dependabot-bundler 0.324.1 → 0.325.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 680f06ee4e940eaa830f822b0fded4ea43826ef39285089608925d0c7e15204a
-  data.tar.gz: 620809604eadbfca78e1bbb75165e84d7bcbf44cf008fffd3a51165eb8be54fa
+  metadata.gz: 57eb6fdc66cbe528038e510497e0f82f35002e2c4a47e842caecbc79d1c7f4f9
+  data.tar.gz: 3332c38e5415493e6d57c0094255fe1e236779b0c1d74192ee102df5e2c42dd0
 SHA512:
-  metadata.gz: fcf6add9227eb52e3a0d6cf441f395abd2179f508974643ed6a8104a9bf3c7e895e21b69ade9e436807320e0d2f8891776a2130cf53ec89906bb1925b9eb8527
-  data.tar.gz: 82ad27d48844ae3d19f55e289840de300d546681b357c2ac6dbf2342c3c2fb333d57f09fb95599bb04ff9a7d2d63366ebebe6d3ff193f5f0a39d09cae098a061
+  metadata.gz: 6b6bd23b82c3d2f473a7937b88c71ff6701ddda5c71ee3eb19fecb9771feb30beece480854a647f1fba4adb580b261d4f08df90ce986dbb481122368083b853b
+  data.tar.gz: a313088f61d1d1fea117c6bcfb958765d23ed8df8f27974153125e0770e4ec686c9f3a9a7a5ec2ccd80c836a620b25959dfe86c736e0ee9350b1c13c1173b9b4

data/lib/dependabot/bundler/file_parser.rb

@@ -1,7 +1,8 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "parallel"
+require "sorbet-runtime"
 require "dependabot/bundler/language"
 require "dependabot/bundler/package_manager"
 require "dependabot/dependency"
@@ -17,7 +18,7 @@ require "dependabot/errors"
 
 module Dependabot
   module Bundler
-    class FileParser < Dependabot::FileParsers::Base
+    class FileParser < Dependabot::FileParsers::Base # rubocop:disable Metrics/ClassLength
       extend T::Sig
       require "dependabot/file_parsers/base/dependency_set"
       require "dependabot/bundler/file_parser/file_preparer"
@@ -50,34 +51,47 @@ module Dependabot
 
       sig { returns(Ecosystem::VersionManager) }
       def package_manager
-        @package_manager ||= PackageManager.new(
-          detected_version: bundler_version,
-          raw_version: bundler_raw_version,
-          requirement: package_manager_requirement
+        @package_manager ||= T.let(
+          PackageManager.new(
+            detected_version: bundler_version,
+            raw_version: bundler_raw_version,
+            requirement: package_manager_requirement
+          ),
+          T.nilable(Ecosystem::VersionManager)
         )
       end
 
+      sig { returns(T.nilable(Requirement)) }
       def package_manager_requirement
-        @package_manager_requirement ||= Helpers.dependency_requirement(
-          Helpers::BUNDLER_GEM_NAME, dependency_files
+        @package_manager_requirement ||= T.let(
+          Helpers.dependency_requirement(
+            Helpers::BUNDLER_GEM_NAME, dependency_files
+          ),
+          T.nilable(T.nilable(Requirement))
         )
       end
 
       sig { returns(T.nilable(Ecosystem::VersionManager)) }
       def language
+        @language = T.let(@language, T.nilable(Ecosystem::VersionManager))
         return @language if defined?(@language)
 
-        return nil if package_manager.unsupported?
+        return @language = nil if package_manager.unsupported?
 
-        Language.new(ruby_raw_version, language_requirement)
+        @language = Language.new(ruby_raw_version, language_requirement)
       end
 
+      sig { returns(T.nilable(Requirement)) }
       def language_requirement
-        @language_requirement ||= Helpers.dependency_requirement(
-          Helpers::LANGUAGE, dependency_files
+        @language_requirement ||= T.let(
+          Helpers.dependency_requirement(
+            Helpers::LANGUAGE, dependency_files
+          ),
+          T.nilable(T.nilable(Requirement))
         )
       end
 
