dependabot-common 0.119.5 → 0.120.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ac20c5d159264edb3113a4e495d02e6c32f5e6aadb5cda883587aeabae475dde
-  data.tar.gz: d5086bb6a7669add859859632b19b2d4e8ddddc9d637f63a2fb101bcb30d92ef
+  metadata.gz: e86bdfc4f410dbf077edfcea229a0125e0e6f56f3f78c02e8a0dcd082cf50445
+  data.tar.gz: e2ec62b6b2d8e487286014b21e87a021d169a518639010d33ab80b3030f8d3af
 SHA512:
-  metadata.gz: 5c1cfdfdba4439500593adc35ca3bca20f32d55c0cf4e7436f09caa1b443cca135eee7607ef8c7dc7e5d385b66556d8f1698b80568f2e6068888faa8a76acc79
-  data.tar.gz: bb518e222b1fd04d0bccd69951ac5d7b58220ef1ed6ed8c7ad29825138f39632b4f605ec314776b14bce59e51025048cdd965aebf33445a9e0419f32b399d2d2
+  metadata.gz: 379aadb5ac467e6d8b31fc771f112a2d9590889ab2438326617e6f19f93c2fddc5b20a9fdff7454ef4c870ea849054b15672fb27fbbe99304f33a895bdd91357
+  data.tar.gz: 966790a0b7977b710db805c819b8952c85bad3d6fb87429a3aa8d300bdce13b2381ee3b9cfc184250f1735ee19281d01841fe7eefaad0fc7c40b2a8d33b1d4f5

data/lib/dependabot/clients/azure.rb

@@ -153,8 +153,9 @@ module Dependabot
           "/pushes?api-version=5.0", content.to_json)
       end
 
+      # rubocop:disable Metrics/ParameterLists
       def create_pull_request(pr_name, source_branch, target_branch,
-                              pr_description, labels)
+                              pr_description, labels, work_item = nil)
         # Azure DevOps only support descriptions up to 4000 characters
         # https://developercommunity.visualstudio.com/content/problem/608770/remove-4000-character-limit-on-pull-request-descri.html
         azure_max_length = 3999
@@ -163,13 +164,15 @@ module Dependabot
           truncate_length = azure_max_length - truncated_msg.length
           pr_description = pr_description[0..truncate_length] + truncated_msg
         end
+        # rubocop:enable Metrics/ParameterLists
 
         content = {
           sourceRefName: "refs/heads/" + source_branch,
           targetRefName: "refs/heads/" + target_branch,
           title: pr_name,
           description: pr_description,
-          labels: labels.map { |label| { name: label } }
+          labels: labels.map { |label| { name: label } },
+          workItemRefs: [{ id: work_item }]
         }
 
         post(source.api_endpoint +
@@ -181,11 +184,12 @@ module Dependabot
       def get(url)
         response = Excon.get(
           url,
-          headers: auth_header,
           user: credentials&.fetch("username", nil),
           password: credentials&.fetch("password", nil),
           idempotent: true,
-          **SharedHelpers.excon_defaults
+          **SharedHelpers.excon_defaults(
+            headers: auth_header
+          )
         )
         raise NotFound if response.status == 404
 
@@ -195,16 +199,17 @@ module Dependabot
       def post(url, json)
         response = Excon.post(
           url,
-          headers: auth_header.merge(
-            {
-              "Content-Type" => "application/json"
-            }
-          ),
           body: json,
           user: credentials&.fetch("username", nil),
           password: credentials&.fetch("password", nil),
           idempotent: true,
-          **SharedHelpers.excon_defaults
+          **SharedHelpers.excon_defaults(
+            headers: auth_header.merge(
+              {
+                "Content-Type" => "application/json"
+              }
+            )
+          )
         )
         raise NotFound if response.status == 404
 

data/lib/dependabot/git_metadata_fetcher.rb

@@ -183,7 +183,7 @@ module Dependabot
 
     def excon_defaults
       # Some git hosts are slow when returning a large number of tags
-      SharedHelpers.excon_defaults.merge(read_timeout: 20)
+      SharedHelpers.excon_defaults(read_timeout: 20)
     end
   end
 end

data/lib/dependabot/pull_request_creator.rb

@@ -17,13 +17,23 @@ module Dependabot
     class RepoDisabled < StandardError; end
     class NoHistoryInCommon < StandardError; end
 
+    # AnnotationError is raised if a PR was created, but failed annotation
+    class AnnotationError < StandardError
+      attr_reader :cause, :pull_request
+      def initialize(cause, pull_request)
+        super(cause.message)
+        @cause = cause
+        @pull_request = pull_request
+      end
+    end
+
     attr_reader :source, :dependencies, :files, :base_commit,
                 :credentials, :pr_message_header, :pr_message_footer,
                 :custom_labels, :author_details, :signature_key,
                 :commit_message_options, :vulnerabilities_fixed,
                 :reviewers, :assignees, :milestone, :branch_name_separator,
                 :branch_name_prefix, :github_redirection_service,
-                :custom_headers
+                :custom_headers, :provider_metadata
 
     def initialize(source:, base_commit:, dependencies:, files:, credentials:,
                    pr_message_header: nil, pr_message_footer: nil,
@@ -33,7 +43,8 @@ module Dependabot
                    branch_name_separator: "/", branch_name_prefix: "dependabot",
                    label_language: false, automerge_candidate: false,
                    github_redirection_service: "github-redirect.dependabot.com",
-                   custom_headers: nil, require_up_to_date_base: false)
+                   custom_headers: nil, require_up_to_date_base: false,
+                   provider_metadata: {})
       @dependencies               = dependencies
       @source                     = source
       @base_commit                = base_commit
@@ -56,6 +67,7 @@ module Dependabot
       @github_redirection_service = github_redirection_service
       @custom_headers             = custom_headers
       @require_up_to_date_base    = require_up_to_date_base
+      @provider_metadata          = provider_metadata
 
       check_dependencies_have_previous_version
     end
@@ -142,7 +