renovate 44.85.0 → 44.86.0

package/dist/modules/manager/poetry/artifacts.js.map

@@ -1 +1 @@
-{"version":3,"file":"artifacts.js","names":["massageToml","parseToml"],"sources":["../../../../lib/modules/manager/poetry/artifacts.ts"],"sourcesContent":["import {\n  isNonEmptyArray,\n  isNonEmptyObject,\n  isNumber,\n  isString,\n} from '@sindresorhus/is';\nimport { Duration } from 'luxon';\nimport { quote } from 'shlex';\nimport { TEMPORARY_ERROR } from '../../../constants/error-messages.ts';\nimport { logger } from '../../../logger/index.ts';\nimport type { HostRule } from '../../../types/index.ts';\nimport { coerceArray } from '../../../util/array.ts';\nimport type { ExecOptions } from '../../../util/exec/types.ts';\nimport {\n  deleteLocalFile,\n  ensureCacheDir,\n  getSiblingFileName,\n  readLocalFile,\n  writeLocalFile,\n} from '../../../util/fs/index.ts';\nimport { withGitEnvironment } from '../../../util/git/exec.ts';\nimport { find } from '../../../util/host-rules.ts';\nimport { toMs } from '../../../util/pretty-time.ts';\nimport { regEx } from '../../../util/regex.ts';\nimport { Result } from '../../../util/result.ts';\nimport {\n  massage as massageToml,\n  parse as parseToml,\n} from '../../../util/toml.ts';\nimport { parseUrl } from '../../../util/url.ts';\nimport { PypiDatasource } from '../../datasource/pypi/index.ts';\nimport { getGoogleAuthHostRule } from '../../datasource/util.ts';\nimport type { UpdateArtifact, UpdateArtifactsResult } from '../types.ts';\nimport { Lockfile, PoetryPyProject } from './schema.ts';\nimport type { PoetryFile, PoetrySource } from './types.ts';\n\nconst gitExec = withGitEnvironment(['poetry']);\n\nexport function getPythonConstraint(\n  pyProjectContent: string,\n  existingLockFileContent: string,\n): string | null {\n  // Read Python version from `pyproject.toml` first as it could have been updated\n  const pyprojectPythonConstraint = Result.parse(\n    massageToml(pyProjectContent),\n    PoetryPyProject.transform(\n      ({ packageFileContent }) =>\n        packageFileContent.deps.find((dep) => dep.depName === 'python')\n          ?.currentValue,\n    ),\n  ).unwrapOrNull();\n  if (pyprojectPythonConstraint) {\n    logger.debug('Using python version from pyproject.toml');\n    return pyprojectPythonConstraint;\n  }\n\n  const lockfilePythonConstraint = Result.parse(\n    existingLockFileContent,\n    Lockfile.transform(({ pythonVersions }) => pythonVersions),\n  ).unwrapOrNull();\n  if (lockfilePythonConstraint) {\n    logger.debug('Using python version from poetry.lock');\n    return lockfilePythonConstraint;\n  }\n\n  return null;\n}\n\nexport function getPoetryRequirement(\n  pyProjectContent: string,\n  existingLockFileContent: string,\n): undefined | string | null {\n  // Read Poetry version from first line of poetry.lock\n  const firstLine = existingLockFileContent.split('\\n')[0];\n  const poetryVersionMatch = regEx(/by Poetry (?<version>[\\d\\\\.]+)/).exec(\n    firstLine,\n  );\n  if (poetryVersionMatch?.groups?.version) {\n    const poetryVersion = poetryVersionMatch.groups.version;\n    logger.debug(\n      `Using poetry version ${poetryVersion} from poetry.lock header`,\n    );\n    return poetryVersion;\n  }\n\n  const { val: lockfilePoetryConstraint } = Result.parse(\n    existingLockFileContent,\n    Lockfile.transform(({ poetryConstraint }) => poetryConstraint),\n  ).unwrap();\n  if (lockfilePoetryConstraint) {\n    logger.debug(\n      `Using poetry version ${lockfilePoetryConstraint} from poetry.lock metadata`,\n    );\n    return lockfilePoetryConstraint;\n  }\n\n  const { val: pyprojectPoetryConstraint } = Result.parse(\n    massageToml(pyProjectContent),\n    PoetryPyProject.transform(({ poetryRequirement }) => poetryRequirement),\n  ).unwrap();\n  if (pyprojectPoetryConstraint) {\n    logger.debug(\n      `Using poetry version ${pyprojectPoetryConstraint} from pyproject.toml`,\n    );\n    return pyprojectPoetryConstraint;\n  }\n\n  return null;\n}\n\nfunction getPoetrySources(content: string, fileName: string): PoetrySource[] {\n  let pyprojectFile: PoetryFile;\n  try {\n    pyprojectFile = parseToml(massageToml(content)) as PoetryFile;\n  } catch (err) {\n    logger.debug({ err }, 'Error parsing pyproject.toml file');\n    return [];\n  }\n  if (!pyprojectFile.tool?.poetry) {\n    logger.debug(`${fileName} contains no poetry section`);\n    return [];\n  }\n\n  const sources = coerceArray(pyprojectFile.tool?.poetry?.source);\n  const sourceArray: PoetrySource[] = [];\n  for (const source of sources) {\n    if (source.name && source.url) {\n      sourceArray.push({ name: source.name, url: source.url });\n    }\n  }\n  return sourceArray;\n}\n\nasync function getMatchingHostRule(url: string | undefined): Promise<HostRule> {\n  const scopedMatch = find({ hostType: PypiDatasource.id, url });\n  const hostRule = isNonEmptyObject(scopedMatch) ? scopedMatch : find({ url });\n  if (hostRule && Object.keys(hostRule).length !== 0) {\n    return hostRule;\n  }\n\n  const parsedUrl = parseUrl(url);\n  if (!parsedUrl) {\n    logger.once.debug(`Failed to parse URL ${url}`);\n    return {};\n  }\n\n  if (parsedUrl.hostname.endsWith('.pkg.dev')) {\n    const hostRule = await getGoogleAuthHostRule();\n    if (hostRule && Object.keys(hostRule).length !== 0) {\n      return hostRule;\n    }\n    logger.once.debug(`Could not get Google access token (url=${url})`);\n  }\n\n  return {};\n}\n\nasync function getSourceCredentialVars(\n  pyprojectContent: string,\n  packageFileName: string,\n): Promise<NodeJS.ProcessEnv> {\n  const poetrySources = getPoetrySources(pyprojectContent, packageFileName);\n  const envVars: NodeJS.ProcessEnv = {};\n\n  for (const source of poetrySources) {\n    const matchingHostRule = await getMatchingHostRule(source.url);\n    const formattedSourceName = source.name\n      .replace(regEx(/(?:\\.|-)+/g), '_')\n      .toUpperCase();\n    if (matchingHostRule.username) {\n      envVars[`POETRY_HTTP_BASIC_${formattedSourceName}_USERNAME`] =\n        matchingHostRule.username;\n    }\n    if (matchingHostRule.password) {\n      envVars[`POETRY_HTTP_BASIC_${formattedSourceName}_PASSWORD`] =\n        matchingHostRule.password;\n    }\n  }\n  return envVars;\n}\n\nexport async function updateArtifacts({\n  packageFileName,\n  updatedDeps,\n  newPackageFileContent,\n  config,\n}: UpdateArtifact): Promise<UpdateArtifactsResult[] | null> {\n  logger.debug(`poetry.updateArtifacts(${packageFileName})`);\n  const { isLockFileMaintenance } = config;\n\n  if (!isNonEmptyArray(updatedDeps) && !isLockFileMaintenance) {\n    logger.debug('No updated poetry deps - returning null');\n    return null;\n  }\n  // Try poetry.lock first\n  let lockFileName = getSiblingFileName(packageFileName, 'poetry.lock');\n  let existingLockFileContent = await readLocalFile(lockFileName, 'utf8');\n  if (!existingLockFileContent) {\n    // Try pyproject.lock next\n    lockFileName = getSiblingFileName(packageFileName, 'pyproject.lock');\n    existingLockFileContent = await readLocalFile(lockFileName, 'utf8');\n    if (!existingLockFileContent) {\n      logger.debug(`No lock file found`);\n      return null;\n    }\n  }\n  logger.debug(`Updating ${lockFileName}`);\n  try {\n    await writeLocalFile(packageFileName, newPackageFileContent);\n    const cmd: string[] = [];\n    if (isLockFileMaintenance) {\n      await deleteLocalFile(lockFileName);\n      cmd.push('poetry update --lock --no-interaction');\n    } else {\n      cmd.push(\n        `poetry update --lock --no-interaction ${updatedDeps\n          .map((dep) => dep.depName)\n          .filter(isString)\n          .map((dep) => quote(dep))\n          .join(' ')}`,\n      );\n    }\n    const pythonConstraint =\n      config?.constraints?.python ??\n      getPythonConstraint(newPackageFileContent, existingLockFileContent);\n    const poetryConstraint =\n      config.constraints?.poetry ??\n      getPoetryRequirement(newPackageFileContent, existingLockFileContent);\n    const extraEnv: NodeJS.ProcessEnv = {\n      ...