renovate 44.85.0 → 44.86.0

package/dist/modules/manager/github-actions/artifacts.js.map

@@ -1 +1 @@
-{"version":3,"file":"artifacts.js","names":["hostRules.find"],"sources":["../../../../lib/modules/manager/github-actions/artifacts.ts"],"sourcesContent":["import { quote } from 'shlex';\nimport { GlobalConfig } from '../../../config/global.ts';\nimport { TEMPORARY_ERROR } from '../../../constants/error-messages.ts';\nimport { logger } from '../../../logger/index.ts';\nimport { coerceArray } from '../../../util/array.ts';\nimport { findGithubToken } from '../../../util/check-token.ts';\nimport { detectPlatform } from '../../../util/common.ts';\nimport { exec } from '../../../util/exec/index.ts';\nimport type { ExecOptions, ExtraEnv } from '../../../util/exec/types.ts';\nimport { readLocalFile, writeLocalFile } from '../../../util/fs/index.ts';\nimport { getRepoStatus } from '../../../util/git/index.ts';\nimport type { FileChange } from '../../../util/git/types.ts';\nimport * as hostRules from '../../../util/host-rules.ts';\nimport { parseUrl } from '../../../util/url.ts';\nimport type { PackageFile, PostUpdateConfig } from '../types.ts';\nimport { artifactErrorMessageFromExecError } from '../util.ts';\nimport { actionsLockFile, isLockfileManaged } from './common.ts';\nimport { ActionsLockfile } from './schema.ts';\nimport type { ActionsLockfileResult, OnboardedWorkflows } from './types.ts';\n\n/** The `gh` CLI extension that generates and verifies the lockfile. */\nconst extensionName = 'github/gh-actions-lock';\n\n/** The `uses:` dep types the lockfile graph is built from. */\nconst lockedDepTypes = ['action', 'workflow', 'docker'];\n\nfunction findToken(url: string): string | undefined {\n  return findGithubToken(hostRules.find({ hostType: 'github', url }));\n}\n\n/**\n * `gh` takes the token from a different variable for GitHub Enterprise Server, and has to be told which host to talk to.\n *\n * Public actions are still resolved against github.com from there, so pass a token for both hosts.\n */\nfunction getTokenEnv(): ExtraEnv {\n  const githubComEndpoint = 'https://api.github.com/';\n  const configuredEndpoint = GlobalConfig.get('endpoint');\n  // The configured endpoint only says where GitHub lives when Renovate is talking to GitHub: workflows mirrored onto another platform still resolve their actions against github.com.\n  const endpoint =\n    configuredEndpoint && detectPlatform(configuredEndpoint) === 'github'\n      ? configuredEndpoint\n      : githubComEndpoint;\n\n  const hostname = parseUrl(endpoint)?.hostname;\n  const isEnterprise =\n    !!hostname && hostname !== 'api.github.com' && hostname !== 'github.com';\n\n  const env: ExtraEnv = {};\n\n  if (isEnterprise) {\n    const enterpriseToken = findToken(endpoint);\n    if (enterpriseToken) {\n      env.GH_HOST = hostname;\n      env.GH_ENTERPRISE_TOKEN = enterpriseToken;\n    }\n  }\n\n  const token = findToken(githubComEndpoint);\n  if (token) {\n    env.GH_TOKEN = token;\n  }\n\n  if (!Object.keys(env).length) {\n    logger.debug('No GitHub token found for `gh actions-lock`');\n  }\n\n  return env;\n}\n\n/**\n * Whether any updated dependency is one the lockfile records an edge for, and sits in a file `gh actions-lock` will look at.\n */\nfunction hasLockedUpdate(\n  config: PostUpdateConfig,\n  onboardedWorkflows: OnboardedWorkflows,\n): boolean {\n  return config.upgrades.some((upgrade) => {\n    if (upgrade.manager !== 'github-actions') {\n      return false;\n    }\n\n    if (!upgrade.depType || !lockedDepTypes.includes(upgrade.depType)) {\n      return false;\n    }\n\n    const packageFile = upgrade.packageFile;\n    if (!packageFile) {\n      return false;\n    }\n\n    return isLockfileManaged(packageFile, onboardedWorkflows);\n  });\n}\n\n/**\n * Regenerate `.github/workflows/actions.lock` once per branch.\n *\n * The lockfile records a transitive graph - resolved commits, numeric owner and repository IDs, and each composite action's own `uses:` edges - so it is regenerated by its own tool rather than patched here.\n * `gh actions-lock` re-reads every workflow from disk and rewrites the whole file, so this runs after all of the branch's package file updates have been flushed, in the same shape as npm's `getAdditionalFiles`.\n */\nexport async function updateActionsLockfile(\n  config: PostUpdateConfig,\n  packageFiles: Record<string, PackageFile[]> | undefined,\n): Promise<ActionsLockfileResult> {\n  const empty: ActionsLockfileResult = {\n    updatedArtifacts: [],\n    artifactErrors: [],\n  };\n\n  const ghaPackageFiles = packageFiles?.['github-actions'];\n  if (!ghaPackageFiles?.length) {\n    return empty;\n  }\n\n  if (config.skipArtifactsUpdate) {\n    logger.debug(`Skipping ${actionsLockFile} generation`);\n    return empty;\n  }\n\n  const existingLockFileContent = await readLocalFile(actionsLockFile, 'utf8');\n  if (!existingLockFileContent) {\n    logger.debug(`No ${actionsLockFile} found`);\n    return empty;\n  }\n\n  const parsedLockfile = ActionsLockfile.safeParse(existingLockFileContent);\n  if (!parsedLockfile.success) {\n    logger.warn(\n      { err: parsedLockfile.error, lockFile: actionsLockFile },\n      'Failed to parse the GitHub Actions lockfile, so not regenerating it',\n    );\n    return empty;\n  }\n\n  if (!hasLockedUpdate(config, parsedLockfile.data.workflows)) {\n    logger.debug(`No locked dependencies updated for ${actionsLockFile}`);\n    return empty;\n  }\n\n  logger.debug(`Regenerating ${actionsLockFile}`);\n\n  const ghaPackageFilePaths = new Set(\n    ghaPackageFiles.map((file) => file.packageFile),\n  );\n\n  // Ensure that in-memory file contents are flushed to disk, so `actions-lock` can run against it.\n  // A branch can group updates from other managers, whose contents may be binary - a Gradle wrapper JAR, say - so only write the workflows which the tool actually reads.\n  const writtenContent = new Map<string, string>();\n  for (const file of coerceArray(config.updatedPackageFiles)) {\n    if (file.type === 'addition' && ghaPackageFilePaths.has(file.path)) {\n      const contents = file.contents!.toString();\n      await writeLocalFile(file.path, contents);\n      writtenContent.set(file.path, contents);\n    }\n  }\n\n  const tokenEnv = getTokenEnv();\n\n  const execOptions: ExecOptions = {\n    // The tool rescans every workflow, so it runs from the repository root\n    cwd: GlobalConfig.get('localDir'),\n    // `extraEnv` is what forwards a variable into the Docker sidecar, but on its own it is only a default: `getChildEnv` lets a same-named variable in Renovate's own environment win.\n    // The token we resolved from the host rules must not be shadowed by an ambient `GH_TOKEN`, so force it as well.\n    extraEnv: tokenEnv,\n    env: tokenEnv,\n    toolConstraints: [{ toolName: 'gh', constraint: config.constraints?.gh }],\n    docker: {},\n  };\n\n  // `--no-interactive`: we have no terminal to answer prompts with\n  // `--no-narrow`: keep the ref that we wrote, to avoid a `@v4` being rewritten as `@v4.2.1`\n  // `--no-migrate-local-actions`: on-by-default, but unrelated to our lockfile updates\n  const commands = [\n    'gh actions-lock --no-interactive --no-narrow --no-migrate-local-actions',\n  ];\n\n  // `binarySource=global` means the administrator provisions tooling, so we must not reach into their `gh` install to add or re-pin an extension.\n  // They own the extension version, and `constraints.ghActionsLock` does not apply.\n  // TODO replace once containerbase/base#7279 is available\n  if (GlobalConfig.get('binarySource') === 'global') {\n    // Debug rather than warn: `constraints.ghActionsLock` ships with a default, so we cannot tell an explicit override from the default here, and warning would fire for every repository on this `binarySource`.\n    logger.once.debug(\n      { constraint: config.constraints?.ghActionsLock },\n      'Not installing the `gh-actions-lock` extension, and ignoring `constraints.ghActionsLock`, because `binarySource=global` leaves tooling to the administrator',\n    );\n  } else {\n    // `--force` makes an install a no-op when the specified version is already installed\n    if (config.constraints?.ghActionsLock) {\n      commands.unshift(\n        `gh extension install ${extensionName} --force --pin ${quote(config.constraints?.ghActionsLock)}`,\n      );\n    } else {\n      commands.unshift(`gh extension install ${extensionName} --force`);\n    }\n  }\n\n  try {\n    await exec(commands, execOptions);\n  } catch (err) {\n    if (err.message === TEMPORARY_ERROR) {\n      throw err;\n    }\n    logger.debug({ err }, `Error updating ${actionsLockFile}`);\n    return {\n      updatedArtifacts: [],\n      artifactErrors: [\n        {\n          fileName: actionsLockFile,\n          // an `ExecError` always carries a `stderr`, so fall back to the message rather than rendering an artifact error with nothing in it\n          stderr: artifactErrorMessageFromExecError(err, err.message),\n        },\n      ],\n    };\n  }\n\n  const updatedArtifacts: FileChange[] = [];\n\n  const newLockFileContent = await readLocalFile(actionsLockFile, 'utf8');\n  if (newLockFileContent && newLockFileContent !== existingLockFileContent) {\n    updatedArtifacts.push({\n      type: 'addition',\n      path: actionsLockFile,\n      contents: newLockFileContent,\n    });\n  }\n\n  // `actions-lock` may annotate workflows being managed with i.e. `# This workflow is managed by gh actions-lock.`, even if there were no updates to that workflow in this branch.\n  // We should diff against Git, rather than against the branch's own updated package files, otherwise those annotations are left behind as uncommitted changes\n  const status = await getRepoStatus();\n  for (const path of status.modified) {\n    // ignore the lockfile, as we've already committed it above, and any file which another manager owns\n    if (path === actionsLockFile || !ghaPackageFilePaths.has(path)) {\n      continue;\n    }\n\n    const newContent = await readLocalFile(path, 'utf8');\n    // Whatever this branch wrote is committed as a package file update already, so only content which the tool changed on top of it is an artifact\n    if (!newContent || newContent === writtenContent.get(path)) {\n      continue;\n    }\n    logger.debug(`\\`gh actions-lock\\` annotated ${path}`);\n    updatedArtifacts.push({\n      type: 'addition',\n      path,\n      contents: newContent,\n    });\n  }\n\n  if (!updatedArtifacts.length) {\n    logger.debug(`${actionsLockFile} is unchanged`);\n  }\n\n  return { updatedArtifacts, artifactErrors: [] };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAqBA,MAAM,gBAAgB;;AAGtB,MAAM,iBAAiB;CAAC;CAAU;CAAY;AAAQ;AAEtD,SAAS,UAAU,KAAiC;CAClD,OAAO,gBAAgBA,KAAe;EAAE,UAAU;EAAU;CAAI,CAAC,CAAC;AACpE;;;;;;AAOA,SAAS,cAAwB;CAC/B,MAAM,oBAAoB;CAC1B,MAAM,qBAAqB,aAAa,IAAI,UAAU;CAEtD,MAAM,WACJ,sBAAsB,eAAe,kBAAkB,MAAM,WACzD,qBACA;CAEN,MAAM,WAAW,SAAS,QAAQ,CAAC,EAAE;CACrC,MAAM,eACJ,CAAC,CAAC,YAAY,aAAa,oBAAoB,aAAa;CAE9D,MAAM,MAAgB,CAAC;CAEvB,IAAI,cAAc;EAChB,MAAM,kBAAkB,UAAU,QAAQ;EAC1C,IAAI,iBAAiB;GACnB,IAAI,UAAU;GACd,IAAI,sBAAsB;EAC5B;CACF;CAEA,MAAM,QAAQ,UAAU,iBAAiB;CACzC,IAAI,OACF,IAAI,WAAW;CAGjB,IAAI,CAAC,OAAO,KAAK,GAAG,CAAC,CAAC,QACpB,OAAO,MAAM,6CAA6C;CAG5D,OAAO;AACT;;;;AAKA,SAAS,gBACP,QACA,oBACS;CACT,OAAO,OAAO,SAAS,MAAM,YAAY;EACvC,IAAI,QAAQ,YAAY,kBACtB,OAAO;EAGT,IAAI,CAAC,QAAQ,WAAW,CAAC,eAAe,SAAS,QAAQ,OAAO,GAC9D,OAAO;EAGT,MAAM,cAAc,QAAQ;EAC5B,IAAI,CAAC,aACH,OAAO;EAGT,OAAO,kBAAkB,aAAa,kBAAkB;CAC1D,CAAC;AACH;;;;;;;AAQA,eAAsB,sBACpB,QACA,cACgC;CAChC,MAAM,QAA+B;EACnC,kBAAkB,CAAC;EACnB,gBAAgB,CAAC;CACnB;CAEA,MAAM,kBAAkB,eAAe;CACvC,IAAI,CAAC,iBAAiB,QACpB,OAAO;CAGT,IAAI,OAAO,qBAAqB;EAC9B,OAAO,MAAM,YAAY,gBAAgB,YAAY;EACrD,OAAO;CACT;CAEA,MAAM,0BAA0B,MAAM,cAAc,iBAAiB,MAAM;CAC3E,IAAI,CAAC,yBAAyB;EAC5B,OAAO,MAAM,MAAM,gBAAgB,OAAO;EAC1C,OAAO;CACT;CAEA,MAAM,iBAAiB,gBAAgB,UAAU,uBAAuB;CACxE,IAAI,CAAC,eAAe,SAAS;EAC3B,OAAO,KACL;GAAE,KAAK,eAAe;GAAO,UAAU;EAAgB,GACvD,qEACF;EACA,OAAO;CACT;CAEA,IAAI,CAAC,gBAAgB,QAAQ,eAAe,KAAK,SAAS,GAAG;EAC3D,OAAO,MAAM,sCAAsC,iBAAiB;EACpE,OAAO;CACT;CAEA,OAAO,MAAM,gBAAgB,iBAAiB;CAE9C,MAAM,sBAAsB,IAAI,IAC9B,gBAAgB,KAAK,SAAS,KAAK,WAAW,CAChD;CAIA,MAAM,iCAAiB,IAAI,IAAoB;CAC/C,KAAK,MAAM,QAAQ,YAAY,OAAO,mBAAmB,GACvD,IAAI,KAAK,SAAS,cAAc,oBAAoB,IAAI,KAAK,IAAI,GAAG;EAClE,MAAM,WAAW,KAAK,SAAU,SAAS;EACzC,MAAM,eAAe,KAAK,MAAM,QAAQ;EACxC,eAAe,IAAI,KAAK,MAAM,QAAQ;CACxC;CAGF,MAAM,WAAW,YAAY;CAE7B,MAAM,cAA2B;EAE/B,KAAK,aAAa,IAAI,UAAU;EAGhC,UAAU;EACV,KAAK;EACL,iBAAiB,CAAC;GAAE,UAAU;GAAM,YAAY,OAAO,aAAa;EAAG,CAAC;EACxE,QAAQ,CAAC;CACX;CAKA,MAAM,WAAW,CACf,yEACF;CAKA,IAAI,aAAa,IAAI,cAAc,MAAM,UAEvC,OAAO,KAAK,MACV,EAAE,YAAY,OAAO,aAAa,cAAc,GAChD,6JACF;MAGA,IAAI,OAAO,aAAa,eACtB,SAAS,QACP,wBAAwB,cAAc,iBAAiB,MAAM,OAAO,aAAa,aAAa,GAChG;MAEA,SAAS,QAAQ,wBAAwB,cAAc,SAAS;CAIpE,IAAI;EACF,MAAM,KAAK,UAAU,WAAW;CAClC,SAAS,KAAK;EACZ,IAAI,IAAI,YAAA,mBACN,MAAM;EAER,OAAO,MAAM,EAAE,IAAI,GAAG,kBAAkB,iBAAiB;EACzD,OAAO;GACL,kBAAkB,CAAC;GACnB,gBAAgB,CACd;IACE,UAAU;IAEV,QAAQ,kCAAkC,KAAK,IAAI,OAAO;GAC5D,CACF;EACF;CACF;CAEA,MAAM,mBAAiC,CAAC;CAExC,MAAM,qBAAqB,MAAM,cAAc,iBAAiB,MAAM;CACtE,IAAI,sBAAsB,uBAAuB,yBAC/C,iBAAiB,KAAK;EACpB,MAAM;EACN,MAAM;EACN,UAAU;CACZ,CAAC;CAKH,MAAM,SAAS,MAAM,cAAc;CACnC,KAAK,MAAM,QAAQ,OAAO,UAAU;EAElC,IAAI,SAAA,oCAA4B,CAAC,oBAAoB,IAAI,IAAI,GAC3D;EAGF,MAAM,aAAa,MAAM,cAAc,MAAM,MAAM;EAEnD,IAAI,CAAC,cAAc,eAAe,eAAe,IAAI,IAAI,GACvD;EAEF,OAAO,MAAM,iCAAiC,MAAM;EACpD,iBAAiB,KAAK;GACpB,MAAM;GACN;GACA,UAAU;EACZ,CAAC;CACH;CAEA,IAAI,CAAC,iBAAiB,QACpB,OAAO,MAAM,GAAG,gBAAgB,cAAc;CAGhD,OAAO;EAAE;EAAkB,gBAAgB,CAAC;CAAE;AAChD"}
+{"version":3,"file":"artifacts.js","names":["hostRules.find"],"sources":["../../../../lib/modules/manager/github-actions/artifacts.ts"],"sourcesContent":["import { quote } from 'shlex';\nimport { GlobalConfig } from '../../../config/global.ts';\nimport { TEMPORARY_ERROR } from '../../../constants/error-messages.ts';\nimport { logger } from '../../../logger/index.ts';\nimport { coerceArray } from '../../../util/array.ts';\nimport { findGithubToken } from '../../../util/check-token.ts';\nimport { detectPlatform } from '../../../util/common.ts';\nimport { exec } from '../../../util/exec/index.ts';\nimport type { ExecOptions, ExtraEnv } from '../../../util/exec/types.ts';\nimport { readLocalFile, writeLocalFile } from '../../../util/fs/index.ts';\nimport { getRepoStatus } from '../../../util/git/index.ts';\nimport type { FileChange } from '../../../util/git/types.ts';\nimport * as hostRules from '../../../util/host-rules.ts';\nimport { parseUrl } from '../../../util/url.ts';\nimport type { PackageFile, PostUpdateConfig } from '../types.ts';\nimport {\n  artifactErrorMessageFromExecError,\n  resolveToolConstraint,\n} from '../util.ts';\nimport { actionsLockFile, isLockfileManaged } from './common.ts';\nimport { ActionsLockfile } from './schema.ts';\nimport type { ActionsLockfileResult, OnboardedWorkflows } from './types.ts';\n\n/** The `gh` CLI extension that generates and verifies the lockfile. */\nconst extensionName = 'github/gh-actions-lock';\n\n/** The `uses:` dep types the lockfile graph is built from. */\nconst lockedDepTypes = ['action', 'workflow', 'docker'];\n\nfunction findToken(url: string): string | undefined {\n  return findGithubToken(hostRules.find({ hostType: 'github', url }));\n}\n\n/**\n * `gh` takes the token from a different variable for GitHub Enterprise Server, and has to be told which host to talk to.\n *\n * Public actions are still resolved against github.com from there, so pass a token for both hosts.\n */\nfunction getTokenEnv(): ExtraEnv {\n  const githubComEndpoint = 'https://api.github.com/';\n  const configuredEndpoint = GlobalConfig.get('endpoint');\n  // The configured endpoint only says where GitHub lives when Renovate is talking to GitHub: workflows mirrored onto another platform still resolve their actions against github.com.\n  const endpoint =\n    configuredEndpoint && detectPlatform(configuredEndpoint) === 'github'\n      ? configuredEndpoint\n      : githubComEndpoint;\n\n  const hostname = parseUrl(endpoint)?.hostname;\n  const isEnterprise =\n    !!hostname && hostname !== 'api.github.com' && hostname !== 'github.com';\n\n  const env: ExtraEnv = {};\n\n  if (isEnterprise) {\n    const enterpriseToken = findToken(endpoint);\n    if (enterpriseToken) {\n      env.GH_HOST = hostname;\n      env.GH_ENTERPRISE_TOKEN = enterpriseToken;\n    }\n  }\n\n  const token = findToken(githubComEndpoint);\n  if (token) {\n    env.GH_TOKEN = token;\n  }\n\n  if (!Object.keys(env).length) {\n    logger.debug('No GitHub token found for `gh actions-lock`');\n  }\n\n  return env;\n}\n\n/**\n * Whether any updated dependency is one the lockfile records an edge for, and sits in a file `gh actions-lock` will look at.\n */\nfunction hasLockedUpdate(\n  config: PostUpdateConfig,\n  onboardedWorkflows: OnboardedWorkflows,\n): boolean {\n  return config.upgrades.some((upgrade) => {\n    if (upgrade.manager !== 'github-actions') {\n      return false;\n    }\n\n    if (!upgrade.depType || !lockedDepTypes.includes(upgrade.depType)) {\n      return false;\n    }\n\n    const packageFile = upgrade.packageFile;\n    if (!packageFile) {\n      return false;\n    }\n\n    return isLockfileManaged(packageFile, onboardedWorkflows);\n  });\n}\n\n/**\n * Regenerate `.github/workflows/actions.lock` once per branch.\n *\n * The lockfile records a transitive graph - resolved commits, numeric owner and repository IDs, and each composite action's own `uses:` edges - so it is regenerated by its own tool rather than patched here.\n * `gh actions-lock` re-reads every workflow from disk and rewrites the whole file, so this runs after all of the branch's package file updates have been flushed, in the same shape as npm's `getAdditionalFiles`.\n */\nexport async function updateActionsLockfile(\n  config: PostUpdateConfig,\n  packageFiles: Record<string, PackageFile[]> | undefined,\n): Promise<ActionsLockfileResult> {\n  const empty: ActionsLockfileResult = {\n    updatedArtifacts: [],\n    artifactErrors: [],\n  };\n\n  const ghaPackageFiles = packageFiles?.['github-actions'];\n  if (!ghaPackageFiles?.length) {\n    return empty;\n  }\n\n  if (config.skipArtifactsUpdate) {\n    logger.debug(`Skipping ${actionsLockFile} generation`);\n    return empty;\n  }\n\n  const existingLockFileContent = await readLocalFile(actionsLockFile, 'utf8');\n  if (!existingLockFileContent) {\n    logger.debug(`No ${actionsLockFile} found`);\n    return empty;\n  }\n\n  const parsedLockfile = ActionsLockfile.safeParse(existingLockFileContent);\n  if (!parsedLockfile.success) {\n    logger.warn(\n      { err: parsedLockfile.error, lockFile: actionsLockFile },\n      'Failed to parse the GitHub Actions lockfile, so not regenerating it',\n    );\n    return empty;\n  }\n\n  if (!hasLockedUpdate(config, parsedLockfile.data.workflows)) {\n    logger.debug(`No locked dependencies updated for ${actionsLockFile}`);\n    return empty;\n  }\n\n  logger.debug(`Regenerating ${actionsLockFile}`);\n\n  const ghaPackageFilePaths = new Set(\n    ghaPackageFiles.map((file) => file.packageFile),\n  );\n\n  // Ensure that in-memory file contents are flushed to disk, so `actions-lock` can run against it.\n  // A branch can group updates from other managers, whose contents may be binary - a Gradle wrapper JAR, say - so only write the workflows which the tool actually reads.\n  const writtenContent = new Map<string, string>();\n  for (const file of coerceArray(config.updatedPackageFiles)) {\n    if (file.type === 'addition' && ghaPackageFilePaths.has(file.path)) {\n      const contents = file.contents!.toString();\n      await writeLocalFile(file.path, contents);\n      writtenContent.set(file.path, contents);\n    }\n  }\n\n  const tokenEnv = getTokenEnv();\n\n  const ghConstraint = await resolveToolConstraint(config, 'gh');\n  const ghActionsLockConstraint = await resolveToolConstraint(\n    config,\n    'ghActionsLock',\n  );\n\n  const execOptions: ExecOptions = {\n    // The tool rescans every workflow, so it runs from the repository root\n    cwd: GlobalConfig.get('localDir'),\n    // `extraEnv` is what forwards a variable into the Docker sidecar, but on its own it is only a default: `getChildEnv` lets a same-named variable in Renovate's own environment win.\n    // The token we resolved from the host rules must not be shadowed by an ambient `GH_TOKEN`, so force it as well.\n    extraEnv: tokenEnv,\n    env: tokenEnv,\n    toolConstraints: [{ toolName: 'gh', constraint: ghConstraint }],\n    docker: {},\n  };\n\n  // `--no-interactive`: we have no terminal to answer prompts with\n  // `--no-narrow`: keep the ref that we wrote, to avoid a `@v4` being rewritten as `@v4.2.1`\n  // `--no-migrate-local-actions`: on-by-default, but unrelated to our lockfile updates\n  const commands = [\n    'gh actions-lock --no-interactive --no-narrow --no-migrate-local-actions',\n  ];\n\n  // `binarySource=global` means the administrator provisions tooling, so we must not reach into their `gh` install to add or re-pin an extension.\n  // They own the extension version, and `constraints.ghActionsLock` does not apply.\n  // TODO replace once containerbase/base#7279 is available\n  if (GlobalConfig.get('binarySource') === 'global') {\n    // Debug rather than warn: `constraints.ghActionsLock` ships with a default, so we cannot tell an explicit override from the default here, and warning would fire for every repository on this `binarySource`.\n    logger.once.debug(\n      { constraint: ghActionsLockConstraint },\n      'Not installing the `gh-actions-lock` extension, and ignoring `constraints.ghActionsLock`, because `binarySource=global` leaves tooling to the administrator',\n    );\n  } else {\n    // `--force` makes an install a no-op when the specified version is already installed\n    if (ghActionsLockConstraint) {\n      commands.unshift(\n        `gh extension install ${extensionName} --force --pin ${quote(ghActionsLockConstraint)}`,\n      );\n    } else {\n      commands.unshift(`gh extension install ${extensionName} --force`);\n    }\n  }\n\n  try {\n    await exec(commands, execOptions);\n  } catch (err) {\n    if (err.message === TEMPORARY_ERROR) {\n      throw err;\n    }\n    logger.debug({ err }, `Error updating ${actionsLockFile}`);\n    return {\n      updatedArtifacts: [],\n      artifactErrors: [\n        {\n          fileName: actionsLockFile,\n          // an `ExecError` always carries a `stderr`, so fall back to the message rather than rendering an artifact error with nothing in it\n          stderr: artifactErrorMessageFromExecError(err, err.message),\n        },\n      ],\n    };\n  }\n\n  const updatedArtifacts: FileChange[] = [];\n\n  const newLockFileContent = await readLocalFile(actionsLockFile, 'utf8');\n  if (newLockFileContent && newLockFileContent !== existingLockFileContent) {\n    updatedArtifacts.push({\n      type: 'addition',\n      path: actionsLockFile,\n      contents: newLockFileContent,\n    });\n  }\n\n  // `actions-lock` may annotate workflows being managed with i.e. `# This workflow is managed by gh actions-lock.`, even if there were no updates to that workflow in this branch.\n  // We should diff against Git, rather than against the branch's own updated package files, otherwise those annotations are left behind as uncommitted changes\n  const status = await getRepoStatus();\n  for (const path of status.modified) {\n    // ignore the lockfile, as we've already committed it above, and any file which another manager owns\n    if (path === actionsLockFile || !ghaPackageFilePaths.has(path)) {\n      continue;\n    }\n\n    const newContent = await readLocalFile(path, 'utf8');\n    // Whatever this branch wrote is committed as a package file update already, so only content which the tool changed on top of it is an artifact\n    if (!newContent || newContent === writtenContent.get(path)) {\n      continue;\n    }\n    logger.debug(`\\`gh actions-lock\\` annotated ${path}`);\n    updatedArtifacts.push({\n      type: 'addition',\n      path,\n      contents: newContent,\n    });\n  }\n\n  if (!updatedArtifacts.length) {\n    logger.debug(`${actionsLockFile} is unchanged`);\n  }\n\n  return { updatedArtifacts, artifactErrors: [] };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAwBA,MAAM,gBAAgB;;AAGtB,MAAM,iBAAiB;CAAC;CAAU;CAAY;AAAQ;AAEtD,SAAS,UAAU,KAAiC;CAClD,OAAO,gBAAgBA,KAAe;EAAE,UAAU;EAAU;CAAI,CAAC,CAAC;AACpE;;;;;;AAOA,SAAS,cAAwB;CAC/B,MAAM,oBAAoB;CAC1B,MAAM,qBAAqB,aAAa,IAAI,UAAU;CAEtD,MAAM,WACJ,sBAAsB,eAAe,kBAAkB,MAAM,WACzD,qBACA;CAEN,MAAM,WAAW,SAAS,QAAQ,CAAC,EAAE;CACrC,MAAM,eACJ,CAAC,CAAC,YAAY,aAAa,oBAAoB,aAAa;CAE9D,MAAM,MAAgB,CAAC;CAEvB,IAAI,cAAc;EAChB,MAAM,kBAAkB,UAAU,QAAQ;EAC1C,IAAI,iBAAiB;GACnB,IAAI,UAAU;GACd,IAAI,sBAAsB;EAC5B;CACF;CAEA,MAAM,QAAQ,UAAU,iBAAiB;CACzC,IAAI,OACF,IAAI,WAAW;CAGjB,IAAI,CAAC,OAAO,KAAK,GAAG,CAAC,CAAC,QACpB,OAAO,MAAM,6CAA6C;CAG5D,OAAO;AACT;;;;AAKA,SAAS,gBACP,QACA,oBACS;CACT,OAAO,OAAO,SAAS,MAAM,YAAY;EACvC,IAAI,QAAQ,YAAY,kBACtB,OAAO;EAGT,IAAI,CAAC,QAAQ,WAAW,CAAC,eAAe,SAAS,QAAQ,OAAO,GAC9D,OAAO;EAGT,MAAM,cAAc,QAAQ;EAC5B,IAAI,CAAC,aACH,OAAO;EAGT,OAAO,kBAAkB,aAAa,kBAAkB;CAC1D,CAAC;AACH;;;;;;;AAQA,eAAsB,sBACpB,QACA,cACgC;CAChC,MAAM,QAA+B;EACnC,kBAAkB,CAAC;EACnB,gBAAgB,CAAC;CACnB;CAEA,MAAM,kBAAkB,eAAe;CACvC,IAAI,CAAC,iBAAiB,QACpB,OAAO;CAGT,IAAI,OAAO,qBAAqB;EAC9B,OAAO,MAAM,YAAY,gBAAgB,YAAY;EACrD,OAAO;CACT;CAEA,MAAM,0BAA0B,MAAM,cAAc,iBAAiB,MAAM;CAC3E,IAAI,CAAC,yBAAyB;EAC5B,OAAO,MAAM,MAAM,gBAAgB,OAAO;EAC1C,OAAO;CACT;CAEA,MAAM,iBAAiB,gBAAgB,UAAU,uBAAuB;CACxE,IAAI,CAAC,eAAe,SAAS;EAC3B,OAAO,KACL;GAAE,KAAK,eAAe;GAAO,UAAU;EAAgB,GACvD,qEACF;EACA,OAAO;CACT;CAEA,IAAI,CAAC,gBAAgB,QAAQ,eAAe,KAAK,SAAS,GAAG;EAC3D,OAAO,MAAM,sCAAsC,iBAAiB;EACpE,OAAO;CACT;CAEA,OAAO,MAAM,gBAAgB,iBAAiB;CAE9C,MAAM,sBAAsB,IAAI,IAC9B,gBAAgB,KAAK,SAAS,KAAK,WAAW,CAChD;CAIA,MAAM,iCAAiB,IAAI,IAAoB;CAC/C,KAAK,MAAM,QAAQ,YAAY,OAAO,mBAAmB,GACvD,IAAI,KAAK,SAAS,cAAc,oBAAoB,IAAI,KAAK,IAAI,GAAG;EAClE,MAAM,WAAW,KAAK,SAAU,SAAS;EACzC,MAAM,eAAe,KAAK,MAAM,QAAQ;EACxC,eAAe,IAAI,KAAK,MAAM,QAAQ;CACxC;CAGF,MAAM,WAAW,YAAY;CAE7B,MAAM,eAAe,MAAM,sBAAsB,QAAQ,IAAI;CAC7D,MAAM,0BAA0B,MAAM,sBACpC,QACA,eACF;CAEA,MAAM,cAA2B;EAE/B,KAAK,aAAa,IAAI,UAAU;EAGhC,UAAU;EACV,KAAK;EACL,iBAAiB,CAAC;GAAE,UAAU;GAAM,YAAY;EAAa,CAAC;EAC9D,QAAQ,CAAC;CACX;CAKA,MAAM,WAAW,CACf,yEACF;CAKA,IAAI,aAAa,IAAI,cAAc,MAAM,UAEvC,OAAO,KAAK,MACV,EAAE,YAAY,wBAAwB,GACtC,6JACF;MAGA,IAAI,yBACF,SAAS,QACP,wBAAwB,cAAc,iBAAiB,MAAM,uBAAuB,GACtF;MAEA,SAAS,QAAQ,wBAAwB,cAAc,SAAS;CAIpE,IAAI;EACF,MAAM,KAAK,UAAU,WAAW;CAClC,SAAS,KAAK;EACZ,IAAI,IAAI,YAAA,mBACN,MAAM;EAER,OAAO,MAAM,EAAE,IAAI,GAAG,kBAAkB,iBAAiB;EACzD,OAAO;GACL,kBAAkB,CAAC;GACnB,gBAAgB,CACd;IACE,UAAU;IAEV,QAAQ,kCAAkC,KAAK,IAAI,OAAO;GAC5D,CACF;EACF;CACF;CAEA,MAAM,mBAAiC,CAAC;CAExC,MAAM,qBAAqB,MAAM,cAAc,iBAAiB,MAAM;CACtE,IAAI,sBAAsB,uBAAuB,yBAC/C,iBAAiB,KAAK;EACpB,MAAM;EACN,MAAM;EACN,UAAU;CACZ,CAAC;CAKH,MAAM,SAAS,MAAM,cAAc;CACnC,KAAK,MAAM,QAAQ,OAAO,UAAU;EAElC,IAAI,SAAA,oCAA4B,CAAC,oBAAoB,IAAI,IAAI,GAC3D;EAGF,MAAM,aAAa,MAAM,cAAc,MAAM,MAAM;EAEnD,IAAI,CAAC,cAAc,eAAe,eAAe,IAAI,IAAI,GACvD;EAEF,OAAO,MAAM,iCAAiC,MAAM;EACpD,iBAAiB,KAAK;GACpB,MAAM;GACN;GACA,UAAU;EACZ,CAAC;CACH;CAEA,IAAI,CAAC,iBAAiB,QACpB,OAAO,MAAM,GAAG,gBAAgB,cAAc;CAGhD,OAAO;EAAE;EAAkB,gBAAgB,CAAC;CAAE;AAChD"}

