dependabot-bazel 0.344.0

data/lib/dependabot/bazel/file_updater/workspace_file_updater.rb

@@ -0,0 +1,203 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "dependabot/bazel/file_updater"
+
+module Dependabot
+  module Bazel
+    class FileUpdater < Dependabot::FileUpdaters::Base
+      class WorkspaceFileUpdater
+        extend T::Sig
+
+        sig do
+          params(
+            dependency_files: T::Array[Dependabot::DependencyFile],
+            dependencies: T::Array[Dependabot::Dependency],
+            credentials: T::Array[Dependabot::Credential]
+          ).void
+        end
+        def initialize(dependency_files:, dependencies:, credentials:)
+          @dependency_files = dependency_files
+          @dependencies = dependencies
+          @credentials = credentials
+        end
+
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
+        def updated_workspace_files
+          workspace_files.filter_map do |file|
+            updated_content = update_file_content(file)
+            next if updated_content == T.must(file.content)
+
+            file.dup.tap { |f| f.content = updated_content }
+          end
+        end
+
+        private
+
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
+        attr_reader :dependency_files
+
+        sig { returns(T::Array[Dependabot::Dependency]) }
+        attr_reader :dependencies
+
+        sig { returns(T::Array[Dependabot::Credential]) }
+        attr_reader :credentials
+
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
+        def workspace_files
+          @workspace_files ||= T.let(
+            dependency_files.select do |f|
+              f.name == "WORKSPACE" || f.name.end_with?("WORKSPACE.bazel")
+            end,
+            T.nilable(T::Array[Dependabot::DependencyFile])
+          )
+        end
+
+        sig { params(file: Dependabot::DependencyFile).returns(String) }
+        def update_file_content(file)
+          content = T.must(file.content).dup
+
+          dependencies.each do |dependency|
+            content = update_dependency_in_content(content, dependency)
+          end
+
+          content
+        end
+
+        sig { params(content: String, dependency: Dependabot::Dependency).returns(String) }
+        def update_dependency_in_content(content, dependency)
+          return content unless dependency.package_manager == "bazel"
+
+          case dependency_type(dependency)
+          when :http_archive
+            update_http_archive_declaration(content, dependency)
+          when :git_repository
+            update_git_repository_declaration(content, dependency)
+          else
+            content
+          end
+        end
+
+        sig { params(dependency: Dependabot::Dependency).returns(Symbol) }
+        def dependency_type(dependency)
+          return :http_archive if dependency.requirements.any? { |req| req.dig(:source, :type) == "http_archive" }
+          return :git_repository if dependency.requirements.any? { |req| req.dig(:source, :type) == "git_repository" }
+
+          :unknown
+        end
+
+        sig { params(content: String, dependency: Dependabot::Dependency).returns(String) }
+        def update_http_archive_declaration(content, dependency)
+          new_version = dependency.version
+          return content unless new_version
+
+          escaped_name = Regexp.escape(dependency.name)
+
+          http_archive_pattern = /http_archive\s*\(([^)]+?)\)/mx
+
+          content.gsub(http_archive_pattern) do |match|
+            function_content = T.must(Regexp.last_match(1))
+
+            if /name\s*=\s*["']#{escaped_name}["']/.match?(function_content)
+              updated_function_content = update_http_archive_attributes(function_content, dependency)
+              "http_archive(#{updated_function_content})"
+            else
+              match
+            end
+          end
+        rescue Dependabot::DependencyFileNotResolvable => e
+          raise e
+        rescue StandardError => e
+          raise Dependabot::DependencyFileNotResolvable,
+                "Failed to update http_archive for #{dependency.name}: #{e.message}"
+        end
+
+        sig { params(function_content: String, dependency: Dependabot::Dependency).returns(String) }
+        def update_http_archive_attributes(function_content, dependency)
+          updated_content = function_content.dup
+
+          updated_content = update_archive_url(updated_content, dependency) if /url\s*=/.match?(updated_content)
+
+          updated_content = update_archive_urls_array(updated_content, dependency) if /urls\s*=/.match?(updated_content)
+
+          updated_content
+        end
+
+        sig { params(content: String, dependency: Dependabot::Dependency).returns(String) }
+        def update_archive_url(content, dependency)
+          old_version = dependency.previous_version
+          new_version = dependency.version
+          return content unless old_version && new_version
+
+          content.gsub(/url\s*=\s*["']([^"']+)["']/) do
+            url = T.must(Regexp.last_match(1))
+            updated_url = transform_version_in_url(url, old_version, new_version)
+            "url = \"#{updated_url}\""
+          end
+        end
+
+        sig { params(content: String, dependency: Dependabot::Dependency).returns(String) }
+        def update_archive_urls_array(content, dependency)
+          old_version = dependency.previous_version
+          new_version = dependency.version
+          return content unless old_version && new_version
+
+          content.gsub(/urls\s*=\s*\[(.*?)\]/m) do
+            urls_content = T.must(Regexp.last_match(1))
+            updated_urls_content = urls_content.gsub(/["']([^"']+)["']/) do
+              url = T.must(Regexp.last_match(1))
+              updated_url = transform_version_in_url(url, old_version, new_version)
+              "\"#{updated_url}\""
+            end
+            "urls = [#{updated_urls_content}]"
+          end
+        end
+
+        sig { params(url: String, old_version: String, new_version: String).returns(String) }
+        def transform_version_in_url(url, old_version, new_version)
+          return url.gsub(old_version, new_version) if url.include?(old_version)
+
+          return url.gsub("v#{old_version}", "v#{new_version}") if url.include?("v#{old_version}")
+
+          old_with_v = "v#{old_version}"
+          return url.gsub(old_with_v, "v#{new_version}") if url.include?(old_with_v)
+
+          url
+        end
+
+        sig { params(content: String, dependency: Dependabot::Dependency).returns(String) }
+        def update_git_repository_declaration(content, dependency)
+          new_version = dependency.version
+          return content unless new_version
+
+          escaped_name = Regexp.escape(dependency.name)
+
+          git_repo_pattern = /git_repository\s*\(([^)]+?)\)/mx
+
+          content.gsub(git_repo_pattern) do |match|
+            function_content = T.must(Regexp.last_match(1))
+
+            if /name\s*=\s*["']#{escaped_name}["']/.match?(function_content)
+              updated_function_content = if /tag\s*=/.match?(function_content)
+                                           function_content.gsub(
+                                             /tag\s*=\s*["'][^"']*["']/,
+                                             "tag = \"#{new_version}\""
+                                           )
+                                         elsif /commit\s*=/.match?(function_content)
+                                           function_content.gsub(
+                                             /commit\s*=\s*["'][^"']*["']/,
+                                             "commit = \"#{new_version}\""
+                                           )
+                                         else
+                                           function_content
+                                         end
+              "git_repository(#{updated_function_content})"
+            else
+              match
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/bazel/file_updater.rb