(await getSourceCredentialVars(\n        newPackageFileContent,\n        packageFileName,\n      )),\n      PIP_CACHE_DIR: await ensureCacheDir('pip'),\n    };\n\n    if (config.minimumReleaseAge) {\n      const ageMs = toMs(config.minimumReleaseAge);\n      if (isNumber(ageMs)) {\n        const days = Math.ceil(Duration.fromMillis(ageMs).as('days'));\n        extraEnv.POETRY_SOLVER_MIN_RELEASE_AGE = days.toString();\n      } else {\n        logger.debug(\n          { minimumReleaseAge: config.minimumReleaseAge },\n          'Invalid minimumReleaseAge, skipping POETRY_SOLVER_MIN_RELEASE_AGE',\n        );\n      }\n    }\n\n    const execOptions: ExecOptions = {\n      cwdFile: packageFileName,\n      extraEnv,\n      docker: {},\n      toolConstraints: [\n        { toolName: 'python', constraint: pythonConstraint },\n        { toolName: 'poetry', constraint: poetryConstraint },\n      ],\n    };\n    await gitExec(cmd, execOptions);\n    const newPoetryLockContent = await readLocalFile(lockFileName, 'utf8');\n    if (existingLockFileContent === newPoetryLockContent) {\n      logger.debug(`${lockFileName} is unchanged`);\n      return null;\n    }\n    logger.debug(`Returning updated ${lockFileName}`);\n    return [\n      {\n        file: {\n          type: 'addition',\n          path: lockFileName,\n          contents: newPoetryLockContent,\n        },\n      },\n    ];\n  } catch (err) {\n    // istanbul ignore if\n    if (err.message === TEMPORARY_ERROR) {\n      throw err;\n    }\n    logger.debug({ err }, `Failed to update ${lockFileName} file`);\n    return [\n      {\n        artifactError: {\n          fileName: lockFileName,\n          stderr: `${String(err.stdout)}\\n${String(err.stderr)}`,\n        },\n      },\n    ];\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAoCA,MAAM,UAAU,mBAAmB,CAAC,QAAQ,CAAC;AAE7C,SAAgB,oBACd,kBACA,yBACe;CAEf,MAAM,4BAA4B,OAAO,MACvCA,QAAY,gBAAgB,GAC5B,gBAAgB,WACb,EAAE,yBACD,mBAAmB,KAAK,MAAM,QAAQ,IAAI,YAAY,QAAQ,CAAC,EAC3D,YACR,CACF,CAAC,CAAC,aAAa;CACf,IAAI,2BAA2B;EAC7B,OAAO,MAAM,0CAA0C;EACvD,OAAO;CACT;CAEA,MAAM,2BAA2B,OAAO,MACtC,yBACA,SAAS,WAAW,EAAE,qBAAqB,cAAc,CAC3D,CAAC,CAAC,aAAa;CACf,IAAI,0BAA0B;EAC5B,OAAO,MAAM,uCAAuC;EACpD,OAAO;CACT;CAEA,OAAO;AACT;AAEA,SAAgB,qBACd,kBACA,yBAC2B;CAE3B,MAAM,YAAY,wBAAwB,MAAM,IAAI,CAAC,CAAC;CACtD,MAAM,qBAAqB,MAAM,gCAAgC,CAAC,CAAC,KACjE,SACF;CACA,IAAI,oBAAoB,QAAQ,SAAS;EACvC,MAAM,gBAAgB,mBAAmB,OAAO;EAChD,OAAO,MACL,wBAAwB,cAAc,yBACxC;EACA,OAAO;CACT;CAEA,MAAM,EAAE,KAAK,6BAA6B,OAAO,MAC/C,yBACA,SAAS,WAAW,EAAE,uBAAuB,gBAAgB,CAC/D,CAAC,CAAC,OAAO;CACT,IAAI,0BAA0B;EAC5B,OAAO,MACL,wBAAwB,yBAAyB,2BACnD;EACA,OAAO;CACT;CAEA,MAAM,EAAE,KAAK,8BAA8B,OAAO,MAChDA,QAAY,gBAAgB,GAC5B,gBAAgB,WAAW,EAAE,wBAAwB,iBAAiB,CACxE,CAAC,CAAC,OAAO;CACT,IAAI,2BAA2B;EAC7B,OAAO,MACL,wBAAwB,0BAA0B,qBACpD;EACA,OAAO;CACT;CAEA,OAAO;AACT;AAEA,SAAS,iBAAiB,SAAiB,UAAkC;CAC3E,IAAI;CACJ,IAAI;EACF,gBAAgBC,MAAUD,QAAY,OAAO,CAAC;CAChD,SAAS,KAAK;EACZ,OAAO,MAAM,EAAE,IAAI,GAAG,mCAAmC;EACzD,OAAO,CAAC;CACV;CACA,IAAI,CAAC,cAAc,MAAM,QAAQ;EAC/B,OAAO,MAAM,GAAG,SAAS,4BAA4B;EACrD,OAAO,CAAC;CACV;CAEA,MAAM,UAAU,YAAY,cAAc,MAAM,QAAQ,MAAM;CAC9D,MAAM,cAA8B,CAAC;CACrC,KAAK,MAAM,UAAU,SACnB,IAAI,OAAO,QAAQ,OAAO,KACxB,YAAY,KAAK;EAAE,MAAM,OAAO;EAAM,KAAK,OAAO;CAAI,CAAC;CAG3D,OAAO;AACT;AAEA,eAAe,oBAAoB,KAA4C;CAC7E,MAAM,cAAc,KAAK;EAAE,UAAU,eAAe;EAAI;CAAI,CAAC;CAC7D,MAAM,WAAW,iBAAiB,WAAW,IAAI,cAAc,KAAK,EAAE,IAAI,CAAC;CAC3E,IAAI,YAAY,OAAO,KAAK,QAAQ,CAAC,CAAC,WAAW,GAC/C,OAAO;CAGT,MAAM,YAAY,SAAS,GAAG;CAC9B,IAAI,CAAC,WAAW;EACd,OAAO,KAAK,MAAM,uBAAuB,KAAK;EAC9C,OAAO,CAAC;CACV;CAEA,IAAI,UAAU,SAAS,SAAS,UAAU,GAAG;EAC3C,MAAM,WAAW,MAAM,sBAAsB;EAC7C,IAAI,YAAY,OAAO,KAAK,QAAQ,CAAC,CAAC,WAAW,GAC/C,OAAO;EAET,OAAO,KAAK,MAAM,0CAA0C,IAAI,EAAE;CACpE;CAEA,OAAO,CAAC;AACV;AAEA,eAAe,wBACb,kBACA,iBAC4B;CAC5B,MAAM,gBAAgB,iBAAiB,kBAAkB,eAAe;CACxE,MAAM,UAA6B,CAAC;CAEpC,KAAK,MAAM,UAAU,eAAe;EAClC,MAAM,mBAAmB,MAAM,oBAAoB,OAAO,GAAG;EAC7D,MAAM,sBAAsB,OAAO,KAChC,QAAQ,MAAM,YAAY,GAAG,GAAG,CAAC,CACjC,YAAY;EACf,IAAI,iBAAiB,UACnB,QAAQ,qBAAqB,oBAAoB,cAC/C,iBAAiB;EAErB,IAAI,iBAAiB,UACnB,QAAQ,qBAAqB,oBAAoB,cAC/C,iBAAiB;CAEvB;CACA,OAAO;AACT;AAEA,eAAsB,gBAAgB,EACpC,iBACA,aACA,uBACA,UAC0D;CAC1D,OAAO,MAAM,0BAA0B,gBAAgB,EAAE;CACzD,MAAM,EAAE,0BAA0B;CAElC,IAAI,CAAC,gBAAgB,WAAW,KAAK,CAAC,uBAAuB;EAC3D,OAAO,MAAM,yCAAyC;EACtD,OAAO;CACT;CAEA,IAAI,eAAe,mBAAmB,iBAAiB,aAAa;CACpE,IAAI,0BAA0B,MAAM,cAAc,cAAc,MAAM;CACtE,IAAI,CAAC,yBAAyB;EAE5B,eAAe,mBAAmB,iBAAiB,gBAAgB;EACnE,0BAA0B,MAAM,cAAc,cAAc,MAAM;EAClE,IAAI,CAAC,yBAAyB;GAC5B,OAAO,MAAM,oBAAoB;GACjC,OAAO;EACT;CACF;CACA,OAAO,MAAM,YAAY,cAAc;CACvC,IAAI;EACF,MAAM,eAAe,iBAAiB,qBAAqB;EAC3D,MAAM,MAAgB,CAAC;EACvB,IAAI,uBAAuB;GACzB,MAAM,gBAAgB,YAAY;GAClC,IAAI,KAAK,uCAAuC;EAClD,OACE,IAAI,KACF,yCAAyC,YACtC,KAAK,QAAQ,IAAI,OAAO,CAAC,CACzB,OAAO,QAAQ,CAAC,CAChB,KAAK,QAAQ,MAAM,GAAG,CAAC,CAAC,CACxB,KAAK,GAAG,GACb;EAEF,MAAM,mBACJ,QAAQ,aAAa,UACrB,oBAAoB,uBAAuB,uBAAuB;EACpE,MAAM,mBACJ,OAAO,aAAa,UACpB,qBAAqB,uBAAuB,uBAAuB;EACrE,MAAM,WAA8B;GAClC,GAAI,MAAM,wBACR,uBACA,eACF;GACA,eAAe,MAAM,eAAe,KAAK;EAC3C;EAEA,IAAI,OAAO,mBAAmB;GAC5B,MAAM,QAAQ,KAAK,OAAO,iBAAiB;GAC3C,IAAI,SAAS,KAAK,GAEhB,SAAS,gCADI,KAAK,KAAK,SAAS,WAAW,KAAK,CAAC,CAAC,GAAG,MAAM,CACf,CAAC,CAAC,SAAS;QAEvD,OAAO,MACL,EAAE,mBAAmB,OAAO,kBAAkB,GAC9C,mEACF;EAEJ;EAWA,MAAM,QAAQ,KAAK;GARjB,SAAS;GACT;GACA,QAAQ,CAAC;GACT,iBAAiB,CACf;IAAE,UAAU;IAAU,YAAY;GAAiB,GACnD;IAAE,UAAU;IAAU,YAAY;GAAiB,CACrD;EAE2B,CAAC;EAC9B,MAAM,uBAAuB,MAAM,cAAc,cAAc,MAAM;EACrE,IAAI,4BAA4B,sBAAsB;GACpD,OAAO,MAAM,GAAG,aAAa,cAAc;GAC3C,OAAO;EACT;EACA,OAAO,MAAM,qBAAqB,cAAc;EAChD,OAAO,CACL,EACE,MAAM;GACJ,MAAM;GACN,MAAM;GACN,UAAU;EACZ,EACF,CACF;CACF,SAAS,KAAK;;EAEZ,IAAI,IAAI,YAAA,mBACN,MAAM;EAER,OAAO,MAAM,EAAE,IAAI,GAAG,oBAAoB,aAAa,MAAM;EAC7D,OAAO,CACL,EACE,eAAe;GACb,UAAU;GACV,QAAQ,GAAG,OAAO,IAAI,MAAM,EAAE,IAAI,OAAO,IAAI,MAAM;EACrD,EACF,CACF;CACF;AACF"}
+{"version":3,"file":"artifacts.js","names":["massageToml","parseToml"],"sources":["../../../../lib/modules/manager/poetry/artifacts.ts"],"sourcesContent":["import {\n  isNonEmptyArray,\n  isNonEmptyObject,\n  isNumber,\n  isString,\n} from '@sindresorhus/is';\nimport { Duration } from 'luxon';\nimport { quote } from 'shlex';\nimport { TEMPORARY_ERROR } from '../../../constants/error-messages.ts';\nimport { logger } from '../../../logger/index.ts';\nimport type { HostRule } from '../../../types/index.ts';\nimport { coerceArray } from '../../../util/array.ts';\nimport type { ExecOptions } from '../../../util/exec/types.ts';\nimport {\n  deleteLocalFile,\n  ensureCacheDir,\n  getSiblingFileName,\n  readLocalFile,\n  writeLocalFile,\n} from '../../../util/fs/index.ts';\nimport { withGitEnvironment } from '../../../util/git/exec.ts';\nimport { find } from '../../../util/host-rules.ts';\nimport { toMs } from '../../../util/pretty-time.ts';\nimport { regEx } from '../../../util/regex.ts';\nimport { Result } from '../../../util/result.ts';\nimport {\n  massage as massageToml,\n  parse as parseToml,\n} from '../../../util/toml.ts';\nimport { parseUrl } from '../../../util/url.ts';\nimport { PypiDatasource } from '../../datasource/pypi/index.ts';\nimport { getGoogleAuthHostRule } from '../../datasource/util.ts';\nimport type { UpdateArtifact, UpdateArtifactsResult } from '../types.ts';\nimport { resolveToolConstraint } from '../util.ts';\nimport { Lockfile, PoetryPyProject } from './schema.ts';\nimport type { PoetryFile, PoetrySource } from './types.ts';\n\nconst gitExec = withGitEnvironment(['poetry']);\n\nexport function getPythonConstraint(\n  pyProjectContent: string,\n  existingLockFileContent: string,\n): string | null {\n  // Read Python version from `pyproject.toml` first as it could have been updated\n  const pyprojectPythonConstraint = Result.parse(\n    massageToml(pyProjectContent),\n    PoetryPyProject.transform(\n      ({ packageFileContent }) =>\n        packageFileContent.deps.find((dep) => dep.depName === 'python')\n          ?.currentValue,\n    ),\n  ).unwrapOrNull();\n  if (pyprojectPythonConstraint) {\n    logger.debug('Using python version from pyproject.toml');\n    return pyprojectPythonConstraint;\n  }\n\n  const lockfilePythonConstraint = Result.parse(\n    existingLockFileContent,\n    Lockfile.transform(({ pythonVersions }) => pythonVersions),\n  ).unwrapOrNull();\n  if (lockfilePythonConstraint) {\n    logger.debug('Using python version from poetry.lock');\n    return lockfilePythonConstraint;\n  }\n\n  return null;\n}\n\nexport function getPoetryRequirement(\n  pyProjectContent: string,\n  existingLockFileContent: string,\n): undefined | string | null {\n  // Read Poetry version from first line of poetry.lock\n  const firstLine = existingLockFileContent.split('\\n')[0];\n  const poetryVersionMatch = regEx(/by Poetry (?<version>[\\d\\\\.]+)/).exec(\n    firstLine,\n  );\n  if (poetryVersionMatch?.groups?.version) {\n    const poetryVersion = poetryVersionMatch.groups.version;\n    logger.debug(\n      `Using poetry version ${poetryVersion} from poetry.lock header`,\n    );\n    return poetryVersion;\n  }\n\n  const { val: lockfilePoetryConstraint } = Result.parse(\n    existingLockFileContent,\n    Lockfile.transform(({ poetryConstraint }) => poetryConstraint),\n  ).unwrap();\n  if (lockfilePoetryConstraint) {\n    logger.debug(\n      `Using poetry version ${lockfilePoetryConstraint} from poetry.lock metadata`,\n    );\n    return lockfilePoetryConstraint;\n  }\n\n  const { val: pyprojectPoetryConstraint } = Result.parse(\n    massageToml(pyProjectContent),\n    PoetryPyProject.transform(({ poetryRequirement }) => poetryRequirement),\n  ).unwrap();\n  if (pyprojectPoetryConstraint) {\n    logger.debug(\n      `Using poetry version ${pyprojectPoetryConstraint} from pyproject.toml`,\n    );\n    return pyprojectPoetryConstraint;\n  }\n\n  return null;\n}\n\nfunction getPoetrySources(content: string, fileName: string): PoetrySource[] {\n  let pyprojectFile: PoetryFile;\n  try {\n    pyprojectFile = parseToml(massageToml(content)) as PoetryFile;\n  } catch (err) {\n    logger.debug({ err }, 'Error parsing pyproject.toml file');\n    return [];\n  }\n  if (!pyprojectFile.tool?.poetry) {\n    logger.debug(`${fileName} contains no poetry section`);\n    return [];\n  }\n\n  const sources = coerceArray(pyprojectFile.tool?.poetry?.source);\n  const sourceArray: PoetrySource[] = [];\n  for (const source of sources) {\n    if (source.name && source.url) {\n      sourceArray.push({ name: source.name, url: source.url });\n    }\n  }\n  return sourceArray;\n}\n\nasync function getMatchingHostRule(url: string | undefined): Promise<HostRule> {\n  const scopedMatch = find({ hostType: PypiDatasource.id, url });\n  const hostRule = isNonEmptyObject(scopedMatch) ? scopedMatch : find({ url });\n  if (hostRule && Object.keys(hostRule).length !