dependabot-bazel 0.391.0 → 0.393.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a5c9b7d2360072081b39e1d4a50fa75cb8ee8f61c4e1bc1f2cb17a618ada75f2
-  data.tar.gz: c1e4b0b06cb5359a95d8d7577391e4ea1a15c89296e8628963a474fe5ee6374f
+  metadata.gz: a287ec6c36d40305a8ed719a166a87a0ad363aaaadb6b77ffdd38bdd89d0ca95
+  data.tar.gz: c2620b0ee29d9da16fad68bbe71a4a51c00815546d29257f222e38c1631c6770
 SHA512:
-  metadata.gz: e4eb9f225b2eeccd4fd7dd17bfd625241afeffb417c246f14a8c06759f02b98f9929ac9069760b158b38d53f00d3e92edfb8404bfd51fb284ae0e8b9fe207f43
-  data.tar.gz: 1e77e525988b8d33afe41a495a647eb90630bd4d629dbb29883ca316a3f58c7d666e0cf57627625b13b545e0a4f4f64c53e427039e4292699b194cd81748ff3a
+  metadata.gz: 0fdde17060ab508d6d819d3124867e68e51665ab4667f1d94b0cedec66d3b6881d3b510263718d9f21123fffd8392f335cc61311de610cfe06b1208ff825b971
+  data.tar.gz: dff2cc0148841141df5e1fcae355619068a41d6d04d5c7e1e6d2996a3680b5363c459610f134a02ad750f0b445d5795616ae0f074b0c2626f238f6833807a7de

data/lib/dependabot/bazel/file_fetcher.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "dependabot/file_fetchers"
@@ -73,7 +73,7 @@ module Dependabot
         files = T.let([], T::Array[DependencyFile])
 
         module_file_items.each do |item|
-          file = fetch_file_if_present(T.must(item.name))
+          file = fetch_file_if_present(item.name)
           files << file if file
         end
 

data/lib/dependabot/bazel/file_updater/lockfile_updater.rb

@@ -104,7 +104,7 @@ module Dependabot
 
         sig { params(dependency: Dependabot::Dependency).returns(T::Boolean) }
         def bzlmod_dependency?(dependency)
-          dependency.requirements.any? { |req| req[:file]&.end_with?("MODULE.bazel") }
+          dependency.requirements.any? { |req| req.file&.end_with?("MODULE.bazel") }
         end
 
         sig { returns(String) }

data/lib/dependabot/bazel/file_updater/workspace_file_updater.rb

@@ -80,8 +80,8 @@ module Dependabot
 
         sig { params(dependency: Dependabot::Dependency).returns(Symbol) }
         def dependency_type(dependency)
-          return :http_archive if dependency.requirements.any? { |req| req.dig(:source, :type) == "http_archive" }
-          return :git_repository if dependency.requirements.any? { |req| req.dig(:source, :type) == "git_repository" }
+          return :http_archive if dependency.requirements.any? { |req| req.source_string("type") == "http_archive" }
+          return :git_repository if dependency.requirements.any? { |req| req.source_string("type") == "git_repository" }
 
           :unknown
         end

data/lib/dependabot/bazel/file_updater.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "dependabot/file_updaters"
@@ -87,13 +87,13 @@ module Dependabot
 
       sig { params(dependency: Dependabot::Dependency).returns(T::Boolean) }
       def bzlmod_dependency?(dependency)
-        dependency.requirements.any? { |req| req[:file]&.end_with?("MODULE.bazel") }
+        dependency.requirements.any? { |req| req.file&.end_with?("MODULE.bazel") }
       end
 
       sig { params(dependency: Dependabot::Dependency).returns(T::Boolean) }
       def workspace_dependency?(dependency)
         dependency.requirements.any? do |req|
-          req[:file] == "WORKSPACE" || req[:file]&.end_with?("WORKSPACE.bazel")
+          req.file == "WORKSPACE" || req.file&.end_with?("WORKSPACE.bazel")
         end
       end
 
@@ -121,7 +121,7 @@ module Dependabot
       def relevant_dependencies_for_file(file)
         dependencies.select do |dependency|
           dependency.package_manager == "bazel" &&
-            dependency.requirements.any? { |req| req[:file] == file.name }
+            dependency.requirements.any? { |req| req.file == file.name }
         end
       end
     end

data/lib/dependabot/bazel/metadata_finder.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "dependabot/metadata_finders"
@@ -39,12 +39,12 @@ module Dependabot
       sig { returns(Symbol) }
       def source_type
         return :bazel_dep if dependency.requirements.empty?
-        return :bazel_dep if dependency.requirements.any? { |r| r[:source].nil? }
+        return :bazel_dep if dependency.requirements.any? { |requirement| requirement.source.nil? }
 
-        source_details = dependency.requirements.first&.dig(:source)
-        return :bazel_dep unless source_details
+        requirement = dependency.requirements.first
+        return :bazel_dep unless requirement
 
