[pull] main from renovatebot:main

lib/config/__snapshots__/validation.spec.ts.snap

@@ -155,19 +155,6 @@ exports[`config/validation > validateConfig(config) > errors if manager objects
 ]
 `;
 
-exports[`config/validation > validateConfig(config) > errors if managerFilePatterns has wrong parent 1`] = `
-[
-  {
-    "message": "managerFilePatterns should only be configured within one of "ansible or ansible-galaxy or argocd or asdf or azure-pipelines or batect or batect-wrapper or bazel or bazel-module or bazelisk or bicep or bitbucket-pipelines or bitrise or buildkite or buildpacks or bun or bun-version or bundler or cake or cargo or cdnurl or circleci or cloudbuild or cocoapods or composer or conan or copier or cpanfile or crossplane or crow or deps-edn or devbox or devcontainer or docker-compose or dockerfile or droneci or fleet or flux or fvm or git-submodules or github-actions or gitlabci or gitlabci-include or glasskube or gleam or gomod or gradle or gradle-wrapper or haskell-cabal or helm-requirements or helm-values or helmfile or helmsman or helmv3 or hermit or homebrew or html or jenkins or jsonnet-bundler or kotlin-script or kubernetes or kustomize or leiningen or maven or maven-wrapper or meteor or mint or mise or mix or nix or nodenv or npm or nuget or nvm or ocb or osgi or pep621 or pep723 or pip-compile or pip_requirements or pip_setup or pipenv or pixi or poetry or pre-commit or pub or puppet or pyenv or renovate-config-presets or ruby-version or runtime-version or sbt or scalafmt or setup-cfg or sveltos or swift or tekton or terraform or terraform-version or terragrunt or terragrunt-version or tflint-plugin or travis or unity3d or velaci or vendir or woodpecker or customManagers" objects. Was found in .",
-    "topic": "managerFilePatterns",
-  },
-  {
-    "message": "managerFilePatterns should only be configured within one of "ansible or ansible-galaxy or argocd or asdf or azure-pipelines or batect or batect-wrapper or bazel or bazel-module or bazelisk or bicep or bitbucket-pipelines or bitrise or buildkite or buildpacks or bun or bun-version or bundler or cake or cargo or cdnurl or circleci or cloudbuild or cocoapods or composer or conan or copier or cpanfile or crossplane or crow or deps-edn or devbox or devcontainer or docker-compose or dockerfile or droneci or fleet or flux or fvm or git-submodules or github-actions or gitlabci or gitlabci-include or glasskube or gleam or gomod or gradle or gradle-wrapper or haskell-cabal or helm-requirements or helm-values or helmfile or helmsman or helmv3 or hermit or homebrew or html or jenkins or jsonnet-bundler or kotlin-script or kubernetes or kustomize or leiningen or maven or maven-wrapper or meteor or mint or mise or mix or nix or nodenv or npm or nuget or nvm or ocb or osgi or pep621 or pep723 or pip-compile or pip_requirements or pip_setup or pipenv or pixi or poetry or pre-commit or pub or puppet or pyenv or renovate-config-presets or ruby-version or runtime-version or sbt or scalafmt or setup-cfg or sveltos or swift or tekton or terraform or terraform-version or terragrunt or terragrunt-version or tflint-plugin or travis or unity3d or velaci or vendir or woodpecker or customManagers" objects. Was found in minor",
-    "topic": "npm.minor.managerFilePatterns",
-  },
-]
-`;
-
 exports[`config/validation > validateConfig(config) > ignore packageRule nesting validation for presets 1`] = `[]`;
 
 exports[`config/validation > validateConfig(config) > included managers of the wrong type 1`] = `
@@ -242,7 +229,7 @@ exports[`config/validation > validateConfig(config) > validates regEx for each m
 exports[`config/validation > validateConfig(config) > warns if hostType has the wrong parent 1`] = `
 [
   {
-    "message": "hostType should only be configured within one of "hostRules" objects. Was found in .",
+    "message": ""hostType" can't be used in ".". Allowed objects: hostRules.",
     "topic": "hostType",
   },
 ]

lib/config/validation.spec.ts

@@ -1,12 +1,9 @@
-import { getManagerList } from '../modules/manager';
 import { configFileNames } from './app-strings';
 import { GlobalConfig } from './global';
 import type { RenovateConfig } from './types';
 import * as configValidation from './validation';
 import { partial } from '~test/util';
 