== 0) {\n    return hostRule;\n  }\n\n  const parsedUrl = parseUrl(url);\n  if (!parsedUrl) {\n    logger.once.debug(`Failed to parse URL ${url}`);\n    return {};\n  }\n\n  if (parsedUrl.hostname.endsWith('.pkg.dev')) {\n    const hostRule = await getGoogleAuthHostRule();\n    if (hostRule && Object.keys(hostRule).length !== 0) {\n      return hostRule;\n    }\n    logger.once.debug(`Could not get Google access token (url=${url})`);\n  }\n\n  return {};\n}\n\nasync function getSourceCredentialVars(\n  pyprojectContent: string,\n  packageFileName: string,\n): Promise<NodeJS.ProcessEnv> {\n  const poetrySources = getPoetrySources(pyprojectContent, packageFileName);\n  const envVars: NodeJS.ProcessEnv = {};\n\n  for (const source of poetrySources) {\n    const matchingHostRule = await getMatchingHostRule(source.url);\n    const formattedSourceName = source.name\n      .replace(regEx(/(?:\\.|-)+/g), '_')\n      .toUpperCase();\n    if (matchingHostRule.username) {\n      envVars[`POETRY_HTTP_BASIC_${formattedSourceName}_USERNAME`] =\n        matchingHostRule.username;\n    }\n    if (matchingHostRule.password) {\n      envVars[`POETRY_HTTP_BASIC_${formattedSourceName}_PASSWORD`] =\n        matchingHostRule.password;\n    }\n  }\n  return envVars;\n}\n\nexport async function updateArtifacts({\n  packageFileName,\n  updatedDeps,\n  newPackageFileContent,\n  config,\n}: UpdateArtifact): Promise<UpdateArtifactsResult[] | null> {\n  logger.debug(`poetry.updateArtifacts(${packageFileName})`);\n  const { isLockFileMaintenance } = config;\n\n  if (!isNonEmptyArray(updatedDeps) && !isLockFileMaintenance) {\n    logger.debug('No updated poetry deps - returning null');\n    return null;\n  }\n  // Try poetry.lock first\n  let lockFileName = getSiblingFileName(packageFileName, 'poetry.lock');\n  let existingLockFileContent = await readLocalFile(lockFileName, 'utf8');\n  if (!existingLockFileContent) {\n    // Try pyproject.lock next\n    lockFileName = getSiblingFileName(packageFileName, 'pyproject.lock');\n    existingLockFileContent = await readLocalFile(lockFileName, 'utf8');\n    if (!existingLockFileContent) {\n      logger.debug(`No lock file found`);\n      return null;\n    }\n  }\n  logger.debug(`Updating ${lockFileName}`);\n  try {\n    await writeLocalFile(packageFileName, newPackageFileContent);\n    const cmd: string[] = [];\n    if (isLockFileMaintenance) {\n      await deleteLocalFile(lockFileName);\n      cmd.push('poetry update --lock --no-interaction');\n    } else {\n      cmd.push(\n        `poetry update --lock --no-interaction ${updatedDeps\n          .map((dep) => dep.depName)\n          .filter(isString)\n          .map((dep) => quote(dep))\n          .join(' ')}`,\n      );\n    }\n    const pythonConstraint = await resolveToolConstraint(config, 'python', () =>\n      getPythonConstraint(newPackageFileContent, existingLockFileContent),\n    );\n    const poetryConstraint = await resolveToolConstraint(config, 'poetry', () =>\n      getPoetryRequirement(newPackageFileContent, existingLockFileContent),\n    );\n    const extraEnv: NodeJS.ProcessEnv = {\n      ...(await getSourceCredentialVars(\n        newPackageFileContent,\n        packageFileName,\n      )),\n      PIP_CACHE_DIR: await ensureCacheDir('pip'),\n    };\n\n    if (config.minimumReleaseAge) {\n      const ageMs = toMs(config.minimumReleaseAge);\n      if (isNumber(ageMs)) {\n        const days = Math.ceil(Duration.fromMillis(ageMs).as('days'));\n        extraEnv.POETRY_SOLVER_MIN_RELEASE_AGE = days.toString();\n      } else {\n        logger.debug(\n          { minimumReleaseAge: config.minimumReleaseAge },\n          'Invalid minimumReleaseAge, skipping POETRY_SOLVER_MIN_RELEASE_AGE',\n        );\n      }\n    }\n\n    const execOptions: ExecOptions = {\n      cwdFile: packageFileName,\n      extraEnv,\n      docker: {},\n      toolConstraints: [\n        { toolName: 'python', constraint: pythonConstraint },\n        { toolName: 'poetry', constraint: poetryConstraint },\n      ],\n    };\n    await gitExec(cmd, execOptions);\n    const newPoetryLockContent = await readLocalFile(lockFileName, 'utf8');\n    if (existingLockFileContent === newPoetryLockContent) {\n      logger.debug(`${lockFileName} is unchanged`);\n      return null;\n    }\n    logger.debug(`Returning updated ${lockFileName}`);\n    return [\n      {\n        file: {\n          type: 'addition',\n          path: lockFileName,\n          contents: newPoetryLockContent,\n        },\n      },\n    ];\n  } catch (err) {\n    // istanbul ignore if\n    if (err.message === TEMPORARY_ERROR) {\n      throw err;\n    }\n    logger.debug({ err }, `Failed to update ${lockFileName} file`);\n    return [\n      {\n        artifactError: {\n          fileName: lockFileName,\n          stderr: `${String(err.stdout)}\\n${String(err.stderr)}`,\n        },\n      },\n    ];\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAqCA,MAAM,UAAU,mBAAmB,CAAC,QAAQ,CAAC;AAE7C,SAAgB,oBACd,kBACA,yBACe;CAEf,MAAM,4BAA4B,OAAO,MACvCA,QAAY,gBAAgB,GAC5B,gBAAgB,WACb,EAAE,yBACD,mBAAmB,KAAK,MAAM,QAAQ,IAAI,YAAY,QAAQ,CAAC,EAC3D,YACR,CACF,CAAC,CAAC,aAAa;CACf,IAAI,2BAA2B;EAC7B,OAAO,MAAM,0CAA0C;EACvD,OAAO;CACT;CAEA,MAAM,2BAA2B,OAAO,MACtC,yBACA,SAAS,WAAW,EAAE,qBAAqB,cAAc,CAC3D,CAAC,CAAC,aAAa;CACf,IAAI,0BAA0B;EAC5B,OAAO,MAAM,uCAAuC;EACpD,OAAO;CACT;CAEA,OAAO;AACT;AAEA,SAAgB,qBACd,kBACA,yBAC2B;CAE3B,MAAM,YAAY,wBAAwB,MAAM,IAAI,CAAC,CAAC;CACtD,MAAM,qBAAqB,MAAM,gCAAgC,CAAC,CAAC,KACjE,SACF;CACA,IAAI,oBAAoB,QAAQ,SAAS;EACvC,MAAM,gBAAgB,mBAAmB,OAAO;EAChD,OAAO,MACL,wBAAwB,cAAc,yBACxC;EACA,OAAO;CACT;CAEA,MAAM,EAAE,KAAK,6BAA6B,OAAO,MAC/C,yBACA,SAAS,WAAW,EAAE,uBAAuB,gBAAgB,CAC/D,CAAC,CAAC,OAAO;CACT,IAAI,0BAA0B;EAC5B,OAAO,MACL,wBAAwB,yBAAyB,2BACnD;EACA,OAAO;CACT;CAEA,MAAM,EAAE,KAAK,8BAA8B,OAAO,MAChDA,QAAY,gBAAgB,GAC5B,gBAAgB,WAAW,EAAE,wBAAwB,iBAAiB,CACxE,CAAC,CAAC,OAAO;CACT,IAAI,2BAA2B;EAC7B,OAAO,MACL,wBAAwB,0BAA0B,qBACpD;EACA,OAAO;CACT;CAEA,OAAO;AACT;AAEA,SAAS,iBAAiB,SAAiB,UAAkC;CAC3E,IAAI;CACJ,IAAI;EACF,gBAAgBC,MAAUD,QAAY,OAAO,CAAC;CAChD,SAAS,KAAK;EACZ,OAAO,MAAM,EAAE,IAAI,GAAG,mCAAmC;EACzD,OAAO,CAAC;CACV;CACA,IAAI,CAAC,cAAc,MAAM,QAAQ;EAC/B,OAAO,MAAM,GAAG,SAAS,4BAA4B;EACrD,OAAO,CAAC;CACV;CAEA,MAAM,UAAU,YAAY,cAAc,MAAM,QAAQ,MAAM;CAC9D,MAAM,cAA8B,CAAC;CACrC,KAAK,MAAM,UAAU,SACnB,IAAI,OAAO,QAAQ,OAAO,KACxB,YAAY,KAAK;EAAE,MAAM,OAAO;EAAM,KAAK,OAAO;CAAI,CAAC;CAG3D,OAAO;AACT;AAEA,eAAe,oBAAoB,KAA4C;CAC7E,MAAM,cAAc,KAAK;EAAE,UAAU,eAAe;EAAI;CAAI,CAAC;CAC7D,MAAM,WAAW,iBAAiB,WAAW,IAAI,cAAc,KAAK,EAAE,IAAI,CAAC;CAC3E,IAAI,YAAY,OAAO,KAAK,QAAQ,CAAC,CAAC,WAAW,GAC/C,OAAO;CAGT,MAAM,YAAY,SAAS,GAAG;CAC9B,IAAI,CAAC,WAAW;EACd,OAAO,KAAK,MAAM,uBAAuB,KAAK;EAC9C,OAAO,CAAC;CACV;CAEA,IAAI,UAAU,SAAS,SAAS,UAAU,GAAG;EAC3C,MAAM,WAAW,MAAM,sBAAsB;EAC7C,IAAI,YAAY,OAAO,KAAK,QAAQ,CAAC,CAAC,WAAW,GAC/C,OAAO;EAET,OAAO,KAAK,MAAM,0CAA0C,IAAI,EAAE;CACpE;CAEA,OAAO,CAAC;AACV;AAEA,eAAe,wBACb,kBACA,iBAC4B;CAC5B,MAAM,gBAAgB,iBAAiB,kBAAkB,eAAe;CACxE,MAAM,UAA6B,CAAC;CAEpC,KAAK,MAAM,UAAU,eAAe;EAClC,MAAM,mBAAmB,MAAM,oBAAoB,OAAO,GAAG;EAC7D,MAAM,sBAAsB,OAAO,KAChC,QAAQ,MAAM,YAAY,GAAG,GAAG,CAAC,CACjC,YAAY;EACf,IAAI,iBAAiB,UACnB,QAAQ,qBAAqB,oBAAoB,cAC/C,iBAAiB;EAErB,IAAI,iBAAiB,UACnB,QAAQ,qBAAqB,oBAAoB,cAC/C,iBAAiB;CAEvB;CACA,OAAO;AACT;AAEA,eAAsB,gBAAgB,EACpC,iBACA,aACA,uBACA,UAC0D;CAC1D,OAAO,MAAM,0BAA0B,gBAAgB,EAAE;CACzD,MAAM,EAAE,0BAA0B;CAElC,IAAI,CAAC,gBAAgB,WAAW,KAAK,CAAC,uBAAuB;EAC3D,OAAO,MAAM,yCAAyC;EACtD,OAAO;CACT;CAEA,IAAI,eAAe,mBAAmB,iBAAiB,aAAa;CACpE,IAAI,0BAA0B,MAAM,cAAc,cAAc,MAAM;CACtE,IAAI,CAAC,yBAAyB;EAE5B,eAAe,mBAAmB,iBAAiB,gBAAgB;EACnE,0BAA0B,MAAM,cAAc,cAAc,MAAM;EAClE,IAAI,CAAC,yBAAyB;GAC5B,OAAO,MAAM,oBAAoB;GACjC,OAAO;EACT;CACF;CACA,OAAO,MAAM,YAAY,cAAc;CACvC,IAAI;EACF,MAAM,eAAe,iBAAiB,qBAAqB;EAC3D,MAAM,MAAgB,CAAC;EACvB,IAAI,uBAAuB;GACzB,MAAM,gBAAgB,YAAY;GAClC,IAAI,KAAK,uCAAuC;EAClD,OACE,IAAI,KACF,yCAAyC,YACtC,KAAK,QAAQ,IAAI,OAAO,CAAC,CACzB,OAAO,QAAQ,CAAC,CAChB,KAAK,QAAQ,MAAM,GAAG,CAAC,CAAC,CACxB,KAAK,GAAG,GACb;EAEF,MAAM,mBAAmB,MAAM,sBAAsB,QAAQ,gBAC3D,oBAAoB,uBAAuB,uBAAuB,CACpE;EACA,MAAM,mBAAmB,MAAM,sBAAsB,QAAQ,gBAC3D,qBAAqB,uBAAuB,uBAAuB,CACrE;EACA,MAAM,WAA8B;GAClC,GAAI,MAAM,wBACR,uBACA,eACF;GACA,eAAe,MAAM,eAAe,KAAK;EAC3C;EAEA,IAAI,OAAO,mBAAmB;GAC5B,MAAM,QAAQ,KAAK,OAAO,iBAAiB;GAC3C,IAAI,SAAS,KAAK,GAEhB,SAAS,gCADI,KAAK,KAAK,SAAS,WAAW,KAAK,CAAC,CAAC,GAAG,MAAM,CACf,CAAC,CAAC,SAAS;QAEvD,OAAO,MACL,EAAE,mBAAmB,OAAO,kBAAkB,GAC9C,mEACF;EAEJ;EAWA,MAAM,QAAQ,KAAK;GARjB,SAAS;GACT;GACA,QAAQ,CAAC;GACT,iBAAiB,CACf;IAAE,UAAU;IAAU,YAAY;GAAiB,GACnD;IAAE,UAAU;IAAU,YAAY;GAAiB,CACrD;EAE2B,CAAC;EAC9B,MAAM,uBAAuB,MAAM,cAAc,cAAc,MAAM;EACrE,IAAI,4BAA4B,sBAAsB;GACpD,OAAO,MAAM,GAAG,aAAa,cAAc;GAC3C,OAAO;EACT;EACA,OAAO,MAAM,qBAAqB,cAAc;EAChD,OAAO,CACL,EACE,MAAM;GACJ,MAAM;GACN,MAAM;GACN,UAAU;EACZ,EACF,CACF;CACF,SAAS,KAAK;;EAEZ,IAAI,IAAI,YAAA,mBACN,MAAM;EAER,OAAO,MAAM,EAAE,IAAI,GAAG,oBAAoB,aAAa,MAAM;EAC7D,OAAO,CACL,EACE,eAAe;GACb,UAAU;GACV,QAAQ,GAAG,OAAO,IAAI,MAAM,EAAE,IAAI,OAAO,IAAI,MAAM;EACrD,EACF,CACF;CACF;AACF"}