package/dist/modules/manager/gleam/artifacts.js

@@ -2,6 +2,7 @@ import "../../../constants/error-messages.js";
 import { logger } from "../../../logger/index.js";
 import { deleteLocalFile, getSiblingFileName, readLocalFile, writeLocalFile } from "../../../util/fs/index.js";
 import { exec } from "../../../util/exec/index.js";
+import { resolveToolConstraint } from "../util.js";
 import { isEmptyArray, isString } from "@sindresorhus/is";
 import { quote } from "shlex";
 //#region lib/modules/manager/gleam/artifacts.ts
@@ -27,7 +28,7 @@ async function updateArtifacts(updateArtifact) {
 			docker: {},
 			toolConstraints: [{
 				toolName: "gleam",
-				constraint: config.constraints?.gleam
+				constraint: await resolveToolConstraint(config, "gleam")
 			}]
 		};
 		const updateCommand = ["gleam deps update", ...(isLockFileMaintenance ? [] : updatedDeps.map((dep) => dep.depName).filter(isString)).map(quote)].join(" ");

package/dist/modules/manager/gleam/artifacts.js.map

@@ -1 +1 @@
-{"version":3,"file":"artifacts.js","names":[],"sources":["../../../../lib/modules/manager/gleam/artifacts.ts"],"sourcesContent":["import { isEmptyArray, isString } from '@sindresorhus/is';\nimport { quote } from 'shlex';\nimport { TEMPORARY_ERROR } from '../../../constants/error-messages.ts';\nimport { logger } from '../../../logger/index.ts';\nimport { exec } from '../../../util/exec/index.ts';\nimport type { ExecOptions } from '../../../util/exec/types.ts';\nimport {\n  deleteLocalFile,\n  getSiblingFileName,\n  readLocalFile,\n  writeLocalFile,\n} from '../../../util/fs/index.ts';\nimport type { UpdateArtifact, UpdateArtifactsResult } from '../types.ts';\n\nexport async function updateArtifacts(\n  updateArtifact: UpdateArtifact,\n): Promise<UpdateArtifactsResult[] | null> {\n  const { packageFileName, updatedDeps, newPackageFileContent, config } =\n    updateArtifact;\n  logger.debug(`gleam.updateArtifacts(${packageFileName})`);\n  const { isLockFileMaintenance } = config;\n\n  if (isEmptyArray(updatedDeps) && !isLockFileMaintenance) {\n    logger.debug('No updated gleam deps - returning null');\n    return null;\n  }\n\n  const lockFileName = getSiblingFileName(packageFileName, 'manifest.toml');\n\n  const oldLockFileContent = await readLocalFile(lockFileName, 'utf8');\n  if (!oldLockFileContent) {\n    logger.debug(`No ${lockFileName} found`);\n    return null;\n  }\n\n  try {\n    await writeLocalFile(packageFileName, newPackageFileContent);\n    if (isLockFileMaintenance) {\n      await deleteLocalFile(lockFileName);\n    }\n\n    const execOptions: ExecOptions = {\n      cwdFile: packageFileName,\n      docker: {},\n      toolConstraints: [\n        {\n          toolName: 'gleam',\n          constraint: config.constraints?.gleam,\n        },\n      ],\n    };\n\n    // `gleam deps update` with no packages rebuilds the lock file\n    const packagesToUpdate = isLockFileMaintenance\n      ? []\n      : updatedDeps.map((dep) => dep.depName).filter(isString);\n\n    const updateCommand = [\n      'gleam deps update',\n      ...packagesToUpdate.map(quote),\n    ].join(' ');\n    await exec(updateCommand, execOptions);\n    const newLockFileContent = await readLocalFile(lockFileName, 'utf8');\n    if (!newLockFileContent) {\n      logger.debug(`No ${lockFileName} found`);\n      return null;\n    }\n    if (oldLockFileContent === newLockFileContent) {\n      logger.debug(`No changes in ${lockFileName} content`);\n      return null;\n    }\n    return [\n      {\n        file: {\n          type: 'addition',\n          path: lockFileName,\n          contents: newLockFileContent,\n        },\n      },\n    ];\n  } catch (err) {\n    if (err.message === TEMPORARY_ERROR) {\n      throw err;\n    }\n    logger.warn({ lockfile: lockFileName, err }, `Failed to update lock file`);\n    return [\n      {\n        artifactError: {\n          fileName: lockFileName,\n          stderr: err.message,\n        },\n      },\n    ];\n  }\n}\n"],"mappings":";;;;;;;AAcA,eAAsB,gBACpB,gBACyC;CACzC,MAAM,EAAE,iBAAiB,aAAa,uBAAuB,WAC3D;CACF,OAAO,MAAM,yBAAyB,gBAAgB,EAAE;CACxD,MAAM,EAAE,0BAA0B;CAElC,IAAI,aAAa,WAAW,KAAK,CAAC,uBAAuB;EACvD,OAAO,MAAM,wCAAwC;EACrD,OAAO;CACT;CAEA,MAAM,eAAe,mBAAmB,iBAAiB,eAAe;CAExE,MAAM,qBAAqB,MAAM,cAAc,cAAc,MAAM;CACnE,IAAI,CAAC,oBAAoB;EACvB,OAAO,MAAM,MAAM,aAAa,OAAO;EACvC,OAAO;CACT;CAEA,IAAI;EACF,MAAM,eAAe,iBAAiB,qBAAqB;EAC3D,IAAI,uBACF,MAAM,gBAAgB,YAAY;EAGpC,MAAM,cAA2B;GAC/B,SAAS;GACT,QAAQ,CAAC;GACT,iBAAiB,CACf;IACE,UAAU;IACV,YAAY,OAAO,aAAa;GAClC,CACF;EACF;EAOA,MAAM,gBAAgB,CACpB,qBACA,IANuB,wBACrB,CAAC,IACD,YAAY,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,OAAO,QAAQ,EAAA,CAInC,IAAI,KAAK,CAC/B,CAAC,CAAC,KAAK,GAAG;EACV,MAAM,KAAK,eAAe,WAAW;EACrC,MAAM,qBAAqB,MAAM,cAAc,cAAc,MAAM;EACnE,IAAI,CAAC,oBAAoB;GACvB,OAAO,MAAM,MAAM,aAAa,OAAO;GACvC,OAAO;EACT;EACA,IAAI,uBAAuB,oBAAoB;GAC7C,OAAO,MAAM,iBAAiB,aAAa,SAAS;GACpD,OAAO;EACT;EACA,OAAO,CACL,EACE,MAAM;GACJ,MAAM;GACN,MAAM;GACN,UAAU;EACZ,EACF,CACF;CACF,SAAS,KAAK;EACZ,IAAI,IAAI,YAAA,mBACN,MAAM;EAER,OAAO,KAAK;GAAE,UAAU;GAAc;EAAI,GAAG,4BAA4B;EACzE,OAAO,CACL,EACE,eAAe;GACb,UAAU;GACV,QAAQ,IAAI;EACd,EACF,CACF;CACF;AACF"}
+{"version":3,"file":"artifacts.js","names":[],"sources":["../../../../lib/modules/manager/gleam/artifacts.ts"],"sourcesContent":["import { isEmptyArray, isString } from '@sindresorhus/is';\nimport { quote } from 'shlex';\nimport { TEMPORARY_ERROR } from '../../../constants/error-messages.ts';\nimport { logger } from '../../../logger/index.ts';\nimport { exec } from '../../../util/exec/index.ts';\nimport type { ExecOptions } from '../../../util/exec/types.ts';\nimport {\n  deleteLocalFile,\n  getSiblingFileName,\n  readLocalFile,\n  writeLocalFile,\n} from '../../../util/fs/index.ts';\nimport type { UpdateArtifact, UpdateArtifactsResult } from '../types.ts';\nimport { resolveToolConstraint } from '../util.ts';\n\nexport async function updateArtifacts(\n  updateArtifact: UpdateArtifact,\n): Promise<UpdateArtifactsResult[] | null> {\n  const { packageFileName, updatedDeps, newPackageFileContent, config } =\n    updateArtifact;\n  logger.debug(`gleam.updateArtifacts(${packageFileName})`);\n  const { isLockFileMaintenance } = config;\n\n  if (isEmptyArray(updatedDeps) && !isLockFileMaintenance) {\n    logger.debug('No updated gleam deps - returning null');\n    return null;\n  }\n\n  const lockFileName = getSiblingFileName(packageFileName, 'manifest.toml');\n\n  const oldLockFileContent = await readLocalFile(lockFileName, 'utf8');\n  if (!oldLockFileContent) {\n    logger.debug(`No ${lockFileName} found`);\n    return null;\n  }\n\n  try {\n    await writeLocalFile(packageFileName, newPackageFileContent);\n    if (isLockFileMaintenance) {\n      await deleteLocalFile(lockFileName);\n    }\n\n    const execOptions: ExecOptions = {\n      cwdFile: packageFileName,\n      docker: {},\n      toolConstraints: [\n        {\n          toolName: 'gleam',\n          constraint: await resolveToolConstraint(config, 'gleam'),\n        },\n      ],\n    };\n\n    // `gleam deps update` with no packages rebuilds the lock file\n    const packagesToUpdate = isLockFileMaintenance\n      ? []\n      : updatedDeps.map((dep) => dep.depName).filter(isString);\n\n    const updateCommand = [\n      'gleam deps update',\n      ...packagesToUpdate.map(quote),\n    ].join(' ');\n    await exec(updateCommand, execOptions);\n    const newLockFileContent = await readLocalFile(lockFileName, 'utf8');\n    if (!newLockFileContent) {\n      logger.debug(`No ${lockFileName} found`);\n      return null;\n    }\n    if (oldLockFileContent === newLockFileContent) {\n      logger.debug(`No changes in ${lockFileName} content`);\n      return null;\n    }\n    return [\n      {\n        file: {\n          type: 'addition',\n          path: lockFileName,\n          contents: newLockFileContent,\n        },\n      },\n    ];\n  } catch (err) {\n    if (err.message === TEMPORARY_ERROR) {\n      throw err;\n    }\n    logger.warn({ lockfile: lockFileName, err }, `Failed to update lock file`);\n    return [\n      {\n        artifactError: {\n          fileName: lockFileName,\n          stderr: err.message,\n        },\n      },\n    ];\n  }\n}\n"],"mappings":";;;;;;;;AAeA,eAAsB,gBACpB,gBACyC;CACzC,MAAM,EAAE,iBAAiB,aAAa,uBAAuB,WAC3D;CACF,OAAO,MAAM,yBAAyB,gBAAgB,EAAE;CACxD,MAAM,EAAE,0BAA0B;CAElC,IAAI,aAAa,WAAW,KAAK,CAAC,uBAAuB;EACvD,OAAO,MAAM,wCAAwC;EACrD,OAAO;CACT;CAEA,MAAM,eAAe,mBAAmB,iBAAiB,eAAe;CAExE,MAAM,qBAAqB,MAAM,cAAc,cAAc,MAAM;CACnE,IAAI,CAAC,oBAAoB;EACvB,OAAO,MAAM,MAAM,aAAa,OAAO;EACvC,OAAO;CACT;CAEA,IAAI;EACF,MAAM,eAAe,iBAAiB,qBAAqB;EAC3D,IAAI,uBACF,MAAM,gBAAgB,YAAY;EAGpC,MAAM,cAA2B;GAC/B,SAAS;GACT,QAAQ,CAAC;GACT,iBAAiB,CACf;IACE,UAAU;IACV,YAAY,MAAM,sBAAsB,QAAQ,OAAO;GACzD,CACF;EACF;EAOA,MAAM,gBAAgB,CACpB,qBACA,IANuB,wBACrB,CAAC,IACD,YAAY,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,OAAO,QAAQ,EAAA,CAInC,IAAI,KAAK,CAC/B,CAAC,CAAC,KAAK,GAAG;EACV,MAAM,KAAK,eAAe,WAAW;EACrC,MAAM,qBAAqB,MAAM,cAAc,cAAc,MAAM;EACnE,IAAI,CAAC,oBAAoB;GACvB,OAAO,MAAM,MAAM,aAAa,OAAO;GACvC,OAAO;EACT;EACA,IAAI,uBAAuB,oBAAoB;GAC7C,OAAO,MAAM,iBAAiB,aAAa,SAAS;GACpD,OAAO;EACT;EACA,OAAO,CACL,EACE,MAAM;GACJ,MAAM;GACN,MAAM;GACN,UAAU;EACZ,EACF,CACF;CACF,SAAS,KAAK;EACZ,IAAI,IAAI,YAAA,mBACN,MAAM;EAER,OAAO,KAAK;GAAE,UAAU;GAAc;EAAI,GAAG,4BAA4B;EACzE,OAAO,CACL,EACE,eAAe;GACb,UAAU;GACV,QAAQ,IAAI;EACd,EACF,CACF;CACF;AACF"}

package/dist/modules/manager/gomod/artifacts.js

@@ -8,6 +8,7 @@ import { ensureCacheDir, findLocalSiblingOrParent, isValidLocalPath, readLocalFi
 import { filterMap } from "../../../util/filter-map.js";
 import { isValid as isVersion } from "../../versioning/semver/index.js";
 import { getRepoStatus } from "../../../util/git/index.js";
+import { resolveToolConstraint } from "../util.js";
 import { withGitEnvironment } from "../../../util/git/exec.js";
 import { getExtraDepsNotice } from "./artifacts-extra.js";
 import { getGoModulesInTidyOrder } from "./package-tree.js";
@@ -18,7 +19,7 @@ import semver from "semver";
 //#region lib/modules/manager/gomod/artifacts.ts
 const { major: major$1, valid: valid$1 } = semver;
 const gitExec = withGitEnvironment(["go"]);
-function getUpdateImportPathCmds(updatedDeps, { constraints }) {
+async function getUpdateImportPathCmds(updatedDeps, config) {
 	const invalidMajorDeps = updatedDeps.filter(({ newVersion }) => !valid$1(newVersion));
 	if (invalidMajorDeps.length > 0) invalidMajorDeps.forEach(({ depName }) => logger.warn({ depName }, "Ignoring dependency: Could not get major version"));
 	const updateImportCommands = updatedDeps.filter(({ newVersion }) => valid$1(newVersion) && !newVersion.endsWith("+incompatible")).map(({ depName, newVersion }) => ({
@@ -27,7 +28,7 @@ function getUpdateImportPathCmds(updatedDeps, { constraints }) {
 	})).filter(({ depName, newMajor }) => depName.startsWith("gopkg.in/") || newMajor > 1).map(({ depName, newMajor }) => `mod upgrade --mod-name=${quote(depName)} -t=${newMajor}`);
 	if (updateImportCommands.length > 0) {
 		let installMarwanModArgs = "install github.com/marwan-at-work/mod/cmd/mod@latest";
-		const gomodModCompatibility = constraints?.gomodMod;
+		const gomodModCompatibility = await resolveToolConstraint(config, "gomodMod");
 		if (gomodModCompatibility) {
 			if (gomodModCompatibility.startsWith("v") && isVersion(gomodModCompatibility.replace(regEx(/^v/), ""))) installMarwanModArgs = installMarwanModArgs.replace(regEx(/@latest$/), `@${gomodModCompatibility}`);
 			else logger.debug({ gomodModCompatibility }, "marwan-at-work/mod compatibility range is not valid - skipping");
@@ -75,7 +76,7 @@ async function updateArtifacts({ packageFileName: goModFileName, updatedDeps, ne
 		massagedGoMod = massagedGoMod.replace(inlineReplaceRegEx, inlineCommentOut).replace(blockReplaceRegEx, blockCommentOut);
 		if (massagedGoMod !== newGoModContent) logger.debug("Removed some relative replace statements and comments from go.mod");
 	}
-	const goConstraints = deriveGoToolchainConstraints(config, newGoModContent);
+	const goConstraints = await deriveGoToolchainConstraints(config, newGoModContent);
 	try {
 		await writeLocalFile(goModFileName, massagedGoMod);
 		const cmd = "go";
@@ -120,7 +121,7 @@ async function updateArtifacts({ packageFileName: goModFileName, updatedDeps, ne
 		execCommands.push(`${cmd} ${args}`);
 		const isImportPathUpdateRequired = config.postUpdateOptions?.includes("gomodUpdateImportPaths") && config.updateType === "major";
 		if (isImportPathUpdateRequired) {
-			const updateImportCmds = getUpdateImportPathCmds(updatedDeps, config);
+			const updateImportCmds = await getUpdateImportPathCmds(updatedDeps, config);
 			if (updateImportCmds.length > 0) {
 				logger.debug(updateImportCmds, "update import path commands included");
 				execCommands.push(...updateImportCmds);
@@ -299,11 +300,12 @@ function getGoConstraints(content) {
 * 1. config: \`constraints.go\`
 * 1. \`go.mod\`: \`toolchain\` directive
 * 1. \`go.mod\`: \`go\` directive
+* 1. the \`go\` constraint collected during extraction
 *
 * NOTE that the \`constraints.golang\` is not used (TODO #42601)
 */
-function deriveGoToolchainConstraints(config, newGoModContent) {
-	return config.constraints?.go ?? getGoConstraints(newGoModContent);
+async function deriveGoToolchainConstraints(config, newGoModContent) {
+	return await resolveToolConstraint(config, "go", () => getGoConstraints(newGoModContent));
 }
 //#endregion
 export { deriveGoToolchainConstraints, updateArtifacts };

