postUpgradeTasks fileFilters do not preserve the executable bit

[richard-kramer]

How are you running Renovate?

Self-hosted Renovate CLI

Which platform you running Renovate on?

GitLab (.com or self-hosted)

Which version of Renovate are you using?

43.234.0

Please tell us more about your question or problem

When postUpgradeTasks runs a command that sets the executable bit on a file (e.g. chmod +x or a generator script that creates files with mode 755), Renovate detects the file as changed via fileFilters, but commits it with mode 644. The execute bit is silently dropped.

Root cause (suspected)

In execute-post-upgrade-commands.js, files picked up from git status after the post-upgrade command runs are pushed onto updatedArtifacts with only contents:

const status = await getRepoStatus();
for (const relativePath of status.modified.concat(status.not_added)) {
  for (const pattern of fileFilters) {
    if (minimatch(pattern, { dot: true }).match(relativePath)) {
      const existingContent = await readLocalFile(relativePath);
      updatedArtifacts.push({
        type: 'addition',
        path: relativePath,
        contents: existingContent,
        // isExecutable is never set here
      });
    }
  }
}

readLocalFile only reads file content — it doesn't stat the file, so there's no way to know the mode at this point.

Later, in prepareCommit (util/git/index.js), the artifact is written and staged using that missing flag:

await fs.outputFile(path, contents, {
  mode: file.isExecutable ? 0o777 : 0o666,  // always 0o666 here, since isExecutable is undefined
});
await git.add(addParams);
if (file.isExecutable) {                    // never true for post-upgrade artifacts
  await git.raw(['update-index', '--chmod=+x', fileName]);
}

Since isExecutable is never set for artifacts collected from postUpgradeTasks, the file is always written/staged as non-executable, regardless of its actual mode on disk after the task ran.

This is despite isExecutable already being a supported mechanism elsewhere in the codebase (e.g. hermit/artifacts.js, npm/post-update/index.js both set it explicitly when needed) — execute-post-upgrade-commands.js is just never wired up to populate it.

Minimal reproduction

1. Repo contains a tracked script with mode 644, e.g. scripts/run.sh.
2. renovate.json:

{
  "packageRules": [
    {
      "matchManagers": ["npm"],
      "postUpgradeTasks": {
        "commands": ["chmod +x scripts/run.sh"],
        "fileFilters": ["scripts/run.sh"],
        "executionMode": "branch"
      }
    }
  ]
}

3. Trigger any update matched by this rule.
4. Renovate commits scripts/run.sh — but the commit still has mode 100644, not 100755.
5. After the branch is checked out / merged, scripts/run.sh loses its executable bit relative to what the post-upgrade command actually produced in the working tree.

Expected behavior

If a file picked up via fileFilters has the executable bit set on disk after the post-upgrade command runs, Renovate should commit it with that mode preserved (isExecutable: true), the same way it already does for hermit/npm artifacts.

Suggested fix

Stat the file when collecting it instead of relying solely on readLocalFile:

const stat = await statLocalFile(relativePath); // already exported from util/fs
const isExecutable = !!(stat?.mode & 0o111);

updatedArtifacts.push({
  type: 'addition',
  path: relativePath,
  contents: existingContent,
  ...(isExecutable && { isExecutable: true }),
});

statLocalFile is already implemented and exported in util/fs/index.js, so this would not require a new dependency.

Environment

• Renovate versions checked: v37.x through v43.x (same code path, behavior unchanged)

Workaround attempted

Setting core.fileMode=true globally before Renovate runs does not fix this — it only affects whether git status reports mode changes as modified, not whether Renovate's prepareCommit actually preserves the mode when writing/staging the artifact. The bug is in the artifact layer, not in git's diff detection.

Logs (if relevant)

No response