dependabot-bundler 0.94.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: c2ec2bbf57a168323e957e8bcc8cee48ce9ad4bd05329e645d4e016483fd01f6
+  data.tar.gz: e80762d26ebbc3afc933fe46ab7a64fb1f88fd49822d9624d53a6bfca58bdee8
+SHA512:
+  metadata.gz: 26a535914e74d584d32f7089c8c17d2aed2bf4dcf5ad3ebf29dcb3713fae24deb7e767b55ccd47caa7e9ab554c2e47ba1c22ccc77de4a70f76e413264ab107e8
+  data.tar.gz: 64e1dc779eb2a0ce63625d1462587e0cbc7d8d18f1e3012fefff304015806788176d789f692e576ff7165dfb410e2910ae9d5fa0dd1cd17dd118c40751442289

data/helpers/Makefile

@@ -0,0 +1,9 @@
+.PHONY = all
+
+all: darwin linux
+
+darwin:
+	GO111MODULE=on GOOS=darwin GOARCH=amd64 go build -o go-helpers.darwin64 .
+
+linux:
+	GO111MODULE=on GOOS=linux GOARCH=amd64  go build -o go-helpers.linux64 .

data/helpers/build

@@ -0,0 +1,26 @@
+#!/bin/bash
+
+set -e
+
+install_dir=$1
+if [ -z "$install_dir" ]; then
+  echo "usage: $0 INSTALL_DIR"
+  exit 1
+fi
+
+if ! [[ "$install_dir" =~ ^/ ]]; then
+  echo "$install_dir must be an absolute path"
+  exit 1
+fi
+
+if [ ! -d "$install_dir/bin" ]; then
+  mkdir -p "$install_dir/bin"
+fi
+
+helpers_dir="$(dirname "${BASH_SOURCE[0]}")"
+cd $helpers_dir
+
+os="$(uname -s | tr '[:upper:]' '[:lower:]')"
+echo "building $install_dir/bin/helper"
+
+GO111MODULE=on GOOS="$os" GOARCH=amd64 go build -o "$install_dir/bin/helper" .

data/lib/dependabot/bundler.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+# These all need to be required so the various classes can be registered in a
+# lookup table of package manager names to concrete classes.
+require "dependabot/bundler/file_fetcher"
+require "dependabot/bundler/file_parser"
+require "dependabot/bundler/update_checker"
+require "dependabot/bundler/file_updater"
+require "dependabot/bundler/metadata_finder"
+require "dependabot/bundler/requirement"
+require "dependabot/bundler/version"
+
+require "dependabot/pull_request_creator/labeler"
+Dependabot::PullRequestCreator::Labeler.
+  register_label_details("bundler", name: "ruby", colour: "ce2d2d")
+
+require "dependabot/dependency"
+Dependabot::Dependency.register_production_check(
+  "bundler",
+  lambda do |groups|
+    return true if groups.empty?
+    return true if groups.include?("runtime")
+    return true if groups.include?("default")
+
+    groups.any? { |g| g.include?("prod") }
+  end
+)

