feat: add support for go:generate directives in gomod #39163
Conversation
|
|
This change adds a `goGenerate` postUpdateOption which enables running `go generate ./...` after a dependency update. Frequently when dependencies are brought in via tools or using vendored code, and those dependencies are used for go:generate instructions, we want to update the generated code after the dependency has been updated. Adding this as a postUpdateCommand wasn't really satisfactory since that necessarily requires making a change in two spots (one in the allowed commands, one in the postUpdateCommand). The other reason this was undesirable was it would cause generate to run after every dependency update, regardless of language.
0348585 to
0685872
Compare
viceice
left a comment
There was a problem hiding this comment.
LGTM besides some security concerns 🤔
|
Yeah this does technically have some very valid risks, because we are now executing arbitrary commands Note that this does have similar risks to https://docs.renovatebot.com/modules/manager/gradle/#dependency-verification where running The code being executed (to generate code) could be maliciously attacked, similar to what we see with |
|
@jamietanna : What is the generally accepted practice for dealing with these types of issues in renovate dependency bumps? Possible options I can come up with:
If you think 1 is viable, I suspect the right spot to insert it would be similar to where goGetDirs is currently configured: https://docs.renovatebot.com/configuration-options/#gogetdirs and add an option such as: Where the valid config would be: if empty: run go generate after updating any dependency Thoughts? |
|
(Haven't forgotten about this - will get back to it this week - need to have a think) |
Changes
This change adds a
goGeneratepostUpdateOption which enables runninggo generate ./...after a dependency update.Frequently when dependencies are brought in via tools or using vendored code, and those dependencies are used for go:generate instructions, we want to update the generated code after the dependency has been updated.
Adding this as a postUpdateCommand wasn't really satisfactory since that necessarily requires making a change in two spots (one in the allowed commands, one in the postUpdateCommand). The other reason this was undesirable was it would cause generate to run after every dependency update, regardless of language.
Context
Please select one of the below:
AI assistance disclosure
Did you use AI tools to create any part of this pull request?
Please select one option and, if yes, briefly describe how AI was used (e.g., code, tests, docs) and which tool(s) you used.
Documentation (please check one with an [x])
How I've tested my work (please select one)
I have verified these changes via:
The public repository: n/a (is private)