dependabot-apm 0.400.0

data/lib/dependabot/apm/update_checker.rb

@@ -0,0 +1,303 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+
+require "dependabot/git_commit_checker"
+require "dependabot/git_metadata_fetcher"
+require "dependabot/git_tag_details"
+require "dependabot/update_checkers"
+require "dependabot/update_checkers/base"
+require "dependabot/apm/git_commit_checker"
+require "dependabot/apm/requirement"
+require "dependabot/apm/version"
+
+module Dependabot
+  module Apm
+    class UpdateChecker < Dependabot::UpdateCheckers::Base
+      extend T::Sig
+
+      sig { override.returns(T.nilable(T.any(String, Gem::Version))) }
+      def latest_version
+        @latest_version ||= T.let(
+          fetch_latest_version,
+          T.nilable(T.any(String, Gem::Version))
+        )
+      end
+
+      sig { override.returns(T.nilable(T.any(String, Gem::Version))) }
+      def latest_resolvable_version
+        # APM dependencies have no resolution graph: each manifest ref is
+        # independent, so the latest version is always resolvable.
+        latest_version
+      end
+
+      sig { override.returns(T.nilable(T.any(String, Gem::Version))) }
+      def latest_resolvable_version_with_no_unlock
+        # Updating an APM dependency always rewrites its manifest requirement,
+        # so there is no newer version reachable "without unlocking".
+        dependency.version
+      end
+
+      # APM packages have no GitHub Advisory Database coverage, so Dependabot
+      # never supplies security advisories for them and the security-update flow
+      # (gated on `vulnerable?`, which is false without advisories) never runs.
+      # We have no visibility into whether APM security updates will be offered
+      # in the future; if they are, this needs a real implementation. The base
+      # declares it abstract, so it is stubbed to nil to satisfy the contract
+      # rather than carrying unreachable resolution logic.
+      sig { override.returns(T.nilable(Gem::Version)) }
+      def lowest_security_fix_version
+        nil
+      end
+
+      sig { override.returns(T.nilable(Gem::Version)) }
+      def lowest_resolvable_security_fix_version
+        lowest_security_fix_version
+      end
+
+      sig { override.returns(T::Array[Dependabot::DependencyRequirement]) }
+      def updated_requirements
+        return dependency.requirements unless git_commit_checker.git_dependency?
+
+        dependency.requirements.map do |req|
+          source = req.source_hash
+          current_ref = req.source_string("ref")
+          # Only rewrite requirements pinned to a semver tag (plain or
+          # package-scoped, e.g. `review--v1.0.0`); branch- and SHA-pinned
+          # entries are left as-is. Normalise the ref to its SemVer core through
+          # the shared APM extractor so scoped tags are recognised and compared.
+          ref_version = current_ref && Version.semver_from_ref(current_ref, dependency_name: dependency.name)
+          next req unless source && ref_version
+
+          # DependencySet merges repeated declarations of the same package into a
+          # single dependency with several requirements whose refs need not share
+          # a tag family (e.g. `review--v1.0.0` and `review-v1.0.0`). Resolve each
+          # requirement independently -- within its own family and above its own
+          # pinned version -- so a declaration is only ever bumped within its own
+          # family, and a higher declaration is never rewritten down to a lower
+          # family's tag.
+          new_tag = resolved_tag_for_requirement(source, ref_version)&.tag
+          next req unless new_tag
+
+          new_source = source.merge(ref: new_tag)
+          Dependabot::DependencyRequirement.create(req.merge(source: new_source))
+        end
+      end
+
+      private
+
+      sig { override.returns(T::Boolean) }
+      def latest_version_resolvable_with_full_unlock?
+        # APM has no concept of a full unlock (no transitive resolution).