package/dist/modules/manager/pub/artifacts.js

@@ -2,6 +2,7 @@ import "../../../constants/error-messages.js";
 import { logger } from "../../../logger/index.js";
 import { getSiblingFileName, readLocalFile, writeLocalFile } from "../../../util/fs/index.js";
 import { exec } from "../../../util/exec/index.js";
+import { resolveToolConstraint } from "../util.js";
 import { parsePubspec, parsePubspecLock } from "./utils.js";
 import { isEmptyArray, isString } from "@sindresorhus/is";
 import { quote } from "shlex";
@@ -26,21 +27,21 @@ async function updateArtifacts({ packageFileName, updatedDeps, newPackageFileCon
 		const isFlutter = newPackageFileContent.includes("sdk: flutter");
 		const toolName = isFlutter ? "flutter" : "dart";
 		const cmd = getExecCommand(toolName, updatedDeps, isLockFileMaintenance);
-		let constraint = config.constraints?.[toolName];
-		if (!constraint) {
-			const pubspec = parsePubspec(packageFileName, newPackageFileContent);
-			const pubspecToolName = isFlutter ? "flutter" : "sdk";
-			constraint = pubspec?.environment[pubspecToolName];
-			if (!constraint) constraint = parsePubspecLock(lockFileName, oldLockFileContent)?.sdks[toolName];
-		}
-		await exec(cmd, {
+		const execOptions = {
 			cwdFile: packageFileName,
 			docker: {},
 			toolConstraints: [{
 				toolName,
-				constraint
+				constraint: await resolveToolConstraint(config, toolName, () => {
+					const pubspec = parsePubspec(packageFileName, newPackageFileContent);
+					const pubspecToolName = isFlutter ? "flutter" : "sdk";
+					const pubspecConstraint = pubspec?.environment[pubspecToolName];
+					if (pubspecConstraint) return pubspecConstraint;
+					return parsePubspecLock(lockFileName, oldLockFileContent)?.sdks[toolName];
+				})
 			}]
-		});
+		};
+		await exec(cmd, execOptions);
 		const newLockFileContent = await readLocalFile(lockFileName, "utf8");
 		if (oldLockFileContent === newLockFileContent) return null;
 		return [{ file: {