-const managerList = getManagerList().sort();
-
 describe('config/validation', () => {
   describe('validateConfig(config)', () => {
     it('returns deprecation warnings', async () => {
@@ -1098,7 +1095,20 @@ describe('config/validation', () => {
 
       expect(errors).toHaveLength(0);
       expect(warnings).toHaveLength(2);
-      expect(warnings).toMatchSnapshot();
+      expect(warnings).toEqual([
+        {
+          topic: 'managerFilePatterns',
+          message: expect.toStartWith(
+            `"managerFilePatterns" can't be used in ".". Allowed objects: `,
+          ),
+        },
+        {
+          topic: 'npm.minor.managerFilePatterns',
+          message: expect.toStartWith(
+            `"managerFilePatterns" can't be used in "minor". Allowed objects: `,
+          ),
+        },
+      ]);
     });
 
     it('errors if manager objects are nested', async () => {
@@ -1763,7 +1773,9 @@ describe('config/validation', () => {
           },
           {
             topic: 'managerFilePatterns',
-            message: `managerFilePatterns should only be configured within one of "${managerList.join(' or ')} or customManagers" objects. Was found in .`,
+            message: expect.toStartWith(
+              `"managerFilePatterns" can't be used in ".". Allowed objects: `,
+            ),
           },
         ]);
       });
@@ -1786,7 +1798,9 @@ describe('config/validation', () => {
         expect(warnings).toEqual([
           {
             topic: 'managerFilePatterns',
-            message: `managerFilePatterns should only be configured within one of "${managerList.join(' or ')} or customManagers" objects. Was found in .`,
+            message: expect.toStartWith(
+              `"managerFilePatterns" can't be used in ".". Allowed objects: `,
+            ),
           },
         ]);
       });

lib/config/validation.ts

@@ -250,9 +250,8 @@ export async function validateConfig(
         !optionParents[key].includes(parentName as AllowedParents)
       ) {
         // TODO: types (#22198)
-        const message = `${key} should only be configured within one of "${optionParents[
-          key
-        ]?.join(' or ')}" objects. Was found in ${parentName}`;
+        const options = optionParents[key]?.sort().join(', ');
+        const message = `"${key}" can't be used in "${parentName}". Allowed objects: ${options}.`;
         warnings.push({
           topic: `${parentPath ? `${parentPath}.` : ''}${key}`,
           message,