+      sig { params(dependencies: T::Array[Dependabot::Dependency]).void }
       def check_external_code(dependencies)
         return unless @reject_external_code
         return unless git_source?(dependencies)
@@ -86,18 +100,23 @@ module Dependabot
         raise ::Dependabot::UnexpectedExternalCode
       end
 
+      sig { params(dependencies: T::Array[Dependabot::Dependency]).returns(T::Boolean) }
       def git_source?(dependencies)
         dependencies.any? do |dep|
           dep.requirements.any? { |req| req.fetch(:source)&.fetch(:type) == "git" }
         end
       end
 
+      sig { returns(DependencySet) }
       def gemfile_dependencies
+        @gemfile_dependencies = T.let(@gemfile_dependencies, T.nilable(DependencySet))
+        return @gemfile_dependencies if @gemfile_dependencies
+
         dependencies = DependencySet.new
 
-        return dependencies unless gemfile
+        return (@gemfile_dependencies = dependencies) unless gemfile
 
-        [gemfile, *evaled_gemfiles].each do |file|
+        [T.must(gemfile), *evaled_gemfiles].each do |file|
           gemfile_declaration_finder = GemfileDeclarationFinder.new(gemfile: file)
 
           parsed_gemfile.each do |dep|
@@ -118,15 +137,17 @@ module Dependabot
           end
         end
 
-        dependencies
+        @gemfile_dependencies = dependencies
       end
 
+      sig { returns(DependencySet) }
       def gemspec_dependencies # rubocop:disable Metrics/PerceivedComplexity
-        return @gemspec_dependencies if defined?(@gemspec_dependencies)
+        @gemspec_dependencies = T.let(@gemspec_dependencies, T.nilable(DependencySet))
+        return @gemspec_dependencies if @gemspec_dependencies
 
         queue = Queue.new
 
-        SharedHelpers.in_a_temporary_repo_directory(base_directory, repo_contents_path) do
+        SharedHelpers.in_a_temporary_repo_directory(T.must(base_directory), repo_contents_path) do
           write_temporary_dependency_files
 
           Parallel.map(gemspecs, in_threads: 4) do |gemspec|
@@ -156,9 +177,10 @@ module Dependabot
 
         dependency_set = DependencySet.new
         dependency_set << queue.pop(true) while queue.size.positive?
-        @gemspec_dependencies ||= dependency_set
+        @gemspec_dependencies = dependency_set
       end
 
+      sig { returns(DependencySet) }
       def lockfile_dependencies
         dependencies = DependencySet.new
 
@@ -185,9 +207,10 @@ module Dependabot
         dependencies
       end
 
+      sig { returns(T::Array[T::Hash[String, T.untyped]]) }
       def parsed_gemfile
-        @parsed_gemfile ||=
-          SharedHelpers.in_a_temporary_repo_directory(base_directory,
+        @parsed_gemfile ||= T.let(
+          SharedHelpers.in_a_temporary_repo_directory(T.must(base_directory),
                                                       repo_contents_path) do
             write_temporary_dependency_files
 
@@ -196,12 +219,14 @@ module Dependabot
               function: "parsed_gemfile",
               options: options,
               args: {
-                gemfile_name: gemfile.name,
+                gemfile_name: T.must(gemfile).name,
                 lockfile_name: lockfile&.name,
                 dir: Dir.pwd
               }
             )
-          end
+          end,
+          T.nilable(T::Array[T::Hash[String, T.untyped]])
+        )
       rescue SharedHelpers::HelperSubprocessFailed => e
         handle_eval_error(e) if e.error_class == "JSON::ParserError"
 
@@ -210,11 +235,13 @@ module Dependabot
         raise Dependabot::DependencyFileNotEvaluatable, msg
       end
 
+      sig { params(err: StandardError).void }
       def handle_eval_error(err)
         msg = "Error evaluating your dependency files: #{err.message}"
         raise Dependabot::DependencyFileNotEvaluatable, msg
       end
 
+      sig { params(file: Dependabot::DependencyFile).returns(T::Array[T::Hash[String, T.untyped]]) }
       def parsed_gemspec(file)
         NativeHelpers.run_bundler_subprocess(
           bundler_version: bundler_version,
@@ -231,16 +258,21 @@ module Dependabot
         raise Dependabot::DependencyFileNotEvaluatable, msg
       end
 