package/dist/modules/manager/gomod/artifacts.js.map

@@ -1 +1 @@
-{"version":3,"file":"artifacts.js","names":["valid","major","isValid"],"sources":["../../../../lib/modules/manager/gomod/artifacts.ts"],"sourcesContent":["import { isString } from '@sindresorhus/is';\nimport semver from 'semver';\nimport { quote } from 'shlex';\nimport upath from 'upath';\nimport { GlobalConfig } from '../../../config/global.ts';\nimport { TEMPORARY_ERROR } from '../../../constants/error-messages.ts';\nimport { logger } from '../../../logger/index.ts';\nimport { coerceArray } from '../../../util/array.ts';\nimport { getEnv } from '../../../util/env.ts';\nimport type { ExecOptions } from '../../../util/exec/types.ts';\nimport { filterMap } from '../../../util/filter-map.ts';\nimport {\n  ensureCacheDir,\n  findLocalSiblingOrParent,\n  isValidLocalPath,\n  readLocalFile,\n  writeLocalFile,\n} from '../../../util/fs/index.ts';\nimport { withGitEnvironment } from '../../../util/git/exec.ts';\nimport { getRepoStatus } from '../../../util/git/index.ts';\nimport { regEx } from '../../../util/regex.ts';\nimport { isValid } from '../../versioning/semver/index.ts';\nimport type {\n  PackageDependency,\n  UpdateArtifact,\n  UpdateArtifactsConfig,\n  UpdateArtifactsResult,\n} from '../types.ts';\nimport { getExtraDepsNotice } from './artifacts-extra.ts';\nimport { getGoModulesInTidyOrder } from './package-tree.ts';\n\nconst { major, valid } = semver;\nconst gitExec = withGitEnvironment(['go']);\n\nfunction getUpdateImportPathCmds(\n  updatedDeps: PackageDependency[],\n  { constraints }: UpdateArtifactsConfig,\n): string[] {\n  // Check if we fail to parse any major versions and log that they're skipped\n  const invalidMajorDeps = updatedDeps.filter(\n    ({ newVersion }) => !valid(newVersion),\n  );\n  if (invalidMajorDeps.length > 0) {\n    invalidMajorDeps.forEach(({ depName }) =>\n      logger.warn(\n        { depName },\n        'Ignoring dependency: Could not get major version',\n      ),\n    );\n  }\n\n  const updateImportCommands = updatedDeps\n    .filter(\n      ({ newVersion }) =>\n        valid(newVersion) && !newVersion!.endsWith('+incompatible'),\n    )\n    .map(({ depName, newVersion }) => ({\n      depName: depName!,\n      newMajor: major(newVersion!),\n    }))\n    // Skip path updates going from v0 to v1\n    .filter(\n      ({ depName, newMajor }) =>\n        depName.startsWith('gopkg.in/') || newMajor > 1,\n    )\n\n    .map(\n      ({ depName, newMajor }) =>\n        `mod upgrade --mod-name=${quote(depName)} -t=${newMajor}`,\n    );\n\n  if (updateImportCommands.length > 0) {\n    let installMarwanModArgs =\n      'install github.com/marwan-at-work/mod/cmd/mod@latest';\n    const gomodModCompatibility = constraints?.gomodMod;\n    if (gomodModCompatibility) {\n      if (\n        gomodModCompatibility.startsWith('v') &&\n        isValid(gomodModCompatibility.replace(regEx(/^v/), ''))\n      ) {\n        installMarwanModArgs = installMarwanModArgs.replace(\n          regEx(/@latest$/),\n          `@${gomodModCompatibility}`,\n        );\n      } else {\n        logger.debug(\n          { gomodModCompatibility },\n          'marwan-at-work/mod compatibility range is not valid - skipping',\n        );\n      }\n    } else {\n      logger.debug(\n        'No marwan-at-work/mod compatibility range found - installing marwan-at-work/mod latest',\n      );\n    }\n    updateImportCommands.unshift(`go ${installMarwanModArgs}`);\n  }\n\n  return updateImportCommands;\n}\n\nfunction useModcacherw(goVersion: string | undefined): boolean {\n  if (!isString(goVersion)) {\n    return true;\n  }\n\n  return semver.intersects(goVersion, `>=1.14`);\n}\n\nexport async function updateArtifacts({\n  packageFileName: goModFileName,\n  updatedDeps,\n  newPackageFileContent: newGoModContent,\n  config,\n}: UpdateArtifact): Promise<UpdateArtifactsResult[] | null> {\n  logger.debug(`gomod.updateArtifacts(${goModFileName})`);\n\n  const sumFileName = goModFileName.replace(regEx(/\\.mod$/), '.sum');\n  const existingGoSumContent = await readLocalFile(sumFileName);\n  if (!existingGoSumContent) {\n    logger.debug('No go.sum found');\n    return null;\n  }\n  const goModDir = upath.dirname(goModFileName);\n  const goModFileBaseName = upath.basename(goModFileName);\n  const modFileFlag =\n    goModFileBaseName === 'go.mod'\n      ? ''\n      : ` -modfile=${quote(goModFileBaseName)}`;\n\n  // The \"vendor\" directory can be next to the go.mod, but also in the parent directory in case\n  // the go workspaces are used.\n  const vendorDir = await findLocalSiblingOrParent(goModFileName, 'vendor');\n  const vendorModulesFileName = upath.join(vendorDir ?? '', 'modules.txt');\n  const useVendor =\n    !!config.postUpdateOptions?.includes('gomodVendor') ||\n    (!config.postUpdateOptions?.includes('gomodSkipVendor') &&\n      vendorDir &&\n      (await readLocalFile(vendorModulesFileName)) !== null);\n  let massagedGoMod = newGoModContent;\n  const useGoGenerate = !!config.postUpdateOptions?.includes('goGenerate');\n  const allowedUnsafeExecutions = GlobalConfig.get('allowedUnsafeExecutions');\n  const goGenerateAllowed = allowedUnsafeExecutions?.includes('goGenerate');\n\n  if (config.postUpdateOptions?.includes('gomodMassage')) {\n    // Regex match inline replace directive, example:\n    // replace golang.org/x/net v1.2.3 => example.com/fork/net v1.4.5\n    // https://go.dev/ref/mod#go-mod-file-replace\n\n    // replace bracket after comments, so it doesn't break the regex, doing a complex regex causes problems\n    // when there's a comment and \")\" after it, the regex will read replace block until comment.. and stop.\n    massagedGoMod = massagedGoMod\n      .split('\\n')\n      .map((line) => {\n        if (line.trim().startsWith('//')) {\n          return line.replace(')', 'renovate-replace-bracket');\n        }\n        return line;\n      })\n      .join('\\n');\n\n    const inlineReplaceRegEx = regEx(\n      /(?<newline>\\r?\\n)(?<directive>replace\\s+[^\\s]+\\s+=>\\s+\\.\\.\\/.*)/g,\n    );\n\n    // $<newline> will be matched with the (\\r?\\n) group\n    // $<directive> will be matched with the inline replace match, example\n    // \"// renovate-replace replace golang.org/x/net v1.2.3 => example.com/fork/net v1.4.5\"\n    const inlineCommentOut = '$<newline>// renovate-replace $<directive>';\n\n    // Regex match replace directive block, example:\n    // replace (\n    //     golang.org/x/net v1.2.3 => example.com/fork/net v1.4.5\n    // )\n    const blockReplaceRegEx = regEx(/(?:\\r?\\n)replace\\s*\\([^)]+\\s*\\)/g);\n\n    /**\n     * replacerFunction for commenting out replace blocks\n     * @param match A string representing a golang replace directive block\n     * @returns A commented out block with // renovate-replace\n     */\n    function blockCommentOut(match: string): string {\n      return match.replace(\n        regEx(/(?<newline>\\r?\\n)/g),\n        '$<newline>// renovate-replace ',\n      );\n    }\n\n    // Comment out golang replace directives\n    massagedGoMod = massagedGoMod\n      .replace(inlineReplaceRegEx, inlineCommentOut)\n      .replace(blockReplaceRegEx, blockCommentOut);\n\n    if (massagedGoMod !== newGoModContent) {\n      logger.debug(\n        'Removed some relative replace statements and comments from go.mod',\n      );\n    }\n  }\n  const goConstraints = deriveGoToolchainConstraints(config, newGoModContent);\n\n  try {\n    await writeLocalFile(goModFileName, massagedGoMod);\n\n    const cmd = 'go';\n    const env = getEnv();\n    const execOptions: ExecOptions = {\n      cwdFile: goModFileName,\n      extraEnv: {\n        GOPATH: await ensureCacheDir('go'),\n        GOPROXY: env.GOPROXY,\n        GOPRIVATE: env.GOPRIVATE,\n        GONOPROXY: env.GONOPROXY,\n        GONOSUMDB: env.GONOSUMDB,\n        GOSUMDB: env.GOSUMDB,\n        GOINSECURE: env.GOINSECURE,\n        /* v8 ignore next -- TODO: add test */\n        GOFLAGS: useModcacherw(goConstraints) ? '-modcacherw' : null,\n        CGO_ENABLED: GlobalConfig.get('binarySource') === 'docker' ? '0' : null,\n      },\n      docker: {},\n      toolConstraints: [\n        {\n          toolName: 'golang',\n          constraint: goConstraints,\n        },\n      ],\n    };\n\n    const execCommands: string[] = [];\n\n    let goGetDirs: string | undefined;\n    if (config.goGetDirs) {\n      goGetDirs = config.goGetDirs\n        .filter((dir) => {\n          const isValid = isValidLocalPath(dir);\n          if (!isValid) {\n            logger.warn({ dir }, 'Invalid path in goGetDirs');\n          }\n          return isValid;\n        })\n        .map(quote)\n        .join(' ');\n\n      if (goGetDirs === '') {\n        throw new Error('Invalid goGetDirs');\n      }\n    }\n\n    let args = `get${modFileFlag} `;\n\n    if (goConstraints && !semver.intersects(goConstraints, `>=1.18`)) {\n      // For Go versions < 1.18, we need to use the -d flag to avoid builds or installs\n      // https://go.dev/doc/go1.18#go-get\n      args += `-d `;\n    }\n\n    args += `-t ${goGetDirs ?? './...'}`;\n    logger.trace({ cmd, args }, 'go get command included');\n    execCommands.push(`${cmd} ${args}`);\n\n    // Update import paths on major updates\n    const isImportPathUpdateRequired =\n      config.postUpdateOptions?.includes('gomodUpdateImportPaths') &&\n      config.updateType === 'major';\n\n    if (isImportPathUpdateRequired) {\n      const updateImportCmds = getUpdateImportPathCmds(updatedDeps, config);\n      if (updateImportCmds.length > 0) {\n        logger.debug(updateImportCmds, 'update import path commands included');\n        // The updates\n        execCommands.push(...updateImportCmds);\n      }\n    }\n\n    const mustSkipGoModTidy =\n      !config.postUpdateOptions?.includes('gomodUpdateImportPaths') &&\n      config.updateType === 'major';\n    if (mustSkipGoModTidy) {\n      logger.debug('go mod tidy command skipped');\n    }\n\n    let tidyOpts = '';\n    if (config.postUpdateOptions?.includes('gomodTidy1.17')) {\n      tidyOpts += ' -compat=1.17';\n    }\n    if (config.postUpdateOptions?.includes('gomodTidyE')) {\n      tidyOpts += ' -e';\n    }\n\n    // dependent modules can only be tidied once the updated module is settled\n    const isGoModTidyAllRequired =\n      config.postUpdateOptions?.includes('gomodTidyAll') === true;\n    const isGoModTidyRequired =\n      !mustSkipGoModTidy &&\n      (config.postUpdateOptions?.includes('gomodTidy') === true ||\n        config.postUpdateOptions?.includes('gomodTidy1.17') === true ||\n        config.postUpdateOptions?.includes('gomodTidyE') === true ||\n        isGoModTidyAllRequired ||\n        (config.updateType === 'major' && isImportPathUpdateRequired));\n    if (isGoModTidyRequired) {\n      args = `mod tidy${modFileFlag}${tidyOpts}`;\n      logger.debug('go mod tidy command included');\n      execCommands.push(`${cmd} ${args}`);\n    }\n\n    let goWorkSumFileName = upath.join(goModDir, 'go.work.sum');\n    if (useVendor) {\n      // If we find a go.work, then use go workspace vendoring.\n      const goWorkFile = await findLocalSiblingOrParent(\n        goModFileName,\n        'go.work',\n      );\n\n      if (goWorkFile) {\n        goWorkSumFileName = upath.join(\n          upath.dirname(goWorkFile),\n          'go.work.sum',\n        );\n\n        args = 'work vendor';\n        logger.debug('using go work vendor');\n        execCommands.push(`${cmd} ${args}`);\n\n        args = 'work sync';\n        logger.debug('using go work sync');\n        execCommands.push(`${cmd} ${args}`);\n      } else {\n        args = `mod vendor${modFileFlag}`;\n        logger.debug('using go mod vendor');\n        execCommands.push(`${cmd} ${args}`);\n      }\n\n      if (isGoModTidyRequired) {\n        args = `mod tidy${modFileFlag}${tidyOpts}`;\n        logger.debug('go mod tidy command included');\n        execCommands.push(`${cmd} ${args}`);\n      }\n    }\n\n    // We tidy one more time as a solution for #6795\n    if (isGoModTidyRequired) {\n      args = `mod tidy${modFileFlag}${tidyOpts}`;\n      logger.debug('go mod tidy command included');\n      execCommands.push(`${cmd} ${args}`);\n    }\n\n    let dependentModules: string[] = [];\n    if (isGoModTidyAllRequired) {\n      try {\n        dependentModules = await getGoModulesInTidyOrder(goModFileName);\n        for (const dependent of dependentModules) {\n          const dir = upath.relative(goModDir, upath.dirname(dependent));\n          execCommands.push(`${cmd} -C ${quote(dir)} mod tidy${tidyOpts}`);\n        }\n        logger.debug({ dependentModules }, 'go mod tidy commands included');\n      } catch (err) {\n        logger.warn({ err }, 'Failed to find dependent Go modules');\n      }\n    }\n\n    if (useGoGenerate) {\n      if (goGenerateAllowed) {\n        logger.debug('go generate command included');\n        execCommands.push(`${cmd} generate ./...`);\n      } else {\n        logger.once.warn(\n          `go generate command requested as a post update action, but goGenerate is not permitted in the allowedUnsafeExecutions`,\n        );\n      }\n    }\n\n    await gitExec(execCommands, execOptions);\n\n    const status = await getRepoStatus();\n    const dependentFiles = dependentModules.flatMap((f) => [\n      f,\n      f.replace(regEx(/\\.mod$/), '.sum'),\n    ]);\n\n    if (\n      !status.modified.includes(sumFileName) &&\n      !status.modified.includes(goModFileName) &&\n      !status.modified.includes(goWorkSumFileName) &&\n      !dependentFiles.some((f) => status.modified.includes(f))\n    ) {\n      return null;\n    }\n\n    const res: UpdateArtifactsResult[] = [];\n    if (status.modified.includes(sumFileName)) {\n      logger.debug('Returning updated go.sum');\n      res.push({\n        file: {\n          type: 'addition',\n          path: sumFileName,\n          contents: await readLocalFile(sumFileName),\n        },\n      });\n    }\n\n    if (status.modified.includes(goWorkSumFileName)) {\n      logger.debug('Returning updated go.work.sum');\n      res.push({\n        file: {\n          type: 'addition',\n          path: goWorkSumFileName,\n          contents: await readLocalFile(goWorkSumFileName),\n        },\n      });\n    }\n\n    for (const f of dependentFiles) {\n      if (status.modified.includes(f)) {\n        logger.trace(`Returning updated ${f}`);\n        res.push({\n          file: {\n            type: 'addition',\n            path: f,\n            contents: await readLocalFile(f),\n          },\n        });\n      }\n    }\n\n    // Include all the .go file import changes\n    if (isImportPathUpdateRequired) {\n      logger.debug('Returning updated go source files for import path changes');\n      for (const f of status.modified) {\n        if (f.endsWith('.go')) {\n          res.push({\n            file: {\n              type: 'addition',\n              path: f,\n              contents: await readLocalFile(f),\n            },\n          });\n        }\n      }\n    }\n\n    const alreadyAdded = new Set<string>();\n    const alreadyDeleted = new Set<string>();\n    if (useVendor) {\n      for (const f of status.modified.concat(status.not_added)) {\n        if (vendorDir && f.startsWith(vendorDir)) {\n          alreadyAdded.add(f);\n          res.push({\n            file: {\n              type: 'addition',\n              path: f,\n              contents: await readLocalFile(f),\n            },\n          });\n        }\n      }\n      for (const f of coerceArray(status.deleted)) {\n        if (vendorDir && f.startsWith(vendorDir)) {\n          alreadyDeleted.add(f);\n          res.push({\n            file: {\n              type: 'deletion',\n              path: f,\n            },\n          });\n        }\n      }\n    }\n\n    // TODO: throws in tests (#22198)\n    const finalGoModContent = (await readLocalFile(goModFileName, 'utf8'))!\n      .replace(regEx(/\\/\\/ renovate-replace /g), '')\n      .replace(regEx(/renovate-replace-bracket/g), ')');\n    if (finalGoModContent !== newGoModContent) {\n      const artifactResult: UpdateArtifactsResult = {\n        file: {\n          type: 'addition',\n          path: goModFileName,\n          contents: finalGoModContent,\n        },\n      };\n\n      const updatedDepNames = filterMap(updatedDeps, (dep) => dep?.depName);\n      const extraDepsNotice = getExtraDepsNotice(\n        newGoModContent,\n        finalGoModContent,\n        updatedDepNames,\n        config,\n      );\n\n      if (extraDepsNotice) {\n        artifactResult.notice = {\n          file: goModFileName,\n          message: extraDepsNotice,\n        };\n      }\n\n      logger.debug('Found updated go.mod after go.sum update');\n      res.push(artifactResult);\n      alreadyAdded.add(goModFileName);\n    }\n\n    // add all files added when in `go generate` mode.\n    // unfortunately there is not a good way as there is with vendoring or go import path updates to detect this.\n    // Do this at the very very end to ensure we only capture files which would have been explicitly\n    // modified, added, or deleted from a `go generate` invocation\n    if (useGoGenerate && goGenerateAllowed) {\n      logger.debug(\n        'Updating all modified files since generated files were added',\n      );\n      for (const f of status.modified.concat(status.created)) {\n        if (!alreadyAdded.has(f)) {\n          res.push({\n            file: {\n              type: 'addition',\n              path: f,\n              contents: await readLocalFile(f),\n            },\n          });\n        }\n      }\n      for (const f of coerceArray(status.deleted)) {\n        if (!alreadyDeleted.has(f)) {\n          res.push({\n            file: {\n              type: 'deletion',\n              path: f,\n            },\n          });\n        }\n      }\n    }\n    return res;\n  } catch (err) {\n    if (err.message === TEMPORARY_ERROR) {\n      throw err;\n    }\n    logger.debug({ err }, 'Failed to update go.sum');\n    return [\n      {\n        artifactError: {\n          fileName: sumFileName,\n          stderr: err.message,\n        },\n      },\n    ];\n  }\n}\n\nfunction getGoConstraints(content: string): string | undefined {\n  // prefer toolchain directive when go.mod has one\n  const toolchainMatch = regEx(/^toolchain\\s*go(?<gover>\\d+\\.\\d+\\.