data/lib/dependabot/bundler/file_fetcher.rb

@@ -0,0 +1,216 @@
+# frozen_string_literal: true
+
+require "dependabot/file_fetchers"
+require "dependabot/file_fetchers/base"
+require "dependabot/bundler/file_updater/lockfile_updater"
+require "dependabot/errors"
+
+module Dependabot
+  module Bundler
+    class FileFetcher < Dependabot::FileFetchers::Base
+      require "dependabot/bundler/file_fetcher/gemspec_finder"
+      require "dependabot/bundler/file_fetcher/path_gemspec_finder"
+      require "dependabot/bundler/file_fetcher/child_gemfile_finder"
+      require "dependabot/bundler/file_fetcher/require_relative_finder"
+
+      def self.required_files_in?(filenames)
+        if filenames.any? { |name| name.match?(%r{^[^/]*\.gemspec$}) }
+          return true
+        end
+
+        filenames.include?("Gemfile") || filenames.include?("gems.rb")
+      end
+
+      def self.required_files_message
+        "Repo must contain either a Gemfile, a gemspec, or a gems.rb."
+      end
+
+      private
+
+      def fetch_files
+        fetched_files = []
+        fetched_files << gemfile if gemfile
+        fetched_files << lockfile if gemfile && lockfile
+        fetched_files += child_gemfiles
+        fetched_files += gemspecs
+        fetched_files << ruby_version_file if ruby_version_file
+        fetched_files += path_gemspecs
+        fetched_files += require_relative_files(fetched_files)
+
+        fetched_files = uniq_files(fetched_files)
+
+        check_required_files_present
+
+        unless self.class.required_files_in?(fetched_files.map(&:name))
+          raise "Invalid set of files: #{fetched_files.map(&:name)}"
+        end
+
+        fetched_files
+      end
+
+      def uniq_files(fetched_files)
+        uniq_files = fetched_files.reject(&:support_file?).uniq
+        uniq_files += fetched_files.
+                      reject { |f| uniq_files.map(&:name).include?(f.name) }
+      end
+
+      def check_required_files_present
+        return if gemfile || gemspecs.any?
+
+        path = Pathname.new(File.join(directory, "Gemfile")).
+               cleanpath.to_path
+        raise Dependabot::DependencyFileNotFound, path
+      end
+
+      def gemfile
+        @gemfile ||= fetch_file_if_present("gems.rb") ||
+                     fetch_file_if_present("Gemfile")
+      end
+
+      def lockfile
+        @lockfile ||= fetch_file_if_present("gems.locked") ||
+                      fetch_file_if_present("Gemfile.lock")
+      end
+
+      def gemspecs
+        return @gemspecs if defined?(@gemspecs)
+
+        gemspecs_paths =
+          gemspec_directories.
+          flat_map do |d|
+            repo_contents(dir: d).
+              select { |f| f.name.end_with?(".gemspec") }.
+              map { |f| File.join(d, f.name) }
+          end
+
+        @gemspecs = gemspecs_paths.map { |n| fetch_file_from_host(n) }
+      rescue Octokit::NotFound
+        []
+      end
+
+      def gemspec_directories
+        gemfiles = ([gemfile] + child_gemfiles).compact
+        directories =
+          gemfiles.flat_map do |file|
+            GemspecFinder.new(gemfile: file).gemspec_directories
+          end.uniq
+
+        directories.empty? ? ["."] : directories
+      end
+
+      def ruby_version_file
+        return unless gemfile
+        return unless gemfile.content.include?(".ruby-version")
+
+        @ruby_version_file ||=
+          fetch_file_if_present(".ruby-version")&.
+          tap { |f| f.support_file = true }
+      end
+
+      def path_gemspecs
+        gemspec_files = []
+        unfetchable_gems = []
+