-        case source_details[:type]
+        case requirement.source_string("type")
         when "http_archive" then :http_archive
         when "git_repository" then :git_repository
         else :unknown
@@ -65,7 +65,7 @@ module Dependabot
 
       sig { returns(T.nilable(Dependabot::Source)) }
       def find_source_from_http_archive
-        url = dependency.requirements.first&.dig(:source, :url)
+        url = dependency.requirements.first&.source_string("url")
         return nil unless url
 
         source_from_url(url)
@@ -73,7 +73,7 @@ module Dependabot
 
       sig { returns(T.nilable(Dependabot::Source)) }
       def find_source_from_git_repository
-        remote_url = dependency.requirements.first&.dig(:source, :remote)
+        remote_url = dependency.requirements.first&.source_string("remote")
         return nil unless remote_url
 
         Dependabot::Source.from_url(remote_url)

data/lib/dependabot/bazel/update_checker/registry_client.rb

@@ -3,6 +3,7 @@
 
 require "json"
 require "base64"
+require "time"
 require "sorbet-runtime"
 require "dependabot/shared_helpers"
 require "dependabot/clients/github_with_retries"
@@ -66,10 +67,8 @@ module Dependabot
           file_path = "modules/#{module_name}/#{version}/source.json"
 
           begin
-            content = T.unsafe(github_client.contents(GITHUB_REPO, path: file_path))
-            return nil unless content
-
-            decoded_content = Base64.decode64(content.content)
+            content = github_file_content(file_path)
+            decoded_content = Base64.decode64(content)
             JSON.parse(decoded_content)
           rescue StandardError => e
             Dependabot.logger.warn("Failed to get source for #{module_name}@#{version}: #{e.message}")
@@ -82,10 +81,7 @@ module Dependabot
           file_path = "modules/#{module_name}/#{version}/MODULE.bazel"
 
           begin
-            content = T.unsafe(github_client.contents(GITHUB_REPO, path: file_path))
-            return nil unless content
-
-            Base64.decode64(content.content)
+            Base64.decode64(github_file_content(file_path))
           rescue StandardError => e
             Dependabot.logger.warn("Failed to get MODULE.bazel for #{module_name}@#{version}: #{e.message}")
             nil
@@ -102,18 +98,45 @@ module Dependabot
           file_path = "modules/#{module_name}/#{version}/MODULE.bazel"
 
           commits = begin
-            T.unsafe(github_client).commits("bazelbuild/bazel-central-registry", path: file_path, per_page: 1)
+            github_client.commits("bazelbuild/bazel-central-registry", path: file_path, per_page: 1)
           rescue StandardError => e
             Dependabot.logger.warn("Failed to get release date for #{module_name} #{version}: #{e.message}")
+            nil
           end
 
-          return nil unless commits&.any?
+          commit = commits&.first
+          return nil unless commit
 
-          T.unsafe(commits).first.commit.committer.date
+          commit_details = resource_field(commit, :commit, "commit details")
+          committer = resource_field(commit_details, :committer, "committer")
+          value = T.cast(committer[:date], Object)
+          return value if value.is_a?(Time)
+          return Time.parse(value) if value.is_a?(String)
+
+          raise TypeError, "committer date must be a time or string"
         end
 
         private
 
+        sig { params(file_path: String).returns(String) }
+        def github_file_content(file_path)
+          response = github_client.contents(GITHUB_REPO, path: file_path)
+          raise TypeError, "GitHub file response must be an object" unless response.is_a?(Sawyer::Resource)
+
+          value = T.cast(response[:content], Object)
+          return value if value.is_a?(String)
+
+          raise TypeError, "GitHub file content must be a string"
+        end
+
+        sig { params(resource: Sawyer::Resource, key: Symbol, context: String).returns(Sawyer::Resource) }
+        def resource_field(resource, key, context)
+          value = T.cast(resource[key], Object)
+          return value if value.is_a?(Sawyer::Resource)
+
+          raise TypeError, "#{context} must be an object"
+        end
+
         sig { returns(Dependabot::Clients::GithubWithRetries) }
         def github_client
           @github_client ||= T.let(

data/lib/dependabot/bazel/update_checker/requirements_updater.rb

@@ -21,10 +21,10 @@ module Dependabot
 
         sig { returns(T::Array[Dependabot::DependencyRequirement]) }
         def updated_requirements
-          @requirements.map do |requirement|
-            updated_requirement = requirement.dup
-            updated_requirement[:requirement] = @latest_version
-            updated_requirement
+          requirements.map do |requirement|
+            Dependabot::DependencyRequirement.create(
+              requirement.merge(requirement: latest_version)
+            )
           end
         end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bazel
 version: !ruby/object:Gem::Version
-  version: 0.391.0
+  version: 0.393.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.391.0
+        version: 0.393.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.391.0
+        version: 0.393.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -269,7 +269,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.391.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.393.0
 rdoc_options: []
 require_paths:
 - lib