.devcontainer/Dockerfile

-FROM containerbase/buildpack@sha256:8d0bd58e02d271304e6ab378aede3927dd2cfb98cdae59d0e8bf6f66a5393963
+FROM containerbase/node:14.17.6@sha256:449af722795fbfec2c8ee00724fea3b1b5a4bbd7bdfecfaf783fa746be48ba19
+
 
-# renovate: datasource=docker versioning=docker
-RUN install-tool node 14.16.1 \
 # renovate: datasource=npm
-  && install-tool yarn 1.22.10
\ No newline at end of file
+RUN install-tool yarn 1.22.11

.devcontainer/devcontainer.json

 {
-  "name": "Node.js 14",
+  "name": "Renovate",
   "dockerFile": "Dockerfile",
   "settings": {
     "terminal.integrated.shell.linux": "/bin/bash"

.eslintrc.js

@@ -3,6 +3,7 @@ module.exports = {
   env: {
     node: true,
   },
+  plugins: ['@renovate'],
   extends: [
     'airbnb-typescript/base',
     'plugin:import/errors',
@@ -51,6 +52,9 @@ module.exports = {
         memberSyntaxSortOrder: ['none', 'all', 'multiple', 'single'],
       },
     ],
+
+    // mdast is a types only package `@types/mdast`
+    'import/no-unresolved': ['error', { ignore: ['^mdast$'] }],
     'import/order': [
       'error',
       {
@@ -60,6 +64,9 @@ module.exports = {
       },
     ],
 
+    // disallow direct `nock` module usage as it causes memory issues.
+    'no-restricted-imports': [2, { paths: ['nock'] }],
+
     // Makes no sense to allow type inference for expression parameters, but require typing the response
     '@typescript-eslint/explicit-function-return-type': [
       'error',
@@ -99,6 +106,7 @@ module.exports = {
 
     '@typescript-eslint/unbound-method': 2,
     '@typescript-eslint/ban-types': 2,
+    '@renovate/jest-root-describe': 2,
   },
   settings: {
     'import/parsers': {
@@ -123,10 +131,12 @@ module.exports = {
         '@typescript-eslint/unbound-method': 0,
 
         'jest/valid-title': [0, { ignoreTypeOfDescribeName: true }],
+        'max-classes-per-file': 0,
+        'class-methods-use-this': 0,
       },
     },
     {
-      files: ['**/*.mjs'],
+      files: ['**/*.{js,mjs}'],
 
       rules: {
         '@typescript-eslint/explicit-function-return-type': 0,
@@ -134,5 +144,31 @@ module.exports = {
         '@typescript-eslint/restrict-template-expressions': 0,
       },
     },
+    {
+      files: ['tools/**/*.{ts,js,mjs}'],
+      env: {
+        node: true,
+      },
+      rules: {
+        'import/no-extraneous-dependencies': [
+          'error',
+          { devDependencies: true },
+        ],
+      },
+    },
+    {
+      files: ['tools/**/*.js'],
+      rules: {
+        // need commonjs
+        '@typescript-eslint/no-var-requires': 'off',
+      },
+    },
+    {
+      files: ['*.mjs'],
+      rules: {
+        // esm always requires extensions
+        'import/extensions': 0,
+      },
+    },
   ],
 };

.github/ISSUE_TEMPLATE/bug_report.md

----
-name: Bug report
-about: You've found a bug with Renovate
-labels: 'type:bug, status:requirements, priority-5-triage'
----
-
-<!--
-      PLEASE DO NOT REPORT ANY SECURITY CONCERNS THIS WAY
-      Email renovate-disclosure@whitesourcesoftware.com instead.
--->
-
-**What Renovate type, platform and version are you using?**
-
-<!-- Tell us if you're using the hosted App, or if you are self-hosted Renovate yourself. Platform too (GitHub, GitLab, etc) plus which version of Renovate if you're self-hosted. -->
-
-**Describe the bug**
-
-<!-- A clear and concise description of what the bug is. -->
-
-**Relevant debug logs**
-
-<!--
-Try not to raise a bug report unless you've looked at the logs first.
-
-If you're running self-hosted, run with `LOG_LEVEL=debug` in your environment variables and search for whatever dependency/branch/PR that is causing the problem. If you are using the Renovate App, log into https://app.renovatebot.com/dashboard and locate the correct job log for when the problem occurred (e.g. when the PR was created).
-
-Paste the *relevant* logs here, not the entire thing and not just a link to the dashboard (others do not have permissions to view them).
--->
-
-<details><summary>Click me to see logs</summary>
-
-```
-Copy/paste any log here, between the starting and ending backticks
-```
-
-</details>
-
-**Have you created a minimal reproduction repository?**
-
-Please read the [minimal reproductions documentation](https://github.com/renovatebot/renovate/blob/master/docs/development/minimal-reproductions.md) to learn how to make a good minimal reproduction repository.
-
-- [ ] I have provided a minimal reproduction repository
-- [ ] I don't have time for that, but it happens in a public repository I have linked to
-- [ ] I don't have time for that, and cannot share my private repository
-- [ ] The nature of this bug means it's impossible to reproduce publicly
-
-**Additional context**
-
-<!-- Add any other context about the problem here, including your own debugging or ideas on what went wrong. -->

