654d');\nhashMap.set('kubernetes','321e7d77fb3600dd4c00a86eaa1294927e7f92300b74fa2977d813dcaa3bb4de');\nhashMap.set('kustomize','14bc841079d278b8e03b1eb184d94fef3df8811fa25beddc7ac9e6e2697b43b5');\nhashMap.set('leiningen','133fca2c3423f53f2ccc22518153ddbcafbf0f4812376c77e952eb3d24d81f85');\nhashMap.set('maven','f084cdc88320ca1e82af957d0008e7c9ce991d3282cb428f3108a5722239cead');\nhashMap.set('maven-wrapper','db967206d960b12d7c58d78132808d3c412087ababf5c59444262782e4434c6a');\nhashMap.set('meteor','4a93a326b27bedfe52118e27e06f39fecd7c55bd4cd7fccec4cb120cac14cec4');\nhashMap.set('mint','248fe4f1ea5c985921c286785792c97e06fc41f402b2d45df82f6aecd17f710e');\nhashMap.set('mise','8509ff587ee410eeb94cbf1d4616c6a174b5f4110d0e748496edd8ed150d8b9b');\nhashMap.set('mix','ca855b0353a8087d91a63fba5cc097d11e0396a963f214a508279aef065707f0');\nhashMap.set('nix','f90bb8943129de40b50564b203df71bb86079dd134e204390a103535de1c5af7');\nhashMap.set('nodenv','ac652c28481b001f7471f4183eac07b45d98ecbe83efc275830b0a1b2e0459b8');\nhashMap.set('npm','788c412f962a5fcace60bc99f9f31438d001b2d70e1a6c04a26900dd5d521992');\nhashMap.set('nuget','4818fdcf3258a19228004c62a605c3fb4b6665ca09df524ab37f712ea201db89');\nhashMap.set('nvm','3eb77c7b0acf6d64753de78fad2499b352719853aa6872878c40675d14152322');\nhashMap.set('ocb','032b216684c14b0954e0bb019513a2aca3faaee5748587acb668d377d7c891ca');\nhashMap.set('osgi','32233a1a8a2725699d7448ba438e3d0b78141f7799cd2b588de278d41e26ed10');\nhashMap.set('pep621','db4dc12af1643b6883819bc8d0b4a7fc4533384e5678a61745710f0087f97ab9');\nhashMap.set('pep723','b96683163de63ed93207ec0538066705b1e58a1cd5b8bd11c63fc28b26bddba1');\nhashMap.set('pip-compile','04747259c660d6ec4f9a36d7efd1c823c78767292faf4b358c11f5507214d6f8');\nhashMap.set('pip_requirements','f92868732a7a9bb2b6d7525bd5b4515108376434fe6a2a12d802f7075c12a56c');\nhashMap.set('pip_setup','0175fe550c19d9bd31c978bd83fdc088cb40fcacd5d6751f640164274ae64e61');\nhashMap.set('pipenv','f4c5d17bfcb6f5cb8b85584d4b782379daa69ee85936ca79ef01172e5d6652a2');\nhashMap.set('pixi','3732f052617efd5007ddbe31091a2ba026909288bac4cbbe6d2bd6ac64d85393');\nhashMap.set('poetry','17e7a8e6a233ef311acfed2663b231dbf681a6d25edc9b92ae7c063205d042fc');\nhashMap.set('pre-commit','17a5f183985ebffe98785a541d3609bf25efedc387deb3d50e9f00f02b25f615');\nhashMap.set('proto','412053d4550026b4ace490b46e970915b87ec1abf0b0a0c6c8c58ccf1fc16843');\nhashMap.set('pub','3ade8bf8232eda456e24909b4d1abce066e674c9ea9aa250c567cf621a96bf9b');\nhashMap.set('puppet','ba58ab689e44acc8f61c3569ab8b40fde01b8a9d3aad712708e2a419e57d8b45');\nhashMap.set('pyenv','9ede8becc97774f9040b40f4472d3e933534b596e04c360bfe0f3c6f95f25182');\nhashMap.set('quadlet','e1fc88a4e14cd595e89bb3d79b4adf2add3ce5eb80f75276e712c32598cca53d');\nhashMap.set('renovate-config','ca60beee2e3b871ea1216fa9df9a501f7ed355fe7da29e12509e56a124a78e69');\nhashMap.set('ruby-version','2db2140d9eee8c555e729a4de0396fa2d78846d3149890ee12fa515bd654be97');\nhashMap.set('runtime-version','b582b168c0cc595e39010feb10f4b97a82683eb269e9598216fbb11cc186e160');\nhashMap.set('rust-toolchain','6ace53db02874d73620d2d872291839820a512a9529c42d174358c692e5db720');\nhashMap.set('sbt','e508c2e2fb8d44e6cbec20f449c8eed096728566e6058187269c637930d388fb');\nhashMap.set('scalafmt','9d36159b56835e96498af026a1fb0543200db0581681ef95ec54988f411e180f');\nhashMap.set('setup-cfg','7dea08c5708625e753bd56918bc214df7fb4d8543a26e936926a21ab43b5f785');\nhashMap.set('smithy','9641b91d065ffb63be0dd888139a0402dba41e550f8b44c592db9daf52109100');\nhashMap.set('sveltos','05b3158e88771ed4629e171592cf4f1bf0ff342f8aeae89be0b340c630cc6d8e');\nhashMap.set('swift','eb5f7c3c4dabf28eed36916269ca9be16ab9ddb83993db03ea66b9195ad7bdc6');\nhashMap.set('tekton','fdc5b9b5edec2a90cda2f858f3ebc532aa8efb1187d1e0b7c89b07796e9cb6cd');\nhashMap.set('terraform','73f9d1753d1077585bd264163b7bfacaf6cf20b586b233cbb8cf058a9fce0103');\nhashMap.set('terraform-version','ec8f786b9731d47f2c2fe0307caf64d7ddd83046fe7ff1f7d8423239f8b0f2aa');\nhashMap.set('terragrunt','ffcbaa67dd65f064d43f8c121c1006115eab1879c4bd38de263b9b90a009c118');\nhashMap.set('terragrunt-version','eea6087b33717d22ede2fc68c2f64df8390b75abe82110ed831a180648feb51d');\nhashMap.set('tflint-plugin','31247d37bc80aae17039bfa21bd989c5717730c5ef10cf2a6f09841576d012ec');\nhashMap.set('travis','bb482a0195cd009ec3896a6227bb95617f5c84bedb518c7d971e50c62235d9ca');\nhashMap.set('typst','d080a79fbd961c6e21fcc505d544b7e0ff2126142acb1dcabdf6abbcd9339248');\nhashMap.set('unity3d','f13e25e115e3443f4e16cf31578acffa78fb1a5e23339680a92d8d6de6052920');\nhashMap.set('velaci','fda00ddb7cc23e9a37e0a8a253151df0a6930b4276d3e4f78cc54b9ac09af7de');\nhashMap.set('vendir','8901ee24116f7998bddcfc8d2492bff8138d9c66a23caea75c24d594ef4a504d');\nhashMap.set('woodpecker','6110d3bec33aaeb3511d4bbfa896cec3c8e02fb04a6cff50c9ba81061c851045');\nhashMap.set('xcodegen','dad511d88a9ce1dbdde8b9731f3da7f2bdaa4ca8a083294ee58d56da62ab1683');\nhashMap.set('jsonata','416bcf61144b276b3112814c6e6d261aa29608f46fbb0516c471d35c16f8f0d7');\nhashMap.set('regex','dbe6889ea021a05127fed06226d73366fdada2ae577147a5c027996fd325416e');"],"mappings":";AAAA,MAAa,0BAAU,IAAI,IAAoB;AAE/C,QAAQ,IAAI,WAAU,kEAAkE;AACxF,QAAQ,IAAI,kBAAiB,kEAAkE;AAC/F,QAAQ,IAAI,OAAM,kEAAkE;AACpF,QAAQ,IAAI,UAAS,kEAAkE;AACvF,QAAQ,IAAI,QAAO,kEAAkE;AACrF,QAAQ,IAAI,mBAAkB,kEAAkE;AAChG,QAAQ,IAAI,UAAS,kEAAkE;AACvF,QAAQ,IAAI,kBAAiB,kEAAkE;AAC/F,QAAQ,IAAI,SAAQ,kEAAkE;AACtF,QAAQ,IAAI,gBAAe,kEAAkE;AAC7F,QAAQ,IAAI,YAAW,kEAAkE;AACzF,QAAQ,IAAI,SAAQ,kEAAkE;AACtF,QAAQ,IAAI,uBAAsB,kEAAkE;AACpG,QAAQ,IAAI,WAAU,kEAAkE;AACxF,QAAQ,IAAI,aAAY,kEAAkE;AAC1F,QAAQ,IAAI,cAAa,kEAAkE;AAC3F,QAAQ,IAAI,OAAM,kEAAkE;AACpF,QAAQ,IAAI,eAAc,kEAAkE;AAC5F,QAAQ,IAAI,WAAU,kEAAkE;AACxF,QAAQ,IAAI,QAAO,kEAAkE;AACrF,QAAQ,IAAI,SAAQ,kEAAkE;AACtF,QAAQ,IAAI,UAAS,kEAAkE;AACvF,QAAQ,IAAI,YAAW,kEAAkE;AACzF,QAAQ,IAAI,cAAa,kEAAkE;AAC3F,QAAQ,IAAI,aAAY,kEAAkE;AAC1F,QAAQ,IAAI,YAAW,kEAAkE;AACzF,QAAQ,IAAI,SAAQ,kEAAkE;AACtF,QAAQ,IAAI,UAAS,kEAAkE;AACvF,QAAQ,IAAI,YAAW,kEAAkE;AACzF,QAAQ,IAAI,cAAa,kEAAkE;AAC3F,QAAQ,IAAI,QAAO,kEAAkE;AACrF,QAAQ,IAAI,QAAO,kEAAkE;AACrF,QAAQ,IAAI,YAAW,kEAAkE;AACzF,QAAQ,IAAI,UAAS,kEAAkE;AACvF,QAAQ,IAAI,gBAAe,kEAAkE;AAC7F,QAAQ,IAAI,kBAAiB,kEAAkE;AAC/F,QAAQ,IAAI,cAAa,kEAAkE;AAC3F,QAAQ,IAAI,WAAU,kEAAkE;AACxF,QAAQ,IAAI,SAAQ,kEAAkE;AACtF,QAAQ,IAAI,QAAO,kEAAkE;AACrF,QAAQ,IAAI,OAAM,kEAAkE;AACpF,QAAQ,IAAI,kBAAiB,kEAAkE;AAC/F,QAAQ,IAAI,kBAAiB,kEAAkE;AAC/F,QAAQ,IAAI,YAAW,kEAAkE;AACzF,QAAQ,IAAI,oBAAmB,kEAAkE;AACjG,QAAQ,IAAI,aAAY,kEAAkE;AAC1F,QAAQ,IAAI,SAAQ,kEAAkE;AACtF,QAAQ,IAAI,SAAQ,kEAAkE;AACtF,QAAQ,IAAI,UAAS,kEAAkE;AACvF,QAAQ,IAAI,kBAAiB,kEAAkE;AAC/F,QAAQ,IAAI,iBAAgB,kEAAkE;AAC9F,QAAQ,IAAI,qBAAoB,kEAAkE;AAClG,QAAQ,IAAI,eAAc,kEAAkE;AAC5F,QAAQ,IAAI,YAAW,kEAAkE;AACzF,QAAQ,IAAI,YAAW,kEAAkE;AACzF,QAAQ,IAAI,UAAS,kEAAkE;AACvF,QAAQ,IAAI,UAAS,kEAAkE;AACvF,QAAQ,IAAI,0BAAyB,kEAAkE;AACvG,QAAQ,IAAI,YAAW,kEAAkE;AACzF,QAAQ,IAAI,QAAO,kEAAkE;AACrF,QAAQ,IAAI,WAAU,kEAAkE;AACxF,QAAQ,IAAI,mBAAkB,kEAAkE;AAChG,QAAQ,IAAI,iBAAgB,kEAAkE;AAC9F,QAAQ,IAAI,cAAa,kEAAkE;AAC3F,QAAQ,IAAI,aAAY,kEAAkE;AAC1F,QAAQ,IAAI,aAAY,kEAAkE;AAC1F,QAAQ,IAAI,SAAQ,kEAAkE;AACtF,QAAQ,IAAI,iBAAgB,kEAAkE;AAC9F,QAAQ,IAAI,UAAS,kEAAkE;AACvF,QAAQ,IAAI,QAAO,kEAAkE;AACrF,QAAQ,IAAI,QAAO,kEAAkE;AACrF,QAAQ,IAAI,OAAM,kEAAkE;AACpF,QAAQ,IAAI,OAAM,kEAAkE;AACpF,QAAQ,IAAI,UAAS,kEAAkE;AACvF,QAAQ,IAAI,OAAM,kEAAkE;AACpF,QAAQ,IAAI,SAAQ,kEAAkE;AACtF,QAAQ,IAAI,OAAM,kEAAkE;AACpF,QAAQ,IAAI,OAAM,kEAAkE;AACpF,QAAQ,IAAI,QAAO,kEAAkE;AACrF,QAAQ,IAAI,UAAS,kEAAkE;AACvF,QAAQ,IAAI,UAAS,kEAAkE;AACvF,QAAQ,IAAI,eAAc,kEAAkE;AAC5F,QAAQ,IAAI,oBAAmB,kEAAkE;AACjG,QAAQ,IAAI,aAAY,kEAAkE;AAC1F,QAAQ,IAAI,UAAS,kEAAkE;AACvF,QAAQ,IAAI,QAAO,kEAAkE;AACrF,QAAQ,IAAI,UAAS,kEAAkE;AACvF,QAAQ,IAAI,cAAa,kEAAkE;AAC3F,QAAQ,IAAI,SAAQ,kEAAkE;AACtF,QAAQ,IAAI,OAAM,kEAAkE;AACpF,QAAQ,IAAI,UAAS,kEAAkE;AACvF,QAAQ,IAAI,SAAQ,kEAAkE;AACtF,QAAQ,IAAI,WAAU,kEAAkE;AACxF,QAAQ,IAAI,mBAAkB,kEAAkE;AAChG,QAAQ,IAAI,gBAAe,kEAAkE;AAC7F,QAAQ,IAAI,mBAAkB,kEAAkE;AAChG,QAAQ,IAAI,kBAAiB,kEAAkE;AAC/F,QAAQ,IAAI,OAAM,kEAAkE;AACpF,QAAQ,IAAI,YAAW,kEAAkE;AACzF,QAAQ,IAAI,aAAY,kEAAkE;AAC1F,QAAQ,IAAI,UAAS,kEAAkE;AACvF,QAAQ,IAAI,WAAU,kEAAkE;AACxF,QAAQ,IAAI,SAAQ,kEAAkE;AACtF,QAAQ,IAAI,UAAS,kEAAkE;AACvF,QAAQ,IAAI,aAAY,kEAAkE;AAC1F,QAAQ,IAAI,qBAAoB,kEAAkE;AAClG,QAAQ,IAAI,cAAa,kEAAkE;AAC3F,QAAQ,IAAI,sBAAqB,kEAAkE;AACnG,QAAQ,IAAI,iBAAgB,kEAAkE;AAC9F,QAAQ,IAAI,UAAS,kEAAkE;AACvF,QAAQ,IAAI,SAAQ,kEAAkE;AACtF,QAAQ,IAAI,WAAU,kEAAkE;AACxF,QAAQ,IAAI,UAAS,kEAAkE;AACvF,QAAQ,IAAI,UAAS,kEAAkE;AACvF,QAAQ,IAAI,cAAa,kEAAkE;AAC3F,QAAQ,IAAI,YAAW,kEAAkE;AACzF,QAAQ,IAAI,WAAU,kEAAkE;AACxF,QAAQ,IAAI,SAAQ,kEAAkE"}
+{"version":3,"file":"fingerprint.generated.js","names":[],"sources":["../../../lib/modules/manager/fingerprint.generated.ts"],"sourcesContent":["export const hashMap = new Map<string, string>();\n\nhashMap.set('ansible','1d3568f42393d697f8f96d461b72077ee7a1044b654e87667a12f861b3083111');\nhashMap.set('ansible-galaxy','8226d47128f2018825d4d6f84794e3183eb79c706045fa7e88491edd5e64106f');\nhashMap.set('ant','2df5943cf0ed19a21b94df13729dbb925655548130caf37e3e22bebaed518e17');\nhashMap.set('argocd','5d35b1992e53130bf83b0e59a0f90ccd3a78919974c69044f306dc5d162f48ce');\nhashMap.set('asdf','b2acfc0a6164e9a279daa724777c423f84572dafb0df09b1b0cf6f205f9eb6d0');\nhashMap.set('azure-pipelines','4f635b0ecd388ee266d992e8281fd40e3db2f5867d86fc1cbce72dc33a66e796');\nhashMap.set('batect','bd9208444eff1a4958061484db66a47b616c31f15a8d49d23b75c4560fcee83e');\nhashMap.set('batect-wrapper','d999355511ea7f4053325a18b8cfc8d2b586c61e6760c35e557d383a673e3939');\nhashMap.set('bazel','4994a8bd86d5bfb169d67c08efd8509b58c368c2bf3dd9bbe42553c0fabc3f1a');\nhashMap.set('bazel-module','40f6a862b4e72fcc7262ee41f8b570ea3fd5600d6d552b94ed3301bb201f5db5');\nhashMap.set('bazelisk','d71489650feefb0dbbe7461f924cb50e41c8eef8fe2e11acdec2d42d0212c8ef');\nhashMap.set('bicep','7246e0bfc06e0e28cbb03ac088c5591f648956b086e106aeb251fe5d628329db');\nhashMap.set('bitbucket-pipelines','59c0503494ab1442b127914503c01b97ac17b6742b19c632292d5aa24de115cd');\nhashMap.set('bitrise','478dfd316221fad7c29e177c70d1018d832fb2626b53308a5d0f1f0380e69f42');\nhashMap.set('buildkite','a93effb1f1c5d65b3277c3b4709924eacde282e8efd028a8e3d8c1ce3ef69407');\nhashMap.set('buildpacks','6bef3cb04d66b5cfbb195adb4829bcbccae6408518706744d291bacf0610421f');\nhashMap.set('bun','691aa0bd20c20f7e05be5d231ed14dccdf81b9399d062448794176403aa53d94');\nhashMap.set('bun-version','df3ae8e4a5de1fa1b4544f3d7fc8117e80adb1e151c46d1ede54a4dbea6521e4');\nhashMap.set('bundler','246899c76663fa66024e19aa18287d364dd0de46febe998cb9c1b1e2b09fe53c');\nhashMap.set('cake','ed6d14c96161f1d3d927adc7e333b96585164e1f25151a87990914d57ae17fe1');\nhashMap.set('cargo','beae41d92d6d321459b1ca6eb80e7ee6906c694fd3c01ffeec32d8053db96e44');\nhashMap.set('cdnurl','d3edf6cdc38e92eb43ff5a2b4e8df6a6a13154cf83244725c39e28d7e6ea9177');\nhashMap.set('circleci','91cbeb33ea20f9838e2c81a1195eb806f0b38fa282bc3679f62552f20575ca85');\nhashMap.set('cloudbuild','8c0c739f7e4082bbfe8e3fdffebaf43e26f70a1314d95b306e9b93e4f4297886');\nhashMap.set('cocoapods','3d3affcaab991e9a27916dfbc8bdddb1066be28303c37be781695bfc0645aa81');\nhashMap.set('composer','d84def5d2f07adb0b5c37195fa115a3a9d86194b57eae014d7b43d2d59fe7d1c');\nhashMap.set('conan','74ca922a0ffdf1a9dd44b83eb2b3a36c56c7d792031e3a4a484f293046be3ecd');\nhashMap.set('copier','3010e0a1f77203b001e4d851dd899d3e23a96f0c25cff8a9c1819837c9972d6a');\nhashMap.set('cpanfile','07813fec3f3c2197056500e9266a0553b9774c02f2c74d5ca2e213188c7c12d3');\nhashMap.set('crossplane','5c26b1201a1a51454ffb94d829e223a76a781569bf79cdb1e47087c30233ec40');\nhashMap.set('crow','eb9a5f9f95041855dded67bcce3dd54724f690995ed6268d272e8a666ff28fd0');\nhashMap.set('deno','a43016a9a469e0472f00855c8db64bb65ef5ffa773e7bbfade02a21400f67690');\nhashMap.set('deps-edn','c87dd5e88587147ad1a78f047b814f3c4aa60d6de30d0c49d849391eeaf1b64c');\nhashMap.set('devbox','a608d1e6db93a8f997d41f8dee7b67533452a956057865978342e2819272e0a9');\nhashMap.set('devcontainer','24320ed1cb6191d04cb8b2707214d82c08c682597aed1d84f250aa00ad1632ec');\nhashMap.set