\\d+)$/m).exec(\n    content,\n  );\n  const toolchainVer = toolchainMatch?.groups?.gover;\n  if (toolchainVer) {\n    logger.debug(\n      `Using go version ${toolchainVer} found in toolchain directive`,\n    );\n    return toolchainVer;\n  }\n\n  // If go.mod doesn't have toolchain directive and has a full go version spec,\n  // for example `go 1.23.6`, pick this version, this doesn't match major.minor version spec.\n  //\n  // This is because when go.mod have same version defined in go directive and toolchain directive,\n  // go will remove toolchain directive from go.mod.\n  //\n  // For example, go will rewrite `go 1.23.5\\ntoolchain go1.23.5` to `go 1.23.5` by default,\n  // in this case, the go directive is the toolchain directive.\n  const goFullVersion = regEx(/^go\\s*(?<gover>\\d+\\.\\d+\\.\\d+)$/m).exec(content)\n    ?.groups?.gover;\n  if (goFullVersion) {\n    return goFullVersion;\n  }\n\n  const re = regEx(/^go\\s*(?<gover>\\d+\\.\\d+)$/m);\n  const match = re.exec(content);\n  if (!match?.groups?.gover) {\n    return undefined;\n  }\n  return `^${match.groups.gover}`;\n}\n\n/**\n * Derive the version of the Go toolchain needed to run this project.\n *\n * This matches with the `golang` Containerbase tool.\n *\n * In precedence order:\n *\n * 1. config: \\`constraints.go\\`\n * 1. \\`go.mod\\`: \\`toolchain\\` directive\n * 1. \\`go.mod\\`: \\`go\\` directive\n *\n * NOTE that the \\`constraints.golang\\` is not used (TODO #42601)\n */\nexport function deriveGoToolchainConstraints(\n  config: UpdateArtifactsConfig,\n  newGoModContent: string,\n): string | undefined {\n  return config.constraints?.go ?? getGoConstraints(newGoModContent);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AA+BA,MAAM,EAAE,OAAA,SAAO,OAAA,YAAU;AACzB,MAAM,UAAU,mBAAmB,CAAC,IAAI,CAAC;AAEzC,SAAS,wBACP,aACA,EAAE,eACQ;CAEV,MAAM,mBAAmB,YAAY,QAClC,EAAE,iBAAiB,CAACA,QAAM,UAAU,CACvC;CACA,IAAI,iBAAiB,SAAS,GAC5B,iBAAiB,SAAS,EAAE,cAC1B,OAAO,KACL,EAAE,QAAQ,GACV,kDACF,CACF;CAGF,MAAM,uBAAuB,YAC1B,QACE,EAAE,iBACDA,QAAM,UAAU,KAAK,CAAC,WAAY,SAAS,eAAe,CAC9D,CAAC,CACA,KAAK,EAAE,SAAS,kBAAkB;EACxB;EACT,UAAUC,QAAM,UAAW;CAC7B,EAAE,CAAC,CAEF,QACE,EAAE,SAAS,eACV,QAAQ,WAAW,WAAW,KAAK,WAAW,CAClD,CAAC,CAEA,KACE,EAAE,SAAS,eACV,0BAA0B,MAAM,OAAO,EAAE,MAAM,UACnD;CAEF,IAAI,qBAAqB,SAAS,GAAG;EACnC,IAAI,uBACF;EACF,MAAM,wBAAwB,aAAa;EAC3C,IAAI,uBAAuB;GACzB,IACE,sBAAsB,WAAW,GAAG,KACpCC,UAAQ,sBAAsB,QAAQ,MAAM,IAAI,GAAG,EAAE,CAAC,GAEtD,uBAAuB,qBAAqB,QAC1C,MAAM,UAAU,GAChB,IAAI,uBACN;QAEA,OAAO,MACL,EAAE,sBAAsB,GACxB,gEACF;EAEJ,OACE,OAAO,MACL,wFACF;EAEF,qBAAqB,QAAQ,MAAM,sBAAsB;CAC3D;CAEA,OAAO;AACT;AAEA,SAAS,cAAc,WAAwC;CAC7D,IAAI,CAAC,SAAS,SAAS,GACrB,OAAO;CAGT,OAAO,OAAO,WAAW,WAAW,QAAQ;AAC9C;AAEA,eAAsB,gBAAgB,EACpC,iBAAiB,eACjB,aACA,uBAAuB,iBACvB,UAC0D;CAC1D,OAAO,MAAM,yBAAyB,cAAc,EAAE;CAEtD,MAAM,cAAc,cAAc,QAAQ,MAAM,QAAQ,GAAG,MAAM;CAEjE,IAAI,CAAC,MAD8B,cAAc,WAAW,GACjC;EACzB,OAAO,MAAM,iBAAiB;EAC9B,OAAO;CACT;CACA,MAAM,WAAW,MAAM,QAAQ,aAAa;CAC5C,MAAM,oBAAoB,MAAM,SAAS,aAAa;CACtD,MAAM,cACJ,sBAAsB,WAClB,KACA,aAAa,MAAM,iBAAiB;CAI1C,MAAM,YAAY,MAAM,yBAAyB,eAAe,QAAQ;CACxE,MAAM,wBAAwB,MAAM,KAAK,aAAa,IAAI,aAAa;CACvE,MAAM,YACJ,CAAC,CAAC,OAAO,mBAAmB,SAAS,aAAa,KACjD,CAAC,OAAO,mBAAmB,SAAS,iBAAiB,KACpD,aACC,MAAM,cAAc,qBAAqB,MAAO;CACrD,IAAI,gBAAgB;CACpB,MAAM,gBAAgB,CAAC,CAAC,OAAO,mBAAmB,SAAS,YAAY;CAEvE,MAAM,oBAD0B,aAAa,IAAI,yBACD,CAAC,EAAE,SAAS,YAAY;CAExE,IAAI,OAAO,mBAAmB,SAAS,cAAc,GAAG;EAOtD,gBAAgB,cACb,MAAM,IAAI,CAAC,CACX,KAAK,SAAS;GACb,IAAI,KAAK,KAAK,CAAC,CAAC,WAAW,IAAI,GAC7B,OAAO,KAAK,QAAQ,KAAK,0BAA0B;GAErD,OAAO;EACT,CAAC,CAAC,CACD,KAAK,IAAI;EAEZ,MAAM,qBAAqB,MACzB,kEACF;EAKA,MAAM,mBAAmB;EAMzB,MAAM,oBAAoB,MAAM,kCAAkC;;;;;;EAOlE,SAAS,gBAAgB,OAAuB;GAC9C,OAAO,MAAM,QACX,MAAM,oBAAoB,GAC1B,gCACF;EACF;EAGA,gBAAgB,cACb,QAAQ,oBAAoB,gBAAgB,CAAC,CAC7C,QAAQ,mBAAmB,eAAe;EAE7C,IAAI,kBAAkB,iBACpB,OAAO,MACL,mEACF;CAEJ;CACA,MAAM,gBAAgB,6BAA6B,QAAQ,eAAe;CAE1E,IAAI;EACF,MAAM,eAAe,eAAe,aAAa;EAEjD,MAAM,MAAM;EACZ,MAAM,MAAM,OAAO;EACnB,MAAM,cAA2B;GAC/B,SAAS;GACT,UAAU;IACR,QAAQ,MAAM,eAAe,IAAI;IACjC,SAAS,IAAI;IACb,WAAW,IAAI;IACf,WAAW,IAAI;IACf,WAAW,IAAI;IACf,SAAS,IAAI;IACb,YAAY,IAAI;;IAEhB,SAAS,cAAc,aAAa,IAAI,gBAAgB;IACxD,aAAa,aAAa,IAAI,cAAc,MAAM,WAAW,MAAM;GACrE;GACA,QAAQ,CAAC;GACT,iBAAiB,CACf;IACE,UAAU;IACV,YAAY;GACd,CACF;EACF;EAEA,MAAM,eAAyB,CAAC;EAEhC,IAAI;EACJ,IAAI,OAAO,WAAW;GACpB,YAAY,OAAO,UAChB,QAAQ,QAAQ;IACf,MAAM,UAAU,iBAAiB,GAAG;IACpC,IAAI,CAAC,SACH,OAAO,KAAK,EAAE,IAAI,GAAG,2BAA2B;IAElD,OAAO;GACT,CAAC,CAAC,CACD,IAAI,KAAK,CAAC,CACV,KAAK,GAAG;GAEX,IAAI,cAAc,IAChB,MAAM,IAAI,MAAM,mBAAmB;EAEvC;EAEA,IAAI,OAAO,MAAM,YAAY;EAE7B,IAAI,iBAAiB,CAAC,OAAO,WAAW,eAAe,QAAQ,GAG7D,QAAQ;EAGV,QAAQ,MAAM,aAAa;EAC3B,OAAO,MAAM;GAAE;GAAK;EAAK,GAAG,yBAAyB;EACrD,aAAa,KAAK,GAAG,IAAI,GAAG,MAAM;EAGlC,MAAM,6BACJ,OAAO,mBAAmB,SAAS,wBAAwB,KAC3D,OAAO,eAAe;EAExB,IAAI,4BAA4B;GAC9B,MAAM,mBAAmB,wBAAwB,aAAa,MAAM;GACpE,IAAI,iBAAiB,SAAS,GAAG;IAC/B,OAAO,MAAM,kBAAkB,sCAAsC;IAErE,aAAa,KAAK,GAAG,gBAAgB;GACvC;EACF;EAEA,MAAM,oBACJ,CAAC,OAAO,mBAAmB,SAAS,wBAAwB,KAC5D,OAAO,eAAe;EACxB,IAAI,mBACF,OAAO,MAAM,6BAA6B;EAG5C,IAAI,WAAW;EACf,IAAI,OAAO,mBAAmB,SAAS,eAAe,GACpD,YAAY;EAEd,IAAI,OAAO,mBAAmB,SAAS,YAAY,GACjD,YAAY;EAId,MAAM,yBACJ,OAAO,mBAAmB,SAAS,cAAc,MAAM;EACzD,MAAM,sBACJ,CAAC,sBACA,OAAO,mBAAmB,SAAS,WAAW,MAAM,QACnD,OAAO,mBAAmB,SAAS,eAAe,MAAM,QACxD,OAAO,mBAAmB,SAAS,YAAY,MAAM,QACrD,0BACC,OAAO,eAAe,WAAW;EACtC,IAAI,qBAAqB;GACvB,OAAO,WAAW,cAAc;GAChC,OAAO,MAAM,8BAA8B;GAC3C,aAAa,KAAK,GAAG,IAAI,GAAG,MAAM;EACpC;EAEA,IAAI,oBAAoB,MAAM,KAAK,UAAU,aAAa;EAC1D,IAAI,WAAW;GAEb,MAAM,aAAa,MAAM,yBACvB,eACA,SACF;GAEA,IAAI,YAAY;IACd,oBAAoB,MAAM,KACxB,MAAM,QAAQ,UAAU,GACxB,aACF;IAEA,OAAO;IACP,OAAO,MAAM,sBAAsB;IACnC,aAAa,KAAK,GAAG,IAAI,GAAG,MAAM;IAElC,OAAO;IACP,OAAO,MAAM,oBAAoB;IACjC,aAAa,KAAK,GAAG,IAAI,GAAG,MAAM;GACpC,OAAO;IACL,OAAO,aAAa;IACpB,OAAO,MAAM,qBAAqB;IAClC,aAAa,KAAK,GAAG,IAAI,GAAG,MAAM;GACpC;GAEA,IAAI,qBAAqB;IACvB,OAAO,WAAW,cAAc;IAChC,OAAO,MAAM,8BAA8B;IAC3C,aAAa,KAAK,GAAG,IAAI,GAAG,MAAM;GACpC;EACF;EAGA,IAAI,qBAAqB;GACvB,OAAO,WAAW,cAAc;GAChC,OAAO,MAAM,8BAA8B;GAC3C,aAAa,KAAK,GAAG,IAAI,GAAG,MAAM;EACpC;EAEA,IAAI,mBAA6B,CAAC;EAClC,IAAI,wBACF,IAAI;GACF,mBAAmB,MAAM,wBAAwB,aAAa;GAC9D,KAAK,MAAM,aAAa,kBAAkB;IACxC,MAAM,MAAM,MAAM,SAAS,UAAU,MAAM,QAAQ,SAAS,CAAC;IAC7D,aAAa,KAAK,GAAG,IAAI,MAAM,MAAM,GAAG,EAAE,WAAW,UAAU;GACjE;GACA,OAAO,MAAM,EAAE,iBAAiB,GAAG,+BAA+B;EACpE,SAAS,KAAK;GACZ,OAAO,KAAK,EAAE,IAAI,GAAG,qCAAqC;EAC5D;EAGF,IAAI,eAAe;GACjB,IAAI,mBAAmB;IACrB,OAAO,MAAM,8BAA8B;IAC3C,aAAa,KAAK,GAAG,IAAI,gBAAgB;GAC3C,OACE,OAAO,KAAK,KACV,uHACF;EAEJ;EAEA,MAAM,QAAQ,cAAc,WAAW;EAEvC,MAAM,SAAS,MAAM,cAAc;EACnC,MAAM,iBAAiB,iBAAiB,SAAS,MAAM,CACrD,GACA,EAAE,QAAQ,MAAM,QAAQ,GAAG,MAAM,CACnC,CAAC;EAED,IACE,CAAC,OAAO,SAAS,SAAS,WAAW,KACrC,CAAC,OAAO,SAAS,SAAS,aAAa,KACvC,CAAC,OAAO,SAAS,SAAS,iBAAiB,KAC3C,CAAC,eAAe,MAAM,MAAM,OAAO,SAAS,SAAS,CAAC,CAAC,GAEvD,OAAO;EAGT,MAAM,MAA+B,CAAC;EACtC,IAAI,OAAO,SAAS,SAAS,WAAW,GAAG;GACzC,OAAO,MAAM,0BAA0B;GACvC,IAAI,KAAK,EACP,MAAM;IACJ,MAAM;IACN,MAAM;IACN,UAAU,MAAM,cAAc,WAAW;GAC3C,EACF,CAAC;EACH;EAEA,IAAI,OAAO,SAAS,SAAS,iBAAiB,GAAG;GAC/C,OAAO,MAAM,+BAA+B;GAC5C,IAAI,KAAK,EACP,MAAM;IACJ,MAAM;IACN,MAAM;IACN,UAAU,MAAM,cAAc,iBAAiB;GACjD,EACF,CAAC;EACH;EAEA,KAAK,MAAM,KAAK,gBACd,IAAI,OAAO,SAAS,SAAS,CAAC,GAAG;GAC/B,OAAO,MAAM,qBAAqB,GAAG;GACrC,IAAI,KAAK,EACP,MAAM;IACJ,MAAM;IACN,MAAM;IACN,UAAU,MAAM,cAAc,CAAC;GACjC,EACF,CAAC;EACH;EAIF,IAAI,4BAA4B;GAC9B,OAAO,MAAM,2DAA2D;GACxE,KAAK,MAAM,KAAK,OAAO,UACrB,IAAI,EAAE,SAAS,KAAK,GAClB,IAAI,KAAK,EACP,MAAM;IACJ,MAAM;IACN,MAAM;IACN,UAAU,MAAM,cAAc,CAAC;GACjC,EACF,CAAC;EAGP;EAEA,MAAM,+BAAe,IAAI,IAAY;EACrC,MAAM,iCAAiB,IAAI,IAAY;EACvC,IAAI,WAAW;GACb,KAAK,MAAM,KAAK,OAAO,SAAS,OAAO,OAAO,SAAS,GACrD,IAAI,aAAa,EAAE,WAAW,SAAS,GAAG;IACxC,aAAa,IAAI,CAAC;IAClB,IAAI,KAAK,EACP,MAAM;KACJ,MAAM;KACN,MAAM;KACN,UAAU,MAAM,cAAc,CAAC;IACjC,EACF,CAAC;GACH;GAEF,KAAK,MAAM,KAAK,YAAY,OAAO,OAAO,GACxC,IAAI,aAAa,EAAE,WAAW,SAAS,GAAG;IACxC,eAAe,IAAI,CAAC;IACpB,IAAI,KAAK,EACP,MAAM;KACJ,MAAM;KACN,MAAM;IACR,EACF,CAAC;GACH;EAEJ;EAGA,MAAM,qBAAqB,MAAM,cAAc,eAAe,MAAM,EAAA,CACjE,QAAQ,MAAM,yBAAyB,GAAG,EAAE,CAAC,CAC7C,QAAQ,MAAM,2BAA2B,GAAG,GAAG;EAClD,IAAI,sBAAsB,iBAAiB;GACzC,MAAM,iBAAwC,EAC5C,MAAM;IACJ,MAAM;IACN,MAAM;IACN,UAAU;GACZ,EACF;GAEA,MAAM,kBAAkB,UAAU,cAAc,QAAQ,KAAK,OAAO;GACpE,MAAM,kBAAkB,mBACtB,iBACA,mBACA,iBACA,MACF;GAEA,IAAI,iBACF,eAAe,SAAS;IACtB,MAAM;IACN,SAAS;GACX;GAGF,OAAO,MAAM,0CAA0C;GACvD,IAAI,KAAK,cAAc;GACvB,aAAa,IAAI,aAAa;EAChC;EAMA,IAAI,iBAAiB,mBAAmB;GACtC,OAAO,MACL,8DACF;GACA,KAAK,MAAM,KAAK,OAAO,SAAS,OAAO,OAAO,OAAO,GACnD,IAAI,CAAC,aAAa,IAAI,CAAC,GACrB,IAAI,KAAK,EACP,MAAM;IACJ,MAAM;IACN,MAAM;IACN,UAAU,MAAM,cAAc,CAAC;GACjC,EACF,CAAC;GAGL,KAAK,MAAM,KAAK,YAAY,OAAO,OAAO,GACxC,IAAI,CAAC,eAAe,IAAI,CAAC,GACvB,IAAI,KAAK,EACP,MAAM;IACJ,MAAM;IACN,MAAM;GACR,EACF,CAAC;EAGP;EACA,OAAO;CACT,SAAS,KAAK;EACZ,IAAI,IAAI,YAAA,mBACN,MAAM;EAER,OAAO,MAAM,EAAE,IAAI,GAAG,yBAAyB;EAC/C,OAAO,CACL,EACE,eAAe;GACb,UAAU;GACV,QAAQ,IAAI;EACd,EACF,CACF;CACF;AACF;AAEA,SAAS,iBAAiB,SAAqC;CAK7D,MAAM,eAHiB,MAAM,0CAA0C,CAAC,CAAC,KACvE,OAEgC,CAAC,EAAE,QAAQ;CAC7C,IAAI,cAAc;EAChB,OAAO,MACL,oBAAoB,aAAa,8BACnC;EACA,OAAO;CACT;CAUA,MAAM,gBAAgB,MAAM,iCAAiC,CAAC,CAAC,KAAK,OAAO,CAAC,EACxE,QAAQ;CACZ,IAAI,eACF,OAAO;CAIT,MAAM,QADK,MAAM,4BACF,CAAC,CAAC,KAAK,OAAO;CAC7B,IAAI,CAAC,OAAO,QAAQ,OAClB;CAEF,OAAO,IAAI,MAAM,OAAO;AAC1B;;;;;;;;;;;;;;AAeA,SAAgB,6BACd,QACA,iBACoB;CACpB,OAAO,OAAO,aAAa,MAAM,iBAAiB,eAAe;AACnE"}
+{"version":3,"file":"artifacts.js","names":["valid","major","isValid"],"sources":["../../../../lib/modules/manager/gomod/artifacts.ts"],"sourcesContent":["import { isString } from '@sindresorhus/is';\nimport semver from 'semver';\nimport { quote } from 'shlex';\nimport upath from 'upath';\nimport { GlobalConfig } from '../../../config/global.ts';\nimport { TEMPORARY_ERROR } from '../../../constants/error-messages.ts';\nimport { logger } from '../../../logger/index.ts';\nimport { coerceArray } from '../../../util/array.ts';\nimport { getEnv } from '../../../util/env.ts';\nimport type { ExecOptions } from '../../../util/exec/types.ts';\nimport { filterMap } from '../../../util/filter-map.ts';\nimport {\n  ensureCacheDir,\n  findLocalSiblingOrParent,\n  isValidLocalPath,\n  readLocalFile,\n  writeLocalFile,\n} from '../../../util/fs/index.ts';\nimport { withGitEnvironment } from '../../../util/git/exec.ts';\nimport { getRepoStatus } from '../../../util/git/index.ts';\nimport { regEx } from '../../../util/regex.ts';\nimport { isValid } from '../../versioning/semver/index.ts';\nimport type {\n  PackageDependency,\n  UpdateArtifact,\n  UpdateArtifactsConfig,\n  UpdateArtifactsResult,\n} from '../types.ts';\nimport { resolveToolConstraint } from '../util.ts';\nimport { getExtraDepsNotice } from './artifacts-extra.ts';\nimport { getGoModulesInTidyOrder } from './package-tree.ts';\n\nconst { major, valid } = semver;\nconst gitExec = withGitEnvironment(['go']);\n\nasync function getUpdateImportPathCmds(\n  updatedDeps: PackageDependency[],\n  config: UpdateArtifactsConfig,\n): Promise<string[]> {\n  // Check if we fail to parse any major versions and log that they're skipped\n  const invalidMajorDeps = updatedDeps.filter(\n    ({ newVersion }) => !valid(newVersion),\n  );\n  if (invalidMajorDeps.length > 0) {\n    invalidMajorDeps.forEach(({ depName }) =>\n      logger.warn(\n        { depName },\n        'Ignoring dependency: Could not get major version',\n      ),\n    );\n  }\n\n  const updateImportCommands = updatedDeps\n    .filter(\n      ({ newVersion }) =>\n        valid(newVersion) && !newVersion!.endsWith('+incompatible'),\n    )\n    .map(({ depName, newVersion }) => ({\n      depName: depName!,\n      newMajor: major(newVersion!),\n    }))\n    // Skip path updates going from v0 to v1\n    .filter(\n      ({ depName, newMajor }) =>\n        depName.startsWith('gopkg.in/') || newMajor > 1,\n    )\n\n    .map(\n      ({ depName, newMajor }) =>\n        `mod upgrade --mod-name=${quote(depName)} -t=${newMajor}`,\n    );\n\n  if (updateImportCommands.length > 0) {\n    let installMarwanModArgs =\n      'install github.com/marwan-at-work/mod/cmd/mod@latest';\n    const gomodModCompatibility = await resolveToolConstraint(\n      config,\n      'gomodMod',\n    );\n    if (gomodModCompatibility) {\n      if (\n        gomodModCompatibility.startsWith('v') &&\n        isValid(gomodModCompatibility.replace(regEx(/^v/), ''))\n      ) {\n        installMarwanModArgs = installMarwanModArgs.replace(\n          regEx(/@latest$/),\n          `@${gomodModCompatibility}`,\n        );\n      } else {\n        logger.debug(\n          { gomodModCompatibility },\n          'marwan-at-work/mod compatibility range is not valid - skipping',\n        );\n      }\n    } else {\n      logger.debug(\n        'No marwan-at-work/mod compatibility range found - installing marwan-at-work/mod latest',\n      );\n    }\n    updateImportCommands.unshift(`go ${installMarwanModArgs}`);\n  }\n\n  return updateImportCommands;\n}\n\nfunction useModcacherw(goVersion: string | undefined): boolean {\n  if (!isString(goVersion)) {\n    return true;\n  }\n\n  return semver.intersects(goVersion, `>=1.14`);\n}\n\nexport async function updateArtifacts({\n  packageFileName: goModFileName,\n  updatedDeps,\n  newPackageFileContent: newGoModContent,\n  config,\n}: UpdateArtifact): Promise<UpdateArtifactsResult[] | null> {\n  logger.debug(`gomod.updateArtifacts(${goModFileName})`);\n\n  const sumFileName = goModFileName.replace(regEx(/\\.mod$/), '.sum');\n  const existingGoSumContent = await readLocalFile(sumFileName);\n  if (!existingGoSumContent) {\n    logger.debug('No go.sum found');\n    return null;\n  }\n  const goModDir = upath.dirname(goModFileName);\n  const goModFileBaseName = upath.basename(goModFileName);\n  const modFileFlag =\n    goModFileBaseName === 'go.mod'\n      ? ''\n      : ` -modfile=${quote(goModFileBaseName)}`;\n\n  // The \"vendor\" directory can be next to the go.mod, but also in the parent directory in case\n  // the go workspaces are used.\n  const vendorDir = await findLocalSiblingOrParent(goModFileName, 'vendor');\n  const vendorModulesFileName = upath.join(vendorDir ?? '', 'modules.txt');\n  const useVendor =\n    !!config.postUpdateOptions?.includes('gomodVendor') ||\n    (!config.postUpdateOptions?.includes('gomodSkipVendor') &&\n      vendorDir &&\n      (await readLocalFile(vendorModulesFileName)) !== null);\n  let massagedGoMod = newGoModContent;\n  const useGoGenerate = !!config.postUpdateOptions?.includes('goGenerate');\n  const allowedUnsafeExecutions = GlobalConfig.get('allowedUnsafeExecutions');\n  const goGenerateAllowed = allowedUnsafeExecutions?.includes('goGenerate');\n\n  if (config.postUpdateOptions?.includes('gomodMassage')) {\n    // Regex match inline replace directive, example:\n    // replace golang.org/x/net v1.2.3 => example.com/fork/net v1.4.5\n    // https://go.dev/ref/mod#go-mod-file-replace\n\n    // replace bracket after comments, so it doesn't break the regex, doing a complex regex causes problems\n    // when there's a comment and \")\" after it, the regex will read replace block until comment.. and stop.\n    massagedGoMod = massagedGoMod\n      .split('\\n')\n      .map((line) => {\n        if (line.trim().startsWith('//')) {\n          return line.replace(')', 'renovate-replace-bracket');\n        }\n        return line;\n      })\n      .join('\\n');\n\n    const inlineReplaceRegEx = regEx(\n      /(?<newline>\\r?\\n)(?<directive>replace\\s+[^\\s]+\\s+=>\\s+\\.\\.\\/.*)/g,\n    );\n\n    // $<newline> will be matched with the (\\r?\\n) group\n    // $<directive> will be matched with the inline replace match, example\n    // \"// renovate-replace replace golang.org/x/net v1.2.3 => example.com/fork/net v1.4.5\"\n    const inlineCommentOut = '$<newline>// renovate-replace $<directive>';\n\n    // Regex match replace directive block, example:\n    // replace (\n    //     golang.org/x/net v1.2.3 => example.com/fork/net v1.4.5\n    // )\n    const blockReplaceRegEx = regEx(/(?:\\r?\\n)replace\\s*\\([^)]+\\s*\\)/g);\n\n    /**\n     * replacerFunction for commenting out replace blocks\n     * @param match A string representing a golang replace directive block\n     * @returns A commented out block with // renovate-replace\n     */\n    function blockCommentOut(match: string): string {\n      return match.replace(\n        regEx(/(?<newline>\\r?\\n)/g),\n        '$<newline>// renovate-replace ',\n      );\n    }\n\n    // Comment out golang replace directives\n    massagedGoMod = massagedGoMod\n      .replace(inlineReplaceRegEx, inlineCommentOut)\n      .replace(blockReplaceRegEx, blockCommentOut);\n\n    if (massagedGoMod !== newGoModContent) {\n      logger.debug(\n        'Removed some relative replace statements and comments from go.mod',\n      );\n    }\n  }\n  const goConstraints = await deriveGoToolchainConstraints(\n    config,\n    newGoModContent,\n  );\n\n  try {\n    await writeLocalFile(goModFileName, massagedGoMod);\n\n    const cmd = 'go';\n    const env = getEnv();\n    const execOptions: ExecOptions = {\n      cwdFile: goModFileName,\n      extraEnv: {\n        GOPATH: await ensureCacheDir('go'),\n        GOPROXY: env.GOPROXY,\n        GOPRIVATE: env.GOPRIVATE,\n        GONOPROXY: env.GONOPROXY,\n        GONOSUMDB: env.GONOSUMDB,\n        GOSUMDB: env.GOSUMDB,\n        GOINSECURE: env.GOINSECURE,\n        /* v8 ignore next -- TODO: add test */\n        GOFLAGS: useModcacherw(goConstraints) ? '-modcacherw' : null,\n        CGO_ENABLED: GlobalConfig.get('binarySource') === 'docker' ? '0' : null,\n      },\n      docker: {},\n      toolConstraints: [\n        {\n          toolName: 'golang',\n          constraint: goConstraints,\n        },\n      ],\n    };\n\n    const execCommands: string[] = [];\n\n    let goGetDirs: string | undefined;\n    if (config.goGetDirs) {\n      goGetDirs = config.goGetDirs\n        .filter((dir) => {\n          const isValid = isValidLocalPath(dir);\n          if (!isValid) {\n            logger.warn({ dir }, 'Invalid path in goGetDirs');\n          }\n          return isValid;\n        })\n        .map(quote)\n        .join(' ');\n\n      if (goGetDirs === '') {\n        throw new Error('Invalid goGetDirs');\n      }\n    }\n\n    let args = `get${modFileFlag} `;\n\n    if (goConstraints && !semver.intersects(goConstraints, `>=1.18`)) {\n      // For Go versions < 1.18, we need to use the -d flag to avoid builds or installs\n      // https://go.dev/doc/go1.18#go-get\n      args += `-d `;\n    }\n\n    args += `-t ${goGetDirs ?? './...'