.github/ISSUE_TEMPLATE/bug_report.yml

+name: Bug report
+description: You've found a bug with Renovate.
+labels: ['type:bug', 'status:requirements', 'priority-5-triage']
+body:
+  - type: dropdown
+    id: how-are-you-running-renovate
+    attributes:
+      label: How are you running Renovate?
+      options:
+        - 'WhiteSource Renovate hosted app on github.com'
+        - 'Self-hosted'
+    validations:
+      required: true
+
+  - type: dropdown
+    id: platform-select
+    attributes:
+      label: Please select which platform you are using if self-hosting.
+      options:
+        - 'Azure DevOps (dev.azure.com)'
+        - 'Azure DevOps Server'
+        - 'Bitbucket Cloud (bitbucket.org)'
+        - 'Bitbucket Server'
+        - 'Gitea'
+        - 'github.com'
+        - 'GitHub Enterprise Server'
+        - 'gitlab.com'
+        - 'GitLab self-hosted'
+    validations:
+      required: false
+
+  - type: input
+    id: renovate-version-if-selfhosting
+    attributes:
+      label: If you're self-hosting Renovate, tell us what version of Renovate you run.
+    validations:
+      required: false
+
+  - type: textarea
+    id: describe-bug
+    attributes:
+      label: Describe the bug
+      description: 'Do not report any security concerns here. Email renovate-disclosure@whitesourcesoftware.com instead.'
+    validations:
+      required: true
+
+  - type: textarea
+    id: debug-logs
+    attributes:
+      label: Relevant debug logs
+      description: |
+        Try not to raise a bug report unless you've looked at the logs first.
+        If you're running self-hosted, run with `LOG_LEVEL=debug` in your environment variables and search for whatever dependency/branch/PR that is causing the problem.
+        If you are using the Renovate App, log into https://app.renovatebot.com/dashboard and locate the correct job log for when the problem occurred (e.g. when the PR was created).
+        Paste the *relevant* logs here, not the entire thing and not just a link to the dashboard (others do not have permissions to view them).
+      value: |
+        <details><summary>Logs</summary>
+
+        ```
+        Copy/paste any log here, between the starting and ending backticks
+        ```
+
+        </details>
+    validations:
+      required: false
+
+  - type: dropdown
+    id: minimal-reproduction-repository
+    attributes:
+      label: Have you created a minimal reproduction repository?
+      description: Please read the [minimal reproductions documentation](https://github.com/renovatebot/renovate/blob/main/docs/development/minimal-reproductions.md) to learn how to make a good minimal reproduction repository.
+      options:
+        - 'I have linked to a minimal reproduction repository in the bug description'
+        - 'No reproduction, but I have linked to a public repo where it occurs'
+        - 'No reproduction repository'
+    validations:
+      required: true

.github/ISSUE_TEMPLATE/feature_request.md

----
-name: Feature request
-about: Suggest an idea for this project
-labels: 'type:feature, status:requirements, priority-5-triage'
----
-
-**What would you like Renovate to be able to do?**
-
-<!-- Tell us what requirements you need solving, and be sure to mention too if this is part of any "bigger" problem you're trying to solve. -->
-
-**Did you already have any implementation ideas?**
-
-<!-- In case you've already dug into existing options or source code and have ideas, mention them here. Try to keep implementation ideas separate from *requirements* above -->
-
-<!-- Please also mention here in case this is a feature you'd be interested in writing yourself, so you can be assigned it. -->

