Path-based hostRules

[rarkins]

What would you like Renovate to be able to do?

Support greater granularity of hostRules. There may be cases where they are specific to a certain path, for example.

Describe the solution you'd like

Concrete example: npm .npmrc or Composer auth.json could be found within subdirectories, and maybe more than one per repo if it's a monorepo.

Describe alternatives you've considered

Currently our hostRules are "global" for the repo. This was partly to save ourselves passing extra config around, but also as a part security feature that decreased the chance that the hostRules config is accidentally leaked.

Additional context

There's may be three possible ways to implement this:

Approach 1: add optional path and package awareness to hostRules

This would retain the "global" hostRules but allow them to be configured with paths and maybe package names. However this solution would require all calls to our got wrapper to include filename and/or package name information.

Approach 2: refactor hostRules so that they are kept in config like packageRules are, and passed "down the chain". This would allow a hostRule to be returned from an extract function, for example - or maybe even embedded within a packageRule. This would require that the config is passed all the way to our got wrapper so that hostRules can be read.

Approach 3: deprecate hostRules and merge all concepts into packageRules. Not sure this is really feasible though.

[viceice]

🤔 I like the idea to add hostRules from managers (eg read from .npmrc and others)

[rarkins]

If parsing .npmrc, we'd need to do at least this:

• Convert scoped instructions into packageRules containing the scope as packagePatterns and then the host as registryUrls
• Convert host into hostRules matching endpoint or hostname and with token

[rarkins]

hostRules would come from:

• Global config init (bot config)
• per-repo init (repo config)
• Extraction of manager files

hostRules are currently used in:

• datasources: docker, npm, packagist
• manager artifacts: bundler, composer, gomod, npm
• all platforms
• changelog retrieval

[rarkins]

Platforms should save the token or username/password passed during initPlatform() and then add it using their own http wrapper. Each platform request won't use hostRules.

Platforms could return one rule for the hostName alone, and another for hostName + hostType, to allow for cases where managers search for rules by hostType.

hostRules order:

• platform-generated
• global bot config
• repo config
• manager-extracted