lib/modules/datasource/npm/__snapshots__/index.spec.ts.snap

@@ -6,13 +6,15 @@ exports[`modules/datasource/npm/index > should fetch package info from custom re
   "registryUrl": "https://npm.mycustomregistry.com",
   "releases": [
     {
+      "attestation": false,
       "dependencies": undefined,
       "devDependencies": undefined,
       "gitRef": undefined,
       "releaseTimestamp": "2018-05-06T05:21:53.000Z",
       "version": "0.0.1",
     },
     {
+      "attestation": false,
       "dependencies": undefined,
       "devDependencies": undefined,
       "gitRef": undefined,
@@ -33,13 +35,15 @@ exports[`modules/datasource/npm/index > should fetch package info from npm 1`] =
   "registryUrl": "https://registry.npmjs.org",
   "releases": [
     {
+      "attestation": false,
       "dependencies": undefined,
       "devDependencies": undefined,
       "gitRef": undefined,
       "releaseTimestamp": "2018-05-06T05:21:53.000Z",
       "version": "0.0.1",
     },
     {
+      "attestation": false,
       "dependencies": undefined,
       "devDependencies": undefined,
       "gitRef": undefined,
@@ -61,13 +65,15 @@ exports[`modules/datasource/npm/index > should handle foobar 1`] = `
   "registryUrl": "https://registry.npmjs.org",
   "releases": [
     {
+      "attestation": false,
       "dependencies": undefined,
       "devDependencies": undefined,
       "gitRef": undefined,
       "releaseTimestamp": "2018-05-06T05:21:53.000Z",
       "version": "0.0.1",
     },
     {
+      "attestation": false,
       "dependencies": undefined,
       "devDependencies": undefined,
       "gitRef": undefined,
@@ -89,13 +95,15 @@ exports[`modules/datasource/npm/index > should handle no time 1`] = `
   "registryUrl": "https://registry.npmjs.org",
   "releases": [
     {
+      "attestation": false,
       "dependencies": undefined,
       "devDependencies": undefined,
       "gitRef": undefined,
       "releaseTimestamp": "2018-05-06T05:21:53.000Z",
       "version": "0.0.1",
     },
     {
+      "attestation": false,
       "dependencies": undefined,
       "devDependencies": undefined,
       "gitRef": undefined,
@@ -116,13 +124,15 @@ exports[`modules/datasource/npm/index > should not send an authorization header
   "registryUrl": "https://registry.npmjs.org",
   "releases": [
     {
+      "attestation": false,
       "dependencies": undefined,
       "devDependencies": undefined,
       "gitRef": undefined,
       "releaseTimestamp": "2018-05-06T05:21:53.000Z",
       "version": "0.0.1",
     },
     {
+      "attestation": false,
       "dependencies": undefined,
       "devDependencies": undefined,
       "gitRef": undefined,
@@ -144,6 +154,7 @@ exports[`modules/datasource/npm/index > should parse repo url (string) 1`] = `
   "registryUrl": "https://registry.npmjs.org",
   "releases": [
     {
+      "attestation": false,
       "dependencies": undefined,
       "devDependencies": undefined,
       "gitRef": undefined,
@@ -164,6 +175,7 @@ exports[`modules/datasource/npm/index > should parse repo url 1`] = `
   "registryUrl": "https://registry.npmjs.org",
   "releases": [
     {
+      "attestation": false,
       "dependencies": undefined,
       "devDependencies": undefined,
       "gitRef": undefined,
@@ -184,13 +196,15 @@ exports[`modules/datasource/npm/index > should replace any environment variable
   "registryUrl": "https://registry.from-env.com",
   "releases": [
     {
+      "attestation": false,
       "dependencies": undefined,
       "devDependencies": undefined,
       "gitRef": undefined,
       "releaseTimestamp": "2018-05-06T05:21:53.000Z",
       "version": "0.0.1",
     },
     {
+      "attestation": false,
       "dependencies": undefined,
       "devDependencies": undefined,
       "gitRef": undefined,
@@ -217,6 +231,7 @@ Marking the latest version of an npm package as deprecated results in the entire
   "registryUrl": "https://registry.npmjs.org",
   "releases": [
     {
+      "attestation": false,
       "dependencies": undefined,
       "devDependencies": undefined,
       "gitRef": undefined,
@@ -225,6 +240,7 @@ Marking the latest version of an npm package as deprecated results in the entire
       "version": "0.0.1",
     },
     {
+      "attestation": false,
       "dependencies": undefined,
       "devDependencies": undefined,
       "gitRef": undefined,
@@ -254,13 +270,15 @@ exports[`modules/datasource/npm/index > should send an authorization header if p
   "registryUrl": "https://registry.npmjs.org",
   "releases": [
     {
+      "attestation": false,
       "dependencies": undefined,
       "devDependencies": undefined,
       "gitRef": undefined,
       "releaseTimestamp": "2018-05-06T05:21:53.000Z",
       "version": "0.0.1",
     },
     {
+      "attestation": false,
       "dependencies": undefined,
       "devDependencies": undefined,
       "gitRef": undefined,
@@ -282,13 +300,15 @@ exports[`modules/datasource/npm/index > should use default registry if missing f
   "registryUrl": "https://registry.npmjs.org",
   "releases": [
     {
+      "attestation": false,
       "dependencies": undefined,
       "devDependencies": undefined,
       "gitRef": undefined,
       "releaseTimestamp": "2018-05-06T05:21:53.000Z",
       "version": "0.0.1",
     },
     {
+      "attestation": false,
       "dependencies": undefined,
       "devDependencies": undefined,
       "gitRef": undefined,
@@ -310,13 +330,15 @@ exports[`modules/datasource/npm/index > should use host rules by baseUrl if prov
   "registryUrl": "https://npm.mycustomregistry.com/_packaging/mycustomregistry/npm/registry",
   "releases": [
     {
+      "attestation": false,
       "dependencies": undefined,
       "devDependencies": undefined,
       "gitRef": undefined,
       "releaseTimestamp": "2018-05-06T05:21:53.000Z",
       "version": "0.0.1",
     },
     {
+      "attestation": false,
       "dependencies": undefined,
       "devDependencies": undefined,
       "gitRef": undefined,
@@ -338,13 +360,15 @@ exports[`modules/datasource/npm/index > should use host rules by hostName if pro
   "registryUrl": "https://npm.mycustomregistry.com",
   "releases": [
     {
+      "attestation": false,
       "dependencies": undefined,
       "devDependencies": undefined,
       "gitRef": undefined,
       "releaseTimestamp": "2018-05-06T05:21:53.000Z",
       "version": "0.0.1",
     },
     {
+      "attestation": false,
       "dependencies": undefined,
       "devDependencies": undefined,
       "gitRef": undefined,