.github/ISSUE_TEMPLATE/feature_request.yml

+name: Feature request
+description: Suggest an idea for this project.
+labels: ['type:feature', 'status:requirements', 'priority-5-triage']
+body:
+  - type: textarea
+    id: what-would-you-like-renovate-to-be-able-to-do
+    attributes:
+      label: What would you like Renovate to be able to do?
+      placeholder: "Tell us what requirements you need solving, and be sure to mention too if this is part of any bigger problem you're trying to solve."
+    validations:
+      required: true
+
+  - type: textarea
+    id: implementation-idea-textbox
+    attributes:
+      label: If you have any ideas on how this should be implemented, please tell us here.
+      placeholder: "In case you've already dug into existing options or source code and have ideas, mention them here. Try to keep implementation ideas separate from requirements."
+    validations:
+      required: true
+
+  - type: dropdown
+    id: interested-in-implementing-the-feature
+    attributes:
+      label: Is this a feature you are interested in implementing yourself?
+      options:
+        - 'Yes'
+        - 'No'
+    validations:
+      required: true

.github/ISSUE_TEMPLATE/refactor.yml

+name: Refactor (internal)
+description: For internal use only.
+labels: ['type:refactor', 'status:requirements', 'priority-5-triage']
+body:
+  - type: markdown
+    attributes:
+      value: '# This form is for Renovate maintainers only.'
+
+  - type: textarea
+    id: describe-proposed-changes
+    attributes:
+      label: Describe the proposed change(s).
+      description: 'Do not report any security concerns here. Email renovate-disclosure@whitesourcesoftware.com instead.'
+    validations:
+      required: true

.github/auto-cancel-actions.yml

 version: 1
 push:
   branches:
-    - '!master'
+    - '!main'
 pull_request:

.github/codeql/codeql-config.yml

+paths-ignore:
+  - /__fixtures__/**

.github/contributing.md

@@ -16,9 +16,10 @@ If you've found a **bug** or have a **feature request** then please create an is
 ## Code
 
 If you would like to fix a bug or implement a feature, please fork the repository and create a Pull Request.
-More information on getting set up locally can be found in [docs/development/local-development.md](https://github.com/renovatebot/renovate/blob/master/docs/development/local-development.md).
+To learn how to setup your local workstation correctly read [docs/development/local-development.md](../docs/development/local-development.md).
+Also skim the [docs/development](../docs/development/) folder, it contains a lot of helpful information on things like adding a new package manager, how Renovate branches work, design decisions and more.
 
-Before you start any Pull Request, it's recommended that you create an issue to discuss first if you have any doubts about requirement or implementation.
+Before you start any Pull Request, it's recommended that you open a [discussion](https://github.com/renovatebot/renovate/discussions) first if you have any doubts about requirements or implementation.
 That way you can be sure that the maintainer(s) agree on what to change and how, and you can hopefully get a quick merge afterwards.
 Also, let the maintainers know that you plan to work on a particular issue so that no one else starts any duplicate work.
 
@@ -34,7 +35,7 @@ Commit as many times as you need in your pull request branch.
 Force pushing a PR is OK when:
 
 - you need to make large changes on a PR which require a full review anyway
-- you need to bring the branch up-to-date with the default branch and incorporating the changes is more work than to create a new PR
+- you need to bring the branch up-to-date with the target branch and incorporating the changes is more work than to create a new PR
 
 ## Re-requesting a review
 

.github/label-actions.yml

@@ -3,15 +3,17 @@
     Hi there,
 
 
-    The Renovate team needs your help!
+    Help us by making a minimal reproduction repository.
+
+
     Before we can start work on your issue we first need to know exactly what's causing the current behavior.
     A minimal reproduction helps us with this.
 
 
-    To get started, please read our guide on [minimal reproductions](https://github.com/renovatebot/renovate/blob/master/docs/development/minimal-reproductions.md) to understand what is needed.
+    To get started, please read our guide on creating a [minimal reproduction](https://github.com/renovatebot/renovate/blob/main/docs/development/minimal-reproductions.md) to understand what is needed.
 
 
-    We may close the issue if you have not provided a minimal reproduction within two weeks.
+    We may close the issue if you (or someone else) have not provided a minimal reproduction within two weeks.
     If you need more time, or are stuck, please ask for help or more time in a comment.
 