@@ -0,0 +1,116 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "dependabot/file_updaters"
+require "dependabot/file_updaters/base"
+
+module Dependabot
+  module Bazel
+    class FileUpdater < Dependabot::FileUpdaters::Base
+      extend T::Sig
+
+      require_relative "file_updater/bzlmod_file_updater"
+      require_relative "file_updater/workspace_file_updater"
+      require_relative "file_updater/declaration_parser"
+
+      sig { returns(T::Array[Regexp]) }
+      def self.updated_files_regex
+        [
+          /^MODULE\.bazel$/,
+          %r{^(?:.*/)?MODULE\.bazel$},
+          /^WORKSPACE$/,
+          %r{^(?:.*/)?WORKSPACE\.bazel$},
+          %r{^(?:.*/)?BUILD$},
+          %r{^(?:.*/)?BUILD\.bazel$}
+        ]
+      end
+
+      sig { override.returns(T::Array[Dependabot::DependencyFile]) }
+      def updated_dependency_files
+        updated_files = T.let([], T::Array[Dependabot::DependencyFile])
+
+        dependencies.each do |dependency|
+          if bzlmod_dependency?(dependency)
+            updated_files.concat(update_bzlmod_dependency(dependency))
+          elsif workspace_dependency?(dependency)
+            updated_files.concat(update_workspace_dependency(dependency))
+          end
+        end
+
+        updated_files.uniq
+      end
+
+      private
+
+      sig { override.void }
+      def check_required_files
+        return if module_files.any? || workspace_files.any?
+
+        raise Dependabot::DependencyFileNotFound.new(
+          nil,
+          "No MODULE.bazel or WORKSPACE file found!"
+        )
+      end
+
+      sig { returns(T::Array[Dependabot::DependencyFile]) }
+      def module_files
+        @module_files ||= T.let(
+          dependency_files.select { |f| f.name.end_with?("MODULE.bazel") },
+          T.nilable(T::Array[Dependabot::DependencyFile])
+        )
+      end
+
+      sig { returns(T::Array[Dependabot::DependencyFile]) }
+      def workspace_files
+        @workspace_files ||= T.let(
+          dependency_files.select do |f|
+            f.name == "WORKSPACE" || f.name.end_with?("WORKSPACE.bazel")
+          end,
+          T.nilable(T::Array[Dependabot::DependencyFile])
+        )
+      end
+
+      sig { params(dependency: Dependabot::Dependency).returns(T::Boolean) }
+      def bzlmod_dependency?(dependency)
+        dependency.requirements.any? { |req| req[:file]&.end_with?("MODULE.bazel") }
+      end
+
+      sig { params(dependency: Dependabot::Dependency).returns(T::Boolean) }
+      def workspace_dependency?(dependency)
+        dependency.requirements.any? do |req|
+          req[:file] == "WORKSPACE" || req[:file]&.end_with?("WORKSPACE.bazel")
+        end
+      end
+
+      sig { params(dependency: Dependabot::Dependency).returns(T::Array[Dependabot::DependencyFile]) }
+      def update_bzlmod_dependency(dependency)
+        bzlmod_updater = BzlmodFileUpdater.new(
+          dependency_files: dependency_files,
+          dependencies: [dependency],
+          credentials: credentials
+        )
+        bzlmod_updater.updated_module_files
+      end
+
+      sig { params(dependency: Dependabot::Dependency).returns(T::Array[Dependabot::DependencyFile]) }
+      def update_workspace_dependency(dependency)
+        workspace_updater = WorkspaceFileUpdater.new(
+          dependency_files: dependency_files,
+          dependencies: [dependency],
+          credentials: credentials
+        )
+        workspace_updater.updated_workspace_files
+      end
+
+      sig { params(file: Dependabot::DependencyFile).returns(T::Array[Dependabot::Dependency]) }
+      def relevant_dependencies_for_file(file)
+        dependencies.select do |dependency|
+          dependency.package_manager == "bazel" &&
+            dependency.requirements.any? { |req| req[:file] == file.name }
+        end
+      end
+    end
+  end
+end
+
+Dependabot::FileUpdaters.register("bazel", Dependabot::Bazel::FileUpdater)

