dependabot-bun 0.379.0 → 0.380.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 27ff91291cb562b6a05c148ce2f77a7b0b1ed4b7b33a4e0021b74872ef04e68c
-  data.tar.gz: a1bafb40bc94437c6b53de4f1796342d731e65bdf03040f1893f110581d61eda
+  metadata.gz: b96db7ce26be2c0633f3c07b3058a44fe60df2b747da3221d13cefbaecfb6f6b
+  data.tar.gz: ba81314d55458594ca198c8efd900709ffd986db3f860dbd01d4af282f31b580
 SHA512:
-  metadata.gz: d2b83ffd8ecd9191893bd22cdb19271e10aa1af9a450a473b8693f47d42692e78469aefbb9827efaee153f71e005da5486194d39fe28ecef19061278f8a51a16
-  data.tar.gz: 74752e2ff6f5c595924a2f980fa0177dbaabaa4c99478ac505a221df144f8c137bdc895216a827d4eccf2b196d3bdb26d31207e0cad6540ef24f75338b62b2de
+  metadata.gz: 23aa46c39d9b9ce5e935e6eef5f67152f3a37f01652742603ab311fd1f962e055224763c6c657b13b161f0976fba42e7475264b46d0e405e6ad9be4912c3dea7
+  data.tar.gz: f174cf566e171a1fd7c857636d2ca2c799c70dfc75fac9519a10675c6ac087e157db5e5d00e67db4ae1e68fb9db814cc82125162384a51cb7ad2c73d5dc46aaf

data/lib/dependabot/bun/dependency_grapher/lockfile_generator.rb

@@ -0,0 +1,109 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+
+require "dependabot/dependency_file"
+require "dependabot/shared_helpers"
+require "dependabot/bun/helpers"
+require "dependabot/bun/bun_package_manager"
+require "dependabot/bun/file_updater/npmrc_builder"
+
+module Dependabot
+  module Bun
+    class DependencyGrapher < Dependabot::DependencyGraphers::Base
+      class LockfileGenerator
+        extend T::Sig
+
+        sig do
+          params(
+            dependency_files: T::Array[Dependabot::DependencyFile],
+            credentials: T::Array[Dependabot::Credential]
+          ).void
+        end
+        def initialize(dependency_files:, credentials:)
+          @dependency_files = dependency_files
+          @credentials = credentials
+        end
+
+        sig { returns(Dependabot::DependencyFile) }
+        def generate
+          SharedHelpers.in_a_temporary_directory do
+            write_temporary_files
+            run_lockfile_generation
+            read_generated_lockfile
+          end
+        rescue SharedHelpers::HelperSubprocessFailed => e
+          handle_generation_error(e)
+          raise
+        end
+
+        private
+
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
+        attr_reader :dependency_files
+
+        sig { returns(T::Array[Dependabot::Credential]) }
+        attr_reader :credentials
+
+        sig { void }
+        def write_temporary_files
+          dependency_files.each do |file|
+            next unless file.name.end_with?("package.json", ".npmrc")
+
+            path = file.name
+            FileUtils.mkdir_p(File.dirname(path))
+            File.write(path, file.content)
+          end
+
+          write_npmrc_from_credentials unless dependency_files.any? { |f| f.name.end_with?(".npmrc") }
+        end
+
+        sig { void }
+        def write_npmrc_from_credentials
+          npmrc_content = FileUpdater::NpmrcBuilder.new(
+            credentials: credentials,
+            dependency_files: dependency_files
+          ).npmrc_content
+
+          return if npmrc_content.strip.empty?
+
+          File.write(".npmrc", npmrc_content)
+        end
+
+        sig { void }
+        def run_lockfile_generation
+          Dependabot.logger.info("Generating bun.lock for dependency graphing")
+          Helpers.run_bun_command("install --ignore-scripts", fingerprint: "install --ignore-scripts")
+        end
+
+        sig { returns(Dependabot::DependencyFile) }
+        def read_generated_lockfile
+          lockfile_name = BunPackageManager::LOCKFILE_NAME
+
+          unless File.exist?(lockfile_name)
+            Dependabot.logger.error("#{lockfile_name} was not generated")
+            raise Dependabot::DependencyFileNotEvaluatable, "#{lockfile_name} was not generated"
+          end
+
+          Dependabot::DependencyFile.new(
+            name: lockfile_name,
+            content: File.read(lockfile_name),
+            directory: package_json_directory
+          )
+        end
+
+        sig { returns(String) }
+        def package_json_directory
+          package_json = dependency_files.find { |f| f.name.end_with?("package.json") }
+          package_json&.directory || "/"
+        end
+
+        sig { params(error: SharedHelpers::HelperSubprocessFailed).void }
+        def handle_generation_error(error)
+          Dependabot.logger.error("Failed to generate bun.lock: #{error.message}")
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/bun/dependency_grapher.rb