 
@@ -20,14 +22,6 @@
 
     The Renovate team
 
-'reproduction:provided':
-  comment: >
-    Thank you for providing a reproduction! :tada: :rocket:
-
-
-    The Renovate team will take a look at the reproduction repository.
-    Once we confirm the provided repository reproduces the problem, the label will be changed to `reproduction:confirmed`.
-
 'logs:problem':
   comment: >
     Hi there,
@@ -99,3 +93,35 @@
         </details>
 
     </details>
+
+'new package manager':
+  comment: >
+    Hi there,
+
+
+    You're requesting support for a new package manager.
+    We need to know some basic information about this package manager first.
+    Please copy/paste [the new package manager questionnaire](https://github.com/renovatebot/renovate/blob/main/docs/development/new-package-manager-template.md), and fill it out in full.
+
+
+    Once the questionnaire is filled out we will evaluate if adding support for this manager is something we want to do.
+
+
+    Good luck,
+
+
+    The Renovate team
+
+'retry latest version':
+  comment: >
+    Hi there,
+
+
+    You're reporting a problem with an outdated version of Renovate.
+    Please try the latest version and tell us if that fixes your problem.
+
+
+    Good luck,
+
+
+    The Renovate team

.github/prettifier.yml

 commitMessage: 'Apply prettier formatting fix'
 excludeBranches:
-  - master
+  - main
 pullsOnly: true

.github/pull_request_template.md

@@ -20,11 +20,11 @@
 I have verified these changes via:
 
 - [ ] Code inspection only, or
-- [ ] Newly added unit tests, or
-- [ ] No new tests but ran on a real repository, or
+- [ ] Newly added/modified unit tests, or
+- [ ] No unit tests but ran on a real repository, or
 - [ ] Both unit tests + ran on a real repository
 
-<!-- Do you have any suggestions about this PR template? Edit it here: https://github.com/renovatebot/renovate/edit/master/.github/pull_request_template.md -->
+<!-- Do you have any suggestions about this PR template? Edit it here: https://github.com/renovatebot/renovate/edit/main/.github/pull_request_template.md -->
 
 <!-- Please do not force push to your PR's branch after you have created your PR, as doing so forces us to review the whole PR again. This makes it harder for us to review your work because we don't know what has changed. -->
 <!-- PRs will always be squashed by us when we merge your work. Commit as many times as you need in this branch. -->

.github/workflows/build-pr.yml

@@ -4,13 +4,14 @@ on:
   pull_request:
 
 env:
-  YARN_MODULES_CACHE_KEY: v1
-  YARN_PACKAGE_CACHE_KEY: v1
-  YARN_CACHE_FOLDER: .cache/yarn
   NODE_VERSION: 14
-  PYTHON_VERSION: 3.8
+  PYTHON_VERSION: 3.9
   SKIP_JAVA_TESTS: true
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   test:
     runs-on: ubuntu-latest
@@ -19,13 +20,18 @@ jobs:
     timeout-minutes: 30
 
     steps:
+      - uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f # renovate: tag=v2.3.4
+        with:
+          fetch-depth: 2
+
       - name: Set up Node.js ${{ env.NODE_VERSION }}
-        uses: actions/setup-node@v2.1.5
+        uses: actions/setup-node@25316bbc1f10ac9d8798711f44914b1cf3c4e954 # renovate: tag=v2.4.0
         with:
           node-version: ${{ env.NODE_VERSION }}
+          cache: yarn
 
       - name: Set up Python ${{ env.PYTHON_VERSION }}
-        uses: actions/setup-python@v2.2.2
+        uses: actions/setup-python@dc73133d4da04e56a135ae2246682783cc7c7cb6 # renovate: tag=v2.2.2
         with:
           python-version: ${{ env.PYTHON_VERSION }}
 
@@ -37,36 +43,19 @@ jobs:
           git config --global user.email 'renovate@whitesourcesoftware.com'
           git config --global user.name  'Renovate Bot'
           npm config set scripts-prepend-node-path true
+          git --version
           echo "Node $(node --version)"
           python --version
           echo "Yarn $(yarn --version)"
 
-      - uses: actions/checkout@v2.3.4
-        with:
-          fetch-depth: 2
-
-      - name: Cache Yarn packages
-        id: yarn_cache_packages
-        uses: actions/cache@v2.1.5
-        with:
-          path: ${{ env.YARN_CACHE_FOLDER }}
-          key: ${{ env.YARN_PACKAGE_CACHE_KEY }}-${{ runner.os }}-yarn_cache-${{ hashFiles('**/yarn.lock') }}
-          restore-keys: |
-            ${{ env.YARN_PACKAGE_CACHE_KEY }}-${{ runner.os }}-yarn_cache-
-
-      # Clear caches on cache miss, otherwise they will grow indefinitely
-      - name: Clear yarn cache
-        if: steps.yarn_cache_packages.outputs.cache-hit != 'true'
-        run: yarn cache clean
-
       - name: Installing dependencies
         run: yarn install --frozen-lockfile
 