('docker-compose','5441af5b5abf8d347e46002d47f02f85743401bda28232f49fb7b3bbb772a4fb');\nhashMap.set('dockerfile','54122792bf8ea0be98e0a0716e627e3115b40a5f0155ccd7ae0cfc52424a3478');\nhashMap.set('droneci','237c8de87b9bf653fb943b56e84e99c45f6d86ae27d86e599b3f3f99c35ba8ee');\nhashMap.set('fleet','d73d5d35f10df0599a561d9c8d25f3935350407d0e3bd3a1d1545295f278912e');\nhashMap.set('flux','70833dd068ea0a746a9392469e7904021562c7629428d0cd554603bad4eb6ce5');\nhashMap.set('fvm','9b161df0f14bc6e536368952adf373e343630097121a913cea60ee284027fb90');\nhashMap.set('git-submodules','e95bbc9b69a36dee82e255e8983640b7179cb5f17d24b035c6cf01d9635b35bd');\nhashMap.set('github-actions','3dea0c91977c92d9c225c16cf27ce04a2dd7a1b652f0382c59d19b4685312cb3');\nhashMap.set('gitlabci','33c264edf7837fb8fbc4cf0078c8bd2d5a75431039b1db65bf47356df7753125');\nhashMap.set('gitlabci-include','ef696c478c2ac1723b3aca070ba9779be0e702fff0844054251ba0029523d0eb');\nhashMap.set('glasskube','93e7b9000a17efa15a1abaaf320b5af9169b1ecd828fc0c881d98570ef9d9e30');\nhashMap.set('gleam','02389785183c39d2896d7893414c5e1060023f95c1fe7b595bd06cc5c1186d39');\nhashMap.set('gomod','b21d52f02d181eb1dcd252a9fd545e7ac04d76679790b254377a9e077f2d3a8a');\nhashMap.set('gradle','1780fe7560babe735da868a0dd1a013fea76d82abfde62028cd48f9de42fb52c');\nhashMap.set('gradle-wrapper','e16500ce08dd35ecb3ddcc3c79989648087b8249c3a95413a991627d064657ca');\nhashMap.set('haskell-cabal','f232d0e883235f74ed71fd9de4a7468e5fcbda9a1af5beb56c24657f7bf2e891');\nhashMap.set('helm-requirements','4d90e5e18a380876ad48e21e1ad88ea62e25d973a1ddaa3763447fc0a9f9915b');\nhashMap.set('helm-values','b5c52c6a27d805557418c585c5d3030c95ee641d53057021f3fe060f81b6e1af');\nhashMap.set('helmfile','0adc0092400df2075e1c4580ebe35bbc3b638ebee67cc948a4338094cb16a8ae');\nhashMap.set('helmsman','ef9680c612f702c7f07aea9b6e5d811e91214dcfa5755c9f3803e9528090935e');\nhashMap.set('helmv3','572f7b0b746377e0c5d6f5ad5c0b78cbed6782a561be77263cf45620b6fdad0c');\nhashMap.set('hermit','61e132cfccbe4e3884801a3728f3391455c214811a33c1f733b0dea7122bbbb6');\nhashMap.set('homeassistant-manifest','05043c6db870cffbb6f8f3e351c025e3de227eaae0b24134b796aec46f84b65f');\nhashMap.set('homebrew','9c64a4f1475b1c2052372e566c9190f32ae8acd1c54313031d55ae8772388367');\nhashMap.set('html','67c5f3c5c58e96f5dd257ba5987d900cf7fef81d667c3640e96c847b37de35a8');\nhashMap.set('jenkins','268ebfc8a1caf3edeb2192c2b1b2fa4bf18a78a3e731ba20a6c104940a5539f3');\nhashMap.set('jsonnet-bundler','e26b390528f2de43dc572bcee7cb15bb4671d2df75413a56caf1ddcee683a0ee');\nhashMap.set('kotlin-script','8a327ba00370d0df5ee656033f0526b898204ef6805cc5692221a71ca2ad654d');\nhashMap.set('kubernetes','321e7d77fb3600dd4c00a86eaa1294927e7f92300b74fa2977d813dcaa3bb4de');\nhashMap.set('kustomize','14bc841079d278b8e03b1eb184d94fef3df8811fa25beddc7ac9e6e2697b43b5');\nhashMap.set('leiningen','133fca2c3423f53f2ccc22518153ddbcafbf0f4812376c77e952eb3d24d81f85');\nhashMap.set('maven','f084cdc88320ca1e82af957d0008e7c9ce991d3282cb428f3108a5722239cead');\nhashMap.set('maven-wrapper','db967206d960b12d7c58d78132808d3c412087ababf5c59444262782e4434c6a');\nhashMap.set('meteor','4a93a326b27bedfe52118e27e06f39fecd7c55bd4cd7fccec4cb120cac14cec4');\nhashMap.set('mint','248fe4f1ea5c985921c286785792c97e06fc41f402b2d45df82f6aecd17f710e');\nhashMap.set('mise','8509ff587ee410eeb94cbf1d4616c6a174b5f4110d0e748496edd8ed150d8b9b');\nhashMap.set('mix','ca855b0353a8087d91a63fba5cc097d11e0396a963f214a508279aef065707f0');\nhashMap.set('nix','f90bb8943129de40b50564b203df71bb86079dd134e204390a103535de1c5af7');\nhashMap.set('nodenv','ac652c28481b001f7471f4183eac07b45d98ecbe83efc275830b0a1b2e0459b8');\nhashMap.set('npm','788c412f962a5fcace60bc99f9f31438d001b2d70e1a6c04a26900dd5d521992');\nhashMap.set('nuget','4818fdcf3258a19228004c62a605c3fb4b6665ca09df524ab37f712ea201db89');\nhashMap.set('nvm','3eb77c7b0acf6d64753de78fad2499b352719853aa6872878c40675d14152322');\nhashMap.set('ocb','032b216684c14b0954e0bb019513a2aca3faaee5748587acb668d377d7c891ca');\nhashMap.set('osgi','32233a1a8a2725699d7448ba438e3d0b78141f7799cd2b588de278d41e26ed10');\nhashMap.set('pep621','db4dc12af1643b6883819bc8d0b4a7fc4533384e5678a61745710f0087f97ab9');\nhashMap.set('pep723','b96683163de63ed93207ec0538066705b1e58a1cd5b8bd11c63fc28b26bddba1');\nhashMap.set('pip-compile','04747259c660d6ec4f9a36d7efd1c823c78767292faf4b358c11f5507214d6f8');\nhashMap.set('pip_requirements','f92868732a7a9bb2b6d7525bd5b4515108376434fe6a2a12d802f7075c12a56c');\nhashMap.set('pip_setup','0175fe550c19d9bd31c978bd83fdc088cb40fcacd5d6751f640164274ae64e61');\nhashMap.set('pipenv','f4c5d17bfcb6f5cb8b85584d4b782379daa69ee85936ca79ef01172e5d6652a2');\nhashMap.set('pixi','3732f052617efd5007ddbe31091a2ba026909288bac4cbbe6d2bd6ac64d85393');\nhashMap.set('poetry','17e7a8e6a233ef311acfed2663b231dbf681a6d25edc9b92ae7c063205d042fc');\nhashMap.set('pre-commit','17a5f183985ebffe98785a541d3609bf25efedc387deb3d50e9f00f02b25f615');\nhashMap.set('proto','412053d4550026b4ace490b46e970915b87ec1abf0b0a0c6c8c58ccf1fc16843');\nhashMap.set('pub','3ade8bf8232eda456e24909b4d1abce066e674c9ea9aa250c567cf621a96bf9b');\nhashMap.set('puppet','ba58ab689e44acc8f61c3569ab8b40fde01b8a9d3aad712708e2a419e57d8b45');\nhashMap.set('pyenv','9ede8becc97774f9040b40f4472d3e933534b596e04c360bfe0f3c6f95f25182');\nhashMap.set('quadlet','e1fc88a4e14cd595e89bb3d79b4adf2add3ce5eb80f75276e712c32598cca53d');\nhashMap.set('renovate-config','ca60beee2e3b871ea1216fa9df9a501f7ed355fe7da29e12509e56a124a78e69');\nhashMap.set('ruby-version','2db2140d9eee8c555e729a4de0396fa2d78846d3149890ee12fa515bd654be97');\nhashMap.set('runtime-version','b582b168c0cc595e39010feb10f4b97a82683eb269e9598216fbb11cc186e160');\nhashMap.set('rust-toolchain','6ace53db02874d73620d2d872291839820a512a9529c42d174358c692e5db720');\nhashMap.set('sbt','e508c2e2fb8d44e6cbec20f449c8eed096728566e6058187269c637930d388fb');\nhashMap.set('scalafmt','9d36159b56835e96498af026a1fb0543200db0581681ef95ec54988f411e180f');\nhashMap.set('setup-cfg','7dea08c5708625e753bd56918bc214df7fb4d8543a26e936926a21ab43b5f785');\nhashMap.set('smithy','9641b91d065ffb63be0dd888139a0402dba41e550f8b44c592db9daf52109100');\nhashMap.set('sveltos','05b3158e88771ed4629e171592cf4f1bf0ff342f8aeae89be0b340c630cc6d8e');\nhashMap.set('swift','eb5f7c3c4dabf28eed36916269ca9be16ab9ddb83993db03ea66b9195ad7bdc6');\nhashMap.set('tekton','fdc5b9b5edec2a90cda2f858f3ebc532aa8efb1187d1e0b7c89b07796e9cb6cd');\nhashMap.set('terraform','73f9d1753d1077585bd264163b7bfacaf6cf20b586b233cbb8cf058a9fce0103');\nhashMap.set('terraform-version','ec8f786b9731d47f2c2fe0307caf64d7ddd83046fe7ff1f7d8423239f8b0f2aa');\nhashMap.set('terragrunt','ffcbaa67dd65f064d43f8c121c1006115eab1879c4bd38de263b9b90a009c118');\nhashMap.set('terragrunt-version','eea6087b33717d22ede2fc68c2f64df8390b75abe82110ed831a180648feb51d');\nhashMap.set('tflint-plugin','31247d37bc80aae17039bfa21bd989c5717730c5ef10cf2a6f09841576d012ec');\nhashMap.set('travis','bb482a0195cd009ec3896a6227bb95617f5c84bedb518c7d971e50c62235d9ca');\nhashMap.set('typst','d080a79fbd961c6e21fcc505d544b7e0ff2126142acb1dcabdf6abbcd9339248');\nhashMap.set('unity3d','f13e25e115e3443f4e16cf31578acffa78fb1a5e23339680a92d8d6de6052920');\nhashMap.set('velaci','fda00ddb7cc23e9a37e0a8a253151df0a6930b4276d3e4f78cc54b9ac09af7de');\nhashMap.set('vendir','8901ee24116f7998bddcfc8d2492bff8138d9c66a23caea75c24d594ef4a504d');\nhashMap.set('woodpecker','6110d3bec33aaeb3511d4bbfa896cec3c8e02fb04a6cff50c9ba81061c851045');\nhashMap.set('xcodegen','dad511d88a9ce1dbdde8b9731f3da7f2bdaa4ca8a083294ee58d56da62ab1683');\nhashMap.set('jsonata','416bcf61144b276b3112814c6e6d261aa29608f46fbb0516c471d35c16f8f0d7');\nhashMap.set('regex','dbe6889ea021a05127fed06226d73366fdada2ae577147a5c027996fd325416e');"],"mappings":";AAAA,MAAa,0BAAU,IAAI,IAAoB;AAE/C,QAAQ,IAAI,WAAU,kEAAkE;AACxF,QAAQ,IAAI,kBAAiB,kEAAkE;AAC/F,QAAQ,IAAI,OAAM,kEAAkE;AACpF,QAAQ,IAAI,UAAS,kEAAkE;AACvF,QAAQ,IAAI,QAAO,kEAAkE;AACrF,QAAQ,IAAI,mBAAkB,kEAAkE;AAChG,QAAQ,IAAI,UAAS,kEAAkE;AACvF,QAAQ,IAAI,kBAAiB,kEAAkE;AAC/F,QAAQ,IAAI,SAAQ,kEAAkE;AACtF,QAAQ,IAAI,gBAAe,kEAAkE;AAC7F,QAAQ,IAAI,YAAW,kEAAkE;AACzF,QAAQ,IAAI,SAAQ,kEAAkE;AACtF,QAAQ,IAAI,uBAAsB,kEAAkE;AACpG,QAAQ,IAAI,WAAU,kEAAkE;AACxF,QAAQ,IAAI,aAAY,kEAAkE;AAC1F,QAAQ,IAAI,cAAa,kEAAkE;AAC3F,QAAQ,IAAI,OAAM,kEAAkE;AACpF,QAAQ,IAAI,eAAc,kEAAkE;AAC5F,QAAQ,IAAI,WAAU,kEAAkE;AACxF,QAAQ,IAAI,QAAO,kEAAkE;AACrF,QAAQ,IAAI,SAAQ,kEAAkE;AACtF,QAAQ,IAAI,UAAS,kEAAkE;AACvF,QAAQ,IAAI,YAAW,kEAAkE;AACzF,QAAQ,IAAI,cAAa,kEAAkE;AAC3F,QAAQ,IAAI,aAAY,kEAAkE;AAC1F,QAAQ,IAAI,YAAW,kEAAkE;AACzF,QAAQ,IAAI,SAAQ,kEAAkE;AACtF,QAAQ,IAAI,UAAS,kEAAkE;AACvF,QAAQ,IAAI,YAAW,kEAAkE;AACzF,QAAQ,IAAI,cAAa,kEAAkE;AAC3F,QAAQ,IAAI,QAAO,kEAAkE;AACrF,QAAQ,IAAI,QAAO,kEAAkE;AACrF,QAAQ,IAAI,YAAW,kEAAkE;AACzF,QAAQ,IAAI,UAAS,kEAAkE;AACvF,QAAQ,IAAI,gBAAe,kEAAkE;AAC7F,QAAQ,IAAI,kBAAiB,kEAAkE;AAC/F,QAAQ,IAAI,cAAa,kEAAkE;AAC3F,QAAQ,IAAI,WAAU,kEAAkE;AACxF,QAAQ,IAAI,SAAQ,kEAAkE;AACtF,QAAQ,IAAI,QAAO,kEAAkE;AACrF,QAAQ,IAAI,OAAM,kEAAkE;AACpF,QAAQ,IAAI,kBAAiB,kEAAkE;AAC/F,QAAQ,IAAI,kBAAiB,kEAAkE;AAC/F,QAAQ,IAAI,YAAW,kEAAkE;AACzF,QAAQ,IAAI,oBAAmB,kEAAkE;AACjG,QAAQ,IAAI,aAAY,kEAAkE;AAC1F,QAAQ,IAAI,SAAQ,kEAAkE;AACtF,QAAQ,IAAI,SAAQ,kEAAkE;AACtF,QAAQ,IAAI,UAAS,kEAAkE;AACvF,QAAQ,IAAI,kBAAiB,kEAAkE;AAC/F,QAAQ,IAAI,iBAAgB,kEAAkE;AAC9F,QAAQ,IAAI,qBAAoB,kEAAkE;AAClG,QAAQ,IAAI,eAAc,kEAAkE;AAC5F,QAAQ,IAAI,YAAW,kEAAkE;AACzF,QAAQ,IAAI,YAAW,kEAAkE;AACzF,QAAQ,IAAI,UAAS,kEAAkE;AACvF,QAAQ,IAAI,UAAS,kEAAkE;AACvF,QAAQ,IAAI,0BAAyB,kEAAkE;AACvG,QAAQ,IAAI,YAAW,kEAAkE;AACzF,QAAQ,IAAI,QAAO,kEAAkE;AACrF,QAAQ,IAAI,WAAU,kEAAkE;AACxF,QAAQ,IAAI,mBAAkB,kEAAkE;AAChG,QAAQ,IAAI,iBAAgB,kEAAkE;AAC9F,QAAQ,IAAI,cAAa,kEAAkE;AAC3F,QAAQ,IAAI,aAAY,kEAAkE;AAC1F,QAAQ,IAAI,aAAY,kEAAkE;AAC1F,QAAQ,IAAI,SAAQ,kEAAkE;AACtF,QAAQ,IAAI,iBAAgB,kEAAkE;AAC9F,QAAQ,IAAI,UAAS,kEAAkE;AACvF,QAAQ,IAAI,QAAO,kEAAkE;AACrF,QAAQ,IAAI,QAAO,kEAAkE;AACrF,QAAQ,IAAI,OAAM,kEAAkE;AACpF,QAAQ,IAAI,OAAM,kEAAkE;AACpF,QAAQ,IAAI,UAAS,kEAAkE;AACvF,QAAQ,IAAI,OAAM,kEAAkE;AACpF,QAAQ,IAAI,SAAQ,kEAAkE;AACtF,QAAQ,IAAI,OAAM,kEAAkE;AACpF,QAAQ,IAAI,OAAM,kEAAkE;AACpF,QAAQ,IAAI,QAAO,kEAAkE;AACrF,QAAQ,IAAI,UAAS,kEAAkE;AACvF,QAAQ,IAAI,UAAS,kEAAkE;AACvF,QAAQ,IAAI,eAAc,kEAAkE;AAC5F,QAAQ,IAAI,oBAAmB,kEAAkE;AACjG,QAAQ,IAAI,aAAY,kEAAkE;AAC1F,QAAQ,IAAI,UAAS,kEAAkE;AACvF,QAAQ,IAAI,QAAO,kEAAkE;AACrF,QAAQ,IAAI,UAAS,kEAAkE;AACvF,QAAQ,IAAI,cAAa,kEAAkE;AAC3F,QAAQ,IAAI,SAAQ,kEAAkE;AACtF,QAAQ,IAAI,OAAM,kEAAkE;AACpF,QAAQ,IAAI,UAAS,kEAAkE;AACvF,QAAQ,IAAI,SAAQ,kEAAkE;AACtF,QAAQ,IAAI,WAAU,kEAAkE;AACxF,QAAQ,IAAI,mBAAkB,kEAAkE;AAChG,QAAQ,IAAI,gBAAe,kEAAkE;AAC7F,QAAQ,IAAI,mBAAkB,kEAAkE;AAChG,QAAQ,IAAI,kBAAiB,kEAAkE;AAC/F,QAAQ,IAAI,OAAM,kEAAkE;AACpF,QAAQ,IAAI,YAAW,kEAAkE;AACzF,QAAQ,IAAI,aAAY,kEAAkE;AAC1F,QAAQ,IAAI,UAAS,kEAAkE;AACvF,QAAQ,IAAI,WAAU,kEAAkE;AACxF,QAAQ,IAAI,SAAQ,kEAAkE;AACtF,QAAQ,IAAI,UAAS,kEAAkE;AACvF,QAAQ,IAAI,aAAY,kEAAkE;AAC1F,QAAQ,IAAI,qBAAoB,kEAAkE;AAClG,QAAQ,IAAI,cAAa,kEAAkE;AAC3F,QAAQ,IAAI,sBAAqB,kEAAkE;AACnG,QAAQ,IAAI,iBAAgB,kEAAkE;AAC9F,QAAQ,IAAI,UAAS,kEAAkE;AACvF,QAAQ,IAAI,SAAQ,kEAAkE;AACtF,QAAQ,IAAI,WAAU,kEAAkE;AACxF,QAAQ,IAAI,UAAS,kEAAkE;AACvF,QAAQ,IAAI,UAAS,kEAAkE;AACvF,QAAQ,IAAI,cAAa,kEAAkE;AAC3F,QAAQ,IAAI,YAAW,kEAAkE;AACzF,QAAQ,IAAI,WAAU,kEAAkE;AACxF,QAAQ,IAAI,SAAQ,kEAAkE"}

package/dist/modules/manager/github-actions/artifacts.js

@@ -17,7 +17,11 @@ import { quote } from "shlex";
 /** The `gh` CLI extension that generates and verifies the lockfile. */
 const extensionName = "github/gh-actions-lock";
 /** The `uses:` dep types the lockfile graph is built from. */
-const lockedDepTypes = ["action", "docker"];
+const lockedDepTypes = [
+	"action",
+	"workflow",
+	"docker"
+];
 function findToken(url) {
 	return findGithubToken(find({
 		hostType: "github",

package/dist/modules/manager/github-actions/artifacts.js.map

@@ -1 +1 @@