}`;\n    logger.trace({ cmd, args }, 'go get command included');\n    execCommands.push(`${cmd} ${args}`);\n\n    // Update import paths on major updates\n    const isImportPathUpdateRequired =\n      config.postUpdateOptions?.includes('gomodUpdateImportPaths') &&\n      config.updateType === 'major';\n\n    if (isImportPathUpdateRequired) {\n      const updateImportCmds = await getUpdateImportPathCmds(\n        updatedDeps,\n        config,\n      );\n      if (updateImportCmds.length > 0) {\n        logger.debug(updateImportCmds, 'update import path commands included');\n        // The updates\n        execCommands.push(...updateImportCmds);\n      }\n    }\n\n    const mustSkipGoModTidy =\n      !config.postUpdateOptions?.includes('gomodUpdateImportPaths') &&\n      config.updateType === 'major';\n    if (mustSkipGoModTidy) {\n      logger.debug('go mod tidy command skipped');\n    }\n\n    let tidyOpts = '';\n    if (config.postUpdateOptions?.includes('gomodTidy1.17')) {\n      tidyOpts += ' -compat=1.17';\n    }\n    if (config.postUpdateOptions?.includes('gomodTidyE')) {\n      tidyOpts += ' -e';\n    }\n\n    // dependent modules can only be tidied once the updated module is settled\n    const isGoModTidyAllRequired =\n      config.postUpdateOptions?.includes('gomodTidyAll') === true;\n    const isGoModTidyRequired =\n      !mustSkipGoModTidy &&\n      (config.postUpdateOptions?.includes('gomodTidy') === true ||\n        config.postUpdateOptions?.includes('gomodTidy1.17') === true ||\n        config.postUpdateOptions?.includes('gomodTidyE') === true ||\n        isGoModTidyAllRequired ||\n        (config.updateType === 'major' && isImportPathUpdateRequired));\n    if (isGoModTidyRequired) {\n      args = `mod tidy${modFileFlag}${tidyOpts}`;\n      logger.debug('go mod tidy command included');\n      execCommands.push(`${cmd} ${args}`);\n    }\n\n    let goWorkSumFileName = upath.join(goModDir, 'go.work.sum');\n    if (useVendor) {\n      // If we find a go.work, then use go workspace vendoring.\n      const goWorkFile = await findLocalSiblingOrParent(\n        goModFileName,\n        'go.work',\n      );\n\n      if (goWorkFile) {\n        goWorkSumFileName = upath.join(\n          upath.dirname(goWorkFile),\n          'go.work.sum',\n        );\n\n        args = 'work vendor';\n        logger.debug('using go work vendor');\n        execCommands.push(`${cmd} ${args}`);\n\n        args = 'work sync';\n        logger.debug('using go work sync');\n        execCommands.push(`${cmd} ${args}`);\n      } else {\n        args = `mod vendor${modFileFlag}`;\n        logger.debug('using go mod vendor');\n        execCommands.push(`${cmd} ${args}`);\n      }\n\n      if (isGoModTidyRequired) {\n        args = `mod tidy${modFileFlag}${tidyOpts}`;\n        logger.debug('go mod tidy command included');\n        execCommands.push(`${cmd} ${args}`);\n      }\n    }\n\n    // We tidy one more time as a solution for #6795\n    if (isGoModTidyRequired) {\n      args = `mod tidy${modFileFlag}${tidyOpts}`;\n      logger.debug('go mod tidy command included');\n      execCommands.push(`${cmd} ${args}`);\n    }\n\n    let dependentModules: string[] = [];\n    if (isGoModTidyAllRequired) {\n      try {\n        dependentModules = await getGoModulesInTidyOrder(goModFileName);\n        for (const dependent of dependentModules) {\n          const dir = upath.relative(goModDir, upath.dirname(dependent));\n          execCommands.push(`${cmd} -C ${quote(dir)} mod tidy${tidyOpts}`);\n        }\n        logger.debug({ dependentModules }, 'go mod tidy commands included');\n      } catch (err) {\n        logger.warn({ err }, 'Failed to find dependent Go modules');\n      }\n    }\n\n    if (useGoGenerate) {\n      if (goGenerateAllowed) {\n        logger.debug('go generate command included');\n        execCommands.push(`${cmd} generate ./...`);\n      } else {\n        logger.once.warn(\n          `go generate command requested as a post update action, but goGenerate is not permitted in the allowedUnsafeExecutions`,\n        );\n      }\n    }\n\n    await gitExec(execCommands, execOptions);\n\n    const status = await getRepoStatus();\n    const dependentFiles = dependentModules.flatMap((f) => [\n      f,\n      f.replace(regEx(/\\.mod$/), '.sum'),\n    ]);\n\n    if (\n      !status.modified.includes(sumFileName) &&\n      !status.modified.includes(goModFileName) &&\n      !status.modified.includes(goWorkSumFileName) &&\n      !dependentFiles.some((f) => status.modified.includes(f))\n    ) {\n      return null;\n    }\n\n    const res: UpdateArtifactsResult[] = [];\n    if (status.modified.includes(sumFileName)) {\n      logger.debug('Returning updated go.sum');\n      res.push({\n        file: {\n          type: 'addition',\n          path: sumFileName,\n          contents: await readLocalFile(sumFileName),\n        },\n      });\n    }\n\n    if (status.modified.includes(goWorkSumFileName)) {\n      logger.debug('Returning updated go.work.sum');\n      res.push({\n        file: {\n          type: 'addition',\n          path: goWorkSumFileName,\n          contents: await readLocalFile(goWorkSumFileName),\n        },\n      });\n    }\n\n    for (const f of dependentFiles) {\n      if (status.modified.includes(f)) {\n        logger.trace(`Returning updated ${f}`);\n        res.push({\n          file: {\n            type: 'addition',\n            path: f,\n            contents: await readLocalFile(f),\n          },\n        });\n      }\n    }\n\n    // Include all the .go file import changes\n    if (isImportPathUpdateRequired) {\n      logger.debug('Returning updated go source files for import path changes');\n      for (const f of status.modified) {\n        if (f.endsWith('.go')) {\n          res.push({\n            file: {\n              type: 'addition',\n              path: f,\n              contents: await readLocalFile(f),\n            },\n          });\n        }\n      }\n    }\n\n    const alreadyAdded = new Set<string>();\n    const alreadyDeleted = new Set<string>();\n    if (useVendor) {\n      for (const f of status.modified.concat(status.not_added)) {\n        if (vendorDir && f.startsWith(vendorDir)) {\n          alreadyAdded.add(f);\n          res.push({\n            file: {\n              type: 'addition',\n              path: f,\n              contents: await readLocalFile(f),\n            },\n          });\n        }\n      }\n      for (const f of coerceArray(status.deleted)) {\n        if (vendorDir && f.startsWith(vendorDir)) {\n          alreadyDeleted.add(f);\n          res.push({\n            file: {\n              type: 'deletion',\n              path: f,\n            },\n          });\n        }\n      }\n    }\n\n    // TODO: throws in tests (#22198)\n    const finalGoModContent = (await readLocalFile(goModFileName, 'utf8'))!\n      .replace(regEx(/\\/\\/ renovate-replace /g), '')\n      .replace(regEx(/renovate-replace-bracket/g), ')');\n    if (finalGoModContent !== newGoModContent) {\n      const artifactResult: UpdateArtifactsResult = {\n        file: {\n          type: 'addition',\n          path: goModFileName,\n          contents: finalGoModContent,\n        },\n      };\n\n      const updatedDepNames = filterMap(updatedDeps, (dep) => dep?.depName);\n      const extraDepsNotice = getExtraDepsNotice(\n        newGoModContent,\n        finalGoModContent,\n        updatedDepNames,\n        config,\n      );\n\n      if (extraDepsNotice) {\n        artifactResult.notice = {\n          file: goModFileName,\n          message: extraDepsNotice,\n        };\n      }\n\n      logger.debug('Found updated go.mod after go.sum update');\n      res.push(artifactResult);\n      alreadyAdded.add(goModFileName);\n    }\n\n    // add all files added when in `go generate` mode.\n    // unfortunately there is not a good way as there is with vendoring or go import path updates to detect this.\n    // Do this at the very very end to ensure we only capture files which would have been explicitly\n    // modified, added, or deleted from a `go generate` invocation\n    if (useGoGenerate && goGenerateAllowed) {\n      logger.debug(\n        'Updating all modified files since generated files were added',\n      );\n      for (const f of status.modified.concat(status.created)) {\n        if (!alreadyAdded.has(f)) {\n          res.push({\n            file: {\n              type: 'addition',\n              path: f,\n              contents: await readLocalFile(f),\n            },\n          });\n        }\n      }\n      for (const f of coerceArray(status.deleted)) {\n        if (!alreadyDeleted.has(f)) {\n          res.push({\n            file: {\n              type: 'deletion',\n              path: f,\n            },\n          });\n        }\n      }\n    }\n    return res;\n  } catch (err) {\n    if (err.message === TEMPORARY_ERROR) {\n      throw err;\n    }\n    logger.debug({ err }, 'Failed to update go.sum');\n    return [\n      {\n        artifactError: {\n          fileName: sumFileName,\n          stderr: err.message,\n        },\n      },\n    ];\n  }\n}\n\nfunction getGoConstraints(content: string): string | undefined {\n  // prefer toolchain directive when go.mod has one\n  const toolchainMatch = regEx(/^toolchain\\s*go(?<gover>\\d+\\.\\d+\\.\\d+)$/m).exec(\n    content,\n  );\n  const toolchainVer = toolchainMatch?.groups?.gover;\n  if (toolchainVer) {\n    logger.debug(\n      `Using go version ${toolchainVer} found in toolchain directive`,\n    );\n    return toolchainVer;\n  }\n\n  // If go.mod doesn't have toolchain directive and has a full go version spec,\n  // for example `go 1.23.6`, pick this version, this doesn't match major.minor version spec.\n  //\n  // This is because when go.mod have same version defined in go directive and toolchain directive,\n  // go will remove toolchain directive from go.mod.\n  //\n  // For example, go will rewrite `go 1.23.5\\ntoolchain go1.23.5` to `go 1.23.5` by default,\n  // in this case, the go directive is the toolchain directive.\n  const goFullVersion = regEx(/^go\\s*(?<gover>\\d+\\.\\d+\\.\\d+)$/m).exec(content)\n    ?.groups?.gover;\n  if (goFullVersion) {\n    return goFullVersion;\n  }\n\n  const re = regEx(/^go\\s*(?<gover>\\d+\\.\\d+)$/m);\n  const match = re.exec(content);\n  if (!match?.groups?.gover) {\n    return undefined;\n  }\n  return `^${match.groups.gover}`;\n}\n\n/**\n * Derive the version of the Go toolchain needed to run this project.\n *\n * This matches with the `golang` Containerbase tool.\n *\n * In precedence order:\n *\n * 1. config: \\`constraints.go\\`\n * 1. \\`go.mod\\`: \\`toolchain\\` directive\n * 1. \\`go.mod\\`: \\`go\\` directive\n * 1. the \\`go\\` constraint collected during extraction\n *\n * NOTE that the \\`constraints.golang\\` is not used (TODO #42601)\n */\nexport async function deriveGoToolchainConstraints(\n  config: UpdateArtifactsConfig,\n  newGoModContent: string,\n): Promise<string | undefined> {\n  return await resolveToolConstraint(config, 'go', () =>\n    getGoConstraints(newGoModContent),\n  );\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAgCA,MAAM,EAAE,OAAA,SAAO,OAAA,YAAU;AACzB,MAAM,UAAU,mBAAmB,CAAC,IAAI,CAAC;AAEzC,eAAe,wBACb,aACA,QACmB;CAEnB,MAAM,mBAAmB,YAAY,QAClC,EAAE,iBAAiB,CAACA,QAAM,UAAU,CACvC;CACA,IAAI,iBAAiB,SAAS,GAC5B,iBAAiB,SAAS,EAAE,cAC1B,OAAO,KACL,EAAE,QAAQ,GACV,kDACF,CACF;CAGF,MAAM,uBAAuB,YAC1B,QACE,EAAE,iBACDA,QAAM,UAAU,KAAK,CAAC,WAAY,SAAS,eAAe,CAC9D,CAAC,CACA,KAAK,EAAE,SAAS,kBAAkB;EACxB;EACT,UAAUC,QAAM,UAAW;CAC7B,EAAE,CAAC,CAEF,QACE,EAAE,SAAS,eACV,QAAQ,WAAW,WAAW,KAAK,WAAW,CAClD,CAAC,CAEA,KACE,EAAE,SAAS,eACV,0BAA0B,MAAM,OAAO,EAAE,MAAM,UACnD;CAEF,IAAI,qBAAqB,SAAS,GAAG;EACnC,IAAI,uBACF;EACF,MAAM,wBAAwB,MAAM,sBAClC,QACA,UACF;EACA,IAAI,uBAAuB;GACzB,IACE,sBAAsB,WAAW,GAAG,KACpCC,UAAQ,sBAAsB,QAAQ,MAAM,IAAI,GAAG,EAAE,CAAC,GAEtD,uBAAuB,qBAAqB,QAC1C,MAAM,UAAU,GAChB,IAAI,uBACN;QAEA,OAAO,MACL,EAAE,sBAAsB,GACxB,gEACF;EAEJ,OACE,OAAO,MACL,wFACF;EAEF,qBAAqB,QAAQ,MAAM,sBAAsB;CAC3D;CAEA,OAAO;AACT;AAEA,SAAS,cAAc,WAAwC;CAC7D,IAAI,CAAC,SAAS,SAAS,GACrB,OAAO;CAGT,OAAO,OAAO,WAAW,WAAW,QAAQ;AAC9C;AAEA,eAAsB,gBAAgB,EACpC,iBAAiB,eACjB,aACA,uBAAuB,iBACvB,UAC0D;CAC1D,OAAO,MAAM,yBAAyB,cAAc,EAAE;CAEtD,MAAM,cAAc,cAAc,QAAQ,MAAM,QAAQ,GAAG,MAAM;CAEjE,IAAI,CAAC,MAD8B,cAAc,WAAW,GACjC;EACzB,OAAO,MAAM,iBAAiB;EAC9B,OAAO;CACT;CACA,MAAM,WAAW,MAAM,QAAQ,aAAa;CAC5C,MAAM,oBAAoB,MAAM,SAAS,aAAa;CACtD,MAAM,cACJ,sBAAsB,WAClB,KACA,aAAa,MAAM,iBAAiB;CAI1C,MAAM,YAAY,MAAM,yBAAyB,eAAe,QAAQ;CACxE,MAAM,wBAAwB,MAAM,KAAK,aAAa,IAAI,aAAa;CACvE,MAAM,YACJ,CAAC,CAAC,OAAO,mBAAmB,SAAS,aAAa,KACjD,CAAC,OAAO,mBAAmB,SAAS,iBAAiB,KACpD,aACC,MAAM,cAAc,qBAAqB,MAAO;CACrD,IAAI,gBAAgB;CACpB,MAAM,gBAAgB,CAAC,CAAC,OAAO,mBAAmB,SAAS,YAAY;CAEvE,MAAM,oBAD0B,aAAa,IAAI,yBACD,CAAC,EAAE,SAAS,YAAY;CAExE,IAAI,OAAO,mBAAmB,SAAS,cAAc,GAAG;EAOtD,gBAAgB,cACb,MAAM,IAAI,CAAC,CACX,KAAK,SAAS;GACb,IAAI,KAAK,KAAK,CAAC,CAAC,WAAW,IAAI,GAC7B,OAAO,KAAK,QAAQ,KAAK,0BAA0B;GAErD,OAAO;EACT,CAAC,CAAC,CACD,KAAK,IAAI;EAEZ,MAAM,qBAAqB,MACzB,kEACF;EAKA,MAAM,mBAAmB;EAMzB,MAAM,oBAAoB,MAAM,kCAAkC;;;;;;EAOlE,SAAS,gBAAgB,OAAuB;GAC9C,OAAO,MAAM,QACX,MAAM,oBAAoB,GAC1B,gCACF;EACF;EAGA,gBAAgB,cACb,QAAQ,oBAAoB,gBAAgB,CAAC,CAC7C,QAAQ,mBAAmB,eAAe;EAE7C,IAAI,kBAAkB,iBACpB,OAAO,MACL,mEACF;CAEJ;CACA,MAAM,gBAAgB,MAAM,6BAC1B,QACA,eACF;CAEA,IAAI;EACF,MAAM,eAAe,eAAe,aAAa;EAEjD,MAAM,MAAM;EACZ,MAAM,MAAM,OAAO;EACnB,MAAM,cAA2B;GAC/B,SAAS;GACT,UAAU;IACR,QAAQ,MAAM,eAAe,IAAI;IACjC,SAAS,IAAI;IACb,WAAW,IAAI;IACf,WAAW,IAAI;IACf,WAAW,IAAI;IACf,SAAS,IAAI;IACb,YAAY,IAAI;;IAEhB,SAAS,cAAc,aAAa,IAAI,gBAAgB;IACxD,aAAa,aAAa,IAAI,cAAc,MAAM,WAAW,MAAM;GACrE;GACA,QAAQ,CAAC;GACT,iBAAiB,CACf;IACE,UAAU;IACV,YAAY;GACd,CACF;EACF;EAEA,MAAM,eAAyB,CAAC;EAEhC,IAAI;EACJ,IAAI,OAAO,WAAW;GACpB,YAAY,OAAO,UAChB,QAAQ,QAAQ;IACf,MAAM,UAAU,iBAAiB,GAAG;IACpC,IAAI,CAAC,SACH,OAAO,KAAK,EAAE,IAAI,GAAG,2BAA2B;IAElD,OAAO;GACT,CAAC,CAAC,CACD,IAAI,KAAK,CAAC,CACV,KAAK,GAAG;GAEX,IAAI,cAAc,IAChB,MAAM,IAAI,MAAM,mBAAmB;EAEvC;EAEA,IAAI,OAAO,MAAM,YAAY;EAE7B,IAAI,iBAAiB,CAAC,OAAO,WAAW,eAAe,QAAQ,GAG7D,QAAQ;EAGV,QAAQ,MAAM,aAAa;EAC3B,OAAO,MAAM;GAAE;GAAK;EAAK,GAAG,yBAAyB;EACrD,aAAa,KAAK,GAAG,IAAI,GAAG,MAAM;EAGlC,MAAM,6BACJ,OAAO,mBAAmB,SAAS,wBAAwB,KAC3D,OAAO,eAAe;EAExB,IAAI,4BAA4B;GAC9B,MAAM,mBAAmB,MAAM,wBAC7B,aACA,MACF;GACA,IAAI,iBAAiB,SAAS,GAAG;IAC/B,OAAO,MAAM,kBAAkB,sCAAsC;IAErE,aAAa,KAAK,GAAG,gBAAgB;GACvC;EACF;EAEA,MAAM,oBACJ,CAAC,OAAO,mBAAmB,SAAS,wBAAwB,KAC5D,OAAO,eAAe;EACxB,IAAI,mBACF,OAAO,MAAM,6BAA6B;EAG5C,IAAI,WAAW;EACf,IAAI,OAAO,mBAAmB,SAAS,eAAe,GACpD,YAAY;EAEd,IAAI,OAAO,mBAAmB,SAAS,YAAY,GACjD,YAAY;EAId,MAAM,yBACJ,OAAO,mBAAmB,SAAS,cAAc,MAAM;EACzD,MAAM,sBACJ,CAAC,sBACA,OAAO,mBAAmB,SAAS,WAAW,MAAM,QACnD,OAAO,mBAAmB,SAAS,eAAe,MAAM,QACxD,OAAO,mBAAmB,SAAS,YAAY,MAAM,QACrD,0BACC,OAAO,eAAe,WAAW;EACtC,IAAI,qBAAqB;GACvB,OAAO,WAAW,cAAc;GAChC,OAAO,MAAM,8BAA8B;GAC3C,aAAa,KAAK,GAAG,IAAI,GAAG,MAAM;EACpC;EAEA,IAAI,oBAAoB,MAAM,KAAK,UAAU,aAAa;EAC1D,IAAI,WAAW;GAEb,MAAM,aAAa,MAAM,yBACvB,eACA,SACF;GAEA,IAAI,YAAY;IACd,oBAAoB,MAAM,KACxB,MAAM,QAAQ,UAAU,GACxB,aACF;IAEA,OAAO;IACP,OAAO,MAAM,sBAAsB;IACnC,aAAa,KAAK,GAAG,IAAI,GAAG,MAAM;IAElC,OAAO;IACP,OAAO,MAAM,oBAAoB;IACjC,aAAa,KAAK,GAAG,IAAI,GAAG,MAAM;GACpC,OAAO;IACL,OAAO,aAAa;IACpB,OAAO,MAAM,qBAAqB;IAClC,aAAa,KAAK,GAAG,IAAI,GAAG,MAAM;GACpC;GAEA,IAAI,qBAAqB;IACvB,OAAO,WAAW,cAAc;IAChC,OAAO,MAAM,8BAA8B;IAC3C,aAAa,KAAK,GAAG,IAAI,GAAG,MAAM;GACpC;EACF;EAGA,IAAI,qBAAqB;GACvB,OAAO,WAAW,cAAc;GAChC,OAAO,MAAM,8BAA8B;GAC3C,aAAa,KAAK,GAAG,IAAI,GAAG,MAAM;EACpC;EAEA,IAAI,mBAA6B,CAAC;EAClC,IAAI,wBACF,IAAI;GACF,mBAAmB,MAAM,wBAAwB,aAAa;GAC9D,KAAK,MAAM,aAAa,kBAAkB;IACxC,MAAM,MAAM,MAAM,SAAS,UAAU,MAAM,QAAQ,SAAS,CAAC;IAC7D,aAAa,KAAK,GAAG,IAAI,MAAM,MAAM,GAAG,EAAE,WAAW,UAAU;GACjE;GACA,OAAO,MAAM,EAAE,iBAAiB,GAAG,+BAA+B;EACpE,SAAS,KAAK;GACZ,OAAO,KAAK,EAAE,IAAI,GAAG,qCAAqC;EAC5D;EAGF,IAAI,eAAe;GACjB,IAAI,mBAAmB;IACrB,OAAO,MAAM,8BAA8B;IAC3C,aAAa,KAAK,GAAG,IAAI,gBAAgB;GAC3C,OACE,OAAO,KAAK,KACV,uHACF;EAEJ;EAEA,MAAM,QAAQ,cAAc,WAAW;EAEvC,MAAM,SAAS,MAAM,cAAc;EACnC,MAAM,iBAAiB,iBAAiB,SAAS,MAAM,CACrD,GACA,EAAE,QAAQ,MAAM,QAAQ,GAAG,MAAM,CACnC,CAAC;EAED,IACE,CAAC,OAAO,SAAS,SAAS,WAAW,KACrC,CAAC,OAAO,SAAS,SAAS,aAAa,KACvC,CAAC,OAAO,SAAS,SAAS,iBAAiB,KAC3C,CAAC,eAAe,MAAM,MAAM,OAAO,SAAS,SAAS,CAAC,CAAC,GAEvD,OAAO;EAGT,MAAM,MAA+B,CAAC;EACtC,IAAI,OAAO,SAAS,SAAS,WAAW,GAAG;GACzC,OAAO,MAAM,0BAA0B;GACvC,IAAI,KAAK,EACP,MAAM;IACJ,MAAM;IACN,MAAM;IACN,UAAU,MAAM,cAAc,WAAW;GAC3C,EACF,CAAC;EACH;EAEA,IAAI,OAAO,SAAS,SAAS,iBAAiB,GAAG;GAC/C,OAAO,MAAM,+BAA+B;GAC5C,IAAI,KAAK,EACP,MAAM;IACJ,MAAM;IACN,MAAM;IACN,UAAU,MAAM,cAAc,iBAAiB;GACjD,EACF,CAAC;EACH;EAEA,KAAK,MAAM,KAAK,gBACd,IAAI,OAAO,SAAS,SAAS,CAAC,GAAG;GAC/B,OAAO,MAAM,qBAAqB,GAAG;GACrC,IAAI,KAAK,EACP,MAAM;IACJ,MAAM;IACN,MAAM;IACN,UAAU,MAAM,cAAc,CAAC;GACjC,EACF,CAAC;EACH;EAIF,IAAI,4BAA4B;GAC9B,OAAO,MAAM,2DAA2D;GACxE,KAAK,MAAM,KAAK,OAAO,UACrB,IAAI,EAAE,SAAS,KAAK,GAClB,IAAI,KAAK,EACP,MAAM;IACJ,MAAM;IACN,MAAM;IACN,UAAU,MAAM,cAAc,CAAC;GACjC,EACF,CAAC;EAGP;EAEA,MAAM,+BAAe,IAAI,IAAY;EACrC,MAAM,iCAAiB,IAAI,IAAY;EACvC,IAAI,WAAW;GACb,KAAK,MAAM,KAAK,OAAO,SAAS,OAAO,OAAO,SAAS,GACrD,IAAI,aAAa,EAAE,WAAW,SAAS,GAAG;IACxC,aAAa,IAAI,CAAC;IAClB,IAAI,KAAK,EACP,MAAM;KACJ,MAAM;KACN,MAAM;KACN,UAAU,MAAM,cAAc,CAAC;IACjC,EACF,CAAC;GACH;GAEF,KAAK,MAAM,KAAK,YAAY,OAAO,OAAO,GACxC,IAAI,aAAa,EAAE,WAAW,SAAS,GAAG;IACxC,eAAe,IAAI,CAAC;IACpB,IAAI,KAAK,EACP,MAAM;KACJ,MAAM;KACN,MAAM;IACR,EACF,CAAC;GACH;EAEJ;EAGA,MAAM,qBAAqB,MAAM,cAAc,eAAe,MAAM,EAAA,CACjE,QAAQ,MAAM,yBAAyB,GAAG,EAAE,CAAC,CAC7C,QAAQ,MAAM,2BAA2B,GAAG,GAAG;EAClD,IAAI,sBAAsB,iBAAiB;GACzC,MAAM,iBAAwC,EAC5C,MAAM;IACJ,MAAM;IACN,MAAM;IACN,UAAU;GACZ,EACF;GAEA,MAAM,kBAAkB,UAAU,cAAc,QAAQ,KAAK,OAAO;GACpE,MAAM,kBAAkB,mBACtB,iBACA,mBACA,iBACA,MACF;GAEA,IAAI,iBACF,eAAe,SAAS;IACtB,MAAM;IACN,SAAS;GACX;GAGF,OAAO,MAAM,0CAA0C;GACvD,IAAI,KAAK,cAAc;GACvB,aAAa,IAAI,aAAa;EAChC;EAMA,IAAI,iBAAiB,mBAAmB;GACtC,OAAO,MACL,8DACF;GACA,KAAK,MAAM,KAAK,OAAO,SAAS,OAAO,OAAO,OAAO,GACnD,IAAI,CAAC,aAAa,IAAI,CAAC,GACrB,IAAI,KAAK,EACP,MAAM;IACJ,MAAM;IACN,MAAM;IACN,UAAU,MAAM,cAAc,CAAC;GACjC,EACF,CAAC;GAGL,KAAK,MAAM,KAAK,YAAY,OAAO,OAAO,GACxC,IAAI,CAAC,eAAe,IAAI,CAAC,GACvB,IAAI,KAAK,EACP,MAAM;IACJ,MAAM;IACN,MAAM;GACR,EACF,CAAC;EAGP;EACA,OAAO;CACT,SAAS,KAAK;EACZ,IAAI,IAAI,YAAA,mBACN,MAAM;EAER,OAAO,MAAM,EAAE,IAAI,GAAG,yBAAyB;EAC/C,OAAO,CACL,EACE,eAAe;GACb,UAAU;GACV,QAAQ,IAAI;EACd,EACF,CACF;CACF;AACF;AAEA,SAAS,iBAAiB,SAAqC;CAK7D,MAAM,eAHiB,MAAM,0CAA0C,CAAC,CAAC,KACvE,OAEgC,CAAC,EAAE,QAAQ;CAC7C,IAAI,cAAc;EAChB,OAAO,MACL,oBAAoB,aAAa,8BACnC;EACA,OAAO;CACT;CAUA,MAAM,gBAAgB,MAAM,iCAAiC,CAAC,CAAC,KAAK,OAAO,CAAC,EACxE,QAAQ;CACZ,IAAI,eACF,OAAO;CAIT,MAAM,QADK,MAAM,4BACF,CAAC,CAAC,KAAK,OAAO;CAC7B,IAAI,CAAC,OAAO,QAAQ,OAClB;CAEF,OAAO,IAAI,MAAM,OAAO;AAC1B;;;;;;;;;;;;;;;AAgBA,eAAsB,6BACpB,QACA,iBAC6B;CAC7B,OAAO,MAAM,sBAAsB,QAAQ,YACzC,iBAAiB,eAAe,CAClC;AACF"}