       - name: Unit tests
-        run: yarn jest --logHeapUsage --maxWorkers=2 --ci
+        run: yarn jest --maxWorkers=2 --ci
 
       - name: Codecov
-        uses: codecov/codecov-action@v1.3.2
+        uses: codecov/codecov-action@f32b3a3741e1053eb607407145bc9619351dc93b # renovate: tag=v2.1.0
         if: always()
 
       # build after tests to exclude files
@@ -83,10 +72,15 @@ jobs:
     timeout-minutes: 15
 
     steps:
+      - uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f # renovate: tag=v2.3.4
+        with:
+          fetch-depth: 2
+
       - name: Set up Node.js ${{ env.NODE_VERSION }}
-        uses: actions/setup-node@v2.1.5
+        uses: actions/setup-node@25316bbc1f10ac9d8798711f44914b1cf3c4e954 # renovate: tag=v2.4.0
         with:
           node-version: ${{ env.NODE_VERSION }}
+          cache: yarn
 
       - name: Init platform
         run: |
@@ -98,30 +92,16 @@ jobs:
           echo "Node $(node --version)"
           echo "Yarn $(yarn --version)"
 
-      - uses: actions/checkout@v2.3.4
-
-      - name: Cache Yarn packages
-        id: yarn_cache_packages
-        uses: actions/cache@v2.1.5
-        with:
-          path: ${{ env.YARN_CACHE_FOLDER }}
-          key: ${{ env.YARN_PACKAGE_CACHE_KEY }}-${{ runner.os }}-yarn_cache-${{ hashFiles('**/yarn.lock') }}
-          restore-keys: |
-            ${{ env.YARN_PACKAGE_CACHE_KEY }}-${{ runner.os }}-yarn_cache-
-
-      # Clear caches on cache miss, otherwise they will grow indefinitely
-      - name: Clear yarn cache
-        if: steps.yarn_cache_packages.outputs.cache-hit != 'true'
-        run: yarn cache clean
-
       - name: Installing dependencies
         run: yarn install --frozen-lockfile
 
       - name: Lint
         run: |
           yarn ls-lint
-          yarn eslint
+          yarn eslint -f gha
           yarn prettier
+          yarn markdown-lint
+          yarn git-check
 
       - name: Test schema
         run: yarn test-schema

.github/workflows/build.yml

@@ -3,15 +3,21 @@ name: build
 on:
   push:
     branches:
-      - master
+      - main
+      - v25
 
   workflow_dispatch:
+    inputs:
+      dryRun:
+        description: 'Dry-Run'
+        default: 'true'
+        required: false
 
 env:
-  YARN_MODULES_CACHE_KEY: v1
-  YARN_PACKAGE_CACHE_KEY: v1
-  YARN_CACHE_FOLDER: .cache/yarn
+  # Currently no way to detect automatically (#8153)
+  DEFAULT_BRANCH: main
   NODE_VERSION: 14
+  DRY_RUN: true
 
 jobs:
   test:
@@ -22,9 +28,9 @@ jobs:
 
     strategy:
       matrix:
-        os: [ubuntu-latest, macos-latest, windows-latest]
+        os: [ubuntu-latest, macos-11, windows-latest]
         node-version: [14]
-        python-version: [3.8]
+        python-version: [3.9]
         java-version: [11]
 
     env:
@@ -34,21 +40,29 @@ jobs:
       JAVA_VERSION: ${{ matrix.java-version }}
 
     steps:
+      - uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f # renovate: tag=v2.3.4
+        with:
+          fetch-depth: 2
+
       - name: Set up Node.js ${{ env.NODE_VERSION }}
-        uses: actions/setup-node@v2.1.5
+        uses: actions/setup-node@25316bbc1f10ac9d8798711f44914b1cf3c4e954 # renovate: tag=v2.4.0
         with:
           node-version: ${{ env.NODE_VERSION }}
+          cache: yarn
 
       - name: Set up Python ${{ env.PYTHON_VERSION }}
-        uses: actions/setup-python@v2.2.2
+        uses: actions/setup-python@dc73133d4da04e56a135ae2246682783cc7c7cb6 # renovate: tag=v2.2.2
         with:
           python-version: ${{ env.PYTHON_VERSION }}
 