-{"version":3,"file":"artifacts.js","names":["hostRules.find"],"sources":["../../../../lib/modules/manager/github-actions/artifacts.ts"],"sourcesContent":["import { quote } from 'shlex';\nimport { GlobalConfig } from '../../../config/global.ts';\nimport { TEMPORARY_ERROR } from '../../../constants/error-messages.ts';\nimport { logger } from '../../../logger/index.ts';\nimport { coerceArray } from '../../../util/array.ts';\nimport { findGithubToken } from '../../../util/check-token.ts';\nimport { detectPlatform } from '../../../util/common.ts';\nimport { exec } from '../../../util/exec/index.ts';\nimport type { ExecOptions, ExtraEnv } from '../../../util/exec/types.ts';\nimport { readLocalFile, writeLocalFile } from '../../../util/fs/index.ts';\nimport { getRepoStatus } from '../../../util/git/index.ts';\nimport type { FileChange } from '../../../util/git/types.ts';\nimport * as hostRules from '../../../util/host-rules.ts';\nimport { parseUrl } from '../../../util/url.ts';\nimport type { PackageFile, PostUpdateConfig } from '../types.ts';\nimport { artifactErrorMessageFromExecError } from '../util.ts';\nimport { actionsLockFile, isLockfileManaged } from './common.ts';\nimport { ActionsLockfile } from './schema.ts';\nimport type { ActionsLockfileResult, OnboardedWorkflows } from './types.ts';\n\n/** The `gh` CLI extension that generates and verifies the lockfile. */\nconst extensionName = 'github/gh-actions-lock';\n\n/** The `uses:` dep types the lockfile graph is built from. */\nconst lockedDepTypes = ['action', 'docker'];\n\nfunction findToken(url: string): string | undefined {\n  return findGithubToken(hostRules.find({ hostType: 'github', url }));\n}\n\n/**\n * `gh` takes the token from a different variable for GitHub Enterprise Server, and has to be told which host to talk to.\n *\n * Public actions are still resolved against github.com from there, so pass a token for both hosts.\n */\nfunction getTokenEnv(): ExtraEnv {\n  const githubComEndpoint = 'https://api.github.com/';\n  const configuredEndpoint = GlobalConfig.get('endpoint');\n  // The configured endpoint only says where GitHub lives when Renovate is talking to GitHub: workflows mirrored onto another platform still resolve their actions against github.com.\n  const endpoint =\n    configuredEndpoint && detectPlatform(configuredEndpoint) === 'github'\n      ? configuredEndpoint\n      : githubComEndpoint;\n\n  const hostname = parseUrl(endpoint)?.hostname;\n  const isEnterprise =\n    !!hostname && hostname !== 'api.github.com' && hostname !== 'github.com';\n\n  const env: ExtraEnv = {};\n\n  if (isEnterprise) {\n    const enterpriseToken = findToken(endpoint);\n    if (enterpriseToken) {\n      env.GH_HOST = hostname;\n      env.GH_ENTERPRISE_TOKEN = enterpriseToken;\n    }\n  }\n\n  const token = findToken(githubComEndpoint);\n  if (token) {\n    env.GH_TOKEN = token;\n  }\n\n  if (!Object.keys(env).length) {\n    logger.debug('No GitHub token found for `gh actions-lock`');\n  }\n\n  return env;\n}\n\n/**\n * Whether any updated dependency is one the lockfile records an edge for, and sits in a file `gh actions-lock` will look at.\n */\nfunction hasLockedUpdate(\n  config: PostUpdateConfig,\n  onboardedWorkflows: OnboardedWorkflows,\n): boolean {\n  return config.upgrades.some((upgrade) => {\n    if (upgrade.manager !== 'github-actions') {\n      return false;\n    }\n\n    if (!upgrade.depType || !lockedDepTypes.includes(upgrade.depType)) {\n      return false;\n    }\n\n    const packageFile = upgrade.packageFile;\n    if (!packageFile) {\n      return false;\n    }\n\n    return isLockfileManaged(packageFile, onboardedWorkflows);\n  });\n}\n\n/**\n * Regenerate `.github/workflows/actions.lock` once per branch.\n *\n * The lockfile records a transitive graph - resolved commits, numeric owner and repository IDs, and each composite action's own `uses:` edges - so it is regenerated by its own tool rather than patched here.\n * `gh actions-lock` re-reads every workflow from disk and rewrites the whole file, so this runs after all of the branch's package file updates have been flushed, in the same shape as npm's `getAdditionalFiles`.\n */\nexport async function updateActionsLockfile(\n  config: PostUpdateConfig,\n  packageFiles: Record<string, PackageFile[]> | undefined,\n): Promise<ActionsLockfileResult> {\n  const empty: ActionsLockfileResult = {\n    updatedArtifacts: [],\n    artifactErrors: [],\n  };\n\n  const ghaPackageFiles = packageFiles?.['github-actions'];\n  if (!ghaPackageFiles?.length) {\n    return empty;\n  }\n\n  if (config.skipArtifactsUpdate) {\n    logger.debug(`Skipping ${actionsLockFile} generation`);\n    return empty;\n  }\n\n  const existingLockFileContent = await readLocalFile(actionsLockFile, 'utf8');\n  if (!existingLockFileContent) {\n    logger.debug(`No ${actionsLockFile} found`);\n    return empty;\n  }\n\n  const parsedLockfile = ActionsLockfile.safeParse(existingLockFileContent);\n  if (!parsedLockfile.success) {\n    logger.warn(\n      { err: parsedLockfile.error, lockFile: actionsLockFile },\n      'Failed to parse the GitHub Actions lockfile, so not regenerating it',\n    );\n    return empty;\n  }\n\n  if (!hasLockedUpdate(config, parsedLockfile.data.workflows)) {\n    logger.debug(`No locked dependencies updated for ${actionsLockFile}`);\n    return empty;\n  }\n\n  logger.debug(`Regenerating ${actionsLockFile}`);\n\n  const ghaPackageFilePaths = new Set(\n    ghaPackageFiles.map((file) => file.packageFile),\n  );\n\n  // Ensure that in-memory file contents are flushed to disk, so `actions-lock` can run against it.\n  // A branch can group updates from other managers, whose contents may be binary - a Gradle wrapper JAR, say - so only write the workflows which the tool actually reads.\n  const writtenContent = new Map<string, string>();\n  for (const file of coerceArray(config.updatedPackageFiles)) {\n    if (file.type === 'addition' && ghaPackageFilePaths.has(file.path)) {\n      const contents = file.contents!.toString();\n      await writeLocalFile(file.path, contents);\n      writtenContent.set(file.path, contents);\n    }\n  }\n\n  const tokenEnv = getTokenEnv();\n\n  const execOptions: ExecOptions = {\n    // The tool rescans every workflow, so it runs from the repository root\n    cwd: GlobalConfig.get('localDir'),\n    // `extraEnv` is what forwards a variable into the Docker sidecar, but on its own it is only a default: `getChildEnv` lets a same-named variable in Renovate's own environment win.\n    // The token we resolved from the host rules must not be shadowed by an ambient `GH_TOKEN`, so force it as well.\n    extraEnv: tokenEnv,\n    env: tokenEnv,\n    toolConstraints: [{ toolName: 'gh', constraint: config.constraints?.gh }],\n    docker: {},\n  };\n\n  // `--no-interactive`: we have no terminal to answer prompts with\n  // `--no-narrow`: keep the ref that we wrote, to avoid a `@v4` being rewritten as `@v4.2.1`\n  // `--no-migrate-local-actions`: on-by-default, but unrelated to our lockfile updates\n  const commands = [\n    'gh actions-lock --no-interactive --no-narrow --no-migrate-local-actions',\n  ];\n\n  // `binarySource=global` means the administrator provisions tooling, so we must not reach into their `gh` install to add or re-pin an extension.\n  // They own the extension version, and `constraints.ghActionsLock` does not apply.\n  // TODO replace once containerbase/base#7279 is available\n  if (GlobalConfig.get('binarySource') === 'global') {\n    // Debug rather than warn: `constraints.ghActionsLock` ships with a default, so we cannot tell an explicit override from the default here, and warning would fire for every repository on this `binarySource`.\n    logger.once.debug(\n      { constraint: config.constraints?.ghActionsLock },\n      'Not installing the `gh-actions-lock` extension, and ignoring `constraints.ghActionsLock`, because `binarySource=global` leaves tooling to the administrator',\n    );\n  } else {\n    // `--force` makes an install a no-op when the specified version is already installed\n    if (config.constraints?.ghActionsLock) {\n      commands.unshift(\n        `gh extension install ${extensionName} --force --pin ${quote(config.constraints?.ghActionsLock)}`,\n      );\n    } else {\n      commands.unshift(`gh extension install ${extensionName} --force`);\n    }\n  }\n\n  try {\n    await exec(commands, execOptions);\n  } catch (err) {\n    if (err.message === TEMPORARY_ERROR) {\n      throw err;\n    }\n    logger.debug({ err }, `Error updating ${actionsLockFile}`);\n    return {\n      updatedArtifacts: [],\n      artifactErrors: [\n        {\n          fileName: actionsLockFile,\n          // an `ExecError` always carries a `stderr`, so fall back to the message rather than rendering an artifact error with nothing in it\n          stderr: artifactErrorMessageFromExecError(err, err.message),\n        },\n      ],\n    };\n  }\n\n  const updatedArtifacts: FileChange[] = [];\n\n  const newLockFileContent = await readLocalFile(actionsLockFile, 'utf8');\n  if (newLockFileContent && newLockFileContent !== existingLockFileContent) {\n    updatedArtifacts.push({\n      type: 'addition',\n      path: actionsLockFile,\n      contents: newLockFileContent,\n    });\n  }\n\n  // `actions-lock` may annotate workflows being managed with i.e. `# This workflow is managed by gh actions-lock.`, even if there were no updates to that workflow in this branch.\n  // We should diff against Git, rather than against the branch's own updated package files, otherwise those annotations are left behind as uncommitted changes\n  const status = await getRepoStatus();\n  for (const path of status.modified) {\n    // ignore the lockfile, as we've already committed it above, and any file which another manager owns\n    if (path === actionsLockFile || !ghaPackageFilePaths.has(path)) {\n      continue;\n    }\n\n    const newContent = await readLocalFile(path, 'utf8');\n    // Whatever this branch wrote is committed as a package file update already, so only content which the tool changed on top of it is an artifact\n    if (!newContent || newContent === writtenContent.get(path)) {\n      continue;\n    }\n    logger.debug(`\\`gh actions-lock\\` annotated ${path}`);\n    updatedArtifacts.push({\n      type: 'addition',\n      path,\n      contents: newContent,\n    });\n  }\n\n  if (!updatedArtifacts.length) {\n    logger.debug(`${actionsLockFile} is unchanged`);\n  }\n\n  return { updatedArtifacts, artifactErrors: [] };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAqBA,MAAM,gBAAgB;;AAGtB,MAAM,iBAAiB,CAAC,UAAU,QAAQ;AAE1C,SAAS,UAAU,KAAiC;CAClD,OAAO,gBAAgBA,KAAe;EAAE,UAAU;EAAU;CAAI,CAAC,CAAC;AACpE;;;;;;AAOA,SAAS,cAAwB;CAC/B,MAAM,oBAAoB;CAC1B,MAAM,qBAAqB,aAAa,IAAI,UAAU;CAEtD,MAAM,WACJ,sBAAsB,eAAe,kBAAkB,MAAM,WACzD,qBACA;CAEN,MAAM,WAAW,SAAS,QAAQ,CAAC,EAAE;CACrC,MAAM,eACJ,CAAC,CAAC,YAAY,aAAa,oBAAoB,aAAa;CAE9D,MAAM,MAAgB,CAAC;CAEvB,IAAI,cAAc;EAChB,MAAM,kBAAkB,UAAU,QAAQ;EAC1C,IAAI,iBAAiB;GACnB,IAAI,UAAU;GACd,IAAI,sBAAsB;EAC5B;CACF;CAEA,MAAM,QAAQ,UAAU,iBAAiB;CACzC,IAAI,OACF,IAAI,WAAW;CAGjB,IAAI,CAAC,OAAO,KAAK,GAAG,CAAC,CAAC,QACpB,OAAO,MAAM,6CAA6C;CAG5D,OAAO;AACT;;;;AAKA,SAAS,gBACP,QACA,oBACS;CACT,OAAO,OAAO,SAAS,MAAM,YAAY;EACvC,IAAI,QAAQ,YAAY,kBACtB,OAAO;EAGT,IAAI,CAAC,QAAQ,WAAW,CAAC,eAAe,SAAS,QAAQ,OAAO,GAC9D,OAAO;EAGT,MAAM,cAAc,QAAQ;EAC5B,IAAI,CAAC,aACH,OAAO;EAGT,OAAO,kBAAkB,aAAa,kBAAkB;CAC1D,CAAC;AACH;;;;;;;AAQA,eAAsB,sBACpB,QACA,cACgC;CAChC,MAAM,QAA+B;EACnC,kBAAkB,CAAC;EACnB,gBAAgB,CAAC;CACnB;CAEA,MAAM,kBAAkB,eAAe;CACvC,IAAI,CAAC,iBAAiB,QACpB,OAAO;CAGT,IAAI,OAAO,qBAAqB;EAC9B,OAAO,MAAM,YAAY,gBAAgB,YAAY;EACrD,OAAO;CACT;CAEA,MAAM,0BAA0B,MAAM,cAAc,iBAAiB,MAAM;CAC3E,IAAI,CAAC,yBAAyB;EAC5B,OAAO,MAAM,MAAM,gBAAgB,OAAO;EAC1C,OAAO;CACT;CAEA,MAAM,iBAAiB,gBAAgB,UAAU,uBAAuB;CACxE,IAAI,CAAC,eAAe,SAAS;EAC3B,OAAO,KACL;GAAE,KAAK,eAAe;GAAO,UAAU;EAAgB,GACvD,qEACF;EACA,OAAO;CACT;CAEA,IAAI,CAAC,gBAAgB,QAAQ,eAAe,KAAK,SAAS,GAAG;EAC3D,OAAO,MAAM,sCAAsC,iBAAiB;EACpE,OAAO;CACT;CAEA,OAAO,MAAM,gBAAgB,iBAAiB;CAE9C,MAAM,sBAAsB,IAAI,IAC9B,gBAAgB,KAAK,SAAS,KAAK,WAAW,CAChD;CAIA,MAAM,iCAAiB,IAAI,IAAoB;CAC/C,KAAK,MAAM,QAAQ,YAAY,OAAO,mBAAmB,GACvD,IAAI,KAAK,SAAS,cAAc,oBAAoB,IAAI,KAAK,IAAI,GAAG;EAClE,MAAM,WAAW,KAAK,SAAU,SAAS;EACzC,MAAM,eAAe,KAAK,MAAM,QAAQ;EACxC,eAAe,IAAI,KAAK,MAAM,QAAQ;CACxC;CAGF,MAAM,WAAW,YAAY;CAE7B,MAAM,cAA2B;EAE/B,KAAK,aAAa,IAAI,UAAU;EAGhC,UAAU;EACV,KAAK;EACL,iBAAiB,CAAC;GAAE,UAAU;GAAM,YAAY,OAAO,aAAa;EAAG,CAAC;EACxE,QAAQ,CAAC;CACX;CAKA,MAAM,WAAW,CACf,yEACF;CAKA,IAAI,aAAa,IAAI,cAAc,MAAM,UAEvC,OAAO,KAAK,MACV,EAAE,YAAY,OAAO,aAAa,cAAc,GAChD,6JACF;MAGA,IAAI,OAAO,aAAa,eACtB,SAAS,QACP,wBAAwB,cAAc,iBAAiB,MAAM,OAAO,aAAa,aAAa,GAChG;MAEA,SAAS,QAAQ,wBAAwB,cAAc,SAAS;CAIpE,IAAI;EACF,MAAM,KAAK,UAAU,WAAW;CAClC,SAAS,KAAK;EACZ,IAAI,IAAI,YAAA,mBACN,MAAM;EAER,OAAO,MAAM,EAAE,IAAI,GAAG,kBAAkB,iBAAiB;EACzD,OAAO;GACL,kBAAkB,CAAC;GACnB,gBAAgB,CACd;IACE,UAAU;IAEV,QAAQ,kCAAkC,KAAK,IAAI,OAAO;GAC5D,CACF;EACF;CACF;CAEA,MAAM,mBAAiC,CAAC;CAExC,MAAM,qBAAqB,MAAM,cAAc,iBAAiB,MAAM;CACtE,IAAI,sBAAsB,uBAAuB,yBAC/C,iBAAiB,KAAK;EACpB,MAAM;EACN,MAAM;EACN,UAAU;CACZ,CAAC;CAKH,MAAM,SAAS,MAAM,cAAc;CACnC,KAAK,MAAM,QAAQ,OAAO,UAAU;EAElC,IAAI,SAAA,oCAA4B,CAAC,oBAAoB,IAAI,IAAI,GAC3D;EAGF,MAAM,aAAa,MAAM,cAAc,MAAM,MAAM;EAEnD,IAAI,CAAC,cAAc,eAAe,eAAe,IAAI,IAAI,GACvD;EAEF,OAAO,MAAM,iCAAiC,MAAM;EACpD,iBAAiB,KAAK;GACpB,MAAM;GACN;GACA,UAAU;EACZ,CAAC;CACH;CAEA,IAAI,CAAC,iBAAiB,QACpB,OAAO,MAAM,GAAG,gBAAgB,cAAc;CAGhD,OAAO;EAAE;EAAkB,gBAAgB,CAAC;CAAE;AAChD"}
