Merge branch 'renovatebot:main' into fix/azure-url-encoding

Author: rm-code

.devcontainer/Dockerfile

@@ -1 +1 @@
-FROM ghcr.io/containerbase/devcontainer:14.14.0
+FROM ghcr.io/containerbase/devcontainer:14.14.4

.github/actions/calculate-prefetch-matrix/action.yml

@@ -27,7 +27,7 @@ runs:
     - name: Calculate cache keys
       id: cache-keys
       env:
-        HASH: ${{ hashFiles('pnpm-lock.yaml') }}
+        HASH: ${{ hashFiles('pnpm-lock.yaml', 'package.json') }}
       shell: bash
       run: |
         echo 'MACOS_KEY=node_modules-macOS-${{ inputs.node-version }}-${{ env.HASH }}' >> "$GITHUB_ENV"

.github/actions/setup-docker/action.yml

@@ -1,5 +1,5 @@
 name: 'Setup Docker'
-description: ''
+description: 'Prepare Docker for multi-platform image builds, freeing disk space on low-capacity runners'
 
 runs:
   using: 'composite'

.github/actions/setup-node/action.yml

@@ -18,6 +18,12 @@ inputs:
     description: 'Save cache when needed'
     required: false
     default: 'false'
+  use-cache:
+    description: >-
+      Set to `false` to skip restoring the `node_modules` and pnpm store caches, forcing a fresh `pnpm install --frozen-lockfile`. Use this in
+      privileged jobs (e.g. release), so that they never execute cache contents.
+    required: false
+    default: 'true'
 runs:
   using: 'composite'
   steps:
@@ -53,6 +59,7 @@ runs:
 
     - name: Restore `node_modules`
       id: node-modules-restore
+      if: inputs.use-cache == 'true'
       uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: node_modules
@@ -67,7 +74,7 @@ runs:
         }}' >> "$GITHUB_ENV"
 
     - name: Setup pnpm
-      uses: pnpm/setup@84cb39b217b10273981911c288cd62326dc7c6d2 # v2.0.2
+      uses: pnpm/setup@703c52620218391530e48b9e8870d5c0082e1b9b # v2.1.0
       with:
         install: false
         runtime: node@${{ inputs.node-version }}
@@ -78,7 +85,7 @@ runs:
         echo "PNPM_STORE=$(pnpm store path)" >> "$GITHUB_ENV"
 
     - name: Cache and restore `pnpm store`
-      if: env.CACHE_HIT != 'true'
+      if: inputs.use-cache == 'true' && env.CACHE_HIT != 'true'
       uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ${{ env.PNPM_STORE }}

.github/workflows/build.yml

@@ -297,9 +297,6 @@ jobs:
       - name: Lint documentation
         run: pnpm lint-documentation
 
-      - name: Markdown lint
-        run: pnpm markdown-lint
-
   lint-other:
     needs:
       - setup-build
@@ -324,7 +321,9 @@ jobs:
         with:
           path: .cache/tsbuildinfo
           key: tsbuildinfo-${{ hashFiles('pnpm-lock.yaml') }}
-          restore-keys: tsbuildinfo-${{ hashFiles('pnpm-lock.yaml') }}-
+          restore-keys: |
+            tsbuildinfo-${{ hashFiles('pnpm-lock.yaml') }}-
+            tsbuildinfo-
 
       - name: Type check
         run: pnpm type-check
@@ -349,8 +348,6 @@ jobs:
         run: pnpm lint-other
 
   lint-actions:
-    needs:
-      - setup-build
     runs-on: ubuntu-latest
     timeout-minutes: 7
     permissions:
@@ -362,7 +359,9 @@ jobs:
         with:
           persist-credentials: false
           show-progress: false
-          sparse-checkout: .github/workflows
+          # include local composite actions, so that actionlint validates
+          # their metadata, and zizmor audits them
+          sparse-checkout: .github/
 