data/lib/dependabot/bazel/language.rb

@@ -0,0 +1,26 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+require "dependabot/bazel/version"
+require "dependabot/bazel/requirement"
+require "dependabot/ecosystem"
+
+module Dependabot
+  module Bazel
+    LANGUAGE = "bazel"
+
+    class Language < Dependabot::Ecosystem::VersionManager
+      extend T::Sig
+
+      sig { params(raw_version: String, requirement: T.nilable(Requirement)).void }
+      def initialize(raw_version, requirement = nil)
+        super(
+          name: LANGUAGE,
+          version: Version.new(raw_version),
+          requirement: requirement
+        )
+      end
+    end
+  end
+end

data/lib/dependabot/bazel/metadata_finder.rb

@@ -0,0 +1,28 @@
+# typed: strong
+# frozen_string_literal: true
+
+# NOTE: This file was scaffolded automatically but is OPTIONAL.
+# If you don't need custom metadata finding logic (changelogs, release notes, etc.),
+# you can safely delete this file and remove the require from lib/dependabot/bazel.rb
+
+require "dependabot/metadata_finders"
+require "dependabot/metadata_finders/base"
+
+module Dependabot
+  module Bazel
+    class MetadataFinder < Dependabot::MetadataFinders::Base
+      extend T::Sig
+
+      private
+
+      sig { override.returns(T.nilable(Dependabot::Source)) }
+      def look_up_source
+        # TODO: Implement custom source lookup logic if needed
+        # Otherwise, delete this file and the require in the main registration file
+        nil
+      end
+    end
+  end
+end
+
+Dependabot::MetadataFinders.register("bazel", Dependabot::Bazel::MetadataFinder)