+        false
+      end
+
+      sig { override.returns(T::Array[Dependabot::Dependency]) }
+      def updated_dependencies_after_full_unlock
+        raise NotImplementedError
+      end
+
+      # `latest_version` deliberately reports the MAX tag reachable by ANY family
+      # so the base `can_update?` gate still fires when only a higher family can
+      # move. But `DependencySet` defines a merged dependency's version as its
+      # LOWEST pin, and `updated_requirements` can leave families on different
+      # tags (e.g. `review-v1.4.0` alongside `review--v1.5.0`). Deriving the
+      # resulting version from `preferred_resolvable_version` (the max) would
+      # report a `1.5.0` update while the merged dependency is really `1.4.0`,
+      # desyncing the reported version (and its update type / PR metadata) from
+      # the rewritten requirements. Derive it from the post-update refs with the
+      # same lowest-pin rule instead, keeping the update gate and the reported
+      # version separate.
+      sig { returns(Dependabot::Dependency) }
+      def updated_dependency_with_own_req_unlock
+        new_requirements = updated_requirements
+        new_version = pinned_versions(new_requirements).min
+
+        Dependabot::Dependency.new(
+          name: dependency.name,
+          version: new_version || dependency.version,
+          requirements: new_requirements,
+          previous_version: dependency.version,
+          previous_requirements: dependency.requirements,
+          package_manager: dependency.package_manager,
+          metadata: dependency.metadata,
+          subdependency_metadata: dependency.subdependency_metadata
+        )
+      end
+
+      sig { returns(T.nilable(T.any(String, Gem::Version))) }
+      def fetch_latest_version
+        return dependency.version unless git_commit_checker.git_dependency?
+
+        # Only entries pinned to a semver tag are bumped in the manifest.
+        # Branch- and SHA-pinned entries are resolved via the lockfile, which
+        # APM regenerates itself, so Dependabot leaves them untouched.
+        return dependency.version unless git_commit_checker.pinned_ref_looks_like_version?
+
+        # A merged dependency can hold several ref families (e.g. `review--v*`
+        # and `review-v*`). Report the highest tag reachable by ANY requirement,
+        # each resolved within its own family and above its own pinned version,
+        # so the base `can_update?` isn't short-circuited when only a non-first
+        # family has a newer tag.
+        semver_requirement_checkers.filter_map do |ref_version, checker|
+          tag_version = latest_version_tag(checker)&.version
+          tag_version if tag_version && Version.new(ref_version) < tag_version
+        end.max || dependency.version
+      end
+
+      # The tag a single requirement should move to: the latest tag resolved
+      # within that requirement's own ref family (via a checker scoped to its
+      # ref). Returns nil when there is no strictly-higher tag, so a requirement
+      # is never downgraded -- a latest capped by an ignore rule must leave an
+      # already-higher declaration untouched.
+      sig do
+        params(source: Dependabot::DependencyRequirement::ObjectHash, ref_version: String)
+          .returns(T.nilable(Dependabot::GitTagDetails))
+      end
+      def resolved_tag_for_requirement(source, ref_version)
+        checker = git_commit_checker_for(source, ref_version)
+        return unless checker.pinned_ref_looks_like_version?
+
+        parsed = Version.new(ref_version)
+        tag = latest_version_tag(checker)
+        tag_version = tag&.version
+        return unless tag_version
+        return if parsed >= tag_version
+
+        tag
+      end
+
+      # Each git-semver-pinned requirement paired with a checker scoped to its
+      # own ref (all sharing one remote fetch via shared_git_metadata_fetcher).
+      # Drives the cross-family latest-version reporting that gates can_update?,
+      # so the gate still fires when only a non-first family has a newer tag.
+      sig { returns(T::Array[[String, Dependabot::GitCommitChecker]]) }
+      def semver_requirement_checkers
+        dependency.requirements.filter_map do |req|
+          source = req.source_hash
+          current_ref = req.source_string("ref")
+          ref_version = current_ref && Version.semver_from_ref(current_ref, dependency_name: dependency.name)
+          next unless source && ref_version
+
+          [ref_version, git_commit_checker_for(source, ref_version)]
+        end
+      end
+
+      # The parsed SemVer core of every requirement pinned to a version tag
+      # (plain or package-scoped, e.g. `review--v1.0.0`). Branch- and SHA-pinned
+      # requirements carry no comparable version and are skipped. Used to derive
+      # the merged post-update version (its lowest pin).