package/dist/modules/manager/pub/artifacts.js.map

@@ -1 +1 @@
-{"version":3,"file":"artifacts.js","names":[],"sources":["../../../../lib/modules/manager/pub/artifacts.ts"],"sourcesContent":["import { isEmptyArray, isString } from '@sindresorhus/is';\nimport { quote } from 'shlex';\nimport { TEMPORARY_ERROR } from '../../../constants/error-messages.ts';\nimport { logger } from '../../../logger/index.ts';\nimport { exec } from '../../../util/exec/index.ts';\nimport type { ExecOptions } from '../../../util/exec/types.ts';\nimport {\n  getSiblingFileName,\n  readLocalFile,\n  writeLocalFile,\n} from '../../../util/fs/index.ts';\nimport type {\n  UpdateArtifact,\n  UpdateArtifactsResult,\n  Upgrade,\n} from '../types.ts';\nimport { parsePubspec, parsePubspecLock } from './utils.ts';\n\nconst SDK_NAMES = ['dart', 'flutter'];\nconst PUB_GET_COMMAND = 'pub get --no-precompile';\n\nexport async function updateArtifacts({\n  packageFileName,\n  updatedDeps,\n  newPackageFileContent,\n  config,\n}: UpdateArtifact): Promise<UpdateArtifactsResult[] | null> {\n  logger.debug(`pub.updateArtifacts(${packageFileName})`);\n  const { isLockFileMaintenance } = config;\n\n  if (isEmptyArray(updatedDeps) && !isLockFileMaintenance) {\n    logger.debug('No updated pub deps - returning null');\n    return null;\n  }\n\n  const lockFileName = getSiblingFileName(packageFileName, 'pubspec.lock');\n  const oldLockFileContent = await readLocalFile(lockFileName, 'utf8');\n  if (!oldLockFileContent) {\n    logger.debug('No pubspec.lock found');\n    return null;\n  }\n\n  try {\n    await writeLocalFile(packageFileName, newPackageFileContent);\n\n    const isFlutter = newPackageFileContent.includes('sdk: flutter');\n    const toolName = isFlutter ? 'flutter' : 'dart';\n    const cmd = getExecCommand(toolName, updatedDeps, isLockFileMaintenance);\n\n    let constraint = config.constraints?.[toolName];\n    if (!constraint) {\n      const pubspec = parsePubspec(packageFileName, newPackageFileContent);\n      const pubspecToolName = isFlutter ? 'flutter' : 'sdk';\n      constraint = pubspec?.environment[pubspecToolName];\n\n      if (!constraint) {\n        const pubspecLock = parsePubspecLock(lockFileName, oldLockFileContent);\n        constraint = pubspecLock?.sdks[toolName];\n      }\n    }\n\n    const execOptions: ExecOptions = {\n      cwdFile: packageFileName,\n      docker: {},\n      toolConstraints: [\n        {\n          toolName,\n          constraint,\n        },\n      ],\n    };\n\n    await exec(cmd, execOptions);\n    const newLockFileContent = await readLocalFile(lockFileName, 'utf8');\n    if (oldLockFileContent === newLockFileContent) {\n      return null;\n    }\n    return [\n      {\n        file: {\n          type: 'addition',\n          path: lockFileName,\n          contents: newLockFileContent,\n        },\n      },\n    ];\n  } catch (err) {\n    // istanbul ignore if\n    if (err.message === TEMPORARY_ERROR) {\n      throw err;\n    }\n    logger.warn({ lockfile: lockFileName, err }, `Failed to update lock file`);\n    return [\n      {\n        artifactError: {\n          fileName: lockFileName,\n          stderr: err.message,\n        },\n      },\n    ];\n  }\n}\n\nfunction getExecCommand(\n  toolName: string,\n  updatedDeps: Upgrade<Record<string, unknown>>[],\n  isLockFileMaintenance: boolean | undefined,\n): string {\n  if (isLockFileMaintenance) {\n    return `${toolName} pub upgrade`;\n  }\n  const depNames = updatedDeps.map((dep) => dep.depName).filter(isString);\n  if (depNames.length === 1 && SDK_NAMES.includes(depNames[0])) {\n    return `${toolName} ${PUB_GET_COMMAND}`;\n  }\n  // If there are two updated dependencies and both of them are SDK updates (Dart and Flutter),\n  // we use Flutter over Dart to run `pub get` as it is a Flutter project.\n  if (\n    depNames.length === 2 &&\n    depNames.filter((depName) => SDK_NAMES.includes(depName)).length === 2\n  ) {\n    return `flutter ${PUB_GET_COMMAND}`;\n  }\n  const depNamesCmd = depNames\n    .filter((depName) => !SDK_NAMES.includes(depName))\n    .map(quote)\n    .join(' ');\n  return `${toolName} pub upgrade ${depNamesCmd}`;\n}\n"],"mappings":";;;;;;;;AAkBA,MAAM,YAAY,CAAC,QAAQ,SAAS;AACpC,MAAM,kBAAkB;AAExB,eAAsB,gBAAgB,EACpC,iBACA,aACA,uBACA,UAC0D;CAC1D,OAAO,MAAM,uBAAuB,gBAAgB,EAAE;CACtD,MAAM,EAAE,0BAA0B;CAElC,IAAI,aAAa,WAAW,KAAK,CAAC,uBAAuB;EACvD,OAAO,MAAM,sCAAsC;EACnD,OAAO;CACT;CAEA,MAAM,eAAe,mBAAmB,iBAAiB,cAAc;CACvE,MAAM,qBAAqB,MAAM,cAAc,cAAc,MAAM;CACnE,IAAI,CAAC,oBAAoB;EACvB,OAAO,MAAM,uBAAuB;EACpC,OAAO;CACT;CAEA,IAAI;EACF,MAAM,eAAe,iBAAiB,qBAAqB;EAE3D,MAAM,YAAY,sBAAsB,SAAS,cAAc;EAC/D,MAAM,WAAW,YAAY,YAAY;EACzC,MAAM,MAAM,eAAe,UAAU,aAAa,qBAAqB;EAEvE,IAAI,aAAa,OAAO,cAAc;EACtC,IAAI,CAAC,YAAY;GACf,MAAM,UAAU,aAAa,iBAAiB,qBAAqB;GACnE,MAAM,kBAAkB,YAAY,YAAY;GAChD,aAAa,SAAS,YAAY;GAElC,IAAI,CAAC,YAEH,aADoB,iBAAiB,cAAc,kBAC5B,CAAC,EAAE,KAAK;EAEnC;EAaA,MAAM,KAAK,KAAK;GAVd,SAAS;GACT,QAAQ,CAAC;GACT,iBAAiB,CACf;IACE;IACA;GACF,CACF;EAGwB,CAAC;EAC3B,MAAM,qBAAqB,MAAM,cAAc,cAAc,MAAM;EACnE,IAAI,uBAAuB,oBACzB,OAAO;EAET,OAAO,CACL,EACE,MAAM;GACJ,MAAM;GACN,MAAM;GACN,UAAU;EACZ,EACF,CACF;CACF,SAAS,KAAK;;EAEZ,IAAI,IAAI,YAAA,mBACN,MAAM;EAER,OAAO,KAAK;GAAE,UAAU;GAAc;EAAI,GAAG,4BAA4B;EACzE,OAAO,CACL,EACE,eAAe;GACb,UAAU;GACV,QAAQ,IAAI;EACd,EACF,CACF;CACF;AACF;AAEA,SAAS,eACP,UACA,aACA,uBACQ;CACR,IAAI,uBACF,OAAO,GAAG,SAAS;CAErB,MAAM,WAAW,YAAY,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,OAAO,QAAQ;CACtE,IAAI,SAAS,WAAW,KAAK,UAAU,SAAS,SAAS,EAAE,GACzD,OAAO,GAAG,SAAS,GAAG;CAIxB,IACE,SAAS,WAAW,KACpB,SAAS,QAAQ,YAAY,UAAU,SAAS,OAAO,CAAC,CAAC,CAAC,WAAW,GAErE,OAAO,WAAW;CAMpB,OAAO,GAAG,SAAS,eAJC,SACjB,QAAQ,YAAY,CAAC,UAAU,SAAS,OAAO,CAAC,CAAC,CACjD,IAAI,KAAK,CAAC,CACV,KAAK,GACoC;AAC9C"}
+{"version":3,"file":"artifacts.js","names":[],"sources":["../../../../lib/modules/manager/pub/artifacts.ts"],"sourcesContent":["import { isEmptyArray, isString } from '@sindresorhus/is';\nimport { quote } from 'shlex';\nimport { TEMPORARY_ERROR } from '../../../constants/error-messages.ts';\nimport { logger } from '../../../logger/index.ts';\nimport { exec } from '../../../util/exec/index.ts';\nimport type { ExecOptions } from '../../../util/exec/types.ts';\nimport {\n  getSiblingFileName,\n  readLocalFile,\n  writeLocalFile,\n} from '../../../util/fs/index.ts';\nimport type {\n  UpdateArtifact,\n  UpdateArtifactsResult,\n  Upgrade,\n} from '../types.ts';\nimport { resolveToolConstraint } from '../util.ts';\nimport { parsePubspec, parsePubspecLock } from './utils.ts';\n\nconst SDK_NAMES = ['dart', 'flutter'];\nconst PUB_GET_COMMAND = 'pub get --no-precompile';\n\nexport async function updateArtifacts({\n  packageFileName,\n  updatedDeps,\n  newPackageFileContent,\n  config,\n}: UpdateArtifact): Promise<UpdateArtifactsResult[] | null> {\n  logger.debug(`pub.updateArtifacts(${packageFileName})`);\n  const { isLockFileMaintenance } = config;\n\n  if (isEmptyArray(updatedDeps) && !isLockFileMaintenance) {\n    logger.debug('No updated pub deps - returning null');\n    return null;\n  }\n\n  const lockFileName = getSiblingFileName(packageFileName, 'pubspec.lock');\n  const oldLockFileContent = await readLocalFile(lockFileName, 'utf8');\n  if (!oldLockFileContent) {\n    logger.debug('No pubspec.lock found');\n    return null;\n  }\n\n  try {\n    await writeLocalFile(packageFileName, newPackageFileContent);\n\n    const isFlutter = newPackageFileContent.includes('sdk: flutter');\n    const toolName = isFlutter ? 'flutter' : 'dart';\n    const cmd = getExecCommand(toolName, updatedDeps, isLockFileMaintenance);\n\n    const constraint = await resolveToolConstraint(config, toolName, () => {\n      const pubspec = parsePubspec(packageFileName, newPackageFileContent);\n      const pubspecToolName = isFlutter ? 'flutter' : 'sdk';\n      const pubspecConstraint = pubspec?.environment[pubspecToolName];\n      if (pubspecConstraint) {\n        return pubspecConstraint;\n      }\n\n      const pubspecLock = parsePubspecLock(lockFileName, oldLockFileContent);\n      return pubspecLock?.sdks[toolName];\n    });\n\n    const execOptions: ExecOptions = {\n      cwdFile: packageFileName,\n      docker: {},\n      toolConstraints: [\n        {\n          toolName,\n          constraint,\n        },\n      ],\n    };\n\n    await exec(cmd, execOptions);\n    const newLockFileContent = await readLocalFile(lockFileName, 'utf8');\n    if (oldLockFileContent === newLockFileContent) {\n      return null;\n    }\n    return [\n      {\n        file: {\n          type: 'addition',\n          path: lockFileName,\n          contents: newLockFileContent,\n        },\n      },\n    ];\n  } catch (err) {\n    // istanbul ignore if\n    if (err.message === TEMPORARY_ERROR) {\n      throw err;\n    }\n    logger.warn({ lockfile: lockFileName, err }, `Failed to update lock file`);\n    return [\n      {\n        artifactError: {\n          fileName: lockFileName,\n          stderr: err.message,\n        },\n      },\n    ];\n  }\n}\n\nfunction getExecCommand(\n  toolName: string,\n  updatedDeps: Upgrade<Record<string, unknown>>[],\n  isLockFileMaintenance: boolean | undefined,\n): string {\n  if (isLockFileMaintenance) {\n    return `${toolName} pub upgrade`;\n  }\n  const depNames = updatedDeps.map((dep) => dep.depName).filter(isString);\n  if (depNames.length === 1 && SDK_NAMES.includes(depNames[0])) {\n    return `${toolName} ${PUB_GET_COMMAND}`;\n  }\n  // If there are two updated dependencies and both of them are SDK updates (Dart and Flutter),\n  // we use Flutter over Dart to run `pub get` as it is a Flutter project.\n  if (\n    depNames.length === 2 &&\n    depNames.filter((depName) => SDK_NAMES.includes(depName)).length === 2\n  ) {\n    return `flutter ${PUB_GET_COMMAND}`;\n  }\n  const depNamesCmd = depNames\n    .filter((depName) => !SDK_NAMES.includes(depName))\n    .map(quote)\n    .join(' ');\n  return `${toolName} pub upgrade ${depNamesCmd}`;\n}\n"],"mappings":";;;;;;;;;AAmBA,MAAM,YAAY,CAAC,QAAQ,SAAS;AACpC,MAAM,kBAAkB;AAExB,eAAsB,gBAAgB,EACpC,iBACA,aACA,uBACA,UAC0D;CAC1D,OAAO,MAAM,uBAAuB,gBAAgB,EAAE;CACtD,MAAM,EAAE,0BAA0B;CAElC,IAAI,aAAa,WAAW,KAAK,CAAC,uBAAuB;EACvD,OAAO,MAAM,sCAAsC;EACnD,OAAO;CACT;CAEA,MAAM,eAAe,mBAAmB,iBAAiB,cAAc;CACvE,MAAM,qBAAqB,MAAM,cAAc,cAAc,MAAM;CACnE,IAAI,CAAC,oBAAoB;EACvB,OAAO,MAAM,uBAAuB;EACpC,OAAO;CACT;CAEA,IAAI;EACF,MAAM,eAAe,iBAAiB,qBAAqB;EAE3D,MAAM,YAAY,sBAAsB,SAAS,cAAc;EAC/D,MAAM,WAAW,YAAY,YAAY;EACzC,MAAM,MAAM,eAAe,UAAU,aAAa,qBAAqB;EAcvE,MAAM,cAA2B;GAC/B,SAAS;GACT,QAAQ,CAAC;GACT,iBAAiB,CACf;IACE;IACA,YAAA,MAlBmB,sBAAsB,QAAQ,gBAAgB;KACrE,MAAM,UAAU,aAAa,iBAAiB,qBAAqB;KACnE,MAAM,kBAAkB,YAAY,YAAY;KAChD,MAAM,oBAAoB,SAAS,YAAY;KAC/C,IAAI,mBACF,OAAO;KAIT,OADoB,iBAAiB,cAAc,kBAClC,CAAC,EAAE,KAAK;IAC3B,CAAC;GASG,CACF;EACF;EAEA,MAAM,KAAK,KAAK,WAAW;EAC3B,MAAM,qBAAqB,MAAM,cAAc,cAAc,MAAM;EACnE,IAAI,uBAAuB,oBACzB,OAAO;EAET,OAAO,CACL,EACE,MAAM;GACJ,MAAM;GACN,MAAM;GACN,UAAU;EACZ,EACF,CACF;CACF,SAAS,KAAK;;EAEZ,IAAI,IAAI,YAAA,mBACN,MAAM;EAER,OAAO,KAAK;GAAE,UAAU;GAAc;EAAI,GAAG,4BAA4B;EACzE,OAAO,CACL,EACE,eAAe;GACb,UAAU;GACV,QAAQ,IAAI;EACd,EACF,CACF;CACF;AACF;AAEA,SAAS,eACP,UACA,aACA,uBACQ;CACR,IAAI,uBACF,OAAO,GAAG,SAAS;CAErB,MAAM,WAAW,YAAY,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,OAAO,QAAQ;CACtE,IAAI,SAAS,WAAW,KAAK,UAAU,SAAS,SAAS,EAAE,GACzD,OAAO,GAAG,SAAS,GAAG;CAIxB,IACE,SAAS,WAAW,KACpB,SAAS,QAAQ,YAAY,UAAU,SAAS,OAAO,CAAC,CAAC,CAAC,WAAW,GAErE,OAAO,WAAW;CAMpB,OAAO,GAAG,SAAS,eAJC,SACjB,QAAQ,YAAY,CAAC,UAAU,SAAS,OAAO,CAAC,CAAC,CACjD,IAAI,KAAK,CAAC,CACV,KAAK,GACoC;AAC9C"}