+{"version":3,"file":"artifacts.js","names":["hostRules.find"],"sources":["../../../../lib/modules/manager/github-actions/artifacts.ts"],"sourcesContent":["import { quote } from 'shlex';\nimport { GlobalConfig } from '../../../config/global.ts';\nimport { TEMPORARY_ERROR } from '../../../constants/error-messages.ts';\nimport { logger } from '../../../logger/index.ts';\nimport { coerceArray } from '../../../util/array.ts';\nimport { findGithubToken } from '../../../util/check-token.ts';\nimport { detectPlatform } from '../../../util/common.ts';\nimport { exec } from '../../../util/exec/index.ts';\nimport type { ExecOptions, ExtraEnv } from '../../../util/exec/types.ts';\nimport { readLocalFile, writeLocalFile } from '../../../util/fs/index.ts';\nimport { getRepoStatus } from '../../../util/git/index.ts';\nimport type { FileChange } from '../../../util/git/types.ts';\nimport * as hostRules from '../../../util/host-rules.ts';\nimport { parseUrl } from '../../../util/url.ts';\nimport type { PackageFile, PostUpdateConfig } from '../types.ts';\nimport { artifactErrorMessageFromExecError } from '../util.ts';\nimport { actionsLockFile, isLockfileManaged } from './common.ts';\nimport { ActionsLockfile } from './schema.ts';\nimport type { ActionsLockfileResult, OnboardedWorkflows } from './types.ts';\n\n/** The `gh` CLI extension that generates and verifies the lockfile. */\nconst extensionName = 'github/gh-actions-lock';\n\n/** The `uses:` dep types the lockfile graph is built from. */\nconst lockedDepTypes = ['action', 'workflow', 'docker'];\n\nfunction findToken(url: string): string | undefined {\n  return findGithubToken(hostRules.find({ hostType: 'github', url }));\n}\n\n/**\n * `gh` takes the token from a different variable for GitHub Enterprise Server, and has to be told which host to talk to.\n *\n * Public actions are still resolved against github.com from there, so pass a token for both hosts.\n */\nfunction getTokenEnv(): ExtraEnv {\n  const githubComEndpoint = 'https://api.github.com/';\n  const configuredEndpoint = GlobalConfig.get('endpoint');\n  // The configured endpoint only says where GitHub lives when Renovate is talking to GitHub: workflows mirrored onto another platform still resolve their actions against github.com.\n  const endpoint =\n    configuredEndpoint && detectPlatform(configuredEndpoint) === 'github'\n      ? configuredEndpoint\n      : githubComEndpoint;\n\n  const hostname = parseUrl(endpoint)?.hostname;\n  const isEnterprise =\n    !!hostname && hostname !== 'api.github.com' && hostname !== 'github.com';\n\n  const env: ExtraEnv = {};\n\n  if (isEnterprise) {\n    const enterpriseToken = findToken(endpoint);\n    if (enterpriseToken) {\n      env.GH_HOST = hostname;\n      env.GH_ENTERPRISE_TOKEN = enterpriseToken;\n    }\n  }\n\n  const token = findToken(githubComEndpoint);\n  if (token) {\n    env.GH_TOKEN = token;\n  }\n\n  if (!Object.keys(env).length) {\n    logger.debug('No GitHub token found for `gh actions-lock`');\n  }\n\n  return env;\n}\n\n/**\n * Whether any updated dependency is one the lockfile records an edge for, and sits in a file `gh actions-lock` will look at.\n */\nfunction hasLockedUpdate(\n  config: PostUpdateConfig,\n  onboardedWorkflows: OnboardedWorkflows,\n): boolean {\n  return config.upgrades.some((upgrade) => {\n    if (upgrade.manager !== 'github-actions') {\n      return false;\n    }\n\n    if (!upgrade.depType || !lockedDepTypes.includes(upgrade.depType)) {\n      return false;\n    }\n\n    const packageFile = upgrade.packageFile;\n    if (!packageFile) {\n      return false;\n    }\n\n    return isLockfileManaged(packageFile, onboardedWorkflows);\n  });\n}\n\n/**\n * Regenerate `.github/workflows/actions.lock` once per branch.\n *\n * The lockfile records a transitive graph - resolved commits, numeric owner and repository IDs, and each composite action's own `uses:` edges - so it is regenerated by its own tool rather than patched here.\n * `gh actions-lock` re-reads every workflow from disk and rewrites the whole file, so this runs after all of the branch's package file updates have been flushed, in the same shape as npm's `getAdditionalFiles`.\n */\nexport async function updateActionsLockfile(\n  config: PostUpdateConfig,\n  packageFiles: Record<string, PackageFile[]> | undefined,\n): Promise<ActionsLockfileResult> {\n  const empty: ActionsLockfileResult = {\n    updatedArtifacts: [],\n    artifactErrors: [],\n  };\n\n  const ghaPackageFiles = packageFiles?.['github-actions'];\n  if (!ghaPackageFiles?.length) {\n    return empty;\n  }\n\n  if (config.skipArtifactsUpdate) {\n    logger.debug(`Skipping ${actionsLockFile} generation`);\n    return empty;\n  }\n\n  const existingLockFileContent = await readLocalFile(actionsLockFile, 'utf8');\n  if (!existingLockFileContent) {\n    logger.debug(`No ${actionsLockFile} found`);\n    return empty;\n  }\n\n  const parsedLockfile = ActionsLockfile.safeParse(existingLockFileContent);\n  if (!parsedLockfile.success) {\n    logger.warn(\n      { err: parsedLockfile.error, lockFile: actionsLockFile },\n      'Failed to parse the GitHub Actions lockfile, so not regenerating it',\n    );\n    return empty;\n  }\n\n  if (!hasLockedUpdate(config, parsedLockfile.data.workflows)) {\n    logger.debug(`No locked dependencies updated for ${actionsLockFile}`);\n    return empty;\n  }\n\n  logger.debug(`Regenerating ${actionsLockFile}`);\n\n  const ghaPackageFilePaths = new Set(\n    ghaPackageFiles.map((file) => file.packageFile),\n  );\n\n  // Ensure that in-memory file contents are flushed to disk, so `actions-lock` can run against it.\n  // A branch can group updates from other managers, whose contents may be binary - a Gradle wrapper JAR, say - so only write the workflows which the tool actually reads.\n  const writtenContent = new Map<string, string>();\n  for (const file of coerceArray(config.updatedPackageFiles)) {\n    if (file.type === 'addition' && ghaPackageFilePaths.has(file.path)) {\n      const contents = file.contents!.toString();\n      await writeLocalFile(file.path, contents);\n      writtenContent.set(file.path, contents);\n    }\n  }\n\n  const tokenEnv = getTokenEnv();\n\n  const execOptions: ExecOptions = {\n    // The tool rescans every workflow, so it runs from the repository root\n    cwd: GlobalConfig.get('localDir'),\n    // `extraEnv` is what forwards a variable into the Docker sidecar, but on its own it is only a default: `getChildEnv` lets a same-named variable in Renovate's own environment win.\n    // The token we resolved from the host rules must not be shadowed by an ambient `GH_TOKEN`, so force it as well.\n    extraEnv: tokenEnv,\n    env: tokenEnv,\n    toolConstraints: [{ toolName: 'gh', constraint: config.constraints?.gh }],\n    docker: {},\n  };\n\n  // `--no-interactive`: we have no terminal to answer prompts with\n  // `--no-narrow`: keep the ref that we wrote, to avoid a `@v4` being rewritten as `@v4.2.1`\n  // `--no-migrate-local-actions`: on-by-default, but unrelated to our lockfile updates\n  const commands = [\n    'gh actions-lock --no-interactive --no-narrow --no-migrate-local-actions',\n  ];\n\n  // `binarySource=global` means the administrator provisions tooling, so we must not reach into their `gh` install to add or re-pin an extension.\n  // They own the extension version, and `constraints.ghActionsLock` does not apply.\n  // TODO replace once containerbase/base#7279 is available\n  if (GlobalConfig.get('binarySource') === 'global') {\n    // Debug rather than warn: `constraints.ghActionsLock` ships with a default, so we cannot tell an explicit override from the default here, and warning would fire for every repository on this `binarySource`.\n    logger.once.debug(\n      { constraint: config.constraints?.ghActionsLock },\n      'Not installing the `gh-actions-lock` extension, and ignoring `constraints.ghActionsLock`, because `binarySource=global` leaves tooling to the administrator',\n    );\n  } else {\n    // `--force` makes an install a no-op when the specified version is already installed\n    if (config.constraints?.ghActionsLock) {\n      commands.unshift(\n        `gh extension install ${extensionName} --force --pin ${quote(config.constraints?.ghActionsLock)}`,\n      );\n    } else {\n      commands.unshift(`gh extension install ${extensionName} --force`);\n    }\n  }\n\n  try {\n    await exec(commands, execOptions);\n  } catch (err) {\n    if (err.message === TEMPORARY_ERROR) {\n      throw err;\n    }\n    logger.debug({ err }, `Error updating ${actionsLockFile}`);\n    return {\n      updatedArtifacts: [],\n      artifactErrors: [\n        {\n          fileName: actionsLockFile,\n          // an `ExecError` always carries a `stderr`, so fall back to the message rather than rendering an artifact error with nothing in it\n          stderr: artifactErrorMessageFromExecError(err, err.message),\n        },\n      ],\n    };\n  }\n\n  const updatedArtifacts: FileChange[] = [];\n\n  const newLockFileContent = await readLocalFile(actionsLockFile, 'utf8');\n  if (newLockFileContent && newLockFileContent !== existingLockFileContent) {\n    updatedArtifacts.push({\n      type: 'addition',\n      path: actionsLockFile,\n      contents: newLockFileContent,\n    });\n  }\n\n  // `actions-lock` may annotate workflows being managed with i.e. `# This workflow is managed by gh actions-lock.`, even if there were no updates to that workflow in this branch.