+      sig { params(requirements: T::Array[Dependabot::DependencyRequirement]).returns(T::Array[Dependabot::Version]) }
+      def pinned_versions(requirements)
+        requirements.filter_map do |req|
+          current_ref = req.source_string("ref")
+          ref_version = current_ref && Version.semver_from_ref(current_ref, dependency_name: dependency.name)
+          ref_version && Version.new(ref_version)
+        end
+      end
+
+      sig { params(checker: Dependabot::GitCommitChecker).returns(T.nilable(Dependabot::GitTagDetails)) }
+      def latest_version_tag(checker = git_commit_checker)
+        return unless checker.git_dependency?
+        return unless checker.pinned_ref_looks_like_version?
+
+        checker.local_tag_for_latest_version(update_cooldown)
+      end
+
+      sig { returns(Dependabot::GitCommitChecker) }
+      def git_commit_checker
+        @git_commit_checker ||= T.let(
+          Dependabot::Apm::GitCommitChecker.new(
+            dependency: dependency,
+            credentials: credentials,
+            ignored_versions: ignored_versions,
+            raise_on_ignored: raise_on_ignored,
+            consider_version_branches_pinned: false,
+            git_metadata_fetcher: shared_git_metadata_fetcher
+          ),
+          T.nilable(Dependabot::GitCommitChecker)
+        )
+      end
+
+      # A checker scoped to a single requirement's source (its own ref), sharing
+      # one remote metadata fetch across every requirement so per-requirement
+      # resolution does not re-fetch the upload pack for each declaration. The
+      # scoped ref makes the parent's family filtering (`same_prefix?`) select
+      # tags in that declaration's own family. When `ref_version` is given the
+      # checker's dependency version is scoped to this requirement's own pinned
+      # ref, so GitCommitChecker#current_version (and therefore cooldown's
+      # SemVer-distance classification) reflects THIS declaration rather than the
+      # merged dependency's lowest pin -- e.g. a `v2.1.0` candidate for a `v2.0.0`
+      # pin stays a minor bump even when a sibling `v1.4.0` pin lowers the merged
+      # version to 1.4.0.
+      sig do
+        params(
+          source: Dependabot::DependencyRequirement::ObjectHash,
+          ref_version: T.nilable(String)
+        ).returns(Dependabot::GitCommitChecker)
+      end
+      def git_commit_checker_for(source, ref_version = nil)
+        scoped_dependency =
+          if ref_version
+            Dependabot::Dependency.new(
+              name: dependency.name,
+              version: ref_version,
+              requirements: dependency.requirements,
+              package_manager: dependency.package_manager,
+              metadata: dependency.metadata,
+              subdependency_metadata: dependency.subdependency_metadata
+            )
+          else
+            dependency
+          end
+
+        Dependabot::Apm::GitCommitChecker.new(
+          dependency: scoped_dependency,
+          credentials: credentials,
+          ignored_versions: ignored_versions,
+          raise_on_ignored: raise_on_ignored,
+          consider_version_branches_pinned: false,
+          dependency_source_details: symbolized_source_details(source),
+          git_metadata_fetcher: shared_git_metadata_fetcher
+        )
+      end
+
+      # One metadata fetcher for the dependency's git remote, shared by the main
+      # and per-requirement checkers so the upload pack is fetched once. All
+      # requirements of a merged dependency share the same clone URL (differing
+      # ports/paths keep them as separate dependencies), so a single fetcher is
+      # correct. Nil for non-git dependencies, where no fetch is needed.