       - name: Check workflow files
         uses: docker://rhysd/actionlint:1.7.12@sha256:b1934ee5f1c509618f2508e6eb47ee0d3520686341fec936f3b79331f9315667
@@ -410,16 +409,27 @@ jobs:
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: .cache/vitest
+          # the shard cache key comes before the lockfile hash so that
+          # `restore-keys` can fall back to the same shard's cache after
+          # a lockfile change
           key: |
             vitest-cache-${{
               runner.os
             }}-${{
               env.NODE_VERSION
+            }}-${{
+              matrix.cache-key
             }}-${{
               hashFiles('pnpm-lock.yaml')
+            }}
+          restore-keys: |
+            vitest-cache-${{
+              runner.os
+            }}-${{
+              env.NODE_VERSION
             }}-${{
               matrix.cache-key
-            }}
+            }}-
 
       - name: Unit tests
         shell: bash
@@ -491,7 +501,7 @@ jobs:
         with:
           use_oidc: true
           directory: coverage/lcov
-          fail_ci_if_error: github.event_name != 'pull_request'
+          fail_ci_if_error: ${{ github.event_name != 'pull_request' }}
           verbose: true
 
   coverage-threshold:
@@ -545,6 +555,10 @@ jobs:
       - codecov
       - coverage-threshold
       - lint-actions
+      - lint-docs
+      - lint-other
+      - lint-oxlint
+      - lint-prettier
       - build-docker
       - build-docs
     runs-on: ubuntu-latest
@@ -603,6 +617,30 @@ jobs:
           needs.lint-actions.result == 'skipped'
         run: exit 1
 
+      - name: Fail for failed or cancelled linting
+        if: |
+          needs.lint-docs.result == 'failure' ||
+          needs.lint-docs.result == 'cancelled' ||
+          needs.lint-other.result == 'failure' ||
+          needs.lint-other.result == 'cancelled' ||
+          needs.lint-oxlint.result == 'failure' ||
+          needs.lint-oxlint.result == 'cancelled' ||
+          needs.lint-prettier.result == 'failure' ||
+          needs.lint-prettier.result == 'cancelled'
+        run: exit 1
+
+      - name: Fail for skipped linting when PR is ready for review
+        if: |
+          github.event_name == 'pull_request' &&
+          github.event.pull_request.draft != true &&
+          (
+            needs.lint-docs.result == 'skipped' ||
+            needs.lint-other.result == 'skipped' ||
+            needs.lint-oxlint.result == 'skipped' ||
+            needs.lint-prettier.result == 'skipped'
+          )
+        run: exit 1
+
       - name: Fail for failed or cancelled docs build
         if: |
           needs.build-docs.result == 'failure' ||
@@ -701,7 +739,6 @@ jobs:
 
   build-docs:
     needs:
-      - lint-docs
       - setup-build
     runs-on: ubuntu-latest
     timeout-minutes: 5
@@ -722,7 +759,7 @@ jobs:
       - name: Setup uv
         uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
         with:
-          version: 0.12.3
+          version: 0.12.7
           enable-cache: true
           cache-python: true
 
@@ -845,32 +882,43 @@ jobs:
         with:
           node-version: ${{ needs.setup-build.outputs.node-version }}
           os: ${{ runner.os }}
+          # ensure that the release job installs fresh, with installed pacakges verified against the lockfile's integrity hashes
+          use-cache: false
 
       - name: Install newer npm if needed
         run: 'dpkg --compare-versions "$(npm -v)" lt 11.5.1 && (npm update -g npm; echo "updated npm to: $(npm -v)") || echo "npm is new enough: $(npm -v)"'
 
       - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
 
       - name: Docker registry login
+        env:
+          DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
+          DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          REPOSITORY_OWNER: ${{ github.repository_owner }}
         run: |
-          echo "${{ secrets.DOCKER_PASSWORD }}" | docker login -u ${{ secrets.DOCKER_USERNAME }} --password-stdin
-          echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.repository_owner }} --password-stdin
+          echo "$DOCKER_PASSWORD" | docker login -u "$DOCKER_USERNAME" --password-stdin
+          echo "$GITHUB_TOKEN" | docker login ghcr.io -u "$REPOSITORY_OWNER" --password-stdin
 