\n  // We should diff against Git, rather than against the branch's own updated package files, otherwise those annotations are left behind as uncommitted changes\n  const status = await getRepoStatus();\n  for (const path of status.modified) {\n    // ignore the lockfile, as we've already committed it above, and any file which another manager owns\n    if (path === actionsLockFile || !ghaPackageFilePaths.has(path)) {\n      continue;\n    }\n\n    const newContent = await readLocalFile(path, 'utf8');\n    // Whatever this branch wrote is committed as a package file update already, so only content which the tool changed on top of it is an artifact\n    if (!newContent || newContent === writtenContent.get(path)) {\n      continue;\n    }\n    logger.debug(`\\`gh actions-lock\\` annotated ${path}`);\n    updatedArtifacts.push({\n      type: 'addition',\n      path,\n      contents: newContent,\n    });\n  }\n\n  if (!updatedArtifacts.length) {\n    logger.debug(`${actionsLockFile} is unchanged`);\n  }\n\n  return { updatedArtifacts, artifactErrors: [] };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAqBA,MAAM,gBAAgB;;AAGtB,MAAM,iBAAiB;CAAC;CAAU;CAAY;AAAQ;AAEtD,SAAS,UAAU,KAAiC;CAClD,OAAO,gBAAgBA,KAAe;EAAE,UAAU;EAAU;CAAI,CAAC,CAAC;AACpE;;;;;;AAOA,SAAS,cAAwB;CAC/B,MAAM,oBAAoB;CAC1B,MAAM,qBAAqB,aAAa,IAAI,UAAU;CAEtD,MAAM,WACJ,sBAAsB,eAAe,kBAAkB,MAAM,WACzD,qBACA;CAEN,MAAM,WAAW,SAAS,QAAQ,CAAC,EAAE;CACrC,MAAM,eACJ,CAAC,CAAC,YAAY,aAAa,oBAAoB,aAAa;CAE9D,MAAM,MAAgB,CAAC;CAEvB,IAAI,cAAc;EAChB,MAAM,kBAAkB,UAAU,QAAQ;EAC1C,IAAI,iBAAiB;GACnB,IAAI,UAAU;GACd,IAAI,sBAAsB;EAC5B;CACF;CAEA,MAAM,QAAQ,UAAU,iBAAiB;CACzC,IAAI,OACF,IAAI,WAAW;CAGjB,IAAI,CAAC,OAAO,KAAK,GAAG,CAAC,CAAC,QACpB,OAAO,MAAM,6CAA6C;CAG5D,OAAO;AACT;;;;AAKA,SAAS,gBACP,QACA,oBACS;CACT,OAAO,OAAO,SAAS,MAAM,YAAY;EACvC,IAAI,QAAQ,YAAY,kBACtB,OAAO;EAGT,IAAI,CAAC,QAAQ,WAAW,CAAC,eAAe,SAAS,QAAQ,OAAO,GAC9D,OAAO;EAGT,MAAM,cAAc,QAAQ;EAC5B,IAAI,CAAC,aACH,OAAO;EAGT,OAAO,kBAAkB,aAAa,kBAAkB;CAC1D,CAAC;AACH;;;;;;;AAQA,eAAsB,sBACpB,QACA,cACgC;CAChC,MAAM,QAA+B;EACnC,kBAAkB,CAAC;EACnB,gBAAgB,CAAC;CACnB;CAEA,MAAM,kBAAkB,eAAe;CACvC,IAAI,CAAC,iBAAiB,QACpB,OAAO;CAGT,IAAI,OAAO,qBAAqB;EAC9B,OAAO,MAAM,YAAY,gBAAgB,YAAY;EACrD,OAAO;CACT;CAEA,MAAM,0BAA0B,MAAM,cAAc,iBAAiB,MAAM;CAC3E,IAAI,CAAC,yBAAyB;EAC5B,OAAO,MAAM,MAAM,gBAAgB,OAAO;EAC1C,OAAO;CACT;CAEA,MAAM,iBAAiB,gBAAgB,UAAU,uBAAuB;CACxE,IAAI,CAAC,eAAe,SAAS;EAC3B,OAAO,KACL;GAAE,KAAK,eAAe;GAAO,UAAU;EAAgB,GACvD,qEACF;EACA,OAAO;CACT;CAEA,IAAI,CAAC,gBAAgB,QAAQ,eAAe,KAAK,SAAS,GAAG;EAC3D,OAAO,MAAM,sCAAsC,iBAAiB;EACpE,OAAO;CACT;CAEA,OAAO,MAAM,gBAAgB,iBAAiB;CAE9C,MAAM,sBAAsB,IAAI,IAC9B,gBAAgB,KAAK,SAAS,KAAK,WAAW,CAChD;CAIA,MAAM,iCAAiB,IAAI,IAAoB;CAC/C,KAAK,MAAM,QAAQ,YAAY,OAAO,mBAAmB,GACvD,IAAI,KAAK,SAAS,cAAc,oBAAoB,IAAI,KAAK,IAAI,GAAG;EAClE,MAAM,WAAW,KAAK,SAAU,SAAS;EACzC,MAAM,eAAe,KAAK,MAAM,QAAQ;EACxC,eAAe,IAAI,KAAK,MAAM,QAAQ;CACxC;CAGF,MAAM,WAAW,YAAY;CAE7B,MAAM,cAA2B;EAE/B,KAAK,aAAa,IAAI,UAAU;EAGhC,UAAU;EACV,KAAK;EACL,iBAAiB,CAAC;GAAE,UAAU;GAAM,YAAY,OAAO,aAAa;EAAG,CAAC;EACxE,QAAQ,CAAC;CACX;CAKA,MAAM,WAAW,CACf,yEACF;CAKA,IAAI,aAAa,IAAI,cAAc,MAAM,UAEvC,OAAO,KAAK,MACV,EAAE,YAAY,OAAO,aAAa,cAAc,GAChD,6JACF;MAGA,IAAI,OAAO,aAAa,eACtB,SAAS,QACP,wBAAwB,cAAc,iBAAiB,MAAM,OAAO,aAAa,aAAa,GAChG;MAEA,SAAS,QAAQ,wBAAwB,cAAc,SAAS;CAIpE,IAAI;EACF,MAAM,KAAK,UAAU,WAAW;CAClC,SAAS,KAAK;EACZ,IAAI,IAAI,YAAA,mBACN,MAAM;EAER,OAAO,MAAM,EAAE,IAAI,GAAG,kBAAkB,iBAAiB;EACzD,OAAO;GACL,kBAAkB,CAAC;GACnB,gBAAgB,CACd;IACE,UAAU;IAEV,QAAQ,kCAAkC,KAAK,IAAI,OAAO;GAC5D,CACF;EACF;CACF;CAEA,MAAM,mBAAiC,CAAC;CAExC,MAAM,qBAAqB,MAAM,cAAc,iBAAiB,MAAM;CACtE,IAAI,sBAAsB,uBAAuB,yBAC/C,iBAAiB,KAAK;EACpB,MAAM;EACN,MAAM;EACN,UAAU;CACZ,CAAC;CAKH,MAAM,SAAS,MAAM,cAAc;CACnC,KAAK,MAAM,QAAQ,OAAO,UAAU;EAElC,IAAI,SAAA,oCAA4B,CAAC,oBAAoB,IAAI,IAAI,GAC3D;EAGF,MAAM,aAAa,MAAM,cAAc,MAAM,MAAM;EAEnD,IAAI,CAAC,cAAc,eAAe,eAAe,IAAI,IAAI,GACvD;EAEF,OAAO,MAAM,iCAAiC,MAAM;EACpD,iBAAiB,KAAK;GACpB,MAAM;GACN;GACA,UAAU;EACZ,CAAC;CACH;CAEA,IAAI,CAAC,iBAAiB,QACpB,OAAO,MAAM,GAAG,gBAAgB,cAAc;CAGhD,OAAO;EAAE;EAAkB,gBAAgB,CAAC;CAAE;AAChD"}

package/dist/modules/manager/github-actions/dep-types.js

@@ -4,6 +4,10 @@ const knownDepTypes = [
 		depType: "action",
 		description: "A repository-based action reference in a `uses:` field (e.g. `actions/checkout@v4`)"
 	},
+	{
+		depType: "workflow",
+		description: "A reusable workflow referenced in a job-level `uses:` field (e.g. `owner/repo/.github/workflows/release.yml@v1`)"
+	},
 	{
 		depType: "docker",
 		description: "A Docker image reference in a `uses:` field (e.g. `uses: docker://alpine:3`)"

package/dist/modules/manager/github-actions/dep-types.js.map

@@ -1 +1 @@
-{"version":3,"file":"dep-types.js","names":[],"sources":["../../../../lib/modules/manager/github-actions/dep-types.ts"],"sourcesContent":["import type { DepTypeMetadata } from '../types.ts';\n\nexport const knownDepTypes = [\n  {\n    depType: 'action',\n    description:\n      'A repository-based action reference in a `uses:` field (e.g. `actions/checkout@v4`)',\n  },\n  {\n    depType: 'docker',\n    description:\n      'A Docker image reference in a `uses:` field (e.g. `uses: docker://alpine:3`)',\n  },\n  {\n    depType: 'container',\n    description: \"A Docker image specified in a job's `container:` field\",\n  },\n  {\n    depType: 'service',\n    description: \"A Docker image specified in a job's `services:` field\",\n  },\n  {\n    depType: 'github-runner',\n    description:\n      'A GitHub-hosted runner version in a `runs-on:` field (e.g. `ubuntu-24.04`)',\n  },\n  {\n    depType: 'uses-with',\n    description:\n      'A language/runtime version passed as an input to a versioned action (e.g. `node-version` for `actions/setup-node`)',\n  },\n] as const satisfies readonly DepTypeMetadata[];\n"],"mappings":";AAEA,MAAa,gBAAgB;CAC3B;EACE,SAAS;EACT,aACE;CACJ;CACA;EACE,SAAS;EACT,aACE;CACJ;CACA;EACE,SAAS;EACT,aAAa;CACf;CACA;EACE,SAAS;EACT,aAAa;CACf;CACA;EACE,SAAS;EACT,aACE;CACJ;CACA;EACE,SAAS;EACT,aACE;CACJ;AACF"}
+{"version":3,"file":"dep-types.js","names":[],"sources":["../../../../lib/modules/manager/github-actions/dep-types.ts"],"sourcesContent":["import type { DepTypeMetadata } from '../types.ts';\n\nexport const knownDepTypes = [\n  {\n    depType: 'action',\n    description:\n      'A repository-based action reference in a `uses:` field (e.g. `actions/checkout@v4`)',\n  },\n  {\n    depType: 'workflow',\n    description:\n      'A reusable workflow referenced in a job-level `uses:` field (e.g. `owner/repo/.github/workflows/release.yml@v1`)',\n  },\n  {\n    depType: 'docker',\n    description:\n      'A Docker image reference in a `uses:` field (e.g. `uses: docker://alpine:3`)',\n  },\n  {\n    depType: 'container',\n    description: \"A Docker image specified in a job's `container:` field\",\n  },\n  {\n    depType: 'service',\n    description: \"A Docker image specified in a job's `services:` field\",\n  },\n  {\n    depType: 'github-runner',\n    description:\n      'A GitHub-hosted runner version in a `runs-on:` field (e.g. `ubuntu-24.04`)',\n  },\n  {\n    depType: 'uses-with',\n    description:\n      'A language/runtime version passed as an input to a versioned action (e.g. `node-version` for `actions/setup-node`)',\n  },\n] as const satisfies readonly DepTypeMetadata[];\n"],"mappings":";AAEA,MAAa,gBAAgB;CAC3B;EACE,SAAS;EACT,aACE;CACJ;CACA;EACE,SAAS;EACT,aACE;CACJ;CACA;EACE,SAAS;EACT,aACE;CACJ;CACA;EACE,SAAS;EACT,aAAa;CACf;CACA;EACE,SAAS;EACT,aAAa;CACf;CACA;EACE,SAAS;EACT,aACE;CACJ;CACA;EACE,SAAS;EACT,aACE;CACJ;AACF"}

package/dist/modules/manager/github-actions/extract.js

@@ -44,6 +44,7 @@ function extractDockerAction(actionRef, config) {
 	dep.replaceString = actionRef.originalRef;
 	return dep;
 }
+const reusableWorkflowPathRe = regEx(/^\.github\/workflows\/[^/]+\.ya?ml$/);
 function extractRepositoryAction(actionRef, parsed, customRegistryUrlsPackageDependency) {
 	const { replaceString: valueString, quote, commentData, commentPrecedingWhitespace } = parsed;
 	const { owner, repo, path: subPath, ref, hostname, isExplicitHostname } = actionRef;
@@ -51,13 +52,15 @@ function extractRepositoryAction(actionRef, parsed, customRegistryUrlsPackageDep
 	const packageName = `${owner}/${repo}`;
 	const depName = `${registryUrl}${packageName}`;
 	const pathSuffix = subPath ? `/${subPath}` : "";
+	const commentWs = commentPrecedingWhitespace || " ";
+	const isReusableWorkflow = !!subPath && reusableWorkflowPathRe.test(subPath);
 	const dep = {
 		depName,
 		commitMessageTopic: "{{{depName}}} action",
 		versioning: id$1,
-		depType: "action",
+		depType: isReusableWorkflow ? "workflow" : "action",
 		replaceString: valueString,
-		autoReplaceStringTemplate: `${quote}{{depName}}${pathSuffix}@{{#if newDigest}}{{newDigest}}${quote}{{#if newValue}}${commentPrecedingWhitespace || " "}# {{newValue}}{{/if}}{{/if}}{{#unless newDigest}}{{newValue}}${quote}{{/unless}}`,
+		autoReplaceStringTemplate: `${quote}{{depName}}${pathSuffix}@{{#if newDigest}}{{newDigest}}${quote}{{#if newValue}}${commentWs}# {{newValue}}{{/if}}{{/if}}{{#unless newDigest}}{{newValue}}${quote}{{/unless}}`,
 		...isExplicitHostname ? detectDatasource(registryUrl) : customRegistryUrlsPackageDependency
 	};
 	if (packageName !== depName) dep.packageName = packageName;
@@ -243,7 +246,7 @@ async function extractPackageFile(content, packageFile, config = {}) {
 	if (!deps.length) return null;
 	const res = { deps };
 	if (await isManagedByLockfile(packageFile)) {
-		for (const dep of deps) if (dep.depType === "action") dep.digestManagedExternally = true;
+		for (const dep of deps) if (dep.depType === "action" || dep.depType === "workflow") dep.digestManagedExternally = true;
 	}
 	return res;
 }

package/dist/modules/manager/github-actions/extract.js.map

@@ -1 +1 @@
-{"version":3,"file":"extract.js","names":["githubActionsVersioning.id","exactVersioning.id","nodeVersioning.id","memCache.get"],"sources":["../../../../lib/modules/manager/github-actions/extract.ts"],"sourcesContent":["import is from '@sindresorhus/is';\nimport { GlobalConfig } from '../../../config/global.ts';\nimport { logger, withMeta } from '../../../logger/index.ts';\nimport * as memCache from '../../../util/cache/memory/index.ts';\nimport { detectPlatform } from '../../../util/common.ts';\nimport { readLocalFile } from '../../../util/fs/index.ts';\nimport { newlineRegex, regEx } from '../../../util/regex.ts';\nimport { parseUrl } from '../../../util/url.ts';\nimport { ForgejoTagsDatasource } from '../../datasource/forgejo-tags/index.ts';\nimport { GiteaTagsDatasource } from '../../datasource/gitea-tags/index.ts';\nimport { GithubDigestDatasource } from '../../datasource/github-digest/index.ts';\nimport { GithubReleasesDatasource } from '../../datasource/github-releases/index.ts';\nimport { GithubRunnersDatasource } from '../../datasource/github-runners/index.ts';\nimport { GithubTagsDatasource } from '../../datasource/github-tags/index.ts';\nimport * as dockerVersioning from '../../versioning/docker/index.ts';\nimport * as exactVersioning from '../../versioning/exact/index.ts';\nimport * as githubActionsVersioning from '../../versioning/github-actions/index.ts';\nimport * as nodeVersioning from '../../versioning/node/index.ts';\nimport * as npmVersioning from '../../versioning/npm/index.ts';\nimport { getDep } from '../dockerfile/extract.ts';\nimport type {\n  ExtractConfig,\n  PackageDependency,\n  PackageFileContent,\n} from '../types.ts';\nimport { actionsLockFile, isLockfileManaged } from './common.ts';\nimport type { DockerReference, RepositoryReference } from './parse.ts';\nimport { isSha, isShortSha, parseUsesLine, versionLikeRe } from './parse.ts';\nimport type { UsesStep } from './schema.ts';\nimport { ActionsLockfile, CommunityActions, Workflow } from './schema.ts';\nimport type { LockfileState } from './types.ts';\n\n// detects if we run against a Github Enterprise Server and adds the URL to the beginning of the registryURLs for looking up Actions\n// This reflects the behavior of how GitHub looks up Actions\n// First on the Enterprise Server, then on GitHub.com\nfunction detectCustomGitHubRegistryUrlsForActions(): PackageDependency {\n  const endpoint = GlobalConfig.get('endpoint');\n  const registryUrls = ['https://github.com'];\n  if (endpoint && GlobalConfig.get('platform') === 'github') {\n    const parsedEndpoint = parseUrl(endpoint);\n    if (!parsedEndpoint) {\n      logger.warn({ endpoint }, 'Failed to parse endpoint url');\n      return {};\n    }\n\n    if (\n      parsedEndpoint.host !== 'github.com' &&\n      parsedEndpoint.host !