package/dist/modules/manager/gradle/artifacts.js

@@ -5,6 +5,7 @@ import { logger } from "../../../logger/index.js";
 import { findUpLocal, readLocalFile, writeLocalFile } from "../../../util/fs/index.js";
 import { exec, getToolSettingsOptions, gradleJvmArg } from "../../../util/exec/index.js";
 import { getFiles, getRepoStatus } from "../../../util/git/index.js";
+import { resolveToolConstraint } from "../util.js";
 import { scm } from "../../platform/scm.js";
 import { isGradleBuildFile } from "./utils.js";
 import { extraEnv, extractGradleVersion, getJavaConstraint, gradleWrapperFileName, prepareGradleCommand } from "../gradle-wrapper/utils.js";
@@ -102,7 +103,7 @@ async function updateArtifacts({ packageFileName, updatedDeps, newPackageFileCon
 			extraEnv,
 			toolConstraints: [{
 				toolName: "java",
-				constraint: config.constraints?.java ?? await getJavaConstraint(await getGradleVersion(gradlewFile), gradlewFile)
+				constraint: await resolveToolConstraint(config, "java", async () => getJavaConstraint(await getGradleVersion(gradlewFile), gradlewFile))
 			}]
 		};
 		const cmds = [];

package/dist/modules/manager/gradle/artifacts.js.map

@@ -1 +1 @@
-{"version":3,"file":"artifacts.js","names":[],"sources":["../../../../lib/modules/manager/gradle/artifacts.ts"],"sourcesContent":["import { isNonEmptyStringAndNotWhitespace } from '@sindresorhus/is';\nimport { quote } from 'shlex';\nimport upath from 'upath';\nimport { GlobalConfig } from '../../../config/global.ts';\nimport { TEMPORARY_ERROR } from '../../../constants/error-messages.ts';\nimport { logger } from '../../../logger/index.ts';\nimport {\n  exec,\n  getToolSettingsOptions,\n  gradleJvmArg,\n} from '../../../util/exec/index.ts';\nimport type { ExecOptions } from '../../../util/exec/types.ts';\nimport {\n  findUpLocal,\n  readLocalFile,\n  writeLocalFile,\n} from '../../../util/fs/index.ts';\nimport { getFiles, getRepoStatus } from '../../../util/git/index.ts';\nimport { regEx } from '../../../util/regex.ts';\nimport { scm } from '../../platform/scm.ts';\nimport {\n  extraEnv,\n  extractGradleVersion,\n  getJavaConstraint,\n  gradleWrapperFileName,\n  prepareGradleCommand,\n} from '../gradle-wrapper/utils.ts';\nimport type { UpdateArtifact, UpdateArtifactsResult } from '../types.ts';\nimport {\n  isGcvLockFile,\n  isGcvPropsFile,\n} from './extract/consistent-versions-plugin.ts';\nimport { isGradleBuildFile } from './utils.ts';\n\nexport function isGradleExecutionAllowed(command: string): boolean {\n  const allowlist = GlobalConfig.get('allowedUnsafeExecutions');\n\n  if (!allowlist.includes('gradleWrapper')) {\n    logger.once.warn(\n      { command },\n      'Gradle wrapper command was requested to run, but `gradleWrapper` is not permitted in the allowedUnsafeExecutions',\n    );\n    return false;\n  }\n\n  return true;\n}\n\n// .lockfile is gradle default lockfile, /versions.lock is gradle-consistent-versions plugin lockfile\nfunction isLockFile(fileName: string): boolean {\n  return fileName.endsWith('.lockfile') || isGcvLockFile(fileName);\n}\n\nasync function getUpdatedLockfiles(\n  oldLockFileContentMap: Record<string, string | null>,\n): Promise<UpdateArtifactsResult[]> {\n  const res: UpdateArtifactsResult[] = [];\n\n  const status = await getRepoStatus();\n\n  for (const modifiedFile of status.modified) {\n    if (\n      isLockFile(modifiedFile) ||\n      modifiedFile.endsWith('gradle/verification-metadata.xml')\n    ) {\n      const newContent = await readLocalFile(modifiedFile, 'utf8');\n      if (oldLockFileContentMap[modifiedFile] !== newContent) {\n        res.push({\n          file: {\n            type: 'addition',\n            path: modifiedFile,\n            contents: newContent,\n          },\n        });\n      }\n    }\n  }\n\n  return res;\n}\n\nasync function getSubProjectList(\n  cmd: string,\n  execOptions: ExecOptions,\n): Promise<string[]> {\n  const subprojects = ['']; // = root project\n  const subprojectsRegex = regEx(/^[ \\t]*subprojects: \\[(?<subprojects>.+)\\]/m);\n\n  const gradleProperties = await exec(`${cmd} properties`, execOptions);\n  const subprojectsMatch = gradleProperties.stdout.match(subprojectsRegex);\n  if (subprojectsMatch?.groups?.subprojects) {\n    const projectRegex = regEx(/project '(?<name>.+?)'/g);\n    const matches = subprojectsMatch.groups.subprojects.matchAll(projectRegex);\n    for (const match of matches) {\n      if (match?.groups?.name) {\n        subprojects.push(match.groups.name);\n      }\n    }\n  }\n\n  return subprojects;\n}\n\nasync function getGradleVersion(gradlewFile: string): Promise<string | null> {\n  const propertiesFile = upath.join(\n    upath.dirname(gradlewFile),\n    'gradle/wrapper/gradle-wrapper.properties',\n  );\n  const properties = await readLocalFile(propertiesFile, 'utf8');\n  const extractResult = extractGradleVersion(properties ?? '');\n\n  return extractResult ? extractResult.version : null;\n}\n\nasync function buildUpdateVerificationMetadataCmd(\n  verificationMetadataFile: string | undefined,\n  baseCmd: string,\n): Promise<string | null> {\n  if (!verificationMetadataFile) {\n    return null;\n  }\n\n  const verificationMetadata = await readLocalFile(verificationMetadataFile);\n  const verifiesChecksums = verificationMetadata?.includes(\n    '<verify-metadata>true</verify-metadata>',\n  );\n  const verifiesSignatures = verificationMetadata?.includes(\n    '<verify-signatures>true</verify-signatures>',\n  );\n\n  const hashTypes = ['sha256', 'sha512'].filter((type) =>\n    verificationMetadata?.includes(`<${type} `),\n  );\n\n  if (verifiesChecksums || hashTypes.length) {\n    logger.debug(\n      'Dependency metadata verification enabled or checksums present - generating checksums',\n    );\n  }\n\n  if ((verifiesChecksums || verifiesSignatures) && !hashTypes.length) {\n    // fallback algorithm for pgp and in case a weak algorithm (md5, sha1) is used for checksums\n    hashTypes.push('sha256');\n  }\n\n  if (verifiesSignatures) {\n    logger.debug(\n      'Dependency signature verification enabled - generating PGP signatures',\n    );\n    hashTypes.push('pgp');\n  }\n\n  if (!hashTypes.length) {\n    return null;\n  }\n\n  return `${baseCmd} --write-verification-metadata ${hashTypes.join(',')} dependencies`;\n}\n\nexport async function updateArtifacts({\n  packageFileName,\n  updatedDeps,\n  newPackageFileContent,\n  config,\n}: UpdateArtifact): Promise<UpdateArtifactsResult[] | null> {\n  logger.debug(`gradle.updateArtifacts(${packageFileName})`);\n\n  const fileList = await scm.getFileList();\n  const lockFiles = fileList.filter((file) => isLockFile(file));\n  const verificationMetadataFile = fileList.find((fileName) =>\n    fileName.endsWith('gradle/verification-metadata.xml'),\n  );\n  if (!lockFiles.length && !verificationMetadataFile) {\n    logger.debug(\n      'No Gradle dependency lockfiles or verification metadata found - skipping update',\n    );\n    return null;\n  }\n\n  const gradlewName = gradleWrapperFileName();\n  const gradlewFile = await findUpLocal(\n    gradlewName,\n    upath.dirname(packageFileName),\n  );\n  if (!gradlewFile) {\n    logger.debug(\n      'Found Gradle dependency lockfiles but no gradlew - aborting update',\n    );\n    return null;\n  }\n\n  if (\n    config.isLockFileMaintenance &&\n    (!isGradleBuildFile(packageFileName) ||\n      upath.dirname(packageFileName) !== upath.dirname(gradlewFile))\n  ) {\n    logger.trace(\n      'No build.gradle(.kts) file or not in root project - skipping lock file maintenance',\n    );\n    return null;\n  }\n\n  if (!isGradleExecutionAllowed(gradlewFile)) {\n    logger.trace(\n      'Not allowed to execute gradle due to allowedUnsafeExecutions - aborting update',\n    );\n    return null;\n  }\n\n  logger.debug('Updating found Gradle dependency lockfiles');\n\n  try {\n    const oldLockFileContentMap = await getFiles(lockFiles);\n    await prepareGradleCommand(gradlewFile);\n\n    const baseCmd = `${gradlewName}${gradleJvmArg(getToolSettingsOptions(config.toolSettings))} --console=plain --dependency-verification lenient -q`;\n    const execOptions: ExecOptions = {\n      cwdFile: gradlewFile,\n      docker: {},\n      extraEnv,\n      toolConstraints: [\n        {\n          toolName: 'java',\n          constraint:\n            config.constraints?.java ??\n            (await getJavaConstraint(\n              await getGradleVersion(gradlewFile),\n              gradlewFile,\n            )),\n        },\n      ],\n    };\n\n    const cmds = [];\n    if (lockFiles.length) {\n      const subprojects = await getSubProjectList(baseCmd, execOptions);\n      let lockfileCmd = `${baseCmd} ${subprojects\n        .map((project) => `${project}:dependencies`)\n        .map(quote)\n        .join(' ')}`;\n\n      if (\n        config.isLockFileMaintenance === true ||\n        !updatedDeps.length ||\n        isGcvPropsFile(packageFileName)\n      ) {\n        lockfileCmd += ' --write-locks';\n      } else {\n        const updatedDepNames = updatedDeps\n          .map(({ depName, packageName }) => packageName ?? depName)\n          .filter(isNonEmptyStringAndNotWhitespace);\n\n        lockfileCmd += ` --update-locks ${updatedDepNames\n          .map(quote)\n          .join(',')}`;\n      }\n      cmds.push(lockfileCmd);\n    }\n\n    const updateVerificationMetadataCmd =\n      await buildUpdateVerificationMetadataCmd(\n        verificationMetadataFile,\n        baseCmd,\n      );\n    if (updateVerificationMetadataCmd) {\n      cmds.push(updateVerificationMetadataCmd);\n    }\n\n    if (!cmds.length) {\n      logger.debug('No lockfile or verification metadata update necessary');\n      return null;\n    }\n\n    await writeLocalFile(packageFileName, newPackageFileContent);\n    await exec(cmds, { ...execOptions, ignoreStdout: true });\n\n    const res = await getUpdatedLockfiles(oldLockFileContentMap);\n    logger.debug('Returning updated Gradle dependency lockfiles');\n\n    return res.length > 0 ? res : null;\n  } catch (err) {\n    if (err.message === TEMPORARY_ERROR) {\n      throw err;\n    }\n\n    logger.debug({ err }, 'Error while updating Gradle dependency lockfiles');\n    return [\n      {\n        artifactError: {\n          fileName: packageFileName,\n          stderr: err.message,\n        },\n      },\n    ];\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;AAkCA,SAAgB,yBAAyB,SAA0B;CAGjE,IAAI,CAFc,aAAa,IAAI,yBAEtB,CAAC,CAAC,SAAS,eAAe,GAAG;EACxC,OAAO,KAAK,KACV,EAAE,QAAQ,GACV,kHACF;EACA,OAAO;CACT;CAEA,OAAO;AACT;AAGA,SAAS,WAAW,UAA2B;CAC7C,OAAO,SAAS,SAAS,WAAW,KAAK,cAAc,QAAQ;AACjE;AAEA,eAAe,oBACb,uBACkC;CAClC,MAAM,MAA+B,CAAC;CAEtC,MAAM,SAAS,MAAM,cAAc;CAEnC,KAAK,MAAM,gBAAgB,OAAO,UAChC,IACE,WAAW,YAAY,KACvB,aAAa,SAAS,kCAAkC,GACxD;EACA,MAAM,aAAa,MAAM,cAAc,cAAc,MAAM;EAC3D,IAAI,sBAAsB,kBAAkB,YAC1C,IAAI,KAAK,EACP,MAAM;GACJ,MAAM;GACN,MAAM;GACN,UAAU;EACZ,EACF,CAAC;CAEL;CAGF,OAAO;AACT;AAEA,eAAe,kBACb,KACA,aACmB;CACnB,MAAM,cAAc,CAAC,EAAE;CACvB,MAAM,mBAAmB,MAAM,6CAA6C;CAG5E,MAAM,oBAAmB,MADM,KAAK,GAAG,IAAI,cAAc,WAAW,EAAA,CAC1B,OAAO,MAAM,gBAAgB;CACvE,IAAI,kBAAkB,QAAQ,aAAa;EACzC,MAAM,eAAe,MAAM,yBAAyB;EACpD,MAAM,UAAU,iBAAiB,OAAO,YAAY,SAAS,YAAY;EACzE,KAAK,MAAM,SAAS,SAClB,IAAI,OAAO,QAAQ,MACjB,YAAY,KAAK,MAAM,OAAO,IAAI;CAGxC;CAEA,OAAO;AACT;AAEA,eAAe,iBAAiB,aAA6C;CAC3E,MAAM,iBAAiB,MAAM,KAC3B,MAAM,QAAQ,WAAW,GACzB,0CACF;CACA,MAAM,aAAa,MAAM,cAAc,gBAAgB,MAAM;CAC7D,MAAM,gBAAgB,qBAAqB,cAAc,EAAE;CAE3D,OAAO,gBAAgB,cAAc,UAAU;AACjD;AAEA,eAAe,mCACb,0BACA,SACwB;CACxB,IAAI,CAAC,0BACH,OAAO;CAGT,MAAM,uBAAuB,MAAM,cAAc,wBAAwB;CACzE,MAAM,oBAAoB,sBAAsB,SAC9C,yCACF;CACA,MAAM,qBAAqB,sBAAsB,SAC/C,6CACF;CAEA,MAAM,YAAY,CAAC,UAAU,QAAQ,CAAC,CAAC,QAAQ,SAC7C,sBAAsB,SAAS,IAAI,KAAK,EAAE,CAC5C;CAEA,IAAI,qBAAqB,UAAU,QACjC,OAAO,MACL,sFACF;CAGF,KAAK,qBAAqB,uBAAuB,CAAC,UAAU,QAE1D,UAAU,KAAK,QAAQ;CAGzB,IAAI,oBAAoB;EACtB,OAAO,MACL,uEACF;EACA,UAAU,KAAK,KAAK;CACtB;CAEA,IAAI,CAAC,UAAU,QACb,OAAO;CAGT,OAAO,GAAG,QAAQ,iCAAiC,UAAU,KAAK,GAAG,EAAE;AACzE;AAEA,eAAsB,gBAAgB,EACpC,iBACA,aACA,uBACA,UAC0D;CAC1D,OAAO,MAAM,0BAA0B,gBAAgB,EAAE;CAEzD,MAAM,WAAW,MAAM,IAAI,YAAY;CACvC,MAAM,YAAY,SAAS,QAAQ,SAAS,WAAW,IAAI,CAAC;CAC5D,MAAM,2BAA2B,SAAS,MAAM,aAC9C,SAAS,SAAS,kCAAkC,CACtD;CACA,IAAI,CAAC,UAAU,UAAU,CAAC,0BAA0B;EAClD,OAAO,MACL,iFACF;EACA,OAAO;CACT;CAEA,MAAM,cAAc,sBAAsB;CAC1C,MAAM,cAAc,MAAM,YACxB,aACA,MAAM,QAAQ,eAAe,CAC/B;CACA,IAAI,CAAC,aAAa;EAChB,OAAO,MACL,oEACF;EACA,OAAO;CACT;CAEA,IACE,OAAO,0BACN,CAAC,kBAAkB,eAAe,KACjC,MAAM,QAAQ,eAAe,MAAM,MAAM,QAAQ,WAAW,IAC9D;EACA,OAAO,MACL,oFACF;EACA,OAAO;CACT;CAEA,IAAI,CAAC,yBAAyB,WAAW,GAAG;EAC1C,OAAO,MACL,gFACF;EACA,OAAO;CACT;CAEA,OAAO,MAAM,4CAA4C;CAEzD,IAAI;EACF,MAAM,wBAAwB,MAAM,SAAS,SAAS;EACtD,MAAM,qBAAqB,WAAW;EAEtC,MAAM,UAAU,GAAG,cAAc,aAAa,uBAAuB,OAAO,YAAY,CAAC,EAAE;EAC3F,MAAM,cAA2B;GAC/B,SAAS;GACT,QAAQ,CAAC;GACT;GACA,iBAAiB,CACf;IACE,UAAU;IACV,YACE,OAAO,aAAa,QACnB,MAAM,kBACL,MAAM,iBAAiB,WAAW,GAClC,WACF;GACJ,CACF;EACF;EAEA,MAAM,OAAO,CAAC;EACd,IAAI,UAAU,QAAQ;GAEpB,IAAI,cAAc,GAAG,QAAQ,IAAG,MADN,kBAAkB,SAAS,WAAW,EAAA,CAE7D,KAAK,YAAY,GAAG,QAAQ,cAAc,CAAC,CAC3C,IAAI,KAAK,CAAC,CACV,KAAK,GAAG;GAEX,IACE,OAAO,0BAA0B,QACjC,CAAC,YAAY,UACb,eAAe,eAAe,GAE9B,eAAe;QACV;IACL,MAAM,kBAAkB,YACrB,KAAK,EAAE,SAAS,kBAAkB,eAAe,OAAO,CAAC,CACzD,OAAO,gCAAgC;IAE1C,eAAe,mBAAmB,gBAC/B,IAAI,KAAK,CAAC,CACV,KAAK,GAAG;GACb;GACA,KAAK,KAAK,WAAW;EACvB;EAEA,MAAM,gCACJ,MAAM,mCACJ,0BACA,OACF;EACF,IAAI,+BACF,KAAK,KAAK,6BAA6B;EAGzC,IAAI,CAAC,KAAK,QAAQ;GAChB,OAAO,MAAM,uDAAuD;GACpE,OAAO;EACT;EAEA,MAAM,eAAe,iBAAiB,qBAAqB;EAC3D,MAAM,KAAK,MAAM;GAAE,GAAG;GAAa,cAAc;EAAK,CAAC;EAEvD,MAAM,MAAM,MAAM,oBAAoB,qBAAqB;EAC3D,OAAO,MAAM,+CAA+C;EAE5D,OAAO,IAAI,SAAS,IAAI,MAAM;CAChC,SAAS,KAAK;EACZ,IAAI,IAAI,YAAA,mBACN,MAAM;EAGR,OAAO,MAAM,EAAE,IAAI,GAAG,kDAAkD;EACxE,OAAO,CACL,EACE,eAAe;GACb,UAAU;GACV,QAAQ,IAAI;EACd,EACF,CACF;CACF;AACF"}
+{"version":3,"file":"artifacts.js","names":[],"sources":["../../../../lib/modules/manager/gradle/artifacts.ts"],"sourcesContent":["import { isNonEmptyStringAndNotWhitespace } from '@sindresorhus/is';\nimport { quote } from 'shlex';\nimport upath from 'upath';\nimport { GlobalConfig } from '../../../config/global.ts';\nimport { TEMPORARY_ERROR } from '../../../constants/error-messages.ts';\nimport { logger } from '../../../logger/index.ts';\nimport {\n  exec,\n  getToolSettingsOptions,\n  gradleJvmArg,\n} from '../../../util/exec/index.ts';\nimport type { ExecOptions } from '../../../util/exec/types.ts';\nimport {\n  findUpLocal,\n  readLocalFile,\n  writeLocalFile,\n} from '../../../util/fs/index.ts';\nimport { getFiles, getRepoStatus } from '../../../util/git/index.ts';\nimport { regEx } from '../../../util/regex.ts';\nimport { scm } from '../../platform/scm.ts';\nimport {\n  extraEnv,\n  extractGradleVersion,\n  getJavaConstraint,\n  gradleWrapperFileName,\n  prepareGradleCommand,\n} from '../gradle-wrapper/utils.ts';\nimport type { UpdateArtifact, UpdateArtifactsResult } from '../types.ts';\nimport { resolveToolConstraint } from '../util.ts';\nimport {\n  isGcvLockFile,\n  isGcvPropsFile,\n} from './extract/consistent-versions-plugin.ts';\nimport { isGradleBuildFile } from './utils.ts';\n\nexport function isGradleExecutionAllowed(command: string): boolean {\n  const allowlist = GlobalConfig.get('allowedUnsafeExecutions');\n\n  if (!allowlist.includes('gradleWrapper')) {\n    logger.once.warn(\n      { command },\n      'Gradle wrapper command was requested to run, but `gradleWrapper` is not permitted in the allowedUnsafeExecutions',\n    );\n    return false;\n  }\n\n  return true;\n}\n\n// .lockfile is gradle default lockfile, /versions.lock is gradle-consistent-versions plugin lockfile\nfunction isLockFile(fileName: string): boolean {\n  return fileName.endsWith('.lockfile') || isGcvLockFile(fileName);\n}\n\nasync function getUpdatedLockfiles(\n  oldLockFileContentMap: Record<string, string | null>,\n): Promise<UpdateArtifactsResult[]> {\n  const res: UpdateArtifactsResult[] = [];\n\n  const status = await getRepoStatus();\n\n  for (const modifiedFile of status.modified) {\n    if (\n      isLockFile(modifiedFile) ||\n      modifiedFile.endsWith('gradle/verification-metadata.xml')\n    ) {\n      const newContent = await readLocalFile(modifiedFile, 'utf8');\n      if (oldLockFileContentMap[modifiedFile] !== newContent) {\n        res.push({\n          file: {\n            type: 'addition',\n            path: modifiedFile,\n            contents: newContent,\n          },\n        });\n      }\n    }\n  }\n\n  return res;\n}\n\nasync function getSubProjectList(\n  cmd: string,\n  execOptions: ExecOptions,\n): Promise<string[]> {\n  const subprojects = ['']; // = root project\n  const subprojectsRegex = regEx(/^[ \\t]*subprojects: \\[(?<subprojects>.+)\\]/m);\n\n  const gradleProperties = await exec(`${cmd} properties`, execOptions);\n  const subprojectsMatch = gradleProperties.stdout.match(subprojectsRegex);\n  if (subprojectsMatch?.groups?.subprojects) {\n    const projectRegex = regEx(/project '(?<name>.+?)'/g);\n    const matches = subprojectsMatch.groups.subprojects.matchAll(projectRegex);\n    for (const match of matches) {\n      if (match?.groups?.name) {\n        subprojects.push(match.groups.name);\n      }\n    }\n  }\n\n  return subprojects;\n}\n\nasync function getGradleVersion(gradlewFile: string): Promise<string | null> {\n  const propertiesFile = upath.join(\n    upath.dirname(gradlewFile),\n    'gradle/wrapper/gradle-wrapper.properties',\n  );\n  const properties = await readLocalFile(propertiesFile, 'utf8');\n  const extractResult = extractGradleVersion(properties ?? '');\n\n  return extractResult ? extractResult.version : null;\n}\n\nasync function buildUpdateVerificationMetadataCmd(\n  verificationMetadataFile: string | undefined,\n  baseCmd: string,\n): Promise<string | null> {\n  if (!verificationMetadataFile) {\n    return null;\n  }\n\n  const verificationMetadata = await readLocalFile(verificationMetadataFile);\n  const verifiesChecksums = verificationMetadata?.includes(\n    '<verify-metadata>true</verify-metadata>',\n  );\n  const verifiesSignatures = verificationMetadata?.includes(\n    '<verify-signatures>true</verify-signatures>',\n  );\n\n  const hashTypes = ['sha256', 'sha512'].filter((type) =>\n    verificationMetadata?.includes(`<${type} `),\n  );\n\n  if (verifiesChecksums || hashTypes.length) {\n    logger.debug(\n      'Dependency metadata verification enabled or checksums present - generating checksums',\n    );\n  }\n\n  if ((verifiesChecksums || verifiesSignatures) && !hashTypes.length) {\n    // fallback algorithm for pgp and in case a weak algorithm (md5, sha1) is used for checksums\n    hashTypes.push('sha256');\n  }\n\n  if (verifiesSignatures) {\n    logger.debug(\n      'Dependency signature verification enabled - generating PGP signatures',\n    );\n    hashTypes.push('pgp');\n  }\n\n  if (!hashTypes.length) {\n    return null;\n  }\n\n  return `${baseCmd} --write-verification-metadata ${hashTypes.join(',')} dependencies`;\n}\n\nexport async function updateArtifacts({\n  packageFileName,\n  updatedDeps,\n  newPackageFileContent,\n  config,\n}: UpdateArtifact): Promise<UpdateArtifactsResult[] | null> {\n  logger.debug(`gradle.updateArtifacts(${packageFileName})`);\n\n  const fileList = await scm.getFileList();\n  const lockFiles = fileList.filter((file) => isLockFile(file));\n  const verificationMetadataFile = fileList.find((fileName) =>\n    fileName.endsWith('gradle/verification-metadata.xml'),\n  );\n  if (!lockFiles.length && !verificationMetadataFile) {\n    logger.debug(\n      'No Gradle dependency lockfiles or verification metadata found - skipping update',\n    );\n    return null;\n  }\n\n  const gradlewName = gradleWrapperFileName();\n  const gradlewFile = await findUpLocal(\n    gradlewName,\n    upath.dirname(packageFileName),\n  );\n  if (!gradlewFile) {\n    logger.debug(\n      'Found Gradle dependency lockfiles but no gradlew - aborting update',\n    );\n    return null;\n  }\n\n  if (\n    config.isLockFileMaintenance &&\n    (!isGradleBuildFile(packageFileName) ||\n      upath.dirname(packageFileName) !== upath.dirname(gradlewFile))\n  ) {\n    logger.trace(\n      'No build.gradle(.kts) file or not in root project - skipping lock file maintenance',\n    );\n    return null;\n  }\n\n  if (!isGradleExecutionAllowed(gradlewFile)) {\n    logger.trace(\n      'Not allowed to execute gradle due to allowedUnsafeExecutions - aborting update',\n    );\n    return null;\n  }\n\n  logger.debug('Updating found Gradle dependency lockfiles');\n\n  try {\n    const oldLockFileContentMap = await getFiles(lockFiles);\n    await prepareGradleCommand(gradlewFile);\n\n    const baseCmd = `${gradlewName}${gradleJvmArg(getToolSettingsOptions(config.toolSettings))} --console=plain --dependency-verification lenient -q`;\n    const execOptions: ExecOptions = {\n      cwdFile: gradlewFile,\n      docker: {},\n      extraEnv,\n      toolConstraints: [\n        {\n          toolName: 'java',\n          constraint: await resolveToolConstraint(config, 'java', async () =>\n            getJavaConstraint(await getGradleVersion(gradlewFile), gradlewFile),\n          ),\n        },\n      ],\n    };\n\n    const cmds = [];\n    if (lockFiles.length) {\n      const subprojects = await getSubProjectList(baseCmd, execOptions);\n      let lockfileCmd = `${baseCmd} ${subprojects\n        .map((project) => `${project}:dependencies`)\n        .map(quote)\n        .join(' ')}`;\n\n      if (\n        config.isLockFileMaintenance === true ||\n        !updatedDeps.length ||\n        isGcvPropsFile(packageFileName)\n      ) {\n        lockfileCmd += ' --write-locks';\n      } else {\n        const updatedDepNames = updatedDeps\n          .map(({ depName, packageName }) => packageName ?? depName)\n          .filter(isNonEmptyStringAndNotWhitespace);\n\n        lockfileCmd += ` --update-locks ${updatedDepNames\n          .map(quote)\n          .join(',')}`;\n      }\n      cmds.push(lockfileCmd);\n    }\n\n    const updateVerificationMetadataCmd =\n      await buildUpdateVerificationMetadataCmd(\n        verificationMetadataFile,\n        baseCmd,\n      );\n    if (updateVerificationMetadataCmd) {\n      cmds.push(updateVerificationMetadataCmd);\n    }\n\n    if (!cmds.length) {\n      logger.debug('No lockfile or verification metadata update necessary');\n      return null;\n    }\n\n    await writeLocalFile(packageFileName, newPackageFileContent);\n    await exec(cmds, { ...execOptions, ignoreStdout: true });\n\n    const res = await getUpdatedLockfiles(oldLockFileContentMap);\n    logger.debug('Returning updated Gradle dependency lockfiles');\n\n    return res.length > 0 ? res : null;\n  } catch (err) {\n    if (err.message === TEMPORARY_ERROR) {\n      throw err;\n    }\n\n    logger.debug({ err }, 'Error while updating Gradle dependency lockfiles');\n    return [\n      {\n        artifactError: {\n          fileName: packageFileName,\n          stderr: err.message,\n        },\n      },\n    ];\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAmCA,SAAgB,yBAAyB,SAA0B;CAGjE,IAAI,CAFc,aAAa,IAAI,yBAEtB,CAAC,CAAC,SAAS,eAAe,GAAG;EACxC,OAAO,KAAK,KACV,EAAE,QAAQ,GACV,kHACF;EACA,OAAO;CACT;CAEA,OAAO;AACT;AAGA,SAAS,WAAW,UAA2B;CAC7C,OAAO,SAAS,SAAS,WAAW,KAAK,cAAc,QAAQ;AACjE;AAEA,eAAe,oBACb,uBACkC;CAClC,MAAM,MAA+B,CAAC;CAEtC,MAAM,SAAS,MAAM,cAAc;CAEnC,KAAK,MAAM,gBAAgB,OAAO,UAChC,IACE,WAAW,YAAY,KACvB,aAAa,SAAS,kCAAkC,GACxD;EACA,MAAM,aAAa,MAAM,cAAc,cAAc,MAAM;EAC3D,IAAI,sBAAsB,kBAAkB,YAC1C,IAAI,KAAK,EACP,MAAM;GACJ,MAAM;GACN,MAAM;GACN,UAAU;EACZ,EACF,CAAC;CAEL;CAGF,OAAO;AACT;AAEA,eAAe,kBACb,KACA,aACmB;CACnB,MAAM,cAAc,CAAC,EAAE;CACvB,MAAM,mBAAmB,MAAM,6CAA6C;CAG5E,MAAM,oBAAmB,MADM,KAAK,GAAG,IAAI,cAAc,WAAW,EAAA,CAC1B,OAAO,MAAM,gBAAgB;CACvE,IAAI,kBAAkB,QAAQ,aAAa;EACzC,MAAM,eAAe,MAAM,yBAAyB;EACpD,MAAM,UAAU,iBAAiB,OAAO,YAAY,SAAS,YAAY;EACzE,KAAK,MAAM,SAAS,SAClB,IAAI,OAAO,QAAQ,MACjB,YAAY,KAAK,MAAM,OAAO,IAAI;CAGxC;CAEA,OAAO;AACT;AAEA,eAAe,iBAAiB,aAA6C;CAC3E,MAAM,iBAAiB,MAAM,KAC3B,MAAM,QAAQ,WAAW,GACzB,0CACF;CACA,MAAM,aAAa,MAAM,cAAc,gBAAgB,MAAM;CAC7D,MAAM,gBAAgB,qBAAqB,cAAc,EAAE;CAE3D,OAAO,gBAAgB,cAAc,UAAU;AACjD;AAEA,eAAe,mCACb,0BACA,SACwB;CACxB,IAAI,CAAC,0BACH,OAAO;CAGT,MAAM,uBAAuB,MAAM,cAAc,wBAAwB;CACzE,MAAM,oBAAoB,sBAAsB,SAC9C,yCACF;CACA,MAAM,qBAAqB,sBAAsB,SAC/C,6CACF;CAEA,MAAM,YAAY,CAAC,UAAU,QAAQ,CAAC,CAAC,QAAQ,SAC7C,sBAAsB,SAAS,IAAI,KAAK,EAAE,CAC5C;CAEA,IAAI,qBAAqB,UAAU,QACjC,OAAO,MACL,sFACF;CAGF,KAAK,qBAAqB,uBAAuB,CAAC,UAAU,QAE1D,UAAU,KAAK,QAAQ;CAGzB,IAAI,oBAAoB;EACtB,OAAO,MACL,uEACF;EACA,UAAU,KAAK,KAAK;CACtB;CAEA,IAAI,CAAC,UAAU,QACb,OAAO;CAGT,OAAO,GAAG,QAAQ,iCAAiC,UAAU,KAAK,GAAG,EAAE;AACzE;AAEA,eAAsB,gBAAgB,EACpC,iBACA,aACA,uBACA,UAC0D;CAC1D,OAAO,MAAM,0BAA0B,gBAAgB,EAAE;CAEzD,MAAM,WAAW,MAAM,IAAI,YAAY;CACvC,MAAM,YAAY,SAAS,QAAQ,SAAS,WAAW,IAAI,CAAC;CAC5D,MAAM,2BAA2B,SAAS,MAAM,aAC9C,SAAS,SAAS,kCAAkC,CACtD;CACA,IAAI,CAAC,UAAU,UAAU,CAAC,0BAA0B;EAClD,OAAO,MACL,iFACF;EACA,OAAO;CACT;CAEA,MAAM,cAAc,sBAAsB;CAC1C,MAAM,cAAc,MAAM,YACxB,aACA,MAAM,QAAQ,eAAe,CAC/B;CACA,IAAI,CAAC,aAAa;EAChB,OAAO,MACL,oEACF;EACA,OAAO;CACT;CAEA,IACE,OAAO,0BACN,CAAC,kBAAkB,eAAe,KACjC,MAAM,QAAQ,eAAe,MAAM,MAAM,QAAQ,WAAW,IAC9D;EACA,OAAO,MACL,oFACF;EACA,OAAO;CACT;CAEA,IAAI,CAAC,yBAAyB,WAAW,GAAG;EAC1C,OAAO,MACL,gFACF;EACA,OAAO;CACT;CAEA,OAAO,MAAM,4CAA4C;CAEzD,IAAI;EACF,MAAM,wBAAwB,MAAM,SAAS,SAAS;EACtD,MAAM,qBAAqB,WAAW;EAEtC,MAAM,UAAU,GAAG,cAAc,aAAa,uBAAuB,OAAO,YAAY,CAAC,EAAE;EAC3F,MAAM,cAA2B;GAC/B,SAAS;GACT,QAAQ,CAAC;GACT;GACA,iBAAiB,CACf;IACE,UAAU;IACV,YAAY,MAAM,sBAAsB,QAAQ,QAAQ,YACtD,kBAAkB,MAAM,iBAAiB,WAAW,GAAG,WAAW,CACpE;GACF,CACF;EACF;EAEA,MAAM,OAAO,CAAC;EACd,IAAI,UAAU,QAAQ;GAEpB,IAAI,cAAc,GAAG,QAAQ,IAAG,MADN,kBAAkB,SAAS,WAAW,EAAA,CAE7D,KAAK,YAAY,GAAG,QAAQ,cAAc,CAAC,CAC3C,IAAI,KAAK,CAAC,CACV,KAAK,GAAG;GAEX,IACE,OAAO,0BAA0B,QACjC,CAAC,YAAY,UACb,eAAe,eAAe,GAE9B,eAAe;QACV;IACL,MAAM,kBAAkB,YACrB,KAAK,EAAE,SAAS,kBAAkB,eAAe,OAAO,CAAC,CACzD,OAAO,gCAAgC;IAE1C,eAAe,mBAAmB,gBAC/B,IAAI,KAAK,CAAC,CACV,KAAK,GAAG;GACb;GACA,KAAK,KAAK,WAAW;EACvB;EAEA,MAAM,gCACJ,MAAM,mCACJ,0BACA,OACF;EACF,IAAI,+BACF,KAAK,KAAK,6BAA6B;EAGzC,IAAI,CAAC,KAAK,QAAQ;GAChB,OAAO,MAAM,uDAAuD;GACpE,OAAO;EACT;EAEA,MAAM,eAAe,iBAAiB,qBAAqB;EAC3D,MAAM,KAAK,MAAM;GAAE,GAAG;GAAa,cAAc;EAAK,CAAC;EAEvD,MAAM,MAAM,MAAM,oBAAoB,qBAAqB;EAC3D,OAAO,MAAM,+CAA+C;EAE5D,OAAO,IAAI,SAAS,IAAI,MAAM;CAChC,SAAS,KAAK;EACZ,IAAI,IAAI,YAAA,mBACN,MAAM;EAGR,OAAO,MAAM,EAAE,IAAI,GAAG,kDAAkD;EACxE,OAAO,CACL,EACE,eAAe;GACb,UAAU;GACV,QAAQ,IAAI;EACd,EACF,CACF;CACF;AACF"}

