From 66f1ef564d1baf0bd13105770e118c10c9d7199d Mon Sep 17 00:00:00 2001
From: JP-Ellis <github@jpellis.me>
Date: Fri, 29 Nov 2024 07:58:28 +1100
Subject: [PATCH] feat(github-action): retain spaces in extracted values
 (#32730)

Signed-off-by: JP-Ellis <josh@jpellis.me>
Co-authored-by: Michael Kriese <michael.kriese@gmx.de>
Co-authored-by: Rhys Arkins <rhys@arkins.net>
---
 .../manager/github-actions/extract.spec.ts    | 53 +++++++++++++++++++
 lib/modules/manager/github-actions/extract.ts |  5 +-
 2 files changed, 56 insertions(+), 2 deletions(-)

diff --git a/lib/modules/manager/github-actions/extract.spec.ts b/lib/modules/manager/github-actions/extract.spec.ts
index b0b796bb30009d..75479bef617333 100644
--- a/lib/modules/manager/github-actions/extract.spec.ts
+++ b/lib/modules/manager/github-actions/extract.spec.ts
@@ -285,6 +285,59 @@ describe('modules/manager/github-actions/extract', () => {
       ]);
     });
 
+    it('maintains spaces between hash and comment', () => {
+      const yamlContent = `
+      jobs:
+        build:
+          steps:
+            # One space
+            - name: "test1"
+              uses: actions/setup-node@56337c425554a6be30cdef71bf441f15be286854 # tag=v3.1.1
+            - name: "test2"
+              uses: 'actions/setup-node@1f8c6b94b26d0feae1e387ca63ccbdc44d27b561' # tag=v3.1.1
+            - name: "test3"
+              uses: "actions/setup-node@1f8c6b94b26d0feae1e387ca63ccbdc44d27b561" # tag=v2.5.1
+
+            # Two space
+            - name: "test1"
+              uses: actions/setup-node@56337c425554a6be30cdef71bf441f15be286854  # tag=v3.1.1
+            - name: "test2"
+              uses: 'actions/setup-node@1f8c6b94b26d0feae1e387ca63ccbdc44d27b561'  # tag=v3.1.1
+            - name: "test3"
+              uses: "actions/setup-node@1f8c6b94b26d0feae1e387ca63ccbdc44d27b561"  # tag=v2.5.1
+"`;
+
+      const res = extractPackageFile(yamlContent, 'workflow.yml');
+      expect(res).toMatchObject({
+        deps: [
+          {
+            replaceString:
+              'actions/setup-node@56337c425554a6be30cdef71bf441f15be286854 # tag=v3.1.1',
+          },
+          {
+            replaceString:
+              "'actions/setup-node@1f8c6b94b26d0feae1e387ca63ccbdc44d27b561' # tag=v3.1.1",
+          },
+          {
+            replaceString:
+              '"actions/setup-node@1f8c6b94b26d0feae1e387ca63ccbdc44d27b561" # tag=v2.5.1',
+          },
+          {
+            replaceString:
+              'actions/setup-node@56337c425554a6be30cdef71bf441f15be286854  # tag=v3.1.1',
+          },
+          {
+            replaceString:
+              "'actions/setup-node@1f8c6b94b26d0feae1e387ca63ccbdc44d27b561'  # tag=v3.1.1",
+          },
+          {
+            replaceString:
+              '"actions/setup-node@1f8c6b94b26d0feae1e387ca63ccbdc44d27b561"  # tag=v2.5.1',
+          },
+        ],
+      });
+    });
+
     it('extracts tags in different formats', () => {
       const res = extractPackageFile(
         Fixtures.get('workflow_4.yml'),
diff --git a/lib/modules/manager/github-actions/extract.ts b/lib/modules/manager/github-actions/extract.ts
index 0839912373120a..c498615e1f6eff 100644
--- a/lib/modules/manager/github-actions/extract.ts
+++ b/lib/modules/manager/github-actions/extract.ts
@@ -15,7 +15,7 @@ import type { Workflow } from './types';
 
 const dockerActionRe = regEx(/^\s+uses\s*: ['"]?docker:\/\/([^'"]+)\s*$/);
 const actionRe = regEx(
-  /^\s+-?\s+?uses\s*: (?<replaceString>['"]?(?<registryUrl>https:\/\/[.\w-]+\/)?(?<depName>[\w-]+\/[.\w-]+)(?<path>\/.*)?@(?<currentValue>[^\s'"]+)['"]?(?:\s+#\s*(((?:renovate\s*:\s*)?(?:pin\s+|tag\s*=\s*)?|(?:ratchet:[\w-]+\/[.\w-]+)?)@?(?<tag>([\w-]*-)?v?\d+(?:\.\d+(?:\.\d+)?)?)|(?:ratchet:exclude)))?)/,
+  /^\s+-?\s+?uses\s*: (?<replaceString>['"]?(?<registryUrl>https:\/\/[.\w-]+\/)?(?<depName>[\w-]+\/[.\w-]+)(?<path>\/.*)?@(?<currentValue>[^\s'"]+)['"]?(?:(?<commentWhiteSpaces>\s+)#\s*(((?:renovate\s*:\s*)?(?:pin\s+|tag\s*=\s*)?|(?:ratchet:[\w-]+\/[.\w-]+)?)@?(?<tag>([\w-]*-)?v?\d+(?:\.\d+(?:\.\d+)?)?)|(?:ratchet:exclude)))?)/,
 );
 
 // SHA1 or SHA256, see https://github.blog/2020-10-19-git-2-29-released/
@@ -72,6 +72,7 @@ function extractWithRegex(content: string): PackageDependency[] {
         tag,
         replaceString,
         registryUrl = '',
+        commentWhiteSpaces = ' ',
       } = tagMatch.groups;
       let quotes = '';
       if (replaceString.indexOf("'") >= 0) {
@@ -87,7 +88,7 @@ function extractWithRegex(content: string): PackageDependency[] {
         versioning: dockerVersioning.id,
         depType: 'action',
         replaceString,
-        autoReplaceStringTemplate: `${quotes}${registryUrl}{{depName}}${path}@{{#if newDigest}}{{newDigest}}${quotes}{{#if newValue}} # {{newValue}}{{/if}}{{/if}}{{#unless newDigest}}{{newValue}}${quotes}{{/unless}}`,
+        autoReplaceStringTemplate: `${quotes}${registryUrl}{{depName}}${path}@{{#if newDigest}}{{newDigest}}${quotes}{{#if newValue}}${commentWhiteSpaces}# {{newValue}}{{/if}}{{/if}}{{#unless newDigest}}{{newValue}}${quotes}{{/unless}}`,
         ...(registryUrl
           ? detectDatasource(registryUrl)
           : customRegistryUrlsPackageDependency),