       - name: Setup uv
         uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
         with:
-          version: 0.12.3
-          enable-cache: true
+          version: 0.12.7
+          # ensure that the release job installs fresh, with installed pacakges verified against the lockfile's integrity hashes
+          enable-cache: false
           cache-python: true
 
       - name: Install uv dependencies
         run: uv sync --locked
 
       - name: Check dry run
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          INPUT_DRY_RUN: ${{ github.event.inputs.dryRun }}
         run: |
-          if [[ "${{github.event_name}}" == "workflow_dispatch" && "${{ github.event.inputs.dryRun }}" != "true"  ]]; then
+          if [[ "$EVENT_NAME" == "workflow_dispatch" && "$INPUT_DRY_RUN" != "true"  ]]; then
             echo "DRY_RUN=false" >> "$GITHUB_ENV"
-          elif [[ "${{env.DO_RELEASE}}" == "true" ]]; then
+          elif [[ "$DO_RELEASE" == "true" ]]; then
             echo "DRY_RUN=false" >> "$GITHUB_ENV"
           fi
 
@@ -891,7 +939,7 @@ jobs:
 
       - name: semantic-release
         run: |
-          pnpm semantic-release --dry-run ${{env.DRY_RUN}}
+          pnpm semantic-release --dry-run "$DRY_RUN"
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           LOG_LEVEL: debug

.github/workflows/codeql-analysis.yml

@@ -42,7 +42,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
+        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           languages: javascript
 
@@ -52,7 +52,7 @@ jobs:
       # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
       # If this step fails, then you should remove it and run the build manually (see below)
       - name: Autobuild
-        uses: github/codeql-action/autobuild@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
+        uses: github/codeql-action/autobuild@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
 
       # ℹ️ Command-line programs to run using the OS shell.
       # 📚 https://git.io/JvXDl
@@ -66,4 +66,4 @@ jobs:
       #   make release
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
+        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9

.github/workflows/find-dequeued-merge-queue-prs.yml

@@ -0,0 +1,29 @@
+name: 'Label PRs dequeued from the merge queue'
+
+on:
+  schedule:
+    # Run every 15 minutes
+    - cron: '*/15 * * * *'
+  # Or when manually requested
+  workflow_dispatch: {}
+
+permissions: {}
+
+jobs:
+  label-dequeued-prs:
+    runs-on: ubuntu-slim
+    if: github.repository == 'renovatebot/renovate'
+
+    permissions:
+      pull-requests: write
+
+    env:
+      GH_TOKEN: ${{ github.token }}
+
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Find and label PRs dequeued from the merge queue
+        run: bash ./tools/find-dequeued-merge-queue-prs.sh

.github/workflows/mend-slack.yml

@@ -16,8 +16,10 @@ jobs:
     steps:
       - name: Calculate time ago
         id: timeago
+        env:
+          CREATED_AT: ${{ github.event.discussion.created_at }}
         run: |
-          created_at="${{ github.event.discussion.created_at }}"
+          created_at="$CREATED_AT"
           created_epoch=$(date -d "$created_at" "+%s")
           now_epoch=$(date +%s)
           diff=$((now_epoch - created_epoch))

.github/workflows/scorecard.yml

@@ -52,6 +52,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: 'Upload to code-scanning'
-        uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           sarif_file: results.sarif

.github/workflows/update-data.yml

@@ -23,7 +23,7 @@ jobs:
           show-progress: false
 
       - name: Setup pnpm
-        uses: pnpm/setup@84cb39b217b10273981911c288cd62326dc7c6d2 # v2.0.2
+        uses: pnpm/setup@703c52620218391530e48b9e8870d5c0082e1b9b # v2.1.0
         with:
           install: false
           runtime: node@${{ env.NODE_VERSION }}
@@ -32,7 +32,7 @@ jobs:
         run: pnpm install --frozen-lockfile
 
       - name: Install mise
-        uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5
+        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
         with:
           # don't run `mise install`, but do install a version of `mise` itself
           install: false