== 'api.github.com'\n    ) {\n      registryUrls.unshift(\n        `${parsedEndpoint.protocol}//${parsedEndpoint.host}`,\n      );\n      return { registryUrls };\n    }\n  }\n  return {};\n}\n\nfunction extractDockerAction(\n  actionRef: DockerReference,\n  config: ExtractConfig,\n): PackageDependency {\n  const dep = getDep(actionRef.originalRef, true, config.registryAliases);\n  dep.depType = 'docker';\n  dep.replaceString = actionRef.originalRef;\n  return dep;\n}\n\nfunction extractRepositoryAction(\n  actionRef: RepositoryReference,\n  parsed: ReturnType<typeof parseUsesLine> & object,\n  customRegistryUrlsPackageDependency: PackageDependency,\n): PackageDependency {\n  const {\n    replaceString: valueString,\n    quote,\n    commentData,\n    commentPrecedingWhitespace,\n  } = parsed;\n  const {\n    owner,\n    repo,\n    path: subPath,\n    ref,\n    hostname,\n    isExplicitHostname,\n  } = actionRef;\n\n  const registryUrl = isExplicitHostname ? `https://${hostname}/` : '';\n  const packageName = `${owner}/${repo}`;\n  const depName = `${registryUrl}${packageName}`;\n  const pathSuffix = subPath ? `/${subPath}` : '';\n  const commentWs = commentPrecedingWhitespace || ' ';\n\n  const dep: PackageDependency = {\n    depName,\n    commitMessageTopic: '{{{depName}}} action',\n    versioning: githubActionsVersioning.id,\n    depType: 'action',\n    replaceString: valueString,\n    autoReplaceStringTemplate: `${quote}{{depName}}${pathSuffix}@{{#if newDigest}}{{newDigest}}${quote}{{#if newValue}}${commentWs}# {{newValue}}{{/if}}{{/if}}{{#unless newDigest}}{{newValue}}${quote}{{/unless}}`,\n    ...(isExplicitHostname\n      ? detectDatasource(registryUrl)\n      : customRegistryUrlsPackageDependency),\n  };\n\n  if (packageName !== depName) {\n    dep.packageName = packageName;\n  }\n\n  // Extend replaceString to include relevant comment portions:\n  // - Pinned version or ref: include only up to the matched token (truncate trailing text)\n  // - Ratchet exclude: include the full comment to preserve the marker\n  const pinComment =\n    commentData.pinnedVersion ??\n    (isSha(ref) || isShortSha(ref) ? commentData.ref : undefined);\n  if (\n    pinComment &&\n    !is.undefined(commentData.index) &&\n    !is.undefined(commentData.matchedString)\n  ) {\n    const cleanComment = parsed.commentString.slice(1);\n    const matchEndIndex = commentData.index + commentData.matchedString.length;\n    const commentSuffix = cleanComment.slice(0, matchEndIndex);\n    dep.replaceString = `${valueString}${commentPrecedingWhitespace}#${commentSuffix}`;\n  } else if (commentData.ratchetExclude) {\n    dep.replaceString =\n      valueString + commentPrecedingWhitespace + parsed.commentString;\n  }\n\n  if (isSha(ref)) {\n    dep.currentValue = commentData.pinnedVersion ?? commentData.ref;\n    dep.currentDigest = ref;\n  } else if (isShortSha(ref)) {\n    dep.currentValue = commentData.pinnedVersion ?? commentData.ref;\n    dep.currentDigestShort = ref;\n  } else {\n    dep.currentValue = ref;\n  }\n\n  if (!dep.currentValue) {\n    dep.enabled = false;\n    dep.skipReason = 'unversioned-reference';\n  }\n\n  const isVersionLike =\n    dep.currentValue && versionLikeRe.test(dep.currentValue);\n  if (!dep.datasource && dep.currentValue && !isVersionLike) {\n    dep.datasource = GithubDigestDatasource.id;\n    dep.versioning = exactVersioning.id;\n  }\n\n  dep.datasource ??= GithubTagsDatasource.id;\n\n  return dep;\n}\n\nfunction extractWithRegex(\n  content: string,\n  config: ExtractConfig,\n): PackageDependency[] {\n  const customRegistryUrlsPackageDependency =\n    detectCustomGitHubRegistryUrlsForActions();\n  logger.trace('github-actions.extractWithRegex()');\n  const deps: PackageDependency[] = [];\n\n  for (const line of content.split(newlineRegex)) {\n    if (line.trim().startsWith('#')) {\n      continue;\n    }\n\n    const parsed = parseUsesLine(line);\n    if (!parsed?.actionRef) {\n      continue;\n    }\n\n    const { actionRef } = parsed;\n\n    if (actionRef.kind === 'docker') {\n      deps.push(extractDockerAction(actionRef, config));\n      continue;\n    }\n\n    if (actionRef.kind === 'repository') {\n      deps.push(\n        extractRepositoryAction(\n          actionRef,\n          parsed,\n          customRegistryUrlsPackageDependency,\n        ),\n      );\n    }\n  }\n\n  return deps;\n}\n\nfunction detectDatasource(registryUrl: string): PackageDependency {\n  const platform = detectPlatform(registryUrl);\n\n  switch (platform) {\n    case 'forgejo':\n      return {\n        registryUrls: [registryUrl],\n        datasource: ForgejoTagsDatasource.id,\n      };\n    case 'gitea':\n      return {\n        registryUrls: [registryUrl],\n        datasource: GiteaTagsDatasource.id,\n      };\n    case 'github':\n      return { registryUrls: [registryUrl] };\n  }\n\n  return {\n    skipReason: 'unsupported-url',\n  };\n}\n\nconst runnerVersionRegex = regEx(\n  /^\\s*(?<depName>[a-zA-Z]+)-(?<currentValue>[^\\s]+)/,\n);\n\nfunction extractRunner(runner: string): PackageDependency | null {\n  const runnerVersionGroups = runnerVersionRegex.exec(runner)?.groups;\n  if (!runnerVersionGroups) {\n    return null;\n  }\n\n  const { depName, currentValue } = runnerVersionGroups;\n\n  if (!GithubRunnersDatasource.isValidRunner(depName, currentValue)) {\n    return null;\n  }\n\n  const dependency: PackageDependency = {\n    depName,\n    currentValue,\n    replaceString: `${depName}-${currentValue}`,\n    depType: 'github-runner',\n    datasource: GithubRunnersDatasource.id,\n    autoReplaceStringTemplate: '{{depName}}-{{newValue}}',\n  };\n\n  if (!dockerVersioning.api.isValid(currentValue)) {\n    dependency.skipReason = 'invalid-version';\n  }\n\n  return dependency;\n}\n\n// For official https://github.com/actions\nconst versionedActions: Record<string, string> = {\n  go: npmVersioning.id,\n  node: nodeVersioning.id,\n  python: npmVersioning.id,\n\n  // Not covered yet because they use different datasources/packageNames:\n  // - dotnet\n  // - java\n};\n\nfunction extractVersionedAction(step: UsesStep): PackageDependency | null {\n  for (const [action, versioning] of Object.entries(versionedActions)) {\n    const actionName = `actions/setup-${action}`;\n    if (step.uses !== actionName && !step.uses?.startsWith(`${actionName}@`)) {\n      continue;\n    }\n\n    const fieldName = `${action}-version`;\n    const currentValue = step.with?.[fieldName];\n    if (!currentValue) {\n      return null;\n    }\n\n    return {\n      datasource: GithubReleasesDatasource.id,\n      depName: action,\n      packageName: `actions/${action}-versions`,\n      versioning,\n      extractVersion: '^(?<version>\\\\d+\\\\.\\\\d+\\\\.\\\\d+)(-\\\\d+)?$',\n      currentValue,\n      depType: 'uses-with',\n    };\n  }\n  return null;\n}\n\nfunction extractSteps(steps: UsesStep[]): PackageDependency[] {\n  const deps: PackageDependency[] = [];\n\n  for (const step of steps) {\n    const res = CommunityActions.safeParse(step);\n    if (res.success) {\n      deps.push(...res.data);\n      continue;\n    }\n\n    const versionedDep = extractVersionedAction(step);\n    if (versionedDep) {\n      deps.push(versionedDep);\n    }\n  }\n\n  return deps;\n}\n\nfunction extractWithYAMLParser(\n  content: string,\n  packageFile: string,\n  config: ExtractConfig,\n): PackageDependency[] {\n  logger.trace('github-actions.extractWithYAMLParser()');\n\n  const obj = withMeta({ packageFile }, () => Workflow.parse(content));\n  if (!obj) {\n    return [];\n  }\n\n  if ('runs' in obj && obj.runs.steps) {\n    return extractSteps(obj.runs.steps);\n  }\n\n  if (!('jobs' in obj)) {\n    return [];\n  }\n\n  const deps: PackageDependency[] = [];\n\n  for (const job of Object.values(obj.jobs)) {\n    if (job.container) {\n      const dep = getDep(job.container, true, config.registryAliases);\n      if (dep) {\n        dep.depType = 'container';\n        deps.push(dep);\n      }\n    }\n\n    for (const service of job.services) {\n      const dep = getDep(service, true, config.registryAliases);\n      if (dep) {\n        dep.depType = 'service';\n        deps.push(dep);\n      }\n    }\n\n    for (const runner of job['runs-on']) {\n      const dep = extractRunner(runner);\n      if (dep) {\n        deps.push(dep);\n      }\n    }\n\n    deps.push(...extractSteps(job.steps));\n  }\n\n  return deps;\n}\n\nasync function readLockfile(): Promise<LockfileState> {\n  const content = await readLocalFile(actionsLockFile, 'utf8');\n  if (!content) {\n    return { type: 'missing' };\n  }\n\n  const parsed = ActionsLockfile.safeParse(content);\n  if (!parsed.success) {\n    // `updateActionsLockfile` warns about this once per branch, so stay quiet\n    logger.debug(`Failed to parse ${actionsLockFile}`);\n    return { type: 'unparseable' };\n  }\n\n  return { type: 'parsed', onboardedWorkflows: parsed.data.workflows };\n}\n\n/**\n * A repository has a single lock file, but can have any number of package files, so read and parse it only once.\n */\nfunction getLockfile(): Promise<LockfileState> {\n  const cacheKey = `github-actions:${actionsLockFile}`;\n  const cached = memCache.get<Promise<LockfileState> | undefined>(cacheKey);\n  if (cached !== undefined) {\n    return cached;\n  }\n\n  const result = readLockfile();\n  memCache.set(cacheKey, result);\n  return result;\n}\n\n/**\n * Whether `gh actions-lock` owns the digests in this file.\n *\n * It rewrites the workflows it manages back to plain refs when regenerating, so an inline digest pin would be stripped straight back out.\n */\nasync function isManagedByLockfile(packageFile: string): Promise<boolean> {\n  const lockfile = await getLockfile();\n\n  switch (lockfile.type) {\n    case 'missing':\n      return false;\n    case 'unparseable':\n      // The tool refuses to regenerate a lock file which it cannot parse, so treat everything as managed: pinning inline here would raise a PR which pins the digests the tool owns and leaves the lock file stale.\n      return true;\n    case 'parsed':\n      return isLockfileManaged(packageFile, lockfile.onboardedWorkflows);\n  }\n}\n\nexport async function extractPackageFile(\n  content: string,\n  packageFile: string,\n  config: ExtractConfig = {}, // TODO: enforce ExtractConfig\n): Promise<PackageFileContent | null> {\n  logger.trace(`github-actions.extractPackageFile(${packageFile})`);\n\n  const deps = [\n    ...extractWithRegex(content, config),\n    ...extractWithYAMLParser(content, packageFile, config),\n  ];\n\n  if (!deps.length) {\n    return null;\n  }\n\n  const res: PackageFileContent = { deps };\n\n  if (await isManagedByLockfile(packageFile)) {\n    // Deliberately no `lockFiles`: nothing here goes through `updateArtifacts`, and `matchFileNames` also tests `lockFiles`, so declaring it would make a negated rule such as `!.github/workflows/release.yml` match every workflow through the lock file path.\n    for (const dep of deps) {\n      // The lock file only records `OWNER/REPO@REF` pins, so a `docker://` image in a `uses:` is still ours to pin.