package/dist/modules/manager/types.d.ts

@@ -25,9 +25,29 @@ interface ExtractConfig extends CustomExtractConfig {
   currentDigest?: string;
   newDigest?: string | null;
 }
-interface UpdateArtifactsConfig {
+/**
+ * The part of a manager config that `resolveToolConstraint()` reads. Managers
+ * must not read these properties directly (enforced by the
+ * `renovate/prefer-resolve-tool-constraint` lint rule), so that user config, a
+ * value derived from the updated files and the extracted constraints are always
+ * applied in the same order.
+ */
+interface ToolConstraintsConfig {
+  /**
+   * Constraints as configured by the user, so they always win over anything a
+   * manager derives itself.
+   */
+  constraints?: Partial<Record<ConstraintName, string>> | null;
+  /**
+   * Constraints collected during extraction, merged over all upgrades of the
+   * branch. They describe the package files as they were on the base branch, so
+   * they are a fallback for a manager that cannot derive the constraint from
+   * the files it is called with.
+   */
+  extractedConstraints?: Partial<Record<ConstraintName, string>> | null;
+}
+interface UpdateArtifactsConfig extends ToolConstraintsConfig {
   isLockFileMaintenance?: boolean;
-  constraints?: Partial<Record<ConstraintName, string>>;
   composerIgnorePlatformReqs?: string[];
   goGetDirs?: string[];
   currentValue?: string;
@@ -348,5 +368,5 @@ interface PostUpdateConfig<T = Record<string, any>> extends Record<string, any>,
   isLockFileMaintenance?: boolean;
 }
 //#endregion
-export { ArtifactError, ArtifactNotice, BumpPackageVersionResult, DepTypeMetadata, ExtractConfig, GlobalManagerConfig, LookupUpdate, ManagerApi, ManagerData, PackageDependency, PackageFile, PackageFileContent, PostUpdateConfig, RangeConfig, UpdateArtifact, UpdateArtifactsConfig, UpdateArtifactsResult, UpdateDependencyConfig, UpdateLockedConfig, UpdateLockedResult, Upgrade };
+export { ArtifactError, ArtifactNotice, BumpPackageVersionResult, DepTypeMetadata, ExtractConfig, GlobalManagerConfig, LookupUpdate, ManagerApi, ManagerData, PackageDependency, PackageFile, PackageFileContent, PostUpdateConfig, RangeConfig, ToolConstraintsConfig, UpdateArtifact, UpdateArtifactsConfig, UpdateArtifactsResult, UpdateDependencyConfig, UpdateLockedConfig, UpdateLockedResult, Upgrade };
 //# sourceMappingURL=types.d.ts.map

package/dist/modules/manager/util.js

@@ -4,6 +4,7 @@ import { GitRefsDatasource } from "../datasource/git-refs/index.js";
 import { GitTagsDatasource } from "../datasource/git-tags/index.js";
 import { GithubTagsDatasource } from "../datasource/github-tags/index.js";
 import { GitlabTagsDatasource } from "../datasource/gitlab-tags/index.js";
+import { isNonEmptyString } from "@sindresorhus/is";
 //#region lib/modules/manager/util.ts
 function applyGitSource(dep, git, rev, tag, branch) {
 	if (tag) {
@@ -43,7 +44,33 @@ function artifactErrorMessageFromExecError(err, message) {
 	if (err.stdout?.trim()) return err.stdout;
 	return message;
 }
+/**
+* Resolve the constraint for a tool that `updateArtifacts()` has to run.
+*
+* The precedence is:
+*
+* 1. `constraints`, because the user asked for it explicitly
+* 2. `derive`, because it reads the package files as the branch changed them,
+*    so it can be newer than what extraction saw
+* 3. `extractedConstraints`, as collected while extracting the base branch
+*
+* Managers that have no way to derive the constraint at artifact time can omit
+* `derive`. An empty string counts as "not set" at every step, so it never
+* shadows a value further down the list.
+*
+* This is the only place that reads `constraints` and `extractedConstraints`
+* from the config; the `renovate/prefer-resolve-tool-constraint` lint rule
+* keeps managers from reading them directly.
+*/
+async function resolveToolConstraint(config, toolName, derive) {
+	const configured = config.constraints?.[toolName];
+	if (isNonEmptyString(configured)) return configured;
+	const derived = await derive?.();
+	if (isNonEmptyString(derived)) return derived;
+	const extracted = config.extractedConstraints?.[toolName];
+	return isNonEmptyString(extracted) ? extracted : void 0;
+}
 //#endregion
-export { applyGitSource, artifactErrorMessageFromExecError };
+export { applyGitSource, artifactErrorMessageFromExecError, resolveToolConstraint };
 
 //# sourceMappingURL=util.js.map

package/dist/modules/manager/util.js.map

@@ -1 +1 @@
-{"version":3,"file":"util.js","names":[],"sources":["../../../lib/modules/manager/util.ts"],"sourcesContent":["import { detectPlatform } from '../../util/common.ts';\nimport type { ExecError } from '../../util/exec/exec-error.ts';\nimport { parseGitUrl } from '../../util/git/url.ts';\nimport { GitRefsDatasource } from '../datasource/git-refs/index.ts';\nimport { GitTagsDatasource } from '../datasource/git-tags/index.ts';\nimport { GithubTagsDatasource } from '../datasource/github-tags/index.ts';\nimport { GitlabTagsDatasource } from '../datasource/gitlab-tags/index.ts';\nimport type { PackageDependency } from './types.ts';\n\nexport function applyGitSource(\n  dep: PackageDependency,\n  git: string,\n  rev: string | undefined,\n  tag: string | undefined,\n  branch: string | undefined,\n): void {\n  if (tag) {\n    const platform = detectPlatform(git);\n    if (platform === 'github' || platform === 'gitlab') {\n      dep.datasource =\n        platform === 'github'\n          ? GithubTagsDatasource.id\n          : GitlabTagsDatasource.id;\n      const { host, full_name } = parseGitUrl(git);\n\n      // Always use HTTPS for GitHub/GitLab API endpoints, even if the git URL protocol is SSH.\n      dep.registryUrls = [`https://${host}`];\n      dep.packageName = full_name;\n    } else {\n      dep.datasource = GitTagsDatasource.id;\n      dep.packageName = git;\n    }\n    dep.currentValue = tag;\n    dep.skipReason = undefined;\n  } else if (rev) {\n    dep.datasource = GitRefsDatasource.id;\n    dep.packageName = git;\n    dep.currentDigest = rev;\n    dep.replaceString = rev;\n    dep.skipReason = undefined;\n  } else {\n    dep.datasource = GitRefsDatasource.id;\n    dep.packageName = git;\n    dep.currentValue = branch;\n    dep.skipReason = branch ? 'git-dependency' : 'unspecified-version';\n  }\n}\n\n/**\n * Given an {@link ExecError}, retrieve the message which will be used for an {@link ArtifactError}.\n *\n * An `ExecError` always carries a `stderr` property, so nullish coalescing would keep an empty string and render an artifact error with no message at all.\n *\n */\nexport function artifactErrorMessageFromExecError(\n  err: Partial<ExecError>,\n  message: string,\n): string {\n  if (err.stderr?.trim()) {\n    return err.stderr;\n  }\n\n  if (err.stdout?.trim()) {\n    return err.stdout;\n  }\n\n  return message;\n}\n"],"mappings":";;;;;;;AASA,SAAgB,eACd,KACA,KACA,KACA,KACA,QACM;CACN,IAAI,KAAK;EACP,MAAM,WAAW,eAAe,GAAG;EACnC,IAAI,aAAa,YAAY,aAAa,UAAU;GAClD,IAAI,aACF,aAAa,WACT,qBAAqB,KACrB,qBAAqB;GAC3B,MAAM,EAAE,MAAM,cAAc,YAAY,GAAG;GAG3C,IAAI,eAAe,CAAC,WAAW,MAAM;GACrC,IAAI,cAAc;EACpB,OAAO;GACL,IAAI,aAAa,kBAAkB;GACnC,IAAI,cAAc;EACpB;EACA,IAAI,eAAe;EACnB,IAAI,aAAa,KAAA;CACnB,OAAO,IAAI,KAAK;EACd,IAAI,aAAa,kBAAkB;EACnC,IAAI,cAAc;EAClB,IAAI,gBAAgB;EACpB,IAAI,gBAAgB;EACpB,IAAI,aAAa,KAAA;CACnB,OAAO;EACL,IAAI,aAAa,kBAAkB;EACnC,IAAI,cAAc;EAClB,IAAI,eAAe;EACnB,IAAI,aAAa,SAAS,mBAAmB;CAC/C;AACF;;;;;;;AAQA,SAAgB,kCACd,KACA,SACQ;CACR,IAAI,IAAI,QAAQ,KAAK,GACnB,OAAO,IAAI;CAGb,IAAI,IAAI,QAAQ,KAAK,GACnB,OAAO,IAAI;CAGb,OAAO;AACT"}
+{"version":3,"file":"util.js","names":[],"sources":["../../../lib/modules/manager/util.ts"],"sourcesContent":["import { isNonEmptyString } from '@sindresorhus/is';\nimport type { MaybePromise } from '../../types/index.ts';\nimport { detectPlatform } from '../../util/common.ts';\nimport type { ExecError } from '../../util/exec/exec-error.ts';\nimport type { ConstraintName } from '../../util/exec/types.ts';\nimport { parseGitUrl } from '../../util/git/url.ts';\nimport { GitRefsDatasource } from '../datasource/git-refs/index.ts';\nimport { GitTagsDatasource } from '../datasource/git-tags/index.ts';\nimport { GithubTagsDatasource } from '../datasource/github-tags/index.ts';\nimport { GitlabTagsDatasource } from '../datasource/gitlab-tags/index.ts';\nimport type { PackageDependency, ToolConstraintsConfig } from './types.ts';\n\nexport function applyGitSource(\n  dep: PackageDependency,\n  git: string,\n  rev: string | undefined,\n  tag: string | undefined,\n  branch: string | undefined,\n): void {\n  if (tag) {\n    const platform = detectPlatform(git);\n    if (platform === 'github' || platform === 'gitlab') {\n      dep.datasource =\n        platform === 'github'\n          ? GithubTagsDatasource.id\n          : GitlabTagsDatasource.id;\n      const { host, full_name } = parseGitUrl(git);\n\n      // Always use HTTPS for GitHub/GitLab API endpoints, even if the git URL protocol is SSH.\n      dep.registryUrls = [`https://${host}`];\n      dep.packageName = full_name;\n    } else {\n      dep.datasource = GitTagsDatasource.id;\n      dep.packageName = git;\n    }\n    dep.currentValue = tag;\n    dep.skipReason = undefined;\n  } else if (rev) {\n    dep.datasource = GitRefsDatasource.id;\n    dep.packageName = git;\n    dep.currentDigest = rev;\n    dep.replaceString = rev;\n    dep.skipReason = undefined;\n  } else {\n    dep.datasource = GitRefsDatasource.id;\n    dep.packageName = git;\n    dep.currentValue = branch;\n    dep.skipReason = branch ? 'git-dependency' : 'unspecified-version';\n  }\n}\n\n/**\n * Given an {@link ExecError}, retrieve the message which will be used for an {@link ArtifactError}.\n *\n * An `ExecError` always carries a `stderr` property, so nullish coalescing would keep an empty string and render an artifact error with no message at all.\n *\n */\nexport function artifactErrorMessageFromExecError(\n  err: Partial<ExecError>,\n  message: string,\n): string {\n  if (err.stderr?.trim()) {\n    return err.stderr;\n  }\n\n  if (err.stdout?.trim()) {\n    return err.stdout;\n  }\n\n  return message;\n}\n\n/**\n * Resolve the constraint for a tool that `updateArtifacts()` has to run.\n *\n * The precedence is:\n *\n * 1. `constraints`, because the user asked for it explicitly\n * 2. `derive`, because it reads the package files as the branch changed them,\n *    so it can be newer than what extraction saw\n * 3. `extractedConstraints`, as collected while extracting the base branch\n *\n * Managers that have no way to derive the constraint at artifact time can omit\n * `derive`. An empty string counts as \"not set\" at every step, so it never\n * shadows a value further down the list.\n *\n * This is the only place that reads `constraints` and `extractedConstraints`\n * from the config; the `renovate/prefer-resolve-tool-constraint` lint rule\n * keeps managers from reading them directly.\n */\nexport async function resolveToolConstraint(\n  config: ToolConstraintsConfig,\n  toolName: ConstraintName,\n  derive?: () => MaybePromise<string | null | undefined>,\n): Promise<string | undefined> {\n  const configured = config.constraints?.[toolName];\n  if (isNonEmptyString(configured)) {\n    return configured;\n  }\n  const derived = await derive?.();\n  if (isNonEmptyString(derived)) {\n    return derived;\n  }\n  const extracted = config.extractedConstraints?.[toolName];\n  return isNonEmptyString(extracted) ? extracted : undefined;\n}\n"],"mappings":";;;;;;;;AAYA,SAAgB,eACd,KACA,KACA,KACA,KACA,QACM;CACN,IAAI,KAAK;EACP,MAAM,WAAW,eAAe,GAAG;EACnC,IAAI,aAAa,YAAY,aAAa,UAAU;GAClD,IAAI,aACF,aAAa,WACT,qBAAqB,KACrB,qBAAqB;GAC3B,MAAM,EAAE,MAAM,cAAc,YAAY,GAAG;GAG3C,IAAI,eAAe,CAAC,WAAW,MAAM;GACrC,IAAI,cAAc;EACpB,OAAO;GACL,IAAI,aAAa,kBAAkB;GACnC,IAAI,cAAc;EACpB;EACA,IAAI,eAAe;EACnB,IAAI,aAAa,KAAA;CACnB,OAAO,IAAI,KAAK;EACd,IAAI,aAAa,kBAAkB;EACnC,IAAI,cAAc;EAClB,IAAI,gBAAgB;EACpB,IAAI,gBAAgB;EACpB,IAAI,aAAa,KAAA;CACnB,OAAO;EACL,IAAI,aAAa,kBAAkB;EACnC,IAAI,cAAc;EAClB,IAAI,eAAe;EACnB,IAAI,aAAa,SAAS,mBAAmB;CAC/C;AACF;;;;;;;AAQA,SAAgB,kCACd,KACA,SACQ;CACR,IAAI,IAAI,QAAQ,KAAK,GACnB,OAAO,IAAI;CAGb,IAAI,IAAI,QAAQ,KAAK,GACnB,OAAO,IAAI;CAGb,OAAO;AACT;;;;;;;;;;;;;;;;;;;AAoBA,eAAsB,sBACpB,QACA,UACA,QAC6B;CAC7B,MAAM,aAAa,OAAO,cAAc;CACxC,IAAI,iBAAiB,UAAU,GAC7B,OAAO;CAET,MAAM,UAAU,MAAM,SAAS;CAC/B,IAAI,iBAAiB,OAAO,GAC1B,OAAO;CAET,MAAM,YAAY,OAAO,uBAAuB;CAChD,OAAO,iBAAiB,SAAS,IAAI,YAAY,KAAA;AACnD"}