package/dist/modules/manager/gradle-wrapper/artifacts.js

@@ -6,6 +6,7 @@ import { localPathExists, readLocalFile, writeLocalFile } from "../../../util/fs
 import { Http } from "../../../util/http/index.js";
 import { exec, getToolSettingsOptions, gradleJvmArg } from "../../../util/exec/index.js";
 import { getRepoStatus } from "../../../util/git/index.js";
+import { resolveToolConstraint } from "../util.js";
 import { extraEnv, getJavaConstraint, gradleWrapperFileName, prepareGradleCommand } from "./utils.js";
 import { isGradleExecutionAllowed, updateArtifacts as updateArtifacts$1 } from "../gradle/artifacts.js";
 import "../gradle/index.js";
@@ -103,7 +104,7 @@ async function updateArtifacts({ packageFileName, newPackageFileContent, updated
 			extraEnv,
 			toolConstraints: [{
 				toolName: "java",
-				constraint: config.constraints?.java ?? await getJavaConstraint(config.currentValue, gradlewFile)
+				constraint: await resolveToolConstraint(config, "java", () => getJavaConstraint(config.currentValue, gradlewFile))
 			}]
 		};
 		try {

package/dist/modules/manager/gradle-wrapper/artifacts.js.map

@@ -1 +1 @@
-{"version":3,"file":"artifacts.js","names":["query","q","gradleUpdateArtifacts"],"sources":["../../../../lib/modules/manager/gradle-wrapper/artifacts.ts"],"sourcesContent":["import { lang, query as q } from '@renovatebot/good-enough-parser';\nimport { isTruthy } from '@sindresorhus/is';\nimport { quote } from 'shlex';\nimport upath from 'upath';\nimport { TEMPORARY_ERROR } from '../../../constants/error-messages.ts';\nimport { logger } from '../../../logger/index.ts';\nimport {\n  exec,\n  getToolSettingsOptions,\n  gradleJvmArg,\n} from '../../../util/exec/index.ts';\nimport type { ExecOptions } from '../../../util/exec/types.ts';\nimport {\n  localPathExists,\n  readLocalFile,\n  writeLocalFile,\n} from '../../../util/fs/index.ts';\nimport { getRepoStatus } from '../../../util/git/index.ts';\nimport type { StatusResult } from '../../../util/git/types.ts';\nimport { Http } from '../../../util/http/index.ts';\nimport { newlineRegex, regEx } from '../../../util/regex.ts';\nimport { replaceAt } from '../../../util/string.ts';\nimport { isGradleExecutionAllowed } from '../gradle/artifacts.ts';\nimport { updateArtifacts as gradleUpdateArtifacts } from '../gradle/index.ts';\nimport type {\n  UpdateArtifact,\n  UpdateArtifactsConfig,\n  UpdateArtifactsResult,\n} from '../types.ts';\nimport {\n  extraEnv,\n  getJavaConstraint,\n  gradleWrapperFileName,\n  prepareGradleCommand,\n} from './utils.ts';\n\nconst http = new Http('gradle-wrapper');\nconst groovy = lang.createLang('groovy');\n\ntype Ctx = string[];\n\nasync function addIfUpdated(\n  status: StatusResult,\n  fileProjectPath: string,\n): Promise<UpdateArtifactsResult | null> {\n  if (status.modified.includes(fileProjectPath)) {\n    return {\n      file: {\n        type: 'addition',\n        path: fileProjectPath,\n        contents: await readLocalFile(fileProjectPath),\n      },\n    };\n  }\n  return null;\n}\n\nfunction getDistributionUrl(newPackageFileContent: string): string | null {\n  const distributionUrlLine = newPackageFileContent\n    .split(newlineRegex)\n    .find((line) => line.startsWith('distributionUrl='));\n  if (distributionUrlLine) {\n    return distributionUrlLine\n      .replace('distributionUrl=', '')\n      .replace('https\\\\:', 'https:');\n  }\n  return null;\n}\n\nasync function getDistributionChecksum(url: string): Promise<string> {\n  const { body } = await http.getText(`${url}.sha256`);\n  return body;\n}\n\nexport async function updateBuildFile(\n  localGradleDir: string,\n  wrapperProperties: Record<string, string | undefined | null>,\n): Promise<string> {\n  let buildFileName = upath.join(localGradleDir, 'build.gradle');\n  if (!(await localPathExists(buildFileName))) {\n    buildFileName = upath.join(localGradleDir, 'build.gradle.kts');\n  }\n\n  const buildFileContent = await readLocalFile(buildFileName, 'utf8');\n  if (!buildFileContent) {\n    logger.debug('build.gradle or build.gradle.kts not found');\n    return buildFileName;\n  }\n\n  let buildFileUpdated = buildFileContent;\n  for (const [propertyName, newValue] of Object.entries(wrapperProperties)) {\n    if (!newValue) {\n      continue;\n    }\n\n    const query = q.tree({\n      type: 'wrapped-tree',\n      maxDepth: 1,\n      search: q\n        .sym<Ctx>(propertyName)\n        .op('=')\n        .str((ctx, { value, offset }) => {\n          buildFileUpdated = replaceAt(\n            buildFileUpdated,\n            offset,\n            value,\n            newValue,\n          );\n          return ctx;\n        }),\n    });\n    groovy.query(buildFileUpdated, query, []);\n  }\n\n  await writeLocalFile(buildFileName, buildFileUpdated);\n\n  return buildFileName;\n}\n\nexport async function updateLockFiles(\n  buildFileName: string,\n  config: UpdateArtifactsConfig,\n): Promise<UpdateArtifactsResult[] | null> {\n  const buildFileContent = await readLocalFile(buildFileName, 'utf8');\n  if (!buildFileContent) {\n    logger.debug('build.gradle or build.gradle.kts not found');\n    return null;\n  }\n\n  return await gradleUpdateArtifacts({\n    packageFileName: buildFileName,\n    updatedDeps: [],\n    newPackageFileContent: buildFileContent,\n    config,\n  });\n}\n\nexport async function updateArtifacts({\n  packageFileName,\n  newPackageFileContent,\n  updatedDeps,\n  config,\n}: UpdateArtifact): Promise<UpdateArtifactsResult[] | null> {\n  try {\n    logger.debug({ updatedDeps }, 'gradle-wrapper.updateArtifacts()');\n    const localGradleDir = upath.join(upath.dirname(packageFileName), '../../');\n    const gradlewFile = upath.join(localGradleDir, gradleWrapperFileName());\n\n    let cmd = await prepareGradleCommand(gradlewFile);\n    if (!cmd) {\n      logger.info('No gradlew found - skipping Artifacts update');\n      return null;\n    }\n\n    if (!isGradleExecutionAllowed(gradlewFile)) {\n      logger.trace(\n        'Not allowed to execute gradle due to allowedUnsafeExecutions - aborting update',\n      );\n\n      return null;\n    }\n\n    // Limit the Gradle daemon Java heap memory size to prevent OOM errors\n    // leading to Renovate kernel-OOMs and timeouts. See #39558\n    cmd += gradleJvmArg(getToolSettingsOptions(config.toolSettings));\n    cmd += ' :wrapper';\n\n    let checksum: string | null = null;\n    const distributionUrl = getDistributionUrl(newPackageFileContent);\n    if (distributionUrl) {\n      cmd += ` --gradle-distribution-url ${quote(distributionUrl)}`;\n      if (newPackageFileContent.includes('distributionSha256Sum=')) {\n        //update checksum in case of distributionSha256Sum in properties then run wrapper\n        checksum = await getDistributionChecksum(distributionUrl);\n        await writeLocalFile(\n          packageFileName,\n          newPackageFileContent.replace(\n            regEx(/distributionSha256Sum=.*/),\n            `distributionSha256Sum=${checksum}`,\n          ),\n        );\n        cmd += ` --gradle-distribution-sha256-sum ${quote(checksum)}`;\n      }\n    } else {\n      cmd += ` --gradle-version ${quote(config.newValue!)}`;\n    }\n    logger.debug(`Updating gradle wrapper: \"${cmd}\"`);\n    const execOptions: ExecOptions = {\n      cwdFile: gradlewFile,\n      docker: {},\n      extraEnv,\n      toolConstraints: [\n        {\n          toolName: 'java',\n          constraint:\n            config.constraints?.java ??\n            (await getJavaConstraint(config.currentValue, gradlewFile)),\n        },\n      ],\n    };\n    try {\n      await exec(cmd, execOptions);\n    } catch (err) {\n      // istanbul ignore if\n      if (err.message === TEMPORARY_ERROR) {\n        throw err;\n      }\n      logger.warn(\n        { err },\n        'Error executing gradle wrapper update command. This may not necessarily be a blocker to the update, so please verify with the gradle wrapper output logs.',\n      );\n    }\n\n    const buildFileName = await updateBuildFile(localGradleDir, {\n      gradleVersion: config.newValue,\n      distributionSha256Sum: checksum,\n      distributionUrl,\n    });\n    const lockFiles = await updateLockFiles(buildFileName, config);\n\n    const status = await getRepoStatus();\n    const artifactFileNames = [\n      packageFileName,\n      buildFileName,\n      ...['gradle/wrapper/gradle-wrapper.jar', 'gradlew', 'gradlew.bat'].map(\n        (filename) => upath.join(localGradleDir, filename),\n      ),\n    ];\n    const updateArtifactsResult = (\n      await Promise.all(\n        artifactFileNames.map((fileProjectPath) =>\n          addIfUpdated(status, fileProjectPath),\n        ),\n      )\n    ).filter(isTruthy);\n    if (lockFiles) {\n      updateArtifactsResult.push(...lockFiles);\n    }\n\n    logger.debug(\n      { files: updateArtifactsResult.map((r) => r.file?.path) },\n      `Returning updated gradle-wrapper files`,\n    );\n    return updateArtifactsResult;\n  } catch (err) {\n    logger.debug({ err }, 'Error setting new Gradle Wrapper release value');\n    return [\n      {\n        artifactError: {\n          fileName: packageFileName,\n          stderr: err.message,\n        },\n      },\n    ];\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAoCA,MAAM,OAAO,IAAI,KAAK,gBAAgB;AACtC,MAAM,SAAS,KAAK,WAAW,QAAQ;AAIvC,eAAe,aACb,QACA,iBACuC;CACvC,IAAI,OAAO,SAAS,SAAS,eAAe,GAC1C,OAAO,EACL,MAAM;EACJ,MAAM;EACN,MAAM;EACN,UAAU,MAAM,cAAc,eAAe;CAC/C,EACF;CAEF,OAAO;AACT;AAEA,SAAS,mBAAmB,uBAA8C;CACxE,MAAM,sBAAsB,sBACzB,MAAM,YAAY,CAAC,CACnB,MAAM,SAAS,KAAK,WAAW,kBAAkB,CAAC;CACrD,IAAI,qBACF,OAAO,oBACJ,QAAQ,oBAAoB,EAAE,CAAC,CAC/B,QAAQ,YAAY,QAAQ;CAEjC,OAAO;AACT;AAEA,eAAe,wBAAwB,KAA8B;CACnE,MAAM,EAAE,SAAS,MAAM,KAAK,QAAQ,GAAG,IAAI,QAAQ;CACnD,OAAO;AACT;AAEA,eAAsB,gBACpB,gBACA,mBACiB;CACjB,IAAI,gBAAgB,MAAM,KAAK,gBAAgB,cAAc;CAC7D,IAAI,CAAE,MAAM,gBAAgB,aAAa,GACvC,gBAAgB,MAAM,KAAK,gBAAgB,kBAAkB;CAG/D,MAAM,mBAAmB,MAAM,cAAc,eAAe,MAAM;CAClE,IAAI,CAAC,kBAAkB;EACrB,OAAO,MAAM,4CAA4C;EACzD,OAAO;CACT;CAEA,IAAI,mBAAmB;CACvB,KAAK,MAAM,CAAC,cAAc,aAAa,OAAO,QAAQ,iBAAiB,GAAG;EACxE,IAAI,CAAC,UACH;EAGF,MAAMA,UAAQC,MAAE,KAAK;GACnB,MAAM;GACN,UAAU;GACV,QAAQA,MACL,IAAS,YAAY,CAAC,CACtB,GAAG,GAAG,CAAC,CACP,KAAK,KAAK,EAAE,OAAO,aAAa;IAC/B,mBAAmB,UACjB,kBACA,QACA,OACA,QACF;IACA,OAAO;GACT,CAAC;EACL,CAAC;EACD,OAAO,MAAM,kBAAkBD,SAAO,CAAC,CAAC;CAC1C;CAEA,MAAM,eAAe,eAAe,gBAAgB;CAEpD,OAAO;AACT;AAEA,eAAsB,gBACpB,eACA,QACyC;CACzC,MAAM,mBAAmB,MAAM,cAAc,eAAe,MAAM;CAClE,IAAI,CAAC,kBAAkB;EACrB,OAAO,MAAM,4CAA4C;EACzD,OAAO;CACT;CAEA,OAAO,MAAME,kBAAsB;EACjC,iBAAiB;EACjB,aAAa,CAAC;EACd,uBAAuB;EACvB;CACF,CAAC;AACH;AAEA,eAAsB,gBAAgB,EACpC,iBACA,uBACA,aACA,UAC0D;CAC1D,IAAI;EACF,OAAO,MAAM,EAAE,YAAY,GAAG,kCAAkC;EAChE,MAAM,iBAAiB,MAAM,KAAK,MAAM,QAAQ,eAAe,GAAG,QAAQ;EAC1E,MAAM,cAAc,MAAM,KAAK,gBAAgB,sBAAsB,CAAC;EAEtE,IAAI,MAAM,MAAM,qBAAqB,WAAW;EAChD,IAAI,CAAC,KAAK;GACR,OAAO,KAAK,8CAA8C;GAC1D,OAAO;EACT;EAEA,IAAI,CAAC,yBAAyB,WAAW,GAAG;GAC1C,OAAO,MACL,gFACF;GAEA,OAAO;EACT;EAIA,OAAO,aAAa,uBAAuB,OAAO,YAAY,CAAC;EAC/D,OAAO;EAEP,IAAI,WAA0B;EAC9B,MAAM,kBAAkB,mBAAmB,qBAAqB;EAChE,IAAI,iBAAiB;GACnB,OAAO,8BAA8B,MAAM,eAAe;GAC1D,IAAI,sBAAsB,SAAS,wBAAwB,GAAG;IAE5D,WAAW,MAAM,wBAAwB,eAAe;IACxD,MAAM,eACJ,iBACA,sBAAsB,QACpB,MAAM,0BAA0B,GAChC,yBAAyB,UAC3B,CACF;IACA,OAAO,qCAAqC,MAAM,QAAQ;GAC5D;EACF,OACE,OAAO,qBAAqB,MAAM,OAAO,QAAS;EAEpD,OAAO,MAAM,6BAA6B,IAAI,EAAE;EAChD,MAAM,cAA2B;GAC/B,SAAS;GACT,QAAQ,CAAC;GACT;GACA,iBAAiB,CACf;IACE,UAAU;IACV,YACE,OAAO,aAAa,QACnB,MAAM,kBAAkB,OAAO,cAAc,WAAW;GAC7D,CACF;EACF;EACA,IAAI;GACF,MAAM,KAAK,KAAK,WAAW;EAC7B,SAAS,KAAK;;GAEZ,IAAI,IAAI,YAAA,mBACN,MAAM;GAER,OAAO,KACL,EAAE,IAAI,GACN,2JACF;EACF;EAEA,MAAM,gBAAgB,MAAM,gBAAgB,gBAAgB;GAC1D,eAAe,OAAO;GACtB,uBAAuB;GACvB;EACF,CAAC;EACD,MAAM,YAAY,MAAM,gBAAgB,eAAe,MAAM;EAE7D,MAAM,SAAS,MAAM,cAAc;EACnC,MAAM,oBAAoB;GACxB;GACA;GACA,GAAG;IAAC;IAAqC;IAAW;GAAa,CAAC,CAAC,KAChE,aAAa,MAAM,KAAK,gBAAgB,QAAQ,CACnD;EACF;EACA,MAAM,yBACJ,MAAM,QAAQ,IACZ,kBAAkB,KAAK,oBACrB,aAAa,QAAQ,eAAe,CACtC,CACF,EAAA,CACA,OAAO,QAAQ;EACjB,IAAI,WACF,sBAAsB,KAAK,GAAG,SAAS;EAGzC,OAAO,MACL,EAAE,OAAO,sBAAsB,KAAK,MAAM,EAAE,MAAM,IAAI,EAAE,GACxD,wCACF;EACA,OAAO;CACT,SAAS,KAAK;EACZ,OAAO,MAAM,EAAE,IAAI,GAAG,gDAAgD;EACtE,OAAO,CACL,EACE,eAAe;GACb,UAAU;GACV,QAAQ,IAAI;EACd,EACF,CACF;CACF;AACF"}
+{"version":3,"file":"artifacts.js","names":["query","q","gradleUpdateArtifacts"],"sources":["../../../../lib/modules/manager/gradle-wrapper/artifacts.ts"],"sourcesContent":["import { lang, query as q } from '@renovatebot/good-enough-parser';\nimport { isTruthy } from '@sindresorhus/is';\nimport { quote } from 'shlex';\nimport upath from 'upath';\nimport { TEMPORARY_ERROR } from '../../../constants/error-messages.ts';\nimport { logger } from '../../../logger/index.ts';\nimport {\n  exec,\n  getToolSettingsOptions,\n  gradleJvmArg,\n} from '../../../util/exec/index.ts';\nimport type { ExecOptions } from '../../../util/exec/types.ts';\nimport {\n  localPathExists,\n  readLocalFile,\n  writeLocalFile,\n} from '../../../util/fs/index.ts';\nimport { getRepoStatus } from '../../../util/git/index.ts';\nimport type { StatusResult } from '../../../util/git/types.ts';\nimport { Http } from '../../../util/http/index.ts';\nimport { newlineRegex, regEx } from '../../../util/regex.ts';\nimport { replaceAt } from '../../../util/string.ts';\nimport { isGradleExecutionAllowed } from '../gradle/artifacts.ts';\nimport { updateArtifacts as gradleUpdateArtifacts } from '../gradle/index.ts';\nimport type {\n  UpdateArtifact,\n  UpdateArtifactsConfig,\n  UpdateArtifactsResult,\n} from '../types.ts';\nimport { resolveToolConstraint } from '../util.ts';\nimport {\n  extraEnv,\n  getJavaConstraint,\n  gradleWrapperFileName,\n  prepareGradleCommand,\n} from './utils.ts';\n\nconst http = new Http('gradle-wrapper');\nconst groovy = lang.createLang('groovy');\n\ntype Ctx = string[];\n\nasync function addIfUpdated(\n  status: StatusResult,\n  fileProjectPath: string,\n): Promise<UpdateArtifactsResult | null> {\n  if (status.modified.includes(fileProjectPath)) {\n    return {\n      file: {\n        type: 'addition',\n        path: fileProjectPath,\n        contents: await readLocalFile(fileProjectPath),\n      },\n    };\n  }\n  return null;\n}\n\nfunction getDistributionUrl(newPackageFileContent: string): string | null {\n  const distributionUrlLine = newPackageFileContent\n    .split(newlineRegex)\n    .find((line) => line.startsWith('distributionUrl='));\n  if (distributionUrlLine) {\n    return distributionUrlLine\n      .replace('distributionUrl=', '')\n      .replace('https\\\\:', 'https:');\n  }\n  return null;\n}\n\nasync function getDistributionChecksum(url: string): Promise<string> {\n  const { body } = await http.getText(`${url}.sha256`);\n  return body;\n}\n\nexport async function updateBuildFile(\n  localGradleDir: string,\n  wrapperProperties: Record<string, string | undefined | null>,\n): Promise<string> {\n  let buildFileName = upath.join(localGradleDir, 'build.gradle');\n  if (!(await localPathExists(buildFileName))) {\n    buildFileName = upath.join(localGradleDir, 'build.gradle.kts');\n  }\n\n  const buildFileContent = await readLocalFile(buildFileName, 'utf8');\n  if (!buildFileContent) {\n    logger.debug('build.gradle or build.gradle.kts not found');\n    return buildFileName;\n  }\n\n  let buildFileUpdated = buildFileContent;\n  for (const [propertyName, newValue] of Object.entries(wrapperProperties)) {\n    if (!newValue) {\n      continue;\n    }\n\n    const query = q.tree({\n      type: 'wrapped-tree',\n      maxDepth: 1,\n      search: q\n        .sym<Ctx>(propertyName)\n        .op('=')\n        .str((ctx, { value, offset }) => {\n          buildFileUpdated = replaceAt(\n            buildFileUpdated,\n            offset,\n            value,\n            newValue,\n          );\n          return ctx;\n        }),\n    });\n    groovy.query(buildFileUpdated, query, []);\n  }\n\n  await writeLocalFile(buildFileName, buildFileUpdated);\n\n  return buildFileName;\n}\n\nexport async function updateLockFiles(\n  buildFileName: string,\n  config: UpdateArtifactsConfig,\n): Promise<UpdateArtifactsResult[] | null> {\n  const buildFileContent = await readLocalFile(buildFileName, 'utf8');\n  if (!buildFileContent) {\n    logger.debug('build.gradle or build.gradle.kts not found');\n    return null;\n  }\n\n  return await gradleUpdateArtifacts({\n    packageFileName: buildFileName,\n    updatedDeps: [],\n    newPackageFileContent: buildFileContent,\n    config,\n  });\n}\n\nexport async function updateArtifacts({\n  packageFileName,\n  newPackageFileContent,\n  updatedDeps,\n  config,\n}: UpdateArtifact): Promise<UpdateArtifactsResult[] | null> {\n  try {\n    logger.debug({ updatedDeps }, 'gradle-wrapper.updateArtifacts()');\n    const localGradleDir = upath.join(upath.dirname(packageFileName), '../../');\n    const gradlewFile = upath.join(localGradleDir, gradleWrapperFileName());\n\n    let cmd = await prepareGradleCommand(gradlewFile);\n    if (!cmd) {\n      logger.info('No gradlew found - skipping Artifacts update');\n      return null;\n    }\n\n    if (!isGradleExecutionAllowed(gradlewFile)) {\n      logger.trace(\n        'Not allowed to execute gradle due to allowedUnsafeExecutions - aborting update',\n      );\n\n      return null;\n    }\n\n    // Limit the Gradle daemon Java heap memory size to prevent OOM errors\n    // leading to Renovate kernel-OOMs and timeouts. See #39558\n    cmd += gradleJvmArg(getToolSettingsOptions(config.toolSettings));\n    cmd += ' :wrapper';\n\n    let checksum: string | null = null;\n    const distributionUrl = getDistributionUrl(newPackageFileContent);\n    if (distributionUrl) {\n      cmd += ` --gradle-distribution-url ${quote(distributionUrl)}`;\n      if (newPackageFileContent.includes('distributionSha256Sum=')) {\n        //update checksum in case of distributionSha256Sum in properties then run wrapper\n        checksum = await getDistributionChecksum(distributionUrl);\n        await writeLocalFile(\n          packageFileName,\n          newPackageFileContent.replace(\n            regEx(/distributionSha256Sum=.*/),\n            `distributionSha256Sum=${checksum}`,\n          ),\n        );\n        cmd += ` --gradle-distribution-sha256-sum ${quote(checksum)}`;\n      }\n    } else {\n      cmd += ` --gradle-version ${quote(config.newValue!)}`;\n    }\n    logger.debug(`Updating gradle wrapper: \"${cmd}\"`);\n    const execOptions: ExecOptions = {\n      cwdFile: gradlewFile,\n      docker: {},\n      extraEnv,\n      toolConstraints: [\n        {\n          toolName: 'java',\n          constraint: await resolveToolConstraint(config, 'java', () =>\n            getJavaConstraint(config.currentValue, gradlewFile),\n          ),\n        },\n      ],\n    };\n    try {\n      await exec(cmd, execOptions);\n    } catch (err) {\n      // istanbul ignore if\n      if (err.message === TEMPORARY_ERROR) {\n        throw err;\n      }\n      logger.warn(\n        { err },\n        'Error executing gradle wrapper update command. This may not necessarily be a blocker to the update, so please verify with the gradle wrapper output logs.',\n      );\n    }\n\n    const buildFileName = await updateBuildFile(localGradleDir, {\n      gradleVersion: config.newValue,\n      distributionSha256Sum: checksum,\n      distributionUrl,\n    });\n    const lockFiles = await updateLockFiles(buildFileName, config);\n\n    const status = await getRepoStatus();\n    const artifactFileNames = [\n      packageFileName,\n      buildFileName,\n      ...['gradle/wrapper/gradle-wrapper.jar', 'gradlew', 'gradlew.bat'].map(\n        (filename) => upath.join(localGradleDir, filename),\n      ),\n    ];\n    const updateArtifactsResult = (\n      await Promise.all(\n        artifactFileNames.map((fileProjectPath) =>\n          addIfUpdated(status, fileProjectPath),\n        ),\n      )\n    ).filter(isTruthy);\n    if (lockFiles) {\n      updateArtifactsResult.push(...lockFiles);\n    }\n\n    logger.debug(\n      { files: updateArtifactsResult.map((r) => r.file?.path) },\n      `Returning updated gradle-wrapper files`,\n    );\n    return updateArtifactsResult;\n  } catch (err) {\n    logger.debug({ err }, 'Error setting new Gradle Wrapper release value');\n    return [\n      {\n        artifactError: {\n          fileName: packageFileName,\n          stderr: err.message,\n        },\n      },\n    ];\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAqCA,MAAM,OAAO,IAAI,KAAK,gBAAgB;AACtC,MAAM,SAAS,KAAK,WAAW,QAAQ;AAIvC,eAAe,aACb,QACA,iBACuC;CACvC,IAAI,OAAO,SAAS,SAAS,eAAe,GAC1C,OAAO,EACL,MAAM;EACJ,MAAM;EACN,MAAM;EACN,UAAU,MAAM,cAAc,eAAe;CAC/C,EACF;CAEF,OAAO;AACT;AAEA,SAAS,mBAAmB,uBAA8C;CACxE,MAAM,sBAAsB,sBACzB,MAAM,YAAY,CAAC,CACnB,MAAM,SAAS,KAAK,WAAW,kBAAkB,CAAC;CACrD,IAAI,qBACF,OAAO,oBACJ,QAAQ,oBAAoB,EAAE,CAAC,CAC/B,QAAQ,YAAY,QAAQ;CAEjC,OAAO;AACT;AAEA,eAAe,wBAAwB,KAA8B;CACnE,MAAM,EAAE,SAAS,MAAM,KAAK,QAAQ,GAAG,IAAI,QAAQ;CACnD,OAAO;AACT;AAEA,eAAsB,gBACpB,gBACA,mBACiB;CACjB,IAAI,gBAAgB,MAAM,KAAK,gBAAgB,cAAc;CAC7D,IAAI,CAAE,MAAM,gBAAgB,aAAa,GACvC,gBAAgB,MAAM,KAAK,gBAAgB,kBAAkB;CAG/D,MAAM,mBAAmB,MAAM,cAAc,eAAe,MAAM;CAClE,IAAI,CAAC,kBAAkB;EACrB,OAAO,MAAM,4CAA4C;EACzD,OAAO;CACT;CAEA,IAAI,mBAAmB;CACvB,KAAK,MAAM,CAAC,cAAc,aAAa,OAAO,QAAQ,iBAAiB,GAAG;EACxE,IAAI,CAAC,UACH;EAGF,MAAMA,UAAQC,MAAE,KAAK;GACnB,MAAM;GACN,UAAU;GACV,QAAQA,MACL,IAAS,YAAY,CAAC,CACtB,GAAG,GAAG,CAAC,CACP,KAAK,KAAK,EAAE,OAAO,aAAa;IAC/B,mBAAmB,UACjB,kBACA,QACA,OACA,QACF;IACA,OAAO;GACT,CAAC;EACL,CAAC;EACD,OAAO,MAAM,kBAAkBD,SAAO,CAAC,CAAC;CAC1C;CAEA,MAAM,eAAe,eAAe,gBAAgB;CAEpD,OAAO;AACT;AAEA,eAAsB,gBACpB,eACA,QACyC;CACzC,MAAM,mBAAmB,MAAM,cAAc,eAAe,MAAM;CAClE,IAAI,CAAC,kBAAkB;EACrB,OAAO,MAAM,4CAA4C;EACzD,OAAO;CACT;CAEA,OAAO,MAAME,kBAAsB;EACjC,iBAAiB;EACjB,aAAa,CAAC;EACd,uBAAuB;EACvB;CACF,CAAC;AACH;AAEA,eAAsB,gBAAgB,EACpC,iBACA,uBACA,aACA,UAC0D;CAC1D,IAAI;EACF,OAAO,MAAM,EAAE,YAAY,GAAG,kCAAkC;EAChE,MAAM,iBAAiB,MAAM,KAAK,MAAM,QAAQ,eAAe,GAAG,QAAQ;EAC1E,MAAM,cAAc,MAAM,KAAK,gBAAgB,sBAAsB,CAAC;EAEtE,IAAI,MAAM,MAAM,qBAAqB,WAAW;EAChD,IAAI,CAAC,KAAK;GACR,OAAO,KAAK,8CAA8C;GAC1D,OAAO;EACT;EAEA,IAAI,CAAC,yBAAyB,WAAW,GAAG;GAC1C,OAAO,MACL,gFACF;GAEA,OAAO;EACT;EAIA,OAAO,aAAa,uBAAuB,OAAO,YAAY,CAAC;EAC/D,OAAO;EAEP,IAAI,WAA0B;EAC9B,MAAM,kBAAkB,mBAAmB,qBAAqB;EAChE,IAAI,iBAAiB;GACnB,OAAO,8BAA8B,MAAM,eAAe;GAC1D,IAAI,sBAAsB,SAAS,wBAAwB,GAAG;IAE5D,WAAW,MAAM,wBAAwB,eAAe;IACxD,MAAM,eACJ,iBACA,sBAAsB,QACpB,MAAM,0BAA0B,GAChC,yBAAyB,UAC3B,CACF;IACA,OAAO,qCAAqC,MAAM,QAAQ;GAC5D;EACF,OACE,OAAO,qBAAqB,MAAM,OAAO,QAAS;EAEpD,OAAO,MAAM,6BAA6B,IAAI,EAAE;EAChD,MAAM,cAA2B;GAC/B,SAAS;GACT,QAAQ,CAAC;GACT;GACA,iBAAiB,CACf;IACE,UAAU;IACV,YAAY,MAAM,sBAAsB,QAAQ,cAC9C,kBAAkB,OAAO,cAAc,WAAW,CACpD;GACF,CACF;EACF;EACA,IAAI;GACF,MAAM,KAAK,KAAK,WAAW;EAC7B,SAAS,KAAK;;GAEZ,IAAI,IAAI,YAAA,mBACN,MAAM;GAER,OAAO,KACL,EAAE,IAAI,GACN,2JACF;EACF;EAEA,MAAM,gBAAgB,MAAM,gBAAgB,gBAAgB;GAC1D,eAAe,OAAO;GACtB,uBAAuB;GACvB;EACF,CAAC;EACD,MAAM,YAAY,MAAM,gBAAgB,eAAe,MAAM;EAE7D,MAAM,SAAS,MAAM,cAAc;EACnC,MAAM,oBAAoB;GACxB;GACA;GACA,GAAG;IAAC;IAAqC;IAAW;GAAa,CAAC,CAAC,KAChE,aAAa,MAAM,KAAK,gBAAgB,QAAQ,CACnD;EACF;EACA,MAAM,yBACJ,MAAM,QAAQ,IACZ,kBAAkB,KAAK,oBACrB,aAAa,QAAQ,eAAe,CACtC,CACF,EAAA,CACA,OAAO,QAAQ;EACjB,IAAI,WACF,sBAAsB,KAAK,GAAG,SAAS;EAGzC,OAAO,MACL,EAAE,OAAO,sBAAsB,KAAK,MAAM,EAAE,MAAM,IAAI,EAAE,GACxD,wCACF;EACA,OAAO;CACT,SAAS,KAAK;EACZ,OAAO,MAAM,EAAE,IAAI,GAAG,gDAAgD;EACtE,OAAO,CACL,EACE,eAAe;GACb,UAAU;GACV,QAAQ,IAAI;EACd,EACF,CACF;CACF;AACF"}