\n      if (dep.depType === 'action') {\n        dep.digestManagedExternally = true;\n      }\n    }\n  }\n\n  return res;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAmCA,SAAS,2CAA8D;CACrE,MAAM,WAAW,aAAa,IAAI,UAAU;CAC5C,MAAM,eAAe,CAAC,oBAAoB;CAC1C,IAAI,YAAY,aAAa,IAAI,UAAU,MAAM,UAAU;EACzD,MAAM,iBAAiB,SAAS,QAAQ;EACxC,IAAI,CAAC,gBAAgB;GACnB,OAAO,KAAK,EAAE,SAAS,GAAG,8BAA8B;GACxD,OAAO,CAAC;EACV;EAEA,IACE,eAAe,SAAS,gBACxB,eAAe,SAAS,kBACxB;GACA,aAAa,QACX,GAAG,eAAe,SAAS,IAAI,eAAe,MAChD;GACA,OAAO,EAAE,aAAa;EACxB;CACF;CACA,OAAO,CAAC;AACV;AAEA,SAAS,oBACP,WACA,QACmB;CACnB,MAAM,MAAM,OAAO,UAAU,aAAa,MAAM,OAAO,eAAe;CACtE,IAAI,UAAU;CACd,IAAI,gBAAgB,UAAU;CAC9B,OAAO;AACT;AAEA,SAAS,wBACP,WACA,QACA,qCACmB;CACnB,MAAM,EACJ,eAAe,aACf,OACA,aACA,+BACE;CACJ,MAAM,EACJ,OACA,MACA,MAAM,SACN,KACA,UACA,uBACE;CAEJ,MAAM,cAAc,qBAAqB,WAAW,SAAS,KAAK;CAClE,MAAM,cAAc,GAAG,MAAM,GAAG;CAChC,MAAM,UAAU,GAAG,cAAc;CACjC,MAAM,aAAa,UAAU,IAAI,YAAY;CAG7C,MAAM,MAAyB;EAC7B;EACA,oBAAoB;EACpB,YAAYA;EACZ,SAAS;EACT,eAAe;EACf,2BAA2B,GAAG,MAAM,aAAa,WAAW,iCAAiC,MAAM,kBARnF,8BAA8B,IAQiF,+DAA+D,MAAM;EACpM,GAAI,qBACA,iBAAiB,WAAW,IAC5B;CACN;CAEA,IAAI,gBAAgB,SAClB,IAAI,cAAc;CASpB,KAFE,YAAY,kBACX,MAAM,GAAG,KAAK,WAAW,GAAG,IAAI,YAAY,MAAM,KAAA,OAGnD,CAAC,GAAG,UAAU,YAAY,KAAK,KAC/B,CAAC,GAAG,UAAU,YAAY,aAAa,GACvC;EACA,MAAM,eAAe,OAAO,cAAc,MAAM,CAAC;EACjD,MAAM,gBAAgB,YAAY,QAAQ,YAAY,cAAc;EAEpE,IAAI,gBAAgB,GAAG,cAAc,2BAA2B,GAD1C,aAAa,MAAM,GAAG,aACmC;CACjF,OAAO,IAAI,YAAY,gBACrB,IAAI,gBACF,cAAc,6BAA6B,OAAO;CAGtD,IAAI,MAAM,GAAG,GAAG;EACd,IAAI,eAAe,YAAY,iBAAiB,YAAY;EAC5D,IAAI,gBAAgB;CACtB,OAAO,IAAI,WAAW,GAAG,GAAG;EAC1B,IAAI,eAAe,YAAY,iBAAiB,YAAY;EAC5D,IAAI,qBAAqB;CAC3B,OACE,IAAI,eAAe;CAGrB,IAAI,CAAC,IAAI,cAAc;EACrB,IAAI,UAAU;EACd,IAAI,aAAa;CACnB;CAEA,MAAM,gBACJ,IAAI,gBAAgB,cAAc,KAAK,IAAI,YAAY;CACzD,IAAI,CAAC,IAAI,cAAc,IAAI,gBAAgB,CAAC,eAAe;EACzD,IAAI,aAAa,uBAAuB;EACxC,IAAI,aAAaC;CACnB;CAEA,IAAI,eAAe,qBAAqB;CAExC,OAAO;AACT;AAEA,SAAS,iBACP,SACA,QACqB;CACrB,MAAM,sCACJ,yCAAyC;CAC3C,OAAO,MAAM,mCAAmC;CAChD,MAAM,OAA4B,CAAC;CAEnC,KAAK,MAAM,QAAQ,QAAQ,MAAM,YAAY,GAAG;EAC9C,IAAI,KAAK,KAAK,CAAC,CAAC,WAAW,GAAG,GAC5B;EAGF,MAAM,SAAS,cAAc,IAAI;EACjC,IAAI,CAAC,QAAQ,WACX;EAGF,MAAM,EAAE,cAAc;EAEtB,IAAI,UAAU,SAAS,UAAU;GAC/B,KAAK,KAAK,oBAAoB,WAAW,MAAM,CAAC;GAChD;EACF;EAEA,IAAI,UAAU,SAAS,cACrB,KAAK,KACH,wBACE,WACA,QACA,mCACF,CACF;CAEJ;CAEA,OAAO;AACT;AAEA,SAAS,iBAAiB,aAAwC;CAGhE,QAFiB,eAAe,WAEjB,GAAf;EACE,KAAK,WACH,OAAO;GACL,cAAc,CAAC,WAAW;GAC1B,YAAY,sBAAsB;EACpC;EACF,KAAK,SACH,OAAO;GACL,cAAc,CAAC,WAAW;GAC1B,YAAY,oBAAoB;EAClC;EACF,KAAK,UACH,OAAO,EAAE,cAAc,CAAC,WAAW,EAAE;CACzC;CAEA,OAAO,EACL,YAAY,kBACd;AACF;AAEA,MAAM,qBAAqB,MACzB,mDACF;AAEA,SAAS,cAAc,QAA0C;CAC/D,MAAM,sBAAsB,mBAAmB,KAAK,MAAM,CAAC,EAAE;CAC7D,IAAI,CAAC,qBACH,OAAO;CAGT,MAAM,EAAE,SAAS,iBAAiB;CAElC,IAAI,CAAC,wBAAwB,cAAc,SAAS,YAAY,GAC9D,OAAO;CAGT,MAAM,aAAgC;EACpC;EACA;EACA,eAAe,GAAG,QAAQ,GAAG;EAC7B,SAAS;EACT,YAAY,wBAAwB;EACpC,2BAA2B;CAC7B;CAEA,IAAI,CAAA,IAAsB,QAAQ,YAAY,GAC5C,WAAW,aAAa;CAG1B,OAAO;AACT;AAGA,MAAM,mBAA2C;CAC/C,IAAI;CACJ,MAAMC;CACN,QAAQ;AAKV;AAEA,SAAS,uBAAuB,MAA0C;CACxE,KAAK,MAAM,CAAC,QAAQ,eAAe,OAAO,QAAQ,gBAAgB,GAAG;EACnE,MAAM,aAAa,iBAAiB;EACpC,IAAI,KAAK,SAAS,cAAc,CAAC,KAAK,MAAM,WAAW,GAAG,WAAW,EAAE,GACrE;EAGF,MAAM,YAAY,GAAG,OAAO;EAC5B,MAAM,eAAe,KAAK,OAAO;EACjC,IAAI,CAAC,cACH,OAAO;EAGT,OAAO;GACL,YAAY,yBAAyB;GACrC,SAAS;GACT,aAAa,WAAW,OAAO;GAC/B;GACA,gBAAgB;GAChB;GACA,SAAS;EACX;CACF;CACA,OAAO;AACT;AAEA,SAAS,aAAa,OAAwC;CAC5D,MAAM,OAA4B,CAAC;CAEnC,KAAK,MAAM,QAAQ,OAAO;EACxB,MAAM,MAAM,iBAAiB,UAAU,IAAI;EAC3C,IAAI,IAAI,SAAS;GACf,KAAK,KAAK,GAAG,IAAI,IAAI;GACrB;EACF;EAEA,MAAM,eAAe,uBAAuB,IAAI;EAChD,IAAI,cACF,KAAK,KAAK,YAAY;CAE1B;CAEA,OAAO;AACT;AAEA,SAAS,sBACP,SACA,aACA,QACqB;CACrB,OAAO,MAAM,wCAAwC;CAErD,MAAM,MAAM,SAAS,EAAE,YAAY,SAAS,SAAS,MAAM,OAAO,CAAC;CACnE,IAAI,CAAC,KACH,OAAO,CAAC;CAGV,IAAI,UAAU,OAAO,IAAI,KAAK,OAC5B,OAAO,aAAa,IAAI,KAAK,KAAK;CAGpC,IAAI,EAAE,UAAU,MACd,OAAO,CAAC;CAGV,MAAM,OAA4B,CAAC;CAEnC,KAAK,MAAM,OAAO,OAAO,OAAO,IAAI,IAAI,GAAG;EACzC,IAAI,IAAI,WAAW;GACjB,MAAM,MAAM,OAAO,IAAI,WAAW,MAAM,OAAO,eAAe;GAC9D,IAAI,KAAK;IACP,IAAI,UAAU;IACd,KAAK,KAAK,GAAG;GACf;EACF;EAEA,KAAK,MAAM,WAAW,IAAI,UAAU;GAClC,MAAM,MAAM,OAAO,SAAS,MAAM,OAAO,eAAe;GACxD,IAAI,KAAK;IACP,IAAI,UAAU;IACd,KAAK,KAAK,GAAG;GACf;EACF;EAEA,KAAK,MAAM,UAAU,IAAI,YAAY;GACnC,MAAM,MAAM,cAAc,MAAM;GAChC,IAAI,KACF,KAAK,KAAK,GAAG;EAEjB;EAEA,KAAK,KAAK,GAAG,aAAa,IAAI,KAAK,CAAC;CACtC;CAEA,OAAO;AACT;AAEA,eAAe,eAAuC;CACpD,MAAM,UAAU,MAAM,cAAc,iBAAiB,MAAM;CAC3D,IAAI,CAAC,SACH,OAAO,EAAE,MAAM,UAAU;CAG3B,MAAM,SAAS,gBAAgB,UAAU,OAAO;CAChD,IAAI,CAAC,OAAO,SAAS;EAEnB,OAAO,MAAM,mBAAmB,iBAAiB;EACjD,OAAO,EAAE,MAAM,cAAc;CAC/B;CAEA,OAAO;EAAE,MAAM;EAAU,oBAAoB,OAAO,KAAK;CAAU;AACrE;;;;AAKA,SAAS,cAAsC;CAC7C,MAAM,WAAW,kBAAkB;CACnC,MAAM,SAASC,IAAiD,QAAQ;CACxE,IAAI,WAAW,KAAA,GACb,OAAO;CAGT,MAAM,SAAS,aAAa;CAC5B,IAAa,UAAU,MAAM;CAC7B,OAAO;AACT;;;;;;AAOA,eAAe,oBAAoB,aAAuC;CACxE,MAAM,WAAW,MAAM,YAAY;CAEnC,QAAQ,SAAS,MAAjB;EACE,KAAK,WACH,OAAO;EACT,KAAK,eAEH,OAAO;EACT,KAAK,UACH,OAAO,kBAAkB,aAAa,SAAS,kBAAkB;CACrE;AACF;AAEA,eAAsB,mBACpB,SACA,aACA,SAAwB,CAAC,GACW;CACpC,OAAO,MAAM,qCAAqC,YAAY,EAAE;CAEhE,MAAM,OAAO,CACX,GAAG,iBAAiB,SAAS,MAAM,GACnC,GAAG,sBAAsB,SAAS,aAAa,MAAM,CACvD;CAEA,IAAI,CAAC,KAAK,QACR,OAAO;CAGT,MAAM,MAA0B,EAAE,KAAK;CAEvC,IAAI,MAAM,oBAAoB,WAAW,GAElC;OAAA,MAAM,OAAO,MAEhB,IAAI,IAAI,YAAY,UAClB,IAAI,0BAA0B;CAAA;CAKpC,OAAO;AACT"}
+{"version":3,"file":"extract.js","names":["githubActionsVersioning.id","exactVersioning.id","nodeVersioning.id","memCache.get"],"sources":["../../../../lib/modules/manager/github-actions/extract.ts"],"sourcesContent":["import is from '@sindresorhus/is';\nimport { GlobalConfig } from '../../../config/global.ts';\nimport { logger, withMeta } from '../../../logger/index.ts';\nimport * as memCache from '../../../util/cache/memory/index.ts';\nimport { detectPlatform } from '../../../util/common.ts';\nimport { readLocalFile } from '../../../util/fs/index.ts';\nimport { newlineRegex, regEx } from '../../../util/regex.ts';\nimport { parseUrl } from '../../../util/url.ts';\nimport { ForgejoTagsDatasource } from '../../datasource/forgejo-tags/index.ts';\nimport { GiteaTagsDatasource } from '../../datasource/gitea-tags/index.ts';\nimport { GithubDigestDatasource } from '../../datasource/github-digest/index.ts';\nimport { GithubReleasesDatasource } from '../../datasource/github-releases/index.ts';\nimport { GithubRunnersDatasource } from '../../datasource/github-runners/index.ts';\nimport { GithubTagsDatasource } from '../../datasource/github-tags/index.ts';\nimport * as dockerVersioning from '../../versioning/docker/index.ts';\nimport * as exactVersioning from '../../versioning/exact/index.ts';\nimport * as githubActionsVersioning from '../../versioning/github-actions/index.ts';\nimport * as nodeVersioning from '../../versioning/node/index.ts';\nimport * as npmVersioning from '../../versioning/npm/index.ts';\nimport { getDep } from '../dockerfile/extract.ts';\nimport type {\n  ExtractConfig,\n  PackageDependency,\n  PackageFileContent,\n} from '../types.ts';\nimport { actionsLockFile, isLockfileManaged } from './common.ts';\nimport type { DockerReference, RepositoryReference } from './parse.ts';\nimport { isSha, isShortSha, parseUsesLine, versionLikeRe } from './parse.ts';\nimport type { UsesStep } from './schema.ts';\nimport { ActionsLockfile, CommunityActions, Workflow } from './schema.ts';\nimport type { LockfileState } from './types.ts';\n\n// detects if we run against a Github Enterprise Server and adds the URL to the beginning of the registryURLs for looking up Actions\n// This reflects the behavior of how GitHub looks up Actions\n// First on the Enterprise Server, then on GitHub.com\nfunction detectCustomGitHubRegistryUrlsForActions(): PackageDependency {\n  const endpoint = GlobalConfig.get('endpoint');\n  const registryUrls = ['https://github.com'];\n  if (endpoint && GlobalConfig.get('platform') === 'github') {\n    const parsedEndpoint = parseUrl(endpoint);\n    if (!parsedEndpoint) {\n      logger.warn({ endpoint }, 'Failed to parse endpoint url');\n      return {};\n    }\n\n    if (\n      parsedEndpoint.host !== 'github.com' &&\n      parsedEndpoint.host !== 'api.github.com'\n    ) {\n      registryUrls.unshift(\n        `${parsedEndpoint.protocol}//${parsedEndpoint.host}`,\n      );\n      return { registryUrls };\n    }\n  }\n  return {};\n}\n\nfunction extractDockerAction(\n  actionRef: DockerReference,\n  config: ExtractConfig,\n): PackageDependency {\n  const dep = getDep(actionRef.originalRef, true, config.registryAliases);\n  dep.depType = 'docker';\n  dep.replaceString = actionRef.originalRef;\n  return dep;\n}\n\nconst reusableWorkflowPathRe = regEx(/^\\.github\\/workflows\\/[^/]+\\.ya?ml$/);\n\nfunction extractRepositoryAction(\n  actionRef: RepositoryReference,\n  parsed: ReturnType<typeof parseUsesLine> & object,\n  customRegistryUrlsPackageDependency: PackageDependency,\n): PackageDependency {\n  const {\n    replaceString: valueString,\n    quote,\n    commentData,\n    commentPrecedingWhitespace,\n  } = parsed;\n  const {\n    owner,\n    repo,\n    path: subPath,\n    ref,\n    hostname,\n    isExplicitHostname,\n  } = actionRef;\n\n  const registryUrl = isExplicitHostname ? `https://${hostname}/` : '';\n  const packageName = `${owner}/${repo}`;\n  const depName = `${registryUrl}${packageName}`;\n  const pathSuffix = subPath ? `/${subPath}` : '';\n  const commentWs = commentPrecedingWhitespace || ' ';\n  const isReusableWorkflow = !!subPath && reusableWorkflowPathRe.test(subPath);\n\n  const dep: PackageDependency = {\n    depName,\n    commitMessageTopic: '{{{depName}}} action',\n    versioning: githubActionsVersioning.id,\n    depType: isReusableWorkflow ? 'workflow' : 'action',\n    replaceString: valueString,\n    autoReplaceStringTemplate: `${quote}{{depName}}${pathSuffix}@{{#if newDigest}}{{newDigest}}${quote}{{#if newValue}}${commentWs}# {{newValue}}{{/if}}{{/if}}{{#unless newDigest}}{{newValue}}${quote}{{/unless}}`,\n    ...(isExplicitHostname\n      ? detectDatasource(registryUrl)\n      : customRegistryUrlsPackageDependency),\n  };\n\n  if (packageName !== depName) {\n    dep.packageName = packageName;\n  }\n\n  // Extend replaceString to include relevant comment portions:\n  // - Pinned version or ref: include only up to the matched token (truncate trailing text)\n  // - Ratchet exclude: include the full comment to preserve the marker\n  const pinComment =\n    commentData.pinnedVersion ??\n    (isSha(ref) || isShortSha(ref) ? commentData.ref : undefined);\n  if (\n    pinComment &&\n    !is.undefined(commentData.index) &&\n    !is.undefined(commentData.matchedString)\n  ) {\n    const cleanComment = parsed.commentString.slice(1);\n    const matchEndIndex = commentData.index + commentData.matchedString.length;\n    const commentSuffix = cleanComment.slice(0, matchEndIndex);\n    dep.replaceString = `${valueString}${commentPrecedingWhitespace}#${commentSuffix}`;\n  } else if (commentData.ratchetExclude) {\n    dep.replaceString =\n      valueString + commentPrecedingWhitespace + parsed.commentString;\n  }\n\n  if (isSha(ref)) {\n    dep.currentValue = commentData.pinnedVersion ?? commentData.ref;\n    dep.currentDigest = ref;\n  } else if (isShortSha(ref)) {\n    dep.currentValue = commentData.pinnedVersion ?? commentData.ref;\n    dep.currentDigestShort = ref;\n  } else {\n    dep.currentValue = ref;\n  }\n\n  if (!dep.currentValue) {\n    dep.enabled = false;\n    dep.skipReason = 'unversioned-reference';\n  }\n\n  const isVersionLike =\n    dep.currentValue && versionLikeRe.test(dep.currentValue);\n  if (!dep.datasource && dep.currentValue && !isVersionLike) {\n    dep.datasource = GithubDigestDatasource.id;\n    dep.versioning = exactVersioning.id;\n  }\n\n  dep.datasource ??= GithubTagsDatasource.id;\n\n  return dep;\n}\n\nfunction extractWithRegex(\n  content: string,\n  config: ExtractConfig,\n): PackageDependency[] {\n  const customRegistryUrlsPackageDependency =\n    detectCustomGitHubRegistryUrlsForActions();\n  logger.trace('github-actions.extractWithRegex()');\n  const deps: PackageDependency[] = [];\n\n  for (const line of content.split(newlineRegex)) {\n    if (line.trim().startsWith('#')) {\n      continue;\n    }\n\n    const parsed = parseUsesLine(line);\n    if (!parsed?.actionRef) {\n      continue;\n    }\n\n    const { actionRef } = parsed;\n\n    if (actionRef.kind === 'docker') {\n      deps.push(extractDockerAction(actionRef, config));\n      continue;\n    }\n\n    if (actionRef.kind === 'repository') {\n      deps.push(\n        extractRepositoryAction(\n          actionRef,\n          parsed,\n          customRegistryUrlsPackageDependency,\n        ),\n      );\n    }\n  }\n\n  return deps;\n}\n\nfunction detectDatasource(registryUrl: string): PackageDependency {\n  const platform = detectPlatform(registryUrl);\n\n  switch (platform) {\n    case 'forgejo':\n      return {\n        registryUrls: [registryUrl],\n        datasource: ForgejoTagsDatasource.id,\n      };\n    case 'gitea':\n      return {\n        registryUrls: [registryUrl],\n        datasource: GiteaTagsDatasource.id,\n      };\n    case 'github':\n      return { registryUrls: [registryUrl] };\n  }\n\n  return {\n    skipReason: 'unsupported-url',\n  };\n}\n\nconst runnerVersionRegex = regEx(\n  /^\\s*(?<depName>[a-zA-Z]+)-(?