package/dist/modules/manager/vendir/artifacts.js

@@ -3,6 +3,7 @@ import { coerceArray } from "../../../util/array.js";
 import { logger } from "../../../logger/index.js";
 import { getParentDir, getSiblingFileName, readLocalFile, writeLocalFile } from "../../../util/fs/index.js";
 import { getRepoStatus } from "../../../util/git/index.js";
+import { resolveToolConstraint } from "../util.js";
 import { withGitEnvironment } from "../../../util/git/exec.js";
 //#region lib/modules/manager/vendir/artifacts.ts
 const gitExec = withGitEnvironment();
@@ -26,10 +27,10 @@ async function updateArtifacts({ packageFileName, newPackageFileContent, config
 			docker: {},
 			toolConstraints: [{
 				toolName: "vendir",
-				constraint: config.constraints?.vendir
+				constraint: await resolveToolConstraint(config, "vendir")
 			}, {
 				toolName: "helm",
-				constraint: config.constraints?.helm
+				constraint: await resolveToolConstraint(config, "helm")
 			}]
 		};
 		await gitExec(`vendir sync`, execOptions);

package/dist/modules/manager/vendir/artifacts.js.map

@@ -1 +1 @@
-{"version":3,"file":"artifacts.js","names":[],"sources":["../../../../lib/modules/manager/vendir/artifacts.ts"],"sourcesContent":["import { TEMPORARY_ERROR } from '../../../constants/error-messages.ts';\nimport { logger } from '../../../logger/index.ts';\nimport { coerceArray } from '../../../util/array.ts';\nimport type { ExecOptions } from '../../../util/exec/types.ts';\nimport {\n  getParentDir,\n  getSiblingFileName,\n  readLocalFile,\n  writeLocalFile,\n} from '../../../util/fs/index.ts';\nimport { withGitEnvironment } from '../../../util/git/exec.ts';\nimport { getRepoStatus } from '../../../util/git/index.ts';\nimport type { UpdateArtifact, UpdateArtifactsResult } from '../types.ts';\n\nconst gitExec = withGitEnvironment();\n\nexport async function updateArtifacts({\n  packageFileName,\n  newPackageFileContent,\n  config,\n}: UpdateArtifact): Promise<UpdateArtifactsResult[] | null> {\n  logger.debug(`vendir.updateArtifacts(${packageFileName})`);\n\n  const lockFileName = getSiblingFileName(packageFileName, 'vendir.lock.yml');\n  if (!lockFileName) {\n    logger.warn('No vendir.lock.yml found');\n    return null;\n  }\n  const existingLockFileContent = await readLocalFile(lockFileName, 'utf8');\n  if (!existingLockFileContent) {\n    logger.warn('Empty vendir.lock.yml found');\n    return null;\n  }\n\n  try {\n    await writeLocalFile(packageFileName, newPackageFileContent);\n    logger.debug('Updating Vendir artifacts');\n    const execOptions: ExecOptions = {\n      cwdFile: packageFileName,\n      docker: {},\n      toolConstraints: [\n        { toolName: 'vendir', constraint: config.constraints?.vendir },\n        { toolName: 'helm', constraint: config.constraints?.helm },\n      ],\n    };\n\n    await gitExec(`vendir sync`, execOptions);\n\n    logger.debug('Returning updated Vendir artifacts');\n\n    const fileChanges: UpdateArtifactsResult[] = [];\n\n    const newVendirLockContent = await readLocalFile(lockFileName, 'utf8');\n    const isLockFileChanged = existingLockFileContent !== newVendirLockContent;\n    if (isLockFileChanged) {\n      fileChanges.push({\n        file: {\n          type: 'addition',\n          path: lockFileName,\n          contents: newVendirLockContent,\n        },\n      });\n    }\n\n    // add modified vendir archives to artifacts\n    logger.debug(\"Adding Sync'd files to git\");\n    // Files must be in the vendor path to get added\n    const vendorDir = getParentDir(packageFileName);\n    const status = await getRepoStatus();\n    if (status) {\n      const modifiedFiles = coerceArray(status.modified);\n      const notAddedFiles = status.not_added;\n      const deletedFiles = coerceArray(status.deleted);\n\n      for (const f of modifiedFiles.concat(notAddedFiles)) {\n        const isFileInVendorDir = f.startsWith(vendorDir);\n        if (vendorDir || isFileInVendorDir) {\n          fileChanges.push({\n            file: {\n              type: 'addition',\n              path: f,\n              contents: await readLocalFile(f),\n            },\n          });\n        }\n      }\n\n      for (const f of deletedFiles) {\n        fileChanges.push({\n          file: {\n            type: 'deletion',\n            path: f,\n          },\n        });\n      }\n    } else {\n      logger.error('Failed to get git status');\n    }\n\n    return fileChanges.length ? fileChanges : null;\n  } catch (err) {\n    if (err.message === TEMPORARY_ERROR) {\n      throw err;\n    }\n    logger.debug({ err }, 'Failed to update Vendir lock file');\n    return [\n      {\n        artifactError: {\n          fileName: lockFileName,\n          stderr: err.message,\n        },\n      },\n    ];\n  }\n}\n"],"mappings":";;;;;;;AAcA,MAAM,UAAU,mBAAmB;AAEnC,eAAsB,gBAAgB,EACpC,iBACA,uBACA,UAC0D;CAC1D,OAAO,MAAM,0BAA0B,gBAAgB,EAAE;CAEzD,MAAM,eAAe,mBAAmB,iBAAiB,iBAAiB;CAC1E,IAAI,CAAC,cAAc;EACjB,OAAO,KAAK,0BAA0B;EACtC,OAAO;CACT;CACA,MAAM,0BAA0B,MAAM,cAAc,cAAc,MAAM;CACxE,IAAI,CAAC,yBAAyB;EAC5B,OAAO,KAAK,6BAA6B;EACzC,OAAO;CACT;CAEA,IAAI;EACF,MAAM,eAAe,iBAAiB,qBAAqB;EAC3D,OAAO,MAAM,2BAA2B;EACxC,MAAM,cAA2B;GAC/B,SAAS;GACT,QAAQ,CAAC;GACT,iBAAiB,CACf;IAAE,UAAU;IAAU,YAAY,OAAO,aAAa;GAAO,GAC7D;IAAE,UAAU;IAAQ,YAAY,OAAO,aAAa;GAAK,CAC3D;EACF;EAEA,MAAM,QAAQ,eAAe,WAAW;EAExC,OAAO,MAAM,oCAAoC;EAEjD,MAAM,cAAuC,CAAC;EAE9C,MAAM,uBAAuB,MAAM,cAAc,cAAc,MAAM;EAErE,IAD0B,4BAA4B,sBAEpD,YAAY,KAAK,EACf,MAAM;GACJ,MAAM;GACN,MAAM;GACN,UAAU;EACZ,EACF,CAAC;EAIH,OAAO,MAAM,4BAA4B;EAEzC,MAAM,YAAY,aAAa,eAAe;EAC9C,MAAM,SAAS,MAAM,cAAc;EACnC,IAAI,QAAQ;GACV,MAAM,gBAAgB,YAAY,OAAO,QAAQ;GACjD,MAAM,gBAAgB,OAAO;GAC7B,MAAM,eAAe,YAAY,OAAO,OAAO;GAE/C,KAAK,MAAM,KAAK,cAAc,OAAO,aAAa,GAAG;IACnD,MAAM,oBAAoB,EAAE,WAAW,SAAS;IAChD,IAAI,aAAa,mBACf,YAAY,KAAK,EACf,MAAM;KACJ,MAAM;KACN,MAAM;KACN,UAAU,MAAM,cAAc,CAAC;IACjC,EACF,CAAC;GAEL;GAEA,KAAK,MAAM,KAAK,cACd,YAAY,KAAK,EACf,MAAM;IACJ,MAAM;IACN,MAAM;GACR,EACF,CAAC;EAEL,OACE,OAAO,MAAM,0BAA0B;EAGzC,OAAO,YAAY,SAAS,cAAc;CAC5C,SAAS,KAAK;EACZ,IAAI,IAAI,YAAA,mBACN,MAAM;EAER,OAAO,MAAM,EAAE,IAAI,GAAG,mCAAmC;EACzD,OAAO,CACL,EACE,eAAe;GACb,UAAU;GACV,QAAQ,IAAI;EACd,EACF,CACF;CACF;AACF"}