package/dist/modules/manager/helmfile/artifacts.js

@@ -7,6 +7,7 @@ import { getSiblingFileName, readLocalFile, writeLocalFile } from "../../../util
 import { Result } from "../../../util/result.js";
 import { exec } from "../../../util/exec/index.js";
 import { getFile } from "../../../util/git/index.js";
+import { resolveToolConstraint } from "../util.js";
 import { generateHelmEnvs } from "../helmv3/common.js";
 import { Doc, LockVersion } from "./schema.js";
 import { generateRegistryLoginCmd, isOCIRegistry } from "./utils.js";
@@ -30,14 +31,14 @@ async function updateArtifacts({ packageFileName, updatedDeps, newPackageFileCon
 		await writeLocalFile(packageFileName, newPackageFileContent);
 		const toolConstraints = [{
 			toolName: "helm",
-			constraint: config.constraints?.helm
+			constraint: await resolveToolConstraint(config, "helm")
 		}, {
 			toolName: "helmfile",
-			constraint: config.constraints?.helmfile ?? Result.parse(existingLockFileContent, LockVersion).unwrapOrNull()
+			constraint: await resolveToolConstraint(config, "helmfile", () => Result.parse(existingLockFileContent, LockVersion).unwrapOrNull())
 		}];
 		if (updatedDeps.some((dep) => dep.managerData?.needKustomize)) toolConstraints.push({
 			toolName: "kustomize",
-			constraint: config.constraints?.kustomize
+			constraint: await resolveToolConstraint(config, "kustomize")
 		});
 		const cmd = [];
 		const docs = parseYaml(newPackageFileContent, {

package/dist/modules/manager/helmfile/artifacts.js.map

@@ -1 +1 @@
-{"version":3,"file":"artifacts.js","names":[],"sources":["../../../../lib/modules/manager/helmfile/artifacts.ts"],"sourcesContent":["import { isFalsy } from '@sindresorhus/is';\nimport { quote } from 'shlex';\nimport { TEMPORARY_ERROR } from '../../../constants/error-messages.ts';\nimport { logger } from '../../../logger/index.ts';\nimport { coerceArray } from '../../../util/array.ts';\nimport { exec } from '../../../util/exec/index.ts';\nimport type { ToolConstraint } from '../../../util/exec/types.ts';\nimport {\n  getSiblingFileName,\n  readLocalFile,\n  writeLocalFile,\n} from '../../../util/fs/index.ts';\nimport { getFile } from '../../../util/git/index.ts';\nimport { regEx } from '../../../util/regex.ts';\nimport { Result } from '../../../util/result.ts';\nimport { parseYaml } from '../../../util/yaml.ts';\nimport { generateHelmEnvs } from '../helmv3/common.ts';\nimport type { UpdateArtifact, UpdateArtifactsResult } from '../types.ts';\nimport { Doc, LockVersion } from './schema.ts';\nimport { generateRegistryLoginCmd, isOCIRegistry } from './utils.ts';\n\nexport async function updateArtifacts({\n  packageFileName,\n  updatedDeps,\n  newPackageFileContent,\n  config,\n}: UpdateArtifact): Promise<UpdateArtifactsResult[] | null> {\n  logger.trace(`helmfile.updateArtifacts(${packageFileName})`);\n\n  const { isLockFileMaintenance } = config;\n  if (\n    !isLockFileMaintenance &&\n    (updatedDeps === undefined || updatedDeps.length < 1)\n  ) {\n    logger.debug('No updated helmfile deps - returning null');\n    return null;\n  }\n\n  const lockFileName = getSiblingFileName(packageFileName, 'helmfile.lock');\n  const existingLockFileContent = await getFile(lockFileName);\n\n  if (isFalsy(existingLockFileContent)) {\n    logger.debug('No helmfile.lock found');\n    return null;\n  }\n\n  try {\n    await writeLocalFile(packageFileName, newPackageFileContent);\n\n    const toolConstraints: ToolConstraint[] = [\n      {\n        toolName: 'helm',\n        constraint: config.constraints?.helm,\n      },\n      {\n        toolName: 'helmfile',\n        constraint:\n          config.constraints?.helmfile ??\n          Result.parse(existingLockFileContent, LockVersion).unwrapOrNull(),\n      },\n    ];\n    const needKustomize = updatedDeps.some(\n      (dep) => dep.managerData?.needKustomize,\n    );\n    if (needKustomize) {\n      toolConstraints.push({\n        toolName: 'kustomize',\n        constraint: config.constraints?.kustomize,\n      });\n    }\n\n    const cmd: string[] = [];\n    const docs = parseYaml(newPackageFileContent, {\n      removeTemplates: true,\n      customSchema: Doc,\n      failureBehaviour: 'filter',\n    });\n\n    for (const doc of docs) {\n      for (const value of coerceArray(doc.repositories).filter(isOCIRegistry)) {\n        const loginCmd = await generateRegistryLoginCmd(\n          value.name,\n          `https://${value.url}`,\n          // this extracts the hostname from url like format ghcr.ip/helm-charts\n          value.url.replace(regEx(/\\/.*/), ''),\n        );\n\n        if (loginCmd) {\n          cmd.push(loginCmd);\n        }\n      }\n    }\n\n    cmd.push(`helmfile deps -f ${quote(packageFileName)}`);\n    await exec(cmd, {\n      docker: {},\n      extraEnv: generateHelmEnvs(),\n      toolConstraints,\n    });\n\n    const newHelmLockContent = await readLocalFile(lockFileName, 'utf8');\n    if (existingLockFileContent === newHelmLockContent) {\n      logger.debug('helmfile.lock is unchanged');\n      return null;\n    }\n\n    return [\n      {\n        file: {\n          type: 'addition',\n          path: lockFileName,\n          contents: newHelmLockContent,\n        },\n      },\n    ];\n  } catch (err) {\n    // istanbul ignore if\n    if (err.message === TEMPORARY_ERROR) {\n      throw err;\n    }\n    logger.debug({ err }, 'Failed to update Helmfile lock file');\n    return [\n      {\n        artifactError: {\n          fileName: lockFileName,\n          stderr: err.message,\n        },\n      },\n    ];\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;AAqBA,eAAsB,gBAAgB,EACpC,iBACA,aACA,uBACA,UAC0D;CAC1D,OAAO,MAAM,4BAA4B,gBAAgB,EAAE;CAE3D,MAAM,EAAE,0BAA0B;CAClC,IACE,CAAC,0BACA,gBAAgB,KAAA,KAAa,YAAY,SAAS,IACnD;EACA,OAAO,MAAM,2CAA2C;EACxD,OAAO;CACT;CAEA,MAAM,eAAe,mBAAmB,iBAAiB,eAAe;CACxE,MAAM,0BAA0B,MAAM,QAAQ,YAAY;CAE1D,IAAI,QAAQ,uBAAuB,GAAG;EACpC,OAAO,MAAM,wBAAwB;EACrC,OAAO;CACT;CAEA,IAAI;EACF,MAAM,eAAe,iBAAiB,qBAAqB;EAE3D,MAAM,kBAAoC,CACxC;GACE,UAAU;GACV,YAAY,OAAO,aAAa;EAClC,GACA;GACE,UAAU;GACV,YACE,OAAO,aAAa,YACpB,OAAO,MAAM,yBAAyB,WAAW,CAAC,CAAC,aAAa;EACpE,CACF;EAIA,IAHsB,YAAY,MAC/B,QAAQ,IAAI,aAAa,aAEZ,GACd,gBAAgB,KAAK;GACnB,UAAU;GACV,YAAY,OAAO,aAAa;EAClC,CAAC;EAGH,MAAM,MAAgB,CAAC;EACvB,MAAM,OAAO,UAAU,uBAAuB;GAC5C,iBAAiB;GACjB,cAAc;GACd,kBAAkB;EACpB,CAAC;EAED,KAAK,MAAM,OAAO,MAChB,KAAK,MAAM,SAAS,YAAY,IAAI,YAAY,CAAC,CAAC,OAAO,aAAa,GAAG;GACvE,MAAM,WAAW,MAAM,yBACrB,MAAM,MACN,WAAW,MAAM,OAEjB,MAAM,IAAI,QAAQ,MAAM,MAAM,GAAG,EAAE,CACrC;GAEA,IAAI,UACF,IAAI,KAAK,QAAQ;EAErB;EAGF,IAAI,KAAK,oBAAoB,MAAM,eAAe,GAAG;EACrD,MAAM,KAAK,KAAK;GACd,QAAQ,CAAC;GACT,UAAU,iBAAiB;GAC3B;EACF,CAAC;EAED,MAAM,qBAAqB,MAAM,cAAc,cAAc,MAAM;EACnE,IAAI,4BAA4B,oBAAoB;GAClD,OAAO,MAAM,4BAA4B;GACzC,OAAO;EACT;EAEA,OAAO,CACL,EACE,MAAM;GACJ,MAAM;GACN,MAAM;GACN,UAAU;EACZ,EACF,CACF;CACF,SAAS,KAAK;;EAEZ,IAAI,IAAI,YAAA,mBACN,MAAM;EAER,OAAO,MAAM,EAAE,IAAI,GAAG,qCAAqC;EAC3D,OAAO,CACL,EACE,eAAe;GACb,UAAU;GACV,QAAQ,IAAI;EACd,EACF,CACF;CACF;AACF"}
+{"version":3,"file":"artifacts.js","names":[],"sources":["../../../../lib/modules/manager/helmfile/artifacts.ts"],"sourcesContent":["import { isFalsy } from '@sindresorhus/is';\nimport { quote } from 'shlex';\nimport { TEMPORARY_ERROR } from '../../../constants/error-messages.ts';\nimport { logger } from '../../../logger/index.ts';\nimport { coerceArray } from '../../../util/array.ts';\nimport { exec } from '../../../util/exec/index.ts';\nimport type { ToolConstraint } from '../../../util/exec/types.ts';\nimport {\n  getSiblingFileName,\n  readLocalFile,\n  writeLocalFile,\n} from '../../../util/fs/index.ts';\nimport { getFile } from '../../../util/git/index.ts';\nimport { regEx } from '../../../util/regex.ts';\nimport { Result } from '../../../util/result.ts';\nimport { parseYaml } from '../../../util/yaml.ts';\nimport { generateHelmEnvs } from '../helmv3/common.ts';\nimport type { UpdateArtifact, UpdateArtifactsResult } from '../types.ts';\nimport { resolveToolConstraint } from '../util.ts';\nimport { Doc, LockVersion } from './schema.ts';\nimport { generateRegistryLoginCmd, isOCIRegistry } from './utils.ts';\n\nexport async function updateArtifacts({\n  packageFileName,\n  updatedDeps,\n  newPackageFileContent,\n  config,\n}: UpdateArtifact): Promise<UpdateArtifactsResult[] | null> {\n  logger.trace(`helmfile.updateArtifacts(${packageFileName})`);\n\n  const { isLockFileMaintenance } = config;\n  if (\n    !isLockFileMaintenance &&\n    (updatedDeps === undefined || updatedDeps.length < 1)\n  ) {\n    logger.debug('No updated helmfile deps - returning null');\n    return null;\n  }\n\n  const lockFileName = getSiblingFileName(packageFileName, 'helmfile.lock');\n  const existingLockFileContent = await getFile(lockFileName);\n\n  if (isFalsy(existingLockFileContent)) {\n    logger.debug('No helmfile.lock found');\n    return null;\n  }\n\n  try {\n    await writeLocalFile(packageFileName, newPackageFileContent);\n\n    const toolConstraints: ToolConstraint[] = [\n      {\n        toolName: 'helm',\n        constraint: await resolveToolConstraint(config, 'helm'),\n      },\n      {\n        toolName: 'helmfile',\n        constraint: await resolveToolConstraint(config, 'helmfile', () =>\n          Result.parse(existingLockFileContent, LockVersion).unwrapOrNull(),\n        ),\n      },\n    ];\n    const needKustomize = updatedDeps.some(\n      (dep) => dep.managerData?.needKustomize,\n    );\n    if (needKustomize) {\n      toolConstraints.push({\n        toolName: 'kustomize',\n        constraint: await resolveToolConstraint(config, 'kustomize'),\n      });\n    }\n\n    const cmd: string[] = [];\n    const docs = parseYaml(newPackageFileContent, {\n      removeTemplates: true,\n      customSchema: Doc,\n      failureBehaviour: 'filter',\n    });\n\n    for (const doc of docs) {\n      for (const value of coerceArray(doc.repositories).filter(isOCIRegistry)) {\n        const loginCmd = await generateRegistryLoginCmd(\n          value.name,\n          `https://${value.url}`,\n          // this extracts the hostname from url like format ghcr.ip/helm-charts\n          value.url.replace(regEx(/\\/.*/), ''),\n        );\n\n        if (loginCmd) {\n          cmd.push(loginCmd);\n        }\n      }\n    }\n\n    cmd.push(`helmfile deps -f ${quote(packageFileName)}`);\n    await exec(cmd, {\n      docker: {},\n      extraEnv: generateHelmEnvs(),\n      toolConstraints,\n    });\n\n    const newHelmLockContent = await readLocalFile(lockFileName, 'utf8');\n    if (existingLockFileContent === newHelmLockContent) {\n      logger.debug('helmfile.lock is unchanged');\n      return null;\n    }\n\n    return [\n      {\n        file: {\n          type: 'addition',\n          path: lockFileName,\n          contents: newHelmLockContent,\n        },\n      },\n    ];\n  } catch (err) {\n    // istanbul ignore if\n    if (err.message === TEMPORARY_ERROR) {\n      throw err;\n    }\n    logger.debug({ err }, 'Failed to update Helmfile lock file');\n    return [\n      {\n        artifactError: {\n          fileName: lockFileName,\n          stderr: err.message,\n        },\n      },\n    ];\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAsBA,eAAsB,gBAAgB,EACpC,iBACA,aACA,uBACA,UAC0D;CAC1D,OAAO,MAAM,4BAA4B,gBAAgB,EAAE;CAE3D,MAAM,EAAE,0BAA0B;CAClC,IACE,CAAC,0BACA,gBAAgB,KAAA,KAAa,YAAY,SAAS,IACnD;EACA,OAAO,MAAM,2CAA2C;EACxD,OAAO;CACT;CAEA,MAAM,eAAe,mBAAmB,iBAAiB,eAAe;CACxE,MAAM,0BAA0B,MAAM,QAAQ,YAAY;CAE1D,IAAI,QAAQ,uBAAuB,GAAG;EACpC,OAAO,MAAM,wBAAwB;EACrC,OAAO;CACT;CAEA,IAAI;EACF,MAAM,eAAe,iBAAiB,qBAAqB;EAE3D,MAAM,kBAAoC,CACxC;GACE,UAAU;GACV,YAAY,MAAM,sBAAsB,QAAQ,MAAM;EACxD,GACA;GACE,UAAU;GACV,YAAY,MAAM,sBAAsB,QAAQ,kBAC9C,OAAO,MAAM,yBAAyB,WAAW,CAAC,CAAC,aAAa,CAClE;EACF,CACF;EAIA,IAHsB,YAAY,MAC/B,QAAQ,IAAI,aAAa,aAEZ,GACd,gBAAgB,KAAK;GACnB,UAAU;GACV,YAAY,MAAM,sBAAsB,QAAQ,WAAW;EAC7D,CAAC;EAGH,MAAM,MAAgB,CAAC;EACvB,MAAM,OAAO,UAAU,uBAAuB;GAC5C,iBAAiB;GACjB,cAAc;GACd,kBAAkB;EACpB,CAAC;EAED,KAAK,MAAM,OAAO,MAChB,KAAK,MAAM,SAAS,YAAY,IAAI,YAAY,CAAC,CAAC,OAAO,aAAa,GAAG;GACvE,MAAM,WAAW,MAAM,yBACrB,MAAM,MACN,WAAW,MAAM,OAEjB,MAAM,IAAI,QAAQ,MAAM,MAAM,GAAG,EAAE,CACrC;GAEA,IAAI,UACF,IAAI,KAAK,QAAQ;EAErB;EAGF,IAAI,KAAK,oBAAoB,MAAM,eAAe,GAAG;EACrD,MAAM,KAAK,KAAK;GACd,QAAQ,CAAC;GACT,UAAU,iBAAiB;GAC3B;EACF,CAAC;EAED,MAAM,qBAAqB,MAAM,cAAc,cAAc,MAAM;EACnE,IAAI,4BAA4B,oBAAoB;GAClD,OAAO,MAAM,4BAA4B;GACzC,OAAO;EACT;EAEA,OAAO,CACL,EACE,MAAM;GACJ,MAAM;GACN,MAAM;GACN,UAAU;EACZ,EACF,CACF;CACF,SAAS,KAAK;;EAEZ,IAAI,IAAI,YAAA,mBACN,MAAM;EAER,OAAO,MAAM,EAAE,IAAI,GAAG,qCAAqC;EAC3D,OAAO,CACL,EACE,eAAe;GACb,UAAU;GACV,QAAQ,IAAI;EACd,EACF,CACF;CACF;AACF"}

package/dist/modules/manager/helmv3/artifacts.js

@@ -9,6 +9,7 @@ import { exec } from "../../../util/exec/index.js";
 import { getRepoStatus } from "../../../util/git/index.js";
 import { DockerDatasource } from "../../datasource/docker/index.js";
 import { HelmDatasource } from "../../datasource/helm/index.js";
+import { resolveToolConstraint } from "../util.js";
 import { isOCIRegistry, removeOCIPrefix } from "./oci.js";
 import { generateHelmEnvs, generateLoginCmd } from "./common.js";
 import { aliasRecordToRepositories, getRepositories, isFileInDir } from "./utils.js";
@@ -77,7 +78,7 @@ async function updateArtifacts({ packageFileName, updatedDeps, newPackageFileCon
 		logger.debug("Updating Helm artifacts");
 		const helmToolConstraint = {
 			toolName: "helm",
-			constraint: config.constraints?.helm
+			constraint: await resolveToolConstraint(config, "helm")
 		};
 		await helmCommands({
 			docker: {},