+      sig { returns(T.nilable(String)) }
       def base_directory
         dependency_files.first&.directory
       end
 
+      sig { returns(T::Array[Dependabot::DependencyFile]) }
       def prepared_dependency_files
-        @prepared_dependency_files ||=
+        @prepared_dependency_files ||= T.let(
           FilePreparer.new(dependency_files: dependency_files)
-                      .prepared_dependency_files
+                              .prepared_dependency_files,
+          T.nilable(T::Array[Dependabot::DependencyFile])
+        )
       end
 
+      sig { void }
       def write_temporary_dependency_files
         prepared_dependency_files.each do |file|
           path = file.name
@@ -248,9 +280,10 @@ module Dependabot
           File.write(path, file.content)
         end
 
-        File.write(lockfile.name, sanitized_lockfile_content) if lockfile
+        File.write(T.must(lockfile).name, sanitized_lockfile_content) if lockfile
       end
 
+      sig { override.void }
       def check_required_files
         file_names = dependency_files.map(&:name)
 
@@ -263,6 +296,7 @@ module Dependabot
         raise "A gemspec or Gemfile must be provided!"
       end
 
+      sig { params(dependency_name: String).returns(T.nilable(T.any(Dependabot::Version, String, Gem::Version))) }
       def dependency_version(dependency_name)
         return unless lockfile
 
@@ -281,11 +315,16 @@ module Dependabot
         spec.version
       end
 
+      sig { returns(T.nilable(Dependabot::DependencyFile)) }
       def gemfile
-        @gemfile ||= get_original_file("Gemfile") ||
-                     get_original_file("gems.rb")
+        @gemfile ||= T.let(
+          get_original_file("Gemfile") ||
+                             get_original_file("gems.rb"),
+          T.nilable(Dependabot::DependencyFile)
+        )
       end
 
+      sig { returns(T::Array[Dependabot::DependencyFile]) }
       def evaled_gemfiles
         dependency_files
           .reject { |f| f.name.end_with?(".gemspec") }
@@ -297,23 +336,33 @@ module Dependabot
           .reject(&:support_file?)
       end
 
+      sig { returns(T.nilable(Dependabot::DependencyFile)) }
       def lockfile
-        @lockfile ||= get_original_file("Gemfile.lock") ||
-                      get_original_file("gems.locked")
+        @lockfile ||= T.let(
+          get_original_file("Gemfile.lock") ||
+                              get_original_file("gems.locked"),
+          T.nilable(Dependabot::DependencyFile)
+        )
       end
 
+      sig { returns(T.untyped) }
       def parsed_lockfile
+        @parsed_lockfile = T.let(@parsed_lockfile, T.untyped)
         @parsed_lockfile ||= CachedLockfileParser.parse(sanitized_lockfile_content)
       end
 
+      sig { returns(T::Array[String]) }
       def production_dep_names
-        @production_dep_names ||=
+        @production_dep_names ||= T.let(
           (gemfile_dependencies + gemspec_dependencies).dependencies
-                                                       .select { |dep| production?(dep) }
-                                                       .flat_map { |dep| expanded_dependency_names(dep) }
-                                                       .uniq
+                                                               .select { |dep| production?(dep) }
+                                                               .flat_map { |dep| expanded_dependency_names(dep) }
+                                                               .uniq,
+          T.nilable(T::Array[String])
+        )
       end
 
+      sig { params(dep: T.any(Dependabot::Dependency, Gem::Dependency)).returns(T::Array[String]) }
       def expanded_dependency_names(dep)
         spec = parsed_lockfile.specs.find { |s| s.name == dep.name }
         return [dep.name] unless spec
@@ -324,6 +373,7 @@ module Dependabot
         ]
       end
 
+      sig { params(dependency: Dependabot::Dependency).returns(T::Boolean) }
       def production?(dependency)
         groups = dependency.requirements
                            .flat_map { |r| r.fetch(:groups) }
@@ -337,15 +387,20 @@ module Dependabot
       end
 