+{"version":3,"file":"artifacts.js","names":[],"sources":["../../../../lib/modules/manager/vendir/artifacts.ts"],"sourcesContent":["import { TEMPORARY_ERROR } from '../../../constants/error-messages.ts';\nimport { logger } from '../../../logger/index.ts';\nimport { coerceArray } from '../../../util/array.ts';\nimport type { ExecOptions } from '../../../util/exec/types.ts';\nimport {\n  getParentDir,\n  getSiblingFileName,\n  readLocalFile,\n  writeLocalFile,\n} from '../../../util/fs/index.ts';\nimport { withGitEnvironment } from '../../../util/git/exec.ts';\nimport { getRepoStatus } from '../../../util/git/index.ts';\nimport type { UpdateArtifact, UpdateArtifactsResult } from '../types.ts';\nimport { resolveToolConstraint } from '../util.ts';\n\nconst gitExec = withGitEnvironment();\n\nexport async function updateArtifacts({\n  packageFileName,\n  newPackageFileContent,\n  config,\n}: UpdateArtifact): Promise<UpdateArtifactsResult[] | null> {\n  logger.debug(`vendir.updateArtifacts(${packageFileName})`);\n\n  const lockFileName = getSiblingFileName(packageFileName, 'vendir.lock.yml');\n  if (!lockFileName) {\n    logger.warn('No vendir.lock.yml found');\n    return null;\n  }\n  const existingLockFileContent = await readLocalFile(lockFileName, 'utf8');\n  if (!existingLockFileContent) {\n    logger.warn('Empty vendir.lock.yml found');\n    return null;\n  }\n\n  try {\n    await writeLocalFile(packageFileName, newPackageFileContent);\n    logger.debug('Updating Vendir artifacts');\n    const execOptions: ExecOptions = {\n      cwdFile: packageFileName,\n      docker: {},\n      toolConstraints: [\n        {\n          toolName: 'vendir',\n          constraint: await resolveToolConstraint(config, 'vendir'),\n        },\n        {\n          toolName: 'helm',\n          constraint: await resolveToolConstraint(config, 'helm'),\n        },\n      ],\n    };\n\n    await gitExec(`vendir sync`, execOptions);\n\n    logger.debug('Returning updated Vendir artifacts');\n\n    const fileChanges: UpdateArtifactsResult[] = [];\n\n    const newVendirLockContent = await readLocalFile(lockFileName, 'utf8');\n    const isLockFileChanged = existingLockFileContent !== newVendirLockContent;\n    if (isLockFileChanged) {\n      fileChanges.push({\n        file: {\n          type: 'addition',\n          path: lockFileName,\n          contents: newVendirLockContent,\n        },\n      });\n    }\n\n    // add modified vendir archives to artifacts\n    logger.debug(\"Adding Sync'd files to git\");\n    // Files must be in the vendor path to get added\n    const vendorDir = getParentDir(packageFileName);\n    const status = await getRepoStatus();\n    if (status) {\n      const modifiedFiles = coerceArray(status.modified);\n      const notAddedFiles = status.not_added;\n      const deletedFiles = coerceArray(status.deleted);\n\n      for (const f of modifiedFiles.concat(notAddedFiles)) {\n        const isFileInVendorDir = f.startsWith(vendorDir);\n        if (vendorDir || isFileInVendorDir) {\n          fileChanges.push({\n            file: {\n              type: 'addition',\n              path: f,\n              contents: await readLocalFile(f),\n            },\n          });\n        }\n      }\n\n      for (const f of deletedFiles) {\n        fileChanges.push({\n          file: {\n            type: 'deletion',\n            path: f,\n          },\n        });\n      }\n    } else {\n      logger.error('Failed to get git status');\n    }\n\n    return fileChanges.length ? fileChanges : null;\n  } catch (err) {\n    if (err.message === TEMPORARY_ERROR) {\n      throw err;\n    }\n    logger.debug({ err }, 'Failed to update Vendir lock file');\n    return [\n      {\n        artifactError: {\n          fileName: lockFileName,\n          stderr: err.message,\n        },\n      },\n    ];\n  }\n}\n"],"mappings":";;;;;;;;AAeA,MAAM,UAAU,mBAAmB;AAEnC,eAAsB,gBAAgB,EACpC,iBACA,uBACA,UAC0D;CAC1D,OAAO,MAAM,0BAA0B,gBAAgB,EAAE;CAEzD,MAAM,eAAe,mBAAmB,iBAAiB,iBAAiB;CAC1E,IAAI,CAAC,cAAc;EACjB,OAAO,KAAK,0BAA0B;EACtC,OAAO;CACT;CACA,MAAM,0BAA0B,MAAM,cAAc,cAAc,MAAM;CACxE,IAAI,CAAC,yBAAyB;EAC5B,OAAO,KAAK,6BAA6B;EACzC,OAAO;CACT;CAEA,IAAI;EACF,MAAM,eAAe,iBAAiB,qBAAqB;EAC3D,OAAO,MAAM,2BAA2B;EACxC,MAAM,cAA2B;GAC/B,SAAS;GACT,QAAQ,CAAC;GACT,iBAAiB,CACf;IACE,UAAU;IACV,YAAY,MAAM,sBAAsB,QAAQ,QAAQ;GAC1D,GACA;IACE,UAAU;IACV,YAAY,MAAM,sBAAsB,QAAQ,MAAM;GACxD,CACF;EACF;EAEA,MAAM,QAAQ,eAAe,WAAW;EAExC,OAAO,MAAM,oCAAoC;EAEjD,MAAM,cAAuC,CAAC;EAE9C,MAAM,uBAAuB,MAAM,cAAc,cAAc,MAAM;EAErE,IAD0B,4BAA4B,sBAEpD,YAAY,KAAK,EACf,MAAM;GACJ,MAAM;GACN,MAAM;GACN,UAAU;EACZ,EACF,CAAC;EAIH,OAAO,MAAM,4BAA4B;EAEzC,MAAM,YAAY,aAAa,eAAe;EAC9C,MAAM,SAAS,MAAM,cAAc;EACnC,IAAI,QAAQ;GACV,MAAM,gBAAgB,YAAY,OAAO,QAAQ;GACjD,MAAM,gBAAgB,OAAO;GAC7B,MAAM,eAAe,YAAY,OAAO,OAAO;GAE/C,KAAK,MAAM,KAAK,cAAc,OAAO,aAAa,GAAG;IACnD,MAAM,oBAAoB,EAAE,WAAW,SAAS;IAChD,IAAI,aAAa,mBACf,YAAY,KAAK,EACf,MAAM;KACJ,MAAM;KACN,MAAM;KACN,UAAU,MAAM,cAAc,CAAC;IACjC,EACF,CAAC;GAEL;GAEA,KAAK,MAAM,KAAK,cACd,YAAY,KAAK,EACf,MAAM;IACJ,MAAM;IACN,MAAM;GACR,EACF,CAAC;EAEL,OACE,OAAO,MAAM,0BAA0B;EAGzC,OAAO,YAAY,SAAS,cAAc;CAC5C,SAAS,KAAK;EACZ,IAAI,IAAI,YAAA,mBACN,MAAM;EAER,OAAO,MAAM,EAAE,IAAI,GAAG,mCAAmC;EACzD,OAAO,CACL,EACE,eAAe;GACb,UAAU;GACV,QAAQ,IAAI;EACd,EACF,CACF;CACF;AACF"}

package/dist/modules/platform/gitlab/index.js

@@ -1,5 +1,5 @@
 import { __exportAll } from "../../../_virtual/_rolldown/runtime.js";
-import { REPOSITORY_ACCESS_FORBIDDEN, REPOSITORY_ARCHIVED, REPOSITORY_CHANGED, REPOSITORY_DISABLED, REPOSITORY_EMPTY, REPOSITORY_MIRRORED, REPOSITORY_NOT_FOUND, TEMPORARY_ERROR } from "../../../constants/error-messages.js";
+import { REPOSITORY_ACCESS_FORBIDDEN, REPOSITORY_ARCHIVED, REPOSITORY_CHANGED, REPOSITORY_DISABLED, REPOSITORY_EMPTY, REPOSITORY_MIRRORED, REPOSITORY_NOT_FOUND, REPOSITORY_PENDING_DELETION, TEMPORARY_ERROR } from "../../../constants/error-messages.js";
 import { getEnv } from "../../../util/env.js";
 import { regEx } from "../../../util/regex.js";
 import { GlobalConfig } from "../../../config/global.js";
@@ -130,7 +130,7 @@ async function getRepos(config) {
 	try {
 		const repos = (await pMap(urls, (url) => gitlabApi.getJsonUnchecked(url, { paginate: true }), { concurrency: 2 })).flatMap((response) => response.body);
 		logger.debug(`Discovered ${repos.length} project(s)`);
-		return repos.filter((repo) => !repo.mirror || config?.includeMirrors).map((repo) => repo.path_with_namespace);
+		return repos.filter((repo) => !repo.mirror || config?.includeMirrors).filter((repo) => !repo.marked_for_deletion_at).map((repo) => repo.path_with_namespace);
 	} catch (err) {
 		logger.error({ err }, `GitLab getRepos error`);
 		throw err;
@@ -162,6 +162,10 @@ async function initRepo({ repository, cloneSubmodules, cloneSubmodulesFilter, gi
 			logger.debug("Repository is archived - throwing error to abort renovation");
 			throw new Error(REPOSITORY_ARCHIVED);
 		}
+		if (res.body.marked_for_deletion_at) {
+			logger.debug("Repository is marked for deletion - throwing error to abort renovation");
+			throw new Error(REPOSITORY_PENDING_DELETION);
+		}
 		if (res.body.mirror && GlobalConfig.get("includeMirrors") !== true) {
 			logger.debug("Repository is a mirror - throwing error to abort renovation");
 			throw new Error(REPOSITORY_MIRRORED);
@@ -194,7 +198,11 @@ async function initRepo({ repository, cloneSubmodules, cloneSubmodulesFilter, gi
 	} catch (err) /* v8 ignore next -- initRepo error mapping needs git-level failures not mocked in specs */ {
 		logger.debug({ err }, "Caught initRepo error");
 		if (err.message.includes("HEAD is not a symbolic ref")) throw new Error(REPOSITORY_EMPTY);
-		if (["archived", "empty"].includes(err.message)) throw err;
+		if ([
+			"archived",
+			"empty",
+			"pending-deletion"
+		].includes(err.message)) throw err;
 		if (err.statusCode === 403) throw new Error(REPOSITORY_ACCESS_FORBIDDEN);
 		if (err.statusCode === 404) throw new Error(REPOSITORY_NOT_FOUND);
 		if (err.message === "disabled") throw err;