+        path_gemspec_paths.each do |path|
+          # Get any gemspecs at the path itself
+          gemspecs_at_path = fetch_gemspecs_from_directory(path)
+
+          # Get any gemspecs nested one level deeper
+          nested_directories =
+            repo_contents(dir: path).
+            select { |f| f.type == "dir" }
+
+          nested_directories.each do |dir|
+            dir_path = File.join(path, dir.name)
+            gemspecs_at_path += fetch_gemspecs_from_directory(dir_path)
+          end
+
+          # Add the fetched gemspecs to the main array, and note an error if
+          # none were found for this path
+          gemspec_files += gemspecs_at_path
+          unfetchable_gems << path.basename.to_s if gemspecs_at_path.empty?
+        rescue Octokit::NotFound, Gitlab::Error::NotFound
+          unfetchable_gems << path.basename.to_s
+        end
+
+        if unfetchable_gems.any?
+          raise Dependabot::PathDependenciesNotReachable, unfetchable_gems
+        end
+
+        gemspec_files.tap { |ar| ar.each { |f| f.support_file = true } }
+      end
+
+      def path_gemspec_paths
+        fetch_path_gemspec_paths.map { |path| Pathname.new(path) }
+      end
+
+      def require_relative_files(files)
+        ruby_files =
+          files.select { |f| f.name.end_with?(".rb", "Gemfile", ".gemspec") }
+
+        paths = ruby_files.flat_map do |file|
+          RequireRelativeFinder.new(file: file).require_relative_paths
+        end
+
+        @require_relative_files ||=
+          paths.map { |path| fetch_file_from_host(path) }.
+          tap { |req_files| req_files.each { |f| f.support_file = true } }
+      end
+
+      def fetch_gemspecs_from_directory(dir_path)
+        repo_contents(dir: dir_path).
+          select { |f| f.name.end_with?(".gemspec") }.
+          map { |f| File.join(dir_path, f.name) }.
+          map { |fp| fetch_file_from_host(fp) }
+      end
+
+      def fetch_path_gemspec_paths
+        if lockfile
+          parsed_lockfile = ::Bundler::LockfileParser.new(
+            sanitized_lockfile_content
+          )
+          parsed_lockfile.specs.
+            select { |s| s.source.instance_of?(::Bundler::Source::Path) }.
+            map { |s| s.source.path }.uniq
+        else
+          gemfiles = ([gemfile] + child_gemfiles).compact
+          gemfiles.flat_map do |file|
+            PathGemspecFinder.new(gemfile: file).path_gemspec_paths
+          end.uniq
+        end
+      rescue ::Bundler::LockfileError
+        raise Dependabot::DependencyFileNotParseable, lockfile.path
+      end
+
+      def child_gemfiles
+        return [] unless gemfile
+
+        @child_gemfiles ||=
+          fetch_child_gemfiles(file: gemfile, previously_fetched_files: [])
+      end
+
+      def sanitized_lockfile_content
+        regex = FileUpdater::LockfileUpdater::LOCKFILE_ENDING
+        lockfile.content.gsub(regex, "")
+      end
+
+      def fetch_child_gemfiles(file:, previously_fetched_files:)
+        paths = ChildGemfileFinder.new(gemfile: file).child_gemfile_paths
+
+        paths.flat_map do |path|
+          next if previously_fetched_files.map(&:name).include?(path)
+          next if file.name == path
+
+          fetched_file = fetch_file_from_host(path)
+          grandchild_gemfiles = fetch_child_gemfiles(
+            file: fetched_file,
+            previously_fetched_files: previously_fetched_files + [file]
+          )
+          [fetched_file, *grandchild_gemfiles]
+        end.compact
+      end
+    end
+  end
+end
+
+Dependabot::FileFetchers.register("bundler", Dependabot::Bundler::FileFetcher)