+      sig { returns(T.nilable(Dependabot::GitMetadataFetcher)) }
+      def shared_git_metadata_fetcher
+        return @shared_git_metadata_fetcher if defined?(@shared_git_metadata_fetcher)
+
+        url = dependency.source_string("url", allowed_types: ["git"])
+        @shared_git_metadata_fetcher = T.let(
+          url && Dependabot::GitMetadataFetcher.new(url: url, credentials: credentials),
+          T.nilable(Dependabot::GitMetadataFetcher)
+        )
+      end
+
+      # A symbol-keyed source-details hash for GitCommitChecker, holding the git
+      # coordinate fields it reads (type/url/ref/branch). Rebuilt explicitly so a
+      # requirement's mixed-key source hash conforms to the checker's expected
+      # `{Symbol => Object}` shape.
+      sig do
+        params(source: Dependabot::DependencyRequirement::ObjectHash)
+          .returns(T::Hash[Symbol, Object])
+      end
+      def symbolized_source_details(source)
+        details = T.let({}, T::Hash[Symbol, Object])
+        %i(type url ref branch).each do |key|
+          value = source[key] || source[key.to_s]
+          details[key] = value if value.is_a?(String)
+        end
+        details
+      end
+    end
+  end
+end
+
+Dependabot::UpdateCheckers
+  .register("apm", Dependabot::Apm::UpdateChecker)

data/lib/dependabot/apm/version.rb

@@ -0,0 +1,228 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+
+require "dependabot/utils"
+require "dependabot/version"
+
+module Dependabot
+  module Apm
+    # APM pins dependencies to git refs. When that ref is a SemVer 2.0.0 tag
+    # (optionally `v`-prefixed, e.g. `v1.2.0`, `1.2.0-alpha.1` or `1.2.0+build.5`)
+    # we treat it as the dependency version.
+    #
+    # The parent class uses RubyGems semantics, which differ from SemVer in ways
+    # that matter for git tags, so this subclass enforces SemVer 2.0.0 instead:
+    #   * validation requires MAJOR.MINOR.PATCH, so partial refs (`v1`, `1.2`) or
+    #     branch names are never mistaken for versions;
+    #   * `+build` metadata is accepted and ignored for precedence;
+    #   * prerelease identifiers follow SemVer precedence (numeric identifiers
+    #     rank below alphanumeric ones, so `1.0.0-alpha.1 < 1.0.0-alpha.beta` —
+    #     the opposite of RubyGems, which compares them the other way around).
+    class Version < Dependabot::Version
+      extend T::Sig
+
+      # Official SemVer 2.0.0 grammar (https://semver.org), anchored end to end so
+      # partial or branch-like refs are rejected.
+      SEMVER_REGEX = /
+        \A
+        (?<major>0|[1-9]\d*)\.(?<minor>0|[1-9]\d*)\.(?<patch>0|[1-9]\d*)
+        (?:-(?<prerelease>
+          (?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)
+          (?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*
+        ))?
+        (?:\+(?<build>[0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?
+        \z
+      /x
+
+      # The separators APM places between a package name and the SemVer core in
+      # package-scoped tags (`{name}_v1.2.3`, `{name}--v1.2.3`, `{name}-v1.2.3`).
+      # Each already ends in the `v` that precedes the version, so the remaining
+      # suffix is a bare SemVer string. None is a prefix of another for a given
+      # name (`foo--v1.2.3` does not start with `foo-v`), so match order is
+      # irrelevant.
+      SCOPED_TAG_SEPARATORS = %w(_v --v -v).freeze
+
+      sig { returns(Integer) }
+      attr_reader :major
+
+      sig { returns(Integer) }
+      attr_reader :minor
+
+      sig { returns(Integer) }
+      attr_reader :patch
+
+      sig { returns(T.nilable(String)) }
+      attr_reader :prerelease_info
+
+      sig { returns(T.nilable(String)) }
+      attr_reader :build_info
+
+      sig { override.params(version: VersionParameter).void }
+      def initialize(version)
+        normalized = Version.remove_leading_v(version).to_s
+        match = normalized.match(SEMVER_REGEX)
+        raise ArgumentError, "Malformed version string - #{version}" unless match
+
+        @version_string = T.let(normalized, String)
+        @major = T.let(T.must(match[:major]).to_i, Integer)
+        @minor = T.let(T.must(match[:minor]).to_i, Integer)
+        @patch = T.let(T.must(match[:patch]).to_i, Integer)
+        @prerelease_info = T.let(match[:prerelease], T.nilable(String))
+        @build_info = T.let(match[:build], T.nilable(String))
+
+        # Hand RubyGems the release (plus any prerelease) without the build
+        # metadata, which is not part of precedence, so requirement matching and
+        # the inherited helpers keep working.