data/lib/dependabot/bazel/package_manager.rb

@@ -0,0 +1,43 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+require "dependabot/bazel/version"
+require "dependabot/ecosystem"
+require "dependabot/bazel/requirement"
+
+module Dependabot
+  module Bazel
+    ECOSYSTEM = "bazel"
+    PACKAGE_MANAGER = "bazel"
+
+    # Keep versions in ascending order
+    SUPPORTED_BAZEL_VERSIONS = T.let([Version.new("6"), Version.new("7")].freeze, T::Array[Dependabot::Version])
+
+    # Currently, we don't support any deprecated versions of Bazel
+    # When a version is going to be unsupported, it will be added here for a while to give users time to upgrade
+    DEPRECATED_BAZEL_VERSIONS = T.let([].freeze, T::Array[Dependabot::Version])
+
+    class PackageManager < Dependabot::Ecosystem::VersionManager
+      extend T::Sig
+
+      sig do
+        params(
+          detected_version: String,
+          raw_version: T.nilable(String),
+          requirement: T.nilable(Requirement)
+        ).void
+      end
+      def initialize(detected_version:, raw_version: nil, requirement: nil)
+        super(
+          name: PACKAGE_MANAGER,
+          detected_version: Version.new(detected_version),
+          version: raw_version ? Version.new(raw_version) : nil,
+          deprecated_versions: DEPRECATED_BAZEL_VERSIONS,
+          supported_versions: SUPPORTED_BAZEL_VERSIONS,
+          requirement: requirement
+        )
+      end
+    end
+  end
+end

data/lib/dependabot/bazel/requirement.rb

@@ -0,0 +1,62 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+require "dependabot/requirement"
+require "dependabot/utils"
+
+module Dependabot
+  module Bazel
+    class Requirement < Dependabot::Requirement
+      extend T::Sig
+
+      # Bazel dependencies typically use exact versions, not version ranges
+      # This class exists for consistency with Dependabot patterns but
+      # may not be heavily used since Bazel tends to pin exact versions
+
+      sig { params(requirement_string: String).returns(String) }
+      def self.normalize_requirement(requirement_string)
+        # Handle exact version specifications (most common in Bazel)
+        return requirement_string if requirement_string.match?(/^[<>=~]/)
+
+        # For bare version strings, treat as exact match
+        return "= #{requirement_string}" if requirement_string.match?(/^\d+(\.\d+)*(-[\w\d.]+)?(\+[\w\d.]+)?$/)
+
+        requirement_string
+      end
+
+      # This abstract method must be implemented
+      sig do
+        override
+          .params(requirement_string: T.nilable(String))
+          .returns(T::Array[Dependabot::Requirement])
+      end
+      def self.requirements_array(requirement_string)
+        # For Bazel, most requirements are simple exact versions
+        return [] if requirement_string.nil? || requirement_string.strip.empty?
+
+        normalized = normalize_requirement(requirement_string)
+        [new(normalized)]
+      end
+
+      sig { override.params(version: Gem::Version).returns(T::Boolean) }
+      def satisfied_by?(version)
+        # For Bazel versions, delegate to the base class
+        # but ensure we're working with proper version objects
+        bazel_version = case version
+                        when Dependabot::Bazel::Version
+                          version
+                        else
+                          Dependabot::Bazel::Version.new(version.to_s)
+                        end
+
+        super(bazel_version)
+      rescue ArgumentError
+        false
+      end
+    end
+  end
+end
+
+Dependabot::Utils
+  .register_requirement_class("bazel", Dependabot::Bazel::Requirement)