data/lib/dependabot/bundler/file_fetcher/child_gemfile_finder.rb

@@ -0,0 +1,68 @@
+# frozen_string_literal: true
+
+require "pathname"
+require "parser/current"
+require "dependabot/bundler/file_fetcher"
+require "dependabot/errors"
+
+module Dependabot
+  module Bundler
+    class FileFetcher
+      # Finds the paths of any Gemfiles declared using `eval_gemfile` in the
+      # passed Gemfile.
+      class ChildGemfileFinder
+        def initialize(gemfile:)
+          @gemfile = gemfile
+        end
+
+        def child_gemfile_paths
+          ast = Parser::CurrentRuby.parse(gemfile.content)
+          find_child_gemfile_paths(ast)
+        rescue Parser::SyntaxError
+          raise Dependabot::DependencyFileNotParseable, gemfile.path
+        end
+
+        private
+
+        attr_reader :gemfile
+
+        # rubocop:disable Security/Eval
+        def find_child_gemfile_paths(node)
+          return [] unless node.is_a?(Parser::AST::Node)
+
+          if declares_eval_gemfile?(node)
+            # We use eval here, but we know what we're doing. The FileFetchers
+            # helper method should only ever be run in an isolated environment
+            source = node.children[2].loc.expression.source
+            begin
+              path = eval(source)
+            rescue StandardError
+              return []
+            end
+            if Pathname.new(path).absolute?
+              base_path = Pathname.new(File.expand_path(Dir.pwd))
+              path = Pathname.new(path).relative_path_from(base_path).to_s
+            end
+            path = File.join(current_dir, path) unless current_dir.nil?
+            return [Pathname.new(path).cleanpath.to_path]
+          end
+
+          node.children.flat_map do |child_node|
+            find_child_gemfile_paths(child_node)
+          end
+        end
+        # rubocop:enable Security/Eval
+
+        def current_dir
+          @current_dir ||= gemfile.name.split("/")[0..-2].last
+        end
+
+        def declares_eval_gemfile?(node)
+          return false unless node.is_a?(Parser::AST::Node)
+
+          node.children[1] == :eval_gemfile
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/bundler/file_fetcher/gemspec_finder.rb

@@ -0,0 +1,96 @@
+# frozen_string_literal: true
+
+require "pathname"
+require "parser/current"
+require "dependabot/bundler/file_fetcher"
+require "dependabot/errors"
+
+module Dependabot
+  module Bundler
+    class FileFetcher
+      # Finds the directories of any gemspecs declared using `gemspec` in the
+      # passed Gemfile.
+      class GemspecFinder
+        def initialize(gemfile:)
+          @gemfile = gemfile
+        end
+
+        def gemspec_directories
+          ast = Parser::CurrentRuby.parse(gemfile.content)
+          find_gemspec_paths(ast)
+        rescue Parser::SyntaxError
+          raise Dependabot::DependencyFileNotParseable, gemfile.path
+        end
+
+        private
+
+        attr_reader :gemfile
+
+        # rubocop:disable Security/Eval
+        def find_gemspec_paths(node)
+          return [] unless node.is_a?(Parser::AST::Node)
+
+          if declares_gemspec_dependency?(node)
+            path_node = path_node_for_gem_declaration(node)
+            return [clean_path(".")] unless path_node
+
+            begin
+              # We use eval here, but we know what we're doing. The
+              # FileFetchers helper method should only ever be run in an
+              # isolated environment
+              path = eval(path_node.loc.expression.source)
+            rescue StandardError
+              return []
+            end
+            return [clean_path(path)]
+          end
+
+          node.children.flat_map do |child_node|
+            find_gemspec_paths(child_node)
+          end
+        end
+        # rubocop:enable Security/Eval
+
+        def current_dir
+          @current_dir ||= gemfile.name.rpartition("/").first
+          @current_dir = nil if @current_dir == ""
+          @current_dir
+        end
+
+        def declares_gemspec_dependency?(node)
+          return false unless node.is_a?(Parser::AST::Node)
+
+          node.children[1] == :gemspec
+        end
+
+        def clean_path(path)
+          if Pathname.new(path).absolute?
+            base_path = Pathname.new(File.expand_path(Dir.pwd))
+            path = Pathname.new(path).relative_path_from(base_path).to_s
+          end
+          path = File.join(current_dir, path) unless current_dir.nil?
+          Pathname.new(path).cleanpath
+        end
+
+        def path_node_for_gem_declaration(node)
+          return unless node.children.last.is_a?(Parser::AST::Node)
+          return unless node.children.last.type == :hash
+
+          kwargs_node = node.children.last
+
+          path_hash_pair =
+            kwargs_node.children.
+            find { |hash_pair| key_from_hash_pair(hash_pair) == :path }
+
+          return unless path_hash_pair
+
+          path_hash_pair.children.last
+        end
+
+        def key_from_hash_pair(node)
+          node.children.first.children.first.to_sym
+        end
+      end
+    end
+  end
+end