branchNameStrict is not working as expected

[Nitrael86]

How are you running Renovate?

Self-hosted Renovate

Which platform you running Renovate on?

GitLab (.com or self-hosted)

Which version of Renovate are you using?

41.143.1

Please tell us more about your question or problem

We have set the property "branchNameStrict": true, but the branch names still contains "." characters.

config:

         "branchPrefix": "renovate-",
         "branchNameStrict": true,

In our case we use 2 sets of basebranches:

 "baseBranches": ["master", "12.12.0"],
  "packageRules": [
    { "matchDatasources": ["docker"],
      "pinDigests": false
    },
    { "matchBaseBranches": ["12.12.0"],
      "excludePackageNames": ["base-almalinux9"],
      "enabled": false
    },

as soon as there is a new almalinux version renovate tries to create a new branch, but with the following name:

DEBUG: dependencyDashboardCheck=undefined (repository=abc/xyz, baseBranch=12.12.0, branch=renovate-12.12.0-major-base-container)

And in the renovate branch name there are some special characters according to the documentation:

"The default false behavior will mean that special characters like . and / may end up in the branch name."

Logs (if relevant)

Logs

Replace this text with your logs, between the starting and ending triple backticks

[github-actions[bot]]

Hi there,

Please help this Discussion progress by creating a minimal reproduction. This means a repository dedicated to reproducing this issue with the minimal dependencies and config possible.

Before we start working on your issue we need to know exactly what's causing the current behavior. A minimal reproduction helps us with this. Discussions without reproductions are less likely to be converted to Issues.

Please follow these steps:

1. Read our guide on creating a minimal reproduction.
2. Go to our minimal reproduction template repository.
3. Select the Use this template button to create a new repository based on the template.
4. Work on the reproduction in your own repository. Ensure it's actually minimal (no unnecesary dependencies or config), or it will be rejected by maintainers.
5. Install the Renovate app to verify that what you say happens (or doesn't happen) reproduces.
6. Fill out the information in your repository's README.md. What you describe there should reflect what you see in this repo, with the hosted app, and not what you saw in your original repo/environment.
7. Add the link to your reproduction to the first post of your Discussion. If you are not the original author, you can post a new comment with the link.
8. Add a Discussion comment mentioning that the reproduction repo is now available and linked.

If you need help with running Renovate on your minimal reproduction repository, please refer to our Running Renovate guide.
Good luck,

The Renovate team

[stefan-kaltenberger]

Hi,

I had a quick look at the code. The reason for the described behavior is as follows:

getBaseBranchConfig appends the baseBranch name without any sanitization to branchPrefix:

renovate/lib/workers/repository/process/index.ts

Lines 97 to 100 in c7586ae

	if (isMultiBaseBranch(config)) {
	baseBranchConfig.branchPrefix += `${baseBranch}-`;
	baseBranchConfig.hasBaseBranches = true;
	}

cleanBranchName strips and then re-appends the branchPrefix, so it is effectively ignored for cleaning purposes:

renovate/lib/workers/repository/updates/branch-name.ts

Lines 34 to 43 in c7586ae

	let existingBranchPrefix = '';
	if (branchNameStrict) {
	if (cleanedBranchName.startsWith(branchPrefix)) {
	existingBranchPrefix = branchPrefix;
	cleanedBranchName = cleanedBranchName.slice(branchPrefix.length);
	}
	cleanedBranchName =
	existingBranchPrefix +
	cleanedBranchName.replace(RE_SPECIAL_CHARS_STRICT, '-'); // massage out all special characters that slip through slugify
	}

I assume the decision not to filter the prefix was based on the idea that an existing branch name must always be valid, and because the default branchPrefix ends with a slash.

In my case, the Renovate branch name now matches the GitLab protected branch pattern and therefore becomes protected. This means that the Renovate bot is not allowed to push its changes to the branch, and as an additional side effect, the branch cannot be amended or deleted by a regular user. I cannot change the protection pattern because GitLab unfortunately does not support regular expressions for this purpose (see https://gitlab.com/groups/gitlab-org/-/epics/15243). As a workaround, I am now using the deprecated branchName option.

I would suggest removing the special handling from cleanBranchName and simply clean the entire branch name. In my opinion, the branchNameStrict option means that the characters defined by RE_SPECIAL_CHARS_STRICT are entirely prohibited. Is there any reason not to do this?

Regards, Stefan