       # TODO: Stop sanitizing the lockfile once we have bundler 2 installed
+      sig { returns(String) }
       def sanitized_lockfile_content
         regex = FileUpdater::LockfileUpdater::LOCKFILE_ENDING
-        lockfile.content.gsub(regex, "")
+        T.must(T.must(lockfile).content).gsub(regex, "")
       end
 
+      sig { returns(T::Array[Dependabot::DependencyFile]) }
       def gemspecs
         # Path gemspecs are excluded (they're supporting files)
-        @gemspecs ||= prepared_dependency_files
-                      .select { |file| file.name.end_with?(".gemspec") }
+        @gemspecs ||= T.let(
+          prepared_dependency_files
+                              .select { |file| file.name.end_with?(".gemspec") },
+          T.nilable(T::Array[Dependabot::DependencyFile])
+        )
       end
 
       sig { returns(T::Array[Dependabot::DependencyFile]) }
@@ -357,38 +412,43 @@ module Dependabot
 
       sig { returns(String) }
       def bundler_raw_version
-        return bundler_raw_version if defined?(@bundler_raw_version)
+        @bundler_raw_version = T.let(@bundler_raw_version, T.nilable(String))
+        return @bundler_raw_version if @bundler_raw_version
 
         package_manager = PackageManager.new(
           detected_version: bundler_version
         )
 
         # If the selected version is unsupported, an unsupported error will be raised,
-        # so there’s no need to attempt retrieving the raw version.
+        # so there's no need to attempt retrieving the raw version.
         return bundler_version if package_manager.unsupported?
 
+        directory = base_directory
         # read raw version directly from the ecosystem environment
-        bundler_raw_version = SharedHelpers.in_a_temporary_repo_directory(
-          base_directory,
-          repo_contents_path
-        ) do
-          write_temporary_dependency_files
-          NativeHelpers.run_bundler_subprocess(
-            function: "bundler_raw_version",
-            args: {},
-            bundler_version: bundler_version,
-            options: { timeout_per_operation_seconds: 10 }
-          )
-        end
-        bundler_raw_version || ::Bundler::VERSION
+        bundler_raw_version = if directory
+                                SharedHelpers.in_a_temporary_repo_directory(
+                                  directory,
+                                  repo_contents_path
+                                ) do
+                                  write_temporary_dependency_files
+                                  NativeHelpers.run_bundler_subprocess(
+                                    function: "bundler_raw_version",
+                                    args: {},
+                                    bundler_version: bundler_version,
+                                    options: { timeout_per_operation_seconds: 10 }
+                                  )
+                                end
+                              end
+        @bundler_raw_version = bundler_raw_version || ::Bundler::VERSION
       end
 
       sig { returns(String) }
       def ruby_raw_version
-        return @ruby_raw_version if defined?(@ruby_raw_version)
+        @ruby_raw_version = T.let(@ruby_raw_version, T.nilable(String))
+        return @ruby_raw_version if @ruby_raw_version
 
         ruby_raw_version = SharedHelpers.in_a_temporary_repo_directory(
-          base_directory,
+          T.must(base_directory),
           repo_contents_path
         ) do
           write_temporary_dependency_files
@@ -399,12 +459,12 @@ module Dependabot
             options: { timeout_per_operation_seconds: 10 }
           )
         end
-        ruby_raw_version || RUBY_VERSION
+        @ruby_raw_version = ruby_raw_version || RUBY_VERSION
       end
 
       sig { returns(String) }
       def bundler_version
-        @bundler_version ||= Helpers.bundler_version(lockfile)
+        @bundler_version ||= T.let(Helpers.bundler_version(lockfile), T.nilable(String))
       end
     end
   end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bundler
 version: !ruby/object:Gem::Version
-  version: 0.324.1
+  version: 0.325.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.324.1
+        version: 0.325.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.324.1
+        version: 0.325.0
 - !ruby/object:Gem::Dependency
   name: parallel
   requirement: !ruby/object:Gem::Requirement
@@ -197,14 +197,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.2'
+        version: 2.2.5
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.2'
+        version: 2.2.5
 - !ruby/object:Gem::Dependency
   name: vcr
   requirement: !ruby/object:Gem::Requirement
@@ -322,7 +322,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.324.1
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.325.0
 rdoc_options: []
 require_paths:
 - lib