feat(vendir): support extracting HTTP sources

As noted in #41435, Vendir's support for HTTP sources would be useful
for Renovate to keep updated.

Instead of managing the updating of files ourselves, we can use Vendir's
existing `lockFileMaintenance` task to do so, where `vendir sync` will
re-fetch the remote file(s) and sync them to the repo.

For this to be supported, we can extract the HTTP sources with
`unsupported-datasource`, so Renovate knows that the dependency is
there, but can't be managed by us.

This makes it possible to extract HTTP dependencies, and then have
Renovate update them through `lockFileMaintenance`.

Author: jamietanna

lib/modules/manager/vendir/__fixtures__/valid-contents.yaml

@@ -41,3 +41,6 @@ directories:
     githubRelease:
       slug: test/test
       tag: "7.10.1"
+  - path: openapi
+    http:
+      url: https://raw.githubusercontent.com/mend/renovate-ce-ee/refs/heads/main/docs/openapi-community.yaml

lib/modules/manager/vendir/extract.spec.ts

@@ -84,6 +84,13 @@ describe('modules/manager/vendir/extract', () => {
             packageName: 'test/test',
             datasource: 'github-releases',
           },
+          {
+            currentValue: 'latest',
+            packageName:
+              'https://raw.githubusercontent.com/mend/renovate-ce-ee/refs/heads/main/docs/openapi-community.yaml',
+            depType: 'HttpSource',
+            skipReason: 'unsupported-datasource',
+          },
         ],
       });
       // git-refs datasource does not support custom registries

lib/modules/manager/vendir/extract.ts

@@ -15,6 +15,7 @@ import type {
   GitRefDefinition,
   GithubReleaseDefinition,
   HelmChartDefinition,
+  HttpReleaseDefinition,
   VendirDefinition,
 } from './schema.ts';
 import { Vendir } from './schema.ts';
@@ -71,6 +72,17 @@ export function extractGithubReleaseSource(
   };
 }
 
+export function extractHttpReleaseSource(
+  httpRelease: HttpReleaseDefinition,
+): PackageDependency {
+  return {
+    packageName: httpRelease.url,
+    currentValue: 'latest',
+    depType: 'HttpSource',
+    skipReason: 'unsupported-datasource',
+  };
+}
+
 export function parseVendir(
   content: string,
   packageFile?: string,
@@ -111,6 +123,9 @@ export function extractPackageFile(
     } else if ('githubRelease' in content && content.githubRelease) {
       const dep = extractGithubReleaseSource(content.githubRelease);
       deps.push(dep);
+    } else if ('http' in content && content.http) {
+      const dep = extractHttpReleaseSource(content.http);
+      deps.push(dep);
     }
   }
 

lib/modules/manager/vendir/readme.md

@@ -80,3 +80,22 @@ directories:
         # optional if tagSelection is specified (available in v0.22.0+)
         tag: v0.1.0
 ```
+
+### HTTP
+
+<!-- prettier-ignore -->
+!!! note
+    Updates to dependencies tracked through the HTTP source can only be updated using [`lockFileMaintenance`](../../../configuration-options.md#lockfilemaintenance).
+
+Renovate can extract HTTP dependency sources, but will not update them without [`lockFileMaintenance`](../../../configuration-options.md#lockfilemaintenance).
+
+```yaml title="Example vendir.yml for syncing a remote file"
+apiVersion: vendir.k14s.io/v1alpha1
+kind: Config
+directories:
+  - path: internal
+    contents:
+      - path: renovate-ce
+        http:
+          url: https://raw.githubusercontent.com/mend/renovate-ce-ee/refs/main/docs/openapi-community.yaml
+```

lib/modules/manager/vendir/schema.ts

@@ -41,10 +41,20 @@ export const GithubReleaseContent = z.object({
   githubRelease: GithubRelease,
 });
 
+export const HttpRelease = z.object({
+  url: z.string(),
+});
+
+export const HttpContent = z.object({
+  path: z.string(),
+  http: HttpRelease,
+});
+
 export const Contents = z.union([
   HelmChartContent,
   GitRefContent,
   GithubReleaseContent,
+  HttpContent,
 ]);
 
 export const Vendir = VendirResource.extend({
@@ -60,3 +70,4 @@ export type VendirDefinition = z.infer<typeof Vendir>;
 export type HelmChartDefinition = z.infer<typeof HelmChart>;
 export type GitRefDefinition = z.infer<typeof GitRef>;
 export type GithubReleaseDefinition = z.infer<typeof GithubRelease>;
+export type HttpReleaseDefinition = z.infer<typeof HttpRelease>;