       - name: Set up Java  ${{ env.JAVA_VERSION }}
         if: env.NODE_VERSION == '14'
-        uses: actions/setup-java@v1.4.3
+        uses: actions/setup-java@3bc31aaf88e8fc94dc1e632d48af61be5ca8721c # renovate: tag=v2.3.0
         with:
           java-version: ${{ env.JAVA_VERSION }}
+          distribution: 'adopt'
+          java-package: jre
+          check-latest: false
 
       - name: Skip Java tests
         if: env.NODE_VERSION != '14'
@@ -62,39 +76,23 @@ jobs:
           git config --global user.email 'renovate@whitesourcesoftware.com'
           git config --global user.name  'Renovate Bot'
           npm config set scripts-prepend-node-path true
+          git --version
           echo "Node $(node --version)"
           python --version
           echo "Yarn $(yarn --version)"
 
-      - uses: actions/checkout@v2.3.4
-        with:
-          fetch-depth: 2
-
-      - name: Cache Yarn packages
-        id: yarn_cache_packages
-        uses: actions/cache@v2.1.5
-        with:
-          path: ${{ env.YARN_CACHE_FOLDER }}
-          key: ${{ env.YARN_PACKAGE_CACHE_KEY }}-${{ runner.os }}-yarn_cache-${{ hashFiles('**/yarn.lock') }}
-          restore-keys: |
-            ${{ env.YARN_PACKAGE_CACHE_KEY }}-${{ runner.os }}-yarn_cache-
-
-      # Clear caches on cache miss, otherwise they will grow indefinitely
-      - name: Clear yarn cache
-        if: steps.yarn_cache_packages.outputs.cache-hit != 'true'
-        run: yarn cache clean
-
       - name: Installing dependencies
         run: yarn install --frozen-lockfile
 
       - name: Unit tests
-        run: yarn jest --logHeapUsage --maxWorkers=2 --ci --coverage ${{ env.coverage }}
+        run: yarn jest --maxWorkers=2 --ci --coverage ${{ env.coverage }}
 
       - name: Codecov
-        uses: codecov/codecov-action@v1.3.2
+        uses: codecov/codecov-action@f32b3a3741e1053eb607407145bc9619351dc93b # renovate: tag=v2.1.0
         if: always() && env.coverage == 'true'
 
-      # build after tests to exclude files
+      # build after tests to exclude build files from tests
+      # TODO: check if build before test speeds up tests
       - name: Build
         run: yarn build
 
@@ -108,10 +106,15 @@ jobs:
     timeout-minutes: 15
 
     steps:
+      - uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f # renovate: tag=v2.3.4
+        with:
+          fetch-depth: 2
+
       - name: Set up Node.js ${{ env.NODE_VERSION }}
-        uses: actions/setup-node@v2.1.5
+        uses: actions/setup-node@25316bbc1f10ac9d8798711f44914b1cf3c4e954 # renovate: tag=v2.4.0
         with:
           node-version: ${{ env.NODE_VERSION }}
+          cache: yarn
 
       - name: Init platform
         run: |
@@ -123,30 +126,16 @@ jobs:
           echo "Node $(node --version)"
           echo "Yarn $(yarn --version)"
 
-      - uses: actions/checkout@v2.3.4
-
-      - name: Cache Yarn packages
-        id: yarn_cache_packages
-        uses: actions/cache@v2.1.5
-        with:
-          path: ${{ env.YARN_CACHE_FOLDER }}
-          key: ${{ env.YARN_PACKAGE_CACHE_KEY }}-${{ runner.os }}-yarn_cache-${{ hashFiles('**/yarn.lock') }}
-          restore-keys: |
-            ${{ env.YARN_PACKAGE_CACHE_KEY }}-${{ runner.os }}-yarn_cache-
-
-      # Clear caches on cache miss, otherwise they will grow indefinitely
-      - name: Clear yarn cache
-        if: steps.yarn_cache_packages.outputs.cache-hit != 'true'
-        run: yarn cache clean
-
       - name: Installing dependencies
         run: yarn install --frozen-lockfile
 
       - name: Lint
         run: |
           yarn ls-lint
-          yarn eslint -f ./tmp/tools/eslint-gh-reporter.js
+          yarn eslint -f gha
           yarn prettier
+          yarn markdown-lint
+          yarn git-check
 