+        super(T.must(normalized.split("+").first))
+      end
+
+      sig { override.params(version: VersionParameter).returns(Dependabot::Apm::Version) }
+      def self.new(version)
+        T.cast(super, Dependabot::Apm::Version)
+      end
+
+      sig { params(version: VersionParameter).returns(VersionParameter) }
+      def self.remove_leading_v(version)
+        return version unless version.to_s.match?(/\Av\d/)
+
+        version.to_s.delete_prefix("v")
+      end
+
+      sig { override.params(version: VersionParameter).returns(T::Boolean) }
+      def self.correct?(version)
+        return false if version.to_s.strip.empty?
+
+        Version.remove_leading_v(version).to_s.match?(SEMVER_REGEX)
+      end
+
+      # Extracts the SemVer core from a git ref for the package `dependency_name`,
+      # or nil when the ref is not a version tag for that package. A plain
+      # `v?<semver>` ref keeps any build metadata; a package-scoped ref
+      # (`{name}_v…`, `{name}--v…`, `{name}-v…`) is accepted only when `{name}`
+      # matches the package's own name -- the final `/`-separated segment of
+      # `dependency_name`, since a virtual package `org/mono/skills/review` is
+      # released as `review--v1.2.3`. Scoping to that name keeps a monorepo's
+      # `security--v2.0.0` from resolving against a `review` dependency. This is
+      # the single reader of APM's tag grammar, shared by the git commit checker,
+      # the file parser and the update checker so ref handling never diverges.
+      sig { params(ref: String, dependency_name: String).returns(T.nilable(String)) }
+      def self.semver_from_ref(ref, dependency_name:)
+        return remove_leading_v(ref).to_s if correct?(ref)
+
+        name = dependency_name.split("/").last.to_s
+        return nil if name.empty?
+
+        SCOPED_TAG_SEPARATORS.each do |separator|
+          prefix = "#{name}#{separator}"
+          next unless ref.start_with?(prefix)
+
+          candidate = ref[prefix.length..].to_s
+          return candidate if candidate.match?(SEMVER_REGEX)
+        end
+
+        nil
+      end
+
+      sig { override.returns(String) }
+      def to_s
+        @version_string
+      end
+
+      sig { override.returns(String) }
+      def inspect
+        "#<#{self.class} #{@version_string}>"
+      end
+
+      # `Gem::Requirement` evaluates a `~> x.y.z` bound by comparing candidates
+      # against this operand's `bump`. The inherited `Gem::Version#bump` drops
+      # the last segment (`1.2.3` -> `1.3`) and rebuilds `self.class` from it,
+      # but `Apm::Version` rejects that partial value and raises while filtering
+      # tags. Return the SemVer upper bound (`x.(y+1).0`) instead, so a
+      # pessimistic ignore rule such as `~> 1.2.3` evaluates as
+      # `>= 1.2.3, < 1.3.0` rather than crashing.
+      sig { returns(Dependabot::Apm::Version) }
+      def bump
+        Version.new("#{major}.#{minor + 1}.0")
+      end
+
+      sig { params(other: Object).returns(T.nilable(Integer)) }
+      def <=>(other)
+        other_version = Version.coerce(other)
+        return super unless other_version
+
+        release = compare_release(other_version)
+        return release unless release.zero?
+
+        Version.compare_prerelease(prerelease_info, other_version.prerelease_info)
+      end
+
+      # Compares the MAJOR.MINOR.PATCH triples numerically.