@@ -14,16 +14,20 @@ module Dependabot
     class DependencyGrapher < Dependabot::DependencyGraphers::Base
       extend T::Sig
 
+      require_relative "dependency_grapher/lockfile_generator"
+
       sig { override.returns(Dependabot::DependencyFile) }
       def relevant_dependency_file
+        return package_json if @ephemeral_lockfile_generated
+
         lockfile || package_json
       end
 
       sig { override.void }
       def prepare!
         if lockfile.nil?
-          Dependabot.logger.warn("No bun.lock found; dependency graph will be incomplete.")
-          errored_fetching_subdependencies!
+          Dependabot.logger.info("No bun.lock found, generating ephemeral lockfile for dependency graphing")
+          generate_ephemeral_lockfile!
         end
         super
       end
@@ -45,6 +49,33 @@ module Dependabot
         dependency.name.sub(/^@/, "%40")
       end
 
+      sig { void }
+      def generate_ephemeral_lockfile!
+        generator = LockfileGenerator.new(
+          dependency_files: dependency_files,
+          credentials: file_parser.credentials
+        )
+
+        ephemeral_lockfile = generator.generate
+        inject_ephemeral_lockfile(ephemeral_lockfile)
+        @ephemeral_lockfile_generated = T.let(true, T.nilable(T::Boolean))
+
+        Dependabot.logger.info("Successfully generated ephemeral bun.lock for dependency graphing")
+      rescue StandardError => e
+        errored_fetching_subdependencies!
+        @subdependency_error = e
+        Dependabot.logger.warn(
+          "Failed to generate ephemeral bun.lock: #{e.message}. " \
+          "Dependency versions may not be resolved."
+        )
+      end
+
+      sig { params(ephemeral_lockfile: Dependabot::DependencyFile).void }
+      def inject_ephemeral_lockfile(ephemeral_lockfile)
+        dependency_files << ephemeral_lockfile
+        remove_instance_variable(:@lockfile) if instance_variable_defined?(:@lockfile)
+      end
+
       sig { returns(Dependabot::DependencyFile) }
       def package_json
         return T.must(@package_json) if defined?(@package_json)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bun
 version: !ruby/object:Gem::Version
-  version: 0.379.0
+  version: 0.380.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.379.0
+        version: 0.380.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.379.0
+        version: 0.380.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -309,6 +309,7 @@ files:
 - lib/dependabot/bun/constraint_helper.rb
 - lib/dependabot/bun/dependency_files_filterer.rb
 - lib/dependabot/bun/dependency_grapher.rb
+- lib/dependabot/bun/dependency_grapher/lockfile_generator.rb
 - lib/dependabot/bun/file_fetcher.rb
 - lib/dependabot/bun/file_fetcher/path_dependency_builder.rb
 - lib/dependabot/bun/file_parser.rb
@@ -348,7 +349,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.379.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.380.0
 rdoc_options: []
 require_paths:
 - lib