<currentValue>[^\\s]+)/,\n);\n\nfunction extractRunner(runner: string): PackageDependency | null {\n  const runnerVersionGroups = runnerVersionRegex.exec(runner)?.groups;\n  if (!runnerVersionGroups) {\n    return null;\n  }\n\n  const { depName, currentValue } = runnerVersionGroups;\n\n  if (!GithubRunnersDatasource.isValidRunner(depName, currentValue)) {\n    return null;\n  }\n\n  const dependency: PackageDependency = {\n    depName,\n    currentValue,\n    replaceString: `${depName}-${currentValue}`,\n    depType: 'github-runner',\n    datasource: GithubRunnersDatasource.id,\n    autoReplaceStringTemplate: '{{depName}}-{{newValue}}',\n  };\n\n  if (!dockerVersioning.api.isValid(currentValue)) {\n    dependency.skipReason = 'invalid-version';\n  }\n\n  return dependency;\n}\n\n// For official https://github.com/actions\nconst versionedActions: Record<string, string> = {\n  go: npmVersioning.id,\n  node: nodeVersioning.id,\n  python: npmVersioning.id,\n\n  // Not covered yet because they use different datasources/packageNames:\n  // - dotnet\n  // - java\n};\n\nfunction extractVersionedAction(step: UsesStep): PackageDependency | null {\n  for (const [action, versioning] of Object.entries(versionedActions)) {\n    const actionName = `actions/setup-${action}`;\n    if (step.uses !== actionName && !step.uses?.startsWith(`${actionName}@`)) {\n      continue;\n    }\n\n    const fieldName = `${action}-version`;\n    const currentValue = step.with?.[fieldName];\n    if (!currentValue) {\n      return null;\n    }\n\n    return {\n      datasource: GithubReleasesDatasource.id,\n      depName: action,\n      packageName: `actions/${action}-versions`,\n      versioning,\n      extractVersion: '^(?<version>\\\\d+\\\\.\\\\d+\\\\.\\\\d+)(-\\\\d+)?$',\n      currentValue,\n      depType: 'uses-with',\n    };\n  }\n  return null;\n}\n\nfunction extractSteps(steps: UsesStep[]): PackageDependency[] {\n  const deps: PackageDependency[] = [];\n\n  for (const step of steps) {\n    const res = CommunityActions.safeParse(step);\n    if (res.success) {\n      deps.push(...res.data);\n      continue;\n    }\n\n    const versionedDep = extractVersionedAction(step);\n    if (versionedDep) {\n      deps.push(versionedDep);\n    }\n  }\n\n  return deps;\n}\n\nfunction extractWithYAMLParser(\n  content: string,\n  packageFile: string,\n  config: ExtractConfig,\n): PackageDependency[] {\n  logger.trace('github-actions.extractWithYAMLParser()');\n\n  const obj = withMeta({ packageFile }, () => Workflow.parse(content));\n  if (!obj) {\n    return [];\n  }\n\n  if ('runs' in obj && obj.runs.steps) {\n    return extractSteps(obj.runs.steps);\n  }\n\n  if (!('jobs' in obj)) {\n    return [];\n  }\n\n  const deps: PackageDependency[] = [];\n\n  for (const job of Object.values(obj.jobs)) {\n    if (job.container) {\n      const dep = getDep(job.container, true, config.registryAliases);\n      if (dep) {\n        dep.depType = 'container';\n        deps.push(dep);\n      }\n    }\n\n    for (const service of job.services) {\n      const dep = getDep(service, true, config.registryAliases);\n      if (dep) {\n        dep.depType = 'service';\n        deps.push(dep);\n      }\n    }\n\n    for (const runner of job['runs-on']) {\n      const dep = extractRunner(runner);\n      if (dep) {\n        deps.push(dep);\n      }\n    }\n\n    deps.push(...extractSteps(job.steps));\n  }\n\n  return deps;\n}\n\nasync function readLockfile(): Promise<LockfileState> {\n  const content = await readLocalFile(actionsLockFile, 'utf8');\n  if (!content) {\n    return { type: 'missing' };\n  }\n\n  const parsed = ActionsLockfile.safeParse(content);\n  if (!parsed.success) {\n    // `updateActionsLockfile` warns about this once per branch, so stay quiet\n    logger.debug(`Failed to parse ${actionsLockFile}`);\n    return { type: 'unparseable' };\n  }\n\n  return { type: 'parsed', onboardedWorkflows: parsed.data.workflows };\n}\n\n/**\n * A repository has a single lock file, but can have any number of package files, so read and parse it only once.\n */\nfunction getLockfile(): Promise<LockfileState> {\n  const cacheKey = `github-actions:${actionsLockFile}`;\n  const cached = memCache.get<Promise<LockfileState> | undefined>(cacheKey);\n  if (cached !== undefined) {\n    return cached;\n  }\n\n  const result = readLockfile();\n  memCache.set(cacheKey, result);\n  return result;\n}\n\n/**\n * Whether `gh actions-lock` owns the digests in this file.\n *\n * It rewrites the workflows it manages back to plain refs when regenerating, so an inline digest pin would be stripped straight back out.\n */\nasync function isManagedByLockfile(packageFile: string): Promise<boolean> {\n  const lockfile = await getLockfile();\n\n  switch (lockfile.type) {\n    case 'missing':\n      return false;\n    case 'unparseable':\n      // The tool refuses to regenerate a lock file which it cannot parse, so treat everything as managed: pinning inline here would raise a PR which pins the digests the tool owns and leaves the lock file stale.\n      return true;\n    case 'parsed':\n      return isLockfileManaged(packageFile, lockfile.onboardedWorkflows);\n  }\n}\n\nexport async function extractPackageFile(\n  content: string,\n  packageFile: string,\n  config: ExtractConfig = {}, // TODO: enforce ExtractConfig\n): Promise<PackageFileContent | null> {\n  logger.trace(`github-actions.extractPackageFile(${packageFile})`);\n\n  const deps = [\n    ...extractWithRegex(content, config),\n    ...extractWithYAMLParser(content, packageFile, config),\n  ];\n\n  if (!deps.length) {\n    return null;\n  }\n\n  const res: PackageFileContent = { deps };\n\n  if (await isManagedByLockfile(packageFile)) {\n    // Deliberately no `lockFiles`: nothing here goes through `updateArtifacts`, and `matchFileNames` also tests `lockFiles`, so declaring it would make a negated rule such as `!.github/workflows/release.yml` match every workflow through the lock file path.\n    for (const dep of deps) {\n      // The lock file only records `OWNER/REPO@REF` pins, so a `docker://` image in a `uses:` is still ours to pin.\n      if (dep.depType === 'action' || dep.depType === 'workflow') {\n        dep.digestManagedExternally = true;\n      }\n    }\n  }\n\n  return res;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAmCA,SAAS,2CAA8D;CACrE,MAAM,WAAW,aAAa,IAAI,UAAU;CAC5C,MAAM,eAAe,CAAC,oBAAoB;CAC1C,IAAI,YAAY,aAAa,IAAI,UAAU,MAAM,UAAU;EACzD,MAAM,iBAAiB,SAAS,QAAQ;EACxC,IAAI,CAAC,gBAAgB;GACnB,OAAO,KAAK,EAAE,SAAS,GAAG,8BAA8B;GACxD,OAAO,CAAC;EACV;EAEA,IACE,eAAe,SAAS,gBACxB,eAAe,SAAS,kBACxB;GACA,aAAa,QACX,GAAG,eAAe,SAAS,IAAI,eAAe,MAChD;GACA,OAAO,EAAE,aAAa;EACxB;CACF;CACA,OAAO,CAAC;AACV;AAEA,SAAS,oBACP,WACA,QACmB;CACnB,MAAM,MAAM,OAAO,UAAU,aAAa,MAAM,OAAO,eAAe;CACtE,IAAI,UAAU;CACd,IAAI,gBAAgB,UAAU;CAC9B,OAAO;AACT;AAEA,MAAM,yBAAyB,MAAM,qCAAqC;AAE1E,SAAS,wBACP,WACA,QACA,qCACmB;CACnB,MAAM,EACJ,eAAe,aACf,OACA,aACA,+BACE;CACJ,MAAM,EACJ,OACA,MACA,MAAM,SACN,KACA,UACA,uBACE;CAEJ,MAAM,cAAc,qBAAqB,WAAW,SAAS,KAAK;CAClE,MAAM,cAAc,GAAG,MAAM,GAAG;CAChC,MAAM,UAAU,GAAG,cAAc;CACjC,MAAM,aAAa,UAAU,IAAI,YAAY;CAC7C,MAAM,YAAY,8BAA8B;CAChD,MAAM,qBAAqB,CAAC,CAAC,WAAW,uBAAuB,KAAK,OAAO;CAE3E,MAAM,MAAyB;EAC7B;EACA,oBAAoB;EACpB,YAAYA;EACZ,SAAS,qBAAqB,aAAa;EAC3C,eAAe;EACf,2BAA2B,GAAG,MAAM,aAAa,WAAW,iCAAiC,MAAM,kBAAkB,UAAU,+DAA+D,MAAM;EACpM,GAAI,qBACA,iBAAiB,WAAW,IAC5B;CACN;CAEA,IAAI,gBAAgB,SAClB,IAAI,cAAc;CASpB,KAFE,YAAY,kBACX,MAAM,GAAG,KAAK,WAAW,GAAG,IAAI,YAAY,MAAM,KAAA,OAGnD,CAAC,GAAG,UAAU,YAAY,KAAK,KAC/B,CAAC,GAAG,UAAU,YAAY,aAAa,GACvC;EACA,MAAM,eAAe,OAAO,cAAc,MAAM,CAAC;EACjD,MAAM,gBAAgB,YAAY,QAAQ,YAAY,cAAc;EAEpE,IAAI,gBAAgB,GAAG,cAAc,2BAA2B,GAD1C,aAAa,MAAM,GAAG,aACmC;CACjF,OAAO,IAAI,YAAY,gBACrB,IAAI,gBACF,cAAc,6BAA6B,OAAO;CAGtD,IAAI,MAAM,GAAG,GAAG;EACd,IAAI,eAAe,YAAY,iBAAiB,YAAY;EAC5D,IAAI,gBAAgB;CACtB,OAAO,IAAI,WAAW,GAAG,GAAG;EAC1B,IAAI,eAAe,YAAY,iBAAiB,YAAY;EAC5D,IAAI,qBAAqB;CAC3B,OACE,IAAI,eAAe;CAGrB,IAAI,CAAC,IAAI,cAAc;EACrB,IAAI,UAAU;EACd,IAAI,aAAa;CACnB;CAEA,MAAM,gBACJ,IAAI,gBAAgB,cAAc,KAAK,IAAI,YAAY;CACzD,IAAI,CAAC,IAAI,cAAc,IAAI,gBAAgB,CAAC,eAAe;EACzD,IAAI,aAAa,uBAAuB;EACxC,IAAI,aAAaC;CACnB;CAEA,IAAI,eAAe,qBAAqB;CAExC,OAAO;AACT;AAEA,SAAS,iBACP,SACA,QACqB;CACrB,MAAM,sCACJ,yCAAyC;CAC3C,OAAO,MAAM,mCAAmC;CAChD,MAAM,OAA4B,CAAC;CAEnC,KAAK,MAAM,QAAQ,QAAQ,MAAM,YAAY,GAAG;EAC9C,IAAI,KAAK,KAAK,CAAC,CAAC,WAAW,GAAG,GAC5B;EAGF,MAAM,SAAS,cAAc,IAAI;EACjC,IAAI,CAAC,QAAQ,WACX;EAGF,MAAM,EAAE,cAAc;EAEtB,IAAI,UAAU,SAAS,UAAU;GAC/B,KAAK,KAAK,oBAAoB,WAAW,MAAM,CAAC;GAChD;EACF;EAEA,IAAI,UAAU,SAAS,cACrB,KAAK,KACH,wBACE,WACA,QACA,mCACF,CACF;CAEJ;CAEA,OAAO;AACT;AAEA,SAAS,iBAAiB,aAAwC;CAGhE,QAFiB,eAAe,WAEjB,GAAf;EACE,KAAK,WACH,OAAO;GACL,cAAc,CAAC,WAAW;GAC1B,YAAY,sBAAsB;EACpC;EACF,KAAK,SACH,OAAO;GACL,cAAc,CAAC,WAAW;GAC1B,YAAY,oBAAoB;EAClC;EACF,KAAK,UACH,OAAO,EAAE,cAAc,CAAC,WAAW,EAAE;CACzC;CAEA,OAAO,EACL,YAAY,kBACd;AACF;AAEA,MAAM,qBAAqB,MACzB,mDACF;AAEA,SAAS,cAAc,QAA0C;CAC/D,MAAM,sBAAsB,mBAAmB,KAAK,MAAM,CAAC,EAAE;CAC7D,IAAI,CAAC,qBACH,OAAO;CAGT,MAAM,EAAE,SAAS,iBAAiB;CAElC,IAAI,CAAC,wBAAwB,cAAc,SAAS,YAAY,GAC9D,OAAO;CAGT,MAAM,aAAgC;EACpC;EACA;EACA,eAAe,GAAG,QAAQ,GAAG;EAC7B,SAAS;EACT,YAAY,wBAAwB;EACpC,2BAA2B;CAC7B;CAEA,IAAI,CAAA,IAAsB,QAAQ,YAAY,GAC5C,WAAW,aAAa;CAG1B,OAAO;AACT;AAGA,MAAM,mBAA2C;CAC/C,IAAI;CACJ,MAAMC;CACN,QAAQ;AAKV;AAEA,SAAS,uBAAuB,MAA0C;CACxE,KAAK,MAAM,CAAC,QAAQ,eAAe,OAAO,QAAQ,gBAAgB,GAAG;EACnE,MAAM,aAAa,iBAAiB;EACpC,IAAI,KAAK,SAAS,cAAc,CAAC,KAAK,MAAM,WAAW,GAAG,WAAW,EAAE,GACrE;EAGF,MAAM,YAAY,GAAG,OAAO;EAC5B,MAAM,eAAe,KAAK,OAAO;EACjC,IAAI,CAAC,cACH,OAAO;EAGT,OAAO;GACL,YAAY,yBAAyB;GACrC,SAAS;GACT,aAAa,WAAW,OAAO;GAC/B;GACA,gBAAgB;GAChB;GACA,SAAS;EACX;CACF;CACA,OAAO;AACT;AAEA,SAAS,aAAa,OAAwC;CAC5D,MAAM,OAA4B,CAAC;CAEnC,KAAK,MAAM,QAAQ,OAAO;EACxB,MAAM,MAAM,iBAAiB,UAAU,IAAI;EAC3C,IAAI,IAAI,SAAS;GACf,KAAK,KAAK,GAAG,IAAI,IAAI;GACrB;EACF;EAEA,MAAM,eAAe,uBAAuB,IAAI;EAChD,IAAI,cACF,KAAK,KAAK,YAAY;CAE1B;CAEA,OAAO;AACT;AAEA,SAAS,sBACP,SACA,aACA,QACqB;CACrB,OAAO,MAAM,wCAAwC;CAErD,MAAM,MAAM,SAAS,EAAE,YAAY,SAAS,SAAS,MAAM,OAAO,CAAC;CACnE,IAAI,CAAC,KACH,OAAO,CAAC;CAGV,IAAI,UAAU,OAAO,IAAI,KAAK,OAC5B,OAAO,aAAa,IAAI,KAAK,KAAK;CAGpC,IAAI,EAAE,UAAU,MACd,OAAO,CAAC;CAGV,MAAM,OAA4B,CAAC;CAEnC,KAAK,MAAM,OAAO,OAAO,OAAO,IAAI,IAAI,GAAG;EACzC,IAAI,IAAI,WAAW;GACjB,MAAM,MAAM,OAAO,IAAI,WAAW,MAAM,OAAO,eAAe;GAC9D,IAAI,KAAK;IACP,IAAI,UAAU;IACd,KAAK,KAAK,GAAG;GACf;EACF;EAEA,KAAK,MAAM,WAAW,IAAI,UAAU;GAClC,MAAM,MAAM,OAAO,SAAS,MAAM,OAAO,eAAe;GACxD,IAAI,KAAK;IACP,IAAI,UAAU;IACd,KAAK,KAAK,GAAG;GACf;EACF;EAEA,KAAK,MAAM,UAAU,IAAI,YAAY;GACnC,MAAM,MAAM,cAAc,MAAM;GAChC,IAAI,KACF,KAAK,KAAK,GAAG;EAEjB;EAEA,KAAK,KAAK,GAAG,aAAa,IAAI,KAAK,CAAC;CACtC;CAEA,OAAO;AACT;AAEA,eAAe,eAAuC;CACpD,MAAM,UAAU,MAAM,cAAc,iBAAiB,MAAM;CAC3D,IAAI,CAAC,SACH,OAAO,EAAE,MAAM,UAAU;CAG3B,MAAM,SAAS,gBAAgB,UAAU,OAAO;CAChD,IAAI,CAAC,OAAO,SAAS;EAEnB,OAAO,MAAM,mBAAmB,iBAAiB;EACjD,OAAO,EAAE,MAAM,cAAc;CAC/B;CAEA,OAAO;EAAE,MAAM;EAAU,oBAAoB,OAAO,KAAK;CAAU;AACrE;;;;AAKA,SAAS,cAAsC;CAC7C,MAAM,WAAW,kBAAkB;CACnC,MAAM,SAASC,IAAiD,QAAQ;CACxE,IAAI,WAAW,KAAA,GACb,OAAO;CAGT,MAAM,SAAS,aAAa;CAC5B,IAAa,UAAU,MAAM;CAC7B,OAAO;AACT;;;;;;AAOA,eAAe,oBAAoB,aAAuC;CACxE,MAAM,WAAW,MAAM,YAAY;CAEnC,QAAQ,SAAS,MAAjB;EACE,KAAK,WACH,OAAO;EACT,KAAK,eAEH,OAAO;EACT,KAAK,UACH,OAAO,kBAAkB,aAAa,SAAS,kBAAkB;CACrE;AACF;AAEA,eAAsB,mBACpB,SACA,aACA,SAAwB,CAAC,GACW;CACpC,OAAO,MAAM,qCAAqC,YAAY,EAAE;CAEhE,MAAM,OAAO,CACX,GAAG,iBAAiB,SAAS,MAAM,GACnC,GAAG,sBAAsB,SAAS,aAAa,MAAM,CACvD;CAEA,IAAI,CAAC,KAAK,QACR,OAAO;CAGT,MAAM,MAA0B,EAAE,KAAK;CAEvC,IAAI,MAAM,oBAAoB,WAAW,GAElC;OAAA,MAAM,OAAO,MAEhB,IAAI,IAAI,YAAY,YAAY,IAAI,YAAY,YAC9C,IAAI,0BAA0B;CAAA;CAKpC,OAAO;AACT"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "renovate",
   "description": "Automated dependency updates. Flexible so you don't need to be.",
-  "version": "44.42.2",
+  "version": "44.43.0",
   "type": "module",
   "bin": {
     "renovate": "dist/renovate.js",

package/renovate-schema.json

@@ -1,8 +1,8 @@
 {
   "$id": "https://docs.renovatebot.com/renovate-schema.json",
-  "title": "JSON schema for Renovate 44.42.2 config files (https://renovatebot.com/)",
+  "title": "JSON schema for Renovate 44.43.0 config files (https://renovatebot.com/)",
   "$schema": "http://json-schema.org/draft-07/schema#",
-  "x-renovate-version": "44.42.2",
+  "x-renovate-version": "44.43.0",
   "allowComments": true,
   "type": "object",
   "definitions": {