Request for Clarification: Removal of Beachball Command from allowedPostUpgradeCommands

[liby]

What would you like help with?

I would like help with my configuration

How are you running Renovate?

Mend Renovate hosted app on github.com

If you're self-hosting Renovate, tell us which platform (GitHub, GitLab, etc) and which version of Renovate.

No response

Please tell us more about your question or problem

Hi, I've noticed a change in the Renovate configuration that I'd like to clarify. It appears that the following command has been removed from the allowedPostUpgradeCommands list:

"^npx beachball change( --no-fetch)? --no-commit --type (patch|none) --message '{{{commitMessage}}}'$"

Observed Changes

I observed this change by comparing Renovate job logs:

1. On Sep 03, 2024, 09:13:11 UTC, the command was present in the allowedPostUpgradeCommands list.
2. From Sep 03, 2024, 13:43:49 UTC onwards, the command was no longer in the list.

Impact

This change affects repositories that are not using self-hosted Renovate and have declared the following in their postUpgradeTasks:

"^npx beachball change( --no-fetch)? --no-commit --type (patch|none) --message '{{{commitMessage}}}'$"

These repositories now encounter the following error when Renovate runs:

Post-upgrade command 'npx beachball change --no-fetch --no-commit --type patch --message '{{{commitMessage}}}'' has not been added to the allowed list in allowedPostUpgradeCommands

Understanding the Context

I'm aware that:

1. Renovate documentation clearly states: "Post-upgrade tasks can only be used on self-hosted Renovate instances."
2. There are alternative ways to achieve the desired outcome, such as:
   a. Using a self-hosted Renovate instance
   b. Writing a custom script to generate changefiles for unreleased changes, either automatically or manually at a different point in the process

Request for Clarification

I would like to confirm if the removal of the Beachball command from allowedPostUpgradeCommands was intentional and expected.

If this change was intentional, could you please provide some insight into the reasoning behind it? This information would be valuable for users who may need to adjust their workflows accordingly.

Thank you for your time and assistance in clarifying this matter.

Logs (if relevant)

Started at: Sep 03, 2024, 09:13:11 UTC

DEBUG: Using RE2 regex engine
DEBUG: Parsing configs
DEBUG: Checking for config file in /runner/renovate/job_config.json
DEBUG: Detected config in env RENOVATE_CONFIG
{
  "config": {
    "extends": [
      "mergeConfidence:all-badges"
    ],
    "prFooter": "This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/{{platform}}/{{repository}}).",
    "redisUrl": "redis://mend-developer-platform-renovate-prod.aqffol.ng.0001.use1.cache.amazonaws.com:6379",
    "binarySource": "install",
    "platformCommit": "enabled",
    "repositoryCache": "enabled",
    "cacheTtlOverride": {
      "datasource-docker-hub-tags": 90
    },
    "encryptedWarning": "Encrypted secrets were detected in the repository config. This feature has been deprecated. Please migrate them to this portal. See the guide at http://docs.renovatebot.com/mend-hosted/migrating-secrets/",
    "onboardingConfig": {
      "$schema": "https://docs.renovatebot.com/renovate-schema.json",
      "extends": [
        "config:recommended"
      ]
    },
    "gitIgnoredAuthors": [
      "29139614+renovate[bot]@users.noreply.github.com"
    ],
    "customizeDashboard": {
      "repoProblemsHeader": "These problems occurred while renovating this repository. [View logs](https://developer.mend.io//{{platform}}/{{repository}})."
    },
    "repositoryCacheType": "s3://mend-developer-platform-prod/renovate/",
    "dependencyDashboardFooter": "\n- [ ] <!-- manual job -->Check this box to trigger a request for Renovate to run again on this repository\n",
    "allowedPostUpgradeCommands": [
      "^git add --all$",
      "^git reset$",
      "^npx beachball change( --no-fetch)? --no-commit --type (patch|none) --message '{{{commitMessage}}}'$",
      "^pwd$"
    ],
    "allowPostUpgradeCommandTemplating": true
  }
}

Started at: Sep 03, 2024, 13:43:49 UTC

DEBUG: Using RE2 regex engine
DEBUG: Parsing configs
DEBUG: Checking for config file in /runner/renovate/job_config.json
DEBUG: Detected config in env RENOVATE_CONFIG
{
  "config": {
    "extends": [
      "mergeConfidence:all-badges"
    ],
    "prFooter": "This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/{{platform}}/{{repository}}).",
    "redisUrl": "redis://mend-developer-platform-renovate-prod.aqffol.ng.0001.use1.cache.amazonaws.com:6379",
    "binarySource": "install",
    "platformCommit": "enabled",
    "repositoryCache": "enabled",
    "cacheTtlOverride": {
      "datasource-docker-hub-tags": 90
    },
    "encryptedWarning": "Encrypted secrets were detected in the repository config. This feature has been deprecated. Please migrate them to this portal. See the guide at http://docs.renovatebot.com/mend-hosted/migrating-secrets/",
    "onboardingConfig": {
      "$schema": "https://docs.renovatebot.com/renovate-schema.json",
      "extends": [
        "config:recommended"
      ]
    },
    "gitIgnoredAuthors": [
      "29139614+renovate[bot]@users.noreply.github.com"
    ],
    "customizeDashboard": {
      "repoProblemsHeader": "These problems occurred while renovating this repository. [View logs](https://developer.mend.io//{{platform}}/{{repository}})."
    },
    "repositoryCacheType": "s3://mend-developer-platform-prod/renovate/",
    "dependencyDashboardFooter": "\n- [ ] <!-- manual job -->Check this box to trigger a request for Renovate to run again on this repository\n",
    "allowedPostUpgradeCommands": [
      "^git add --all$",
      "^git reset$",
      "^pwd$"
    ],
    "allowPostUpgradeCommandTemplating": true
  }
}

[rarkins]

Unfortunately the npx command is too easily manipulable for us to allow it to be run by all repos, so it has been limited to only the (trusted) org which originally requested it (github.com/microsoft).

Our plans are that we will allow paying (Mend.io) customers or approved Open Source projects with a valid need to run "arbitrary" commands, but otherwise they'll be fairly locked down for all free accounts.