       - name: Test schema
         run: yarn test-schema
@@ -161,10 +150,16 @@ jobs:
     timeout-minutes: 15
 
     steps:
+      # full checkout for semantic-release
+      - uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f # renovate: tag=v2.3.4
+        with:
+          fetch-depth: 0
+
       - name: Set up Node.js ${{ env.NODE_VERSION }}
-        uses: actions/setup-node@v2.1.5
+        uses: actions/setup-node@25316bbc1f10ac9d8798711f44914b1cf3c4e954 # renovate: tag=v2.4.0
         with:
           node-version: ${{ env.NODE_VERSION }}
+          cache: yarn
 
       - name: Init platform
         run: |
@@ -175,25 +170,24 @@ jobs:
           yarn config set version-git-tag false
           npm config set scripts-prepend-node-path true
 
-      # full checkout for semantic-release
-      - uses: actions/checkout@v2.3.4
-        with:
-          fetch-depth: 0
-
-      - name: Cache Yarn packages
-        uses: actions/cache@v2.1.5
-        with:
-          path: ${{ env.YARN_CACHE_FOLDER }}
-          key: ${{ env.YARN_PACKAGE_CACHE_KEY }}-${{ runner.os }}-yarn_cache-${{ hashFiles('**/yarn.lock') }}
+      - name: Check dry run
+        run: |
+          if [[ "${{github.event_name}}" == "workflow_dispatch" && "${{ github.event.inputs.dryRun }}" != "true"  ]]; then
+            echo "DRY_RUN=false" >> $GITHUB_ENV
+          elif [[ "${{github.ref}}" == "refs/heads/${{env.DEFAULT_BRANCH}}" ]]; then
+            echo "DRY_RUN=false" >> $GITHUB_ENV
+          elif [[ "${{github.ref}}" =~ ^refs/heads/v[0-9]+(\.[0-9]+)?$ ]]; then
+            echo "DRY_RUN=false" >> $GITHUB_ENV
+          fi
 
       - name: Installing dependencies
         run: yarn install --frozen-lockfile
 
       - name: semantic-release
-        if: github.ref == 'refs/heads/master'
         run: |
-          echo '//registry.npmjs.org/:_authToken=${NPM_TOKEN}' >> ~/.npmrc
-          npx semantic-release --dry-run ${{github.ref != 'refs/heads/master'}} --ci ${{github.ref == 'refs/heads/master'}}
+          echo '//registry.npmjs.org/:_authToken=${NPM_TOKEN}' >> ./.npmrc
+          npx semantic-release --dry-run ${{env.DRY_RUN}}
+          git checkout -- .npmrc
         env:
           GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}
           NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

.github/workflows/codeql-analysis.yml

@@ -2,24 +2,33 @@ name: 'Code scanning - action'
 
 on:
   push:
-    branches: [master]
+    branches: [main]
   pull_request:
     # The branches below must be a subset of the branches above
-    branches: [master]
+    branches: [main]
   schedule:
     - cron: '0 13 * * 1'
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.number || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  security-events: write
+
 jobs:
   CodeQL-Build:
     runs-on: ubuntu-latest
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v2.3.4
+        uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f # renovate: tag=v2.3.4
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v1
+        uses: github/codeql-action/init@4854dd23d5f2aada3f026670784d5109e7702ea9 # renovate: tag=v1.0.14
+        with:
+          config-file: ./.github/codeql/codeql-config.yml
 
         # Override language selection by uncommenting this and choosing your languages
         # with:
@@ -27,7 +36,7 @@ jobs:
       # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
       # If this step fails, then you should remove it and run the build manually (see below)
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v1
+        uses: github/codeql-action/autobuild@4854dd23d5f2aada3f026670784d5109e7702ea9 # renovate: tag=v1.0.14
 
       # ℹ️ Command-line programs to run using the OS shell.
       # 📚 https://git.io/JvXDl
@@ -41,4 +50,4 @@ jobs:
       #   make release
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v1
+        uses: github/codeql-action/analyze@4854dd23d5f2aada3f026670784d5109e7702ea9 # renovate: tag=v1.0.14

.github/workflows/label-actions.yml

@@ -4,11 +4,15 @@ on:
   issues:
     types: [labeled]
 
+permissions:
+  contents: read
+  issues: write
+
 jobs:
   reaction:
     runs-on: ubuntu-latest
     steps:
-      - uses: dessant/label-actions@v2
+      - uses: dessant/label-actions@201c706f66d13baf871b4af784bbdb7555e983b4 # renovate: tag=v2.1.3
         with:
           github-token: ${{ github.token }}
           process-only: 'issues'

.github/workflows/lock.yml

@@ -8,11 +8,15 @@ on:
   # allow manual trigger
   workflow_dispatch:
 
+permissions:
+  issues: write
+  pull-requests: write
+
 jobs:
   lock:
     runs-on: ubuntu-latest
     steps:
-      - uses: dessant/lock-threads@v2.0.3
+      - uses: dessant/lock-threads@f1a42f0f44eb83361d617a014663e1a76cf282d2 # renovate: tag=v2.1.2
         if: github.repository == 'renovatebot/renovate'
         with:
           github-token: ${{ github.token }}

.github/workflows/release-npm.yml

 name: release-npm
+
 on:
   repository_dispatch:
     types: [renovate-release]
 
+  workflow_dispatch:
+    inputs:
+      sha:
+        description: 'Git sha to checkout'
+        required: true
+      version:
+        description: 'Version to release'
+        required: true
+      tag:
+        description: 'Npm dist-tag'
+        default: 'latest'
+        required: false
+
 env:
-  YARN_MODULES_CACHE_KEY: v1
-  YARN_PACKAGE_CACHE_KEY: v1
-  YARN_CACHE_FOLDER: .cache/yarn
   NODE_VERSION: 14
+  GIT_SHA: ${{ github.event.client_payload.sha }}
+  NPM_VERSION: ${{ github.event.client_payload.version }}
+  NPM_TAG: ${{ github.event.client_payload.tag }}
 
 jobs:
   release-npm:
     runs-on: ubuntu-latest
     steps:
+      - name: Prepare env
+        run: |
+          if [[ "${{github.event_name}}" == "workflow_dispatch" ]]; then
+            echo "GIT_SHA=${{ github.event.inputs.sha }}" >> $GITHUB_ENV
+            echo "NPM_VERSION=${{ github.event.inputs.version }}" >> $GITHUB_ENV
+            echo "NPM_TAG=${{ github.event.inputs.tag }}" >> $GITHUB_ENV
+          fi
+
+      - uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f # renovate: tag=v2.3.4
+        with:
+          ref: ${{ env.GIT_SHA }}
+
       - name: Set up Node.js ${{ env.NODE_VERSION }}
-        uses: actions/setup-node@v2.1.5
+        uses: actions/setup-node@25316bbc1f10ac9d8798711f44914b1cf3c4e954 # renovate: tag=v2.4.0
         with:
           node-version: ${{ env.NODE_VERSION }}
+          cache: yarn
 
       - name: Init platform
         run: |
@@ -27,30 +54,20 @@ jobs:
           yarn config set version-git-tag false
           npm config set scripts-prepend-node-path true
 
-      - uses: actions/checkout@v2.3.4
-        with:
-          ref: ${{ github.event.client_payload.sha }}
-
-      - name: Cache Yarn packages
-        id: yarn_cache_packages
-        uses: actions/cache@v2.1.5
-        with:
-          path: ${{ env.YARN_CACHE_FOLDER }}
-          key: ${{ env.YARN_PACKAGE_CACHE_KEY }}-${{ runner.os }}-yarn_cache-${{ hashFiles('**/yarn.lock') }}
-
       - name: Installing dependencies
         run: yarn install --frozen-lockfile
 
-      - name: Build ${{ github.event.client_payload.version }}
+      - name: Build ${{ env.NPM_VERSION }}
         run: yarn build
 
-      - name: Prepare ${{ github.event.client_payload.version }}
+      - name: Prepare  ${{ env.NPM_VERSION }}
         run: |
-          npm --no-git-tag-version version ${{ github.event.client_payload.version }}
+          npm --no-git-tag-version version ${{ env.NPM_VERSION }}
 
-      - name: Publish ${{ github.event.client_payload.version }}
+      - name: Publish ${{ env.NPM_VERSION }}
         run: |
-          echo '//registry.npmjs.org/:_authToken=${NPM_TOKEN}' >> ~/.npmrc
-          npm publish
+          echo '//registry.npmjs.org/:_authToken=${NPM_TOKEN}' >> ./.npmrc
+          npm publish --tag ${{ env.NPM_TAG }}
+          git checkout -- .npmrc
         env:
           NPM_TOKEN: ${{ secrets.NPM_TOKEN }}