data/lib/dependabot/bazel/update_checker/registry_client.rb

@@ -0,0 +1,133 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "json"
+require "base64"
+require "sorbet-runtime"
+require "dependabot/shared_helpers"
+require "dependabot/clients/github_with_retries"
+require "dependabot/dependency"
+require "dependabot/errors"
+
+module Dependabot
+  module Bazel
+    class UpdateChecker
+      class RegistryClient
+        extend T::Sig
+
+        GITHUB_REPO = T.let("bazelbuild/bazel-central-registry", String)
+        RAW_BASE = T.let("https://raw.githubusercontent.com/#{GITHUB_REPO}/main".freeze, String)
+
+        sig { params(credentials: T::Array[Dependabot::Credential]).void }
+        def initialize(credentials:)
+          @credentials = credentials
+        end
+
+        sig { params(module_name: String).returns(T::Array[String]) }
+        def all_module_versions(module_name)
+          contents = T.unsafe(github_client).contents(GITHUB_REPO, path: "modules/#{module_name}")
+          return [] unless contents.is_a?(Array)
+
+          versions = contents.filter_map do |item|
+            next unless item[:type] == "dir"
+
+            item[:name]
+          end
+
+          versions.sort_by { |v| version_sort_key(v) }
+        rescue Octokit::NotFound
+          Dependabot.logger.info("Module '#{module_name}' not found in registry")
+          []
+        end
+
+        sig { params(module_name: String).returns(T.nilable(String)) }
+        def latest_module_version(module_name)
+          versions = all_module_versions(module_name)
+          return nil if versions.empty?
+
+          versions.max_by { |v| version_sort_key(v) }
+        end
+
+        sig { params(module_name: String).returns(T.nilable(T::Hash[String, T.untyped])) }
+        def get_metadata(module_name)
+          versions = all_module_versions(module_name)
+          return nil if versions.empty?
+
+          {
+            "name" => module_name,
+            "versions" => versions,
+            "latest_version" => latest_module_version(module_name)
+          }
+        end
+
+        sig { params(module_name: String, version: String).returns(T.nilable(T::Hash[String, T.untyped])) }
+        def get_source(module_name, version)
+          file_path = "modules/#{module_name}/#{version}/source.json"
+
+          begin
+            content = T.unsafe(github_client).contents(GITHUB_REPO, path: file_path)
+            return nil unless content
+
+            decoded_content = Base64.decode64(content.content)
+            JSON.parse(decoded_content)
+          rescue StandardError => e
+            Dependabot.logger.warn("Failed to get source for #{module_name}@#{version}: #{e.message}")
+            nil
+          end
+        end
+
+        sig { params(module_name: String, version: String).returns(T.nilable(String)) }
+        def get_module_bazel(module_name, version)
+          file_path = "modules/#{module_name}/#{version}/MODULE.bazel"
+
+          begin
+            content = T.unsafe(github_client).contents(GITHUB_REPO, path: file_path)
+            return nil unless content
+
+            Base64.decode64(content.content)
+          rescue StandardError => e
+            Dependabot.logger.warn("Failed to get MODULE.bazel for #{module_name}@#{version}: #{e.message}")
+            nil
+          end
+        end
+
+        sig { params(module_name: String, version: String).returns(T::Boolean) }
+        def module_version_exists?(module_name, version)
+          !get_source(module_name, version).nil?
+        end
+
+        sig { params(module_name: String, version: String).returns(T.nilable(Time)) }
+        def get_version_release_date(module_name, version)
+          file_path = "modules/#{module_name}/#{version}/MODULE.bazel"
+
+          commits = begin
+            T.unsafe(github_client).commits("bazelbuild/bazel-central-registry", path: file_path, per_page: 1)
+          rescue StandardError => e
+            Dependabot.logger.warn("Failed to get release date for #{module_name} #{version}: #{e.message}")
+          end
+
+          return nil unless commits&.any?
+
+          commits.first.commit.committer.date
+        end
+
+        private
+
+        sig { returns(Dependabot::Clients::GithubWithRetries) }
+        def github_client
+          @github_client ||= T.let(
+            Dependabot::Clients::GithubWithRetries.for_github_dot_com(credentials: @credentials),
+            T.nilable(Dependabot::Clients::GithubWithRetries)
+          )
+        end
+
+        sig { params(version: String).returns(T::Array[Integer]) }
+        def version_sort_key(version)
+          cleaned = version.gsub(/^v/, "")
+          parts = cleaned.split(".")
+          parts.map { |part| part.match?(/^\d+$/) ? part.to_i : 0 }
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/bazel/update_checker/requirements_updater.rb

@@ -0,0 +1,35 @@
+# typed: strong
+# frozen_string_literal: true
+
+module Dependabot
+  module Bazel
+    class UpdateChecker
+      class RequirementsUpdater
+        extend T::Sig
+
+        sig { params(requirements: T::Array[T::Hash[Symbol, T.untyped]], latest_version: String).void }
+        def initialize(requirements:, latest_version:)
+          @requirements = requirements
+          @latest_version = latest_version
+        end
+
+        sig { returns(T::Array[T::Hash[Symbol, T.untyped]]) }
+        def updated_requirements
+          @requirements.map do |requirement|
+            updated_requirement = requirement.dup
+            updated_requirement[:requirement] = @latest_version
+            updated_requirement
+          end
+        end
+
+        private
+
+        sig { returns(T::Array[T::Hash[Symbol, T.untyped]]) }
+        attr_reader :requirements
+
+        sig { returns(String) }
+        attr_reader :latest_version
+      end
+    end
+  end
+end