+      sig { params(other: Dependabot::Apm::Version).returns(Integer) }
+      def compare_release(other)
+        [[major, other.major], [minor, other.minor], [patch, other.patch]].each do |mine, theirs|
+          comparison = mine <=> theirs
+          return comparison unless comparison.zero?
+        end
+
+        0
+      end
+
+      # Coerces a comparison operand into an Apm::Version when it is a strict
+      # SemVer value, or nil when it is not (so `<=>` can fall back to RubyGems
+      # semantics for e.g. a bare `Gem::Version` requirement bound).
+      sig { params(other: Object).returns(T.nilable(Dependabot::Apm::Version)) }
+      def self.coerce(other)
+        return other if other.is_a?(Dependabot::Apm::Version)
+        return unless other.is_a?(String) || other.is_a?(Gem::Version)
+        return unless correct?(other.to_s)
+
+        new(other.to_s)
+      end
+
+      # SemVer prerelease precedence (spec rule 11): a version WITH a prerelease
+      # ranks below the same version without one, and equal releases are ordered
+      # by their prerelease identifiers.
+      sig { params(left: T.nilable(String), right: T.nilable(String)).returns(Integer) }
+      def self.compare_prerelease(left, right)
+        return 0 if left == right
+        return 1 if left.nil? # a normal version outranks any prerelease
+        return -1 if right.nil?
+
+        compare_prerelease_identifiers(left.split("."), right.split("."))
+      end
+
+      # Compares dot-separated prerelease identifiers left to right; a longer set
+      # of identifiers wins when the shorter one is a prefix of it.
+      sig { params(left: T::Array[String], right: T::Array[String]).returns(Integer) }
+      def self.compare_prerelease_identifiers(left, right)
+        left.zip(right).each do |l, r|
+          return 1 if r.nil? # left carries an extra identifier
+
+          comparison = compare_identifier(l, r)
+          return comparison unless comparison.zero?
+        end
+
+        left.length <=> right.length
+      end
+
+      # A single prerelease identifier: numeric identifiers compare numerically
+      # and always rank below alphanumeric ones, which compare lexically (ASCII).
+      sig { params(left: String, right: String).returns(Integer) }
+      def self.compare_identifier(left, right)
+        left_numeric = left.match?(/\A\d+\z/)
+        right_numeric = right.match?(/\A\d+\z/)
+
+        return left.to_i <=> right.to_i if left_numeric && right_numeric
+        return -1 if left_numeric
+        return 1 if right_numeric
+
+        T.must(left <=> right)
+      end
+    end
+  end
+end
+
+Dependabot::Utils
+  .register_version_class("apm", Dependabot::Apm::Version)

data/lib/dependabot/apm.rb

@@ -0,0 +1,28 @@
+# typed: strict
+# frozen_string_literal: true
+
+# These all need to be required so the various classes can be registered in a
+# lookup table of package manager names to concrete classes.
+require "dependabot/apm/file_fetcher"
+require "dependabot/apm/file_parser"
+require "dependabot/apm/update_checker"
+require "dependabot/apm/file_updater"
+require "dependabot/apm/metadata_finder"
+require "dependabot/apm/requirement"
+require "dependabot/apm/version"
+
+require "dependabot/pull_request_creator/labeler"
+Dependabot::PullRequestCreator::Labeler
+  .register_label_details("apm", name: "apm", colour: "0e8a16")
+
+require "dependabot/dependency"
+Dependabot::Dependency
+  .register_production_check(
+    "apm",
+    # Production when the explicit "dependencies" marker is present (or when a
+    # dependency carries no group information at all). Presence-based rather than
+    # "not development", so a package merged from both `dependencies.apm` and
+    # `devDependencies.apm` -- whose flattened groups include both markers --
+    # stays production, while a `devDependencies`-only entry does not.
+    ->(groups) { groups.empty? || groups.include?("dependencies") }
+  )