lib/modules/datasource/npm/get.spec.ts

@@ -596,7 +596,15 @@ describe('modules/datasource/npm/get', () => {
 
       expect(dep).toEqual({
         registryUrl: 'https://example.com',
-        releases: [{ version: '1.0.0' }],
+        releases: [
+          {
+            attestation: false,
+            dependencies: undefined,
+            devDependencies: undefined,
+            gitRef: undefined,
+            version: '1.0.0',
+          },
+        ],
         sourceDirectory: 'packages/foo',
         sourceUrl:
           'https://github.com/octocat/Hello-World/tree/master/packages/test',
@@ -622,7 +630,15 @@ describe('modules/datasource/npm/get', () => {
 
       expect(dep).toEqual({
         registryUrl: 'https://example.com',
-        releases: [{ version: '1.0.0' }],
+        releases: [
+          {
+            attestation: false,
+            dependencies: undefined,
+            devDependencies: undefined,
+            gitRef: undefined,
+            version: '1.0.0',
+          },
+        ],
         sourceDirectory: 'packages/foo',
         sourceUrl:
           'https://github.com/octocat/Hello-World/tree/master/packages/test',
@@ -648,7 +664,15 @@ describe('modules/datasource/npm/get', () => {
 
       expect(dep).toEqual({
         registryUrl: 'https://example.com',
-        releases: [{ version: '1.0.0' }],
+        releases: [
+          {
+            attestation: false,
+            dependencies: undefined,
+            devDependencies: undefined,
+            gitRef: undefined,
+            version: '1.0.0',
+          },
+        ],
         sourceDirectory: 'packages/foo',
         sourceUrl:
           'https://github.com/octocat/Hello-World/tree/master/packages/test',

lib/modules/datasource/npm/get.ts

@@ -1,4 +1,4 @@
-import is from '@sindresorhus/is';
+import is, { isString } from '@sindresorhus/is';
 import { z } from 'zod';
 import { HOST_DISABLED } from '../../../constants/error-messages';
 import { logger } from '../../../logger';
@@ -138,6 +138,7 @@ export async function getDependency(
         gitRef: res.versions?.[version].gitHead,
         dependencies: res.versions?.[version].dependencies,
         devDependencies: res.versions?.[version].devDependencies,
+        attestation: isString(res.versions?.[version].dist?.attestations?.url),
       };
       const releaseTimestamp = asTimestamp(res.time?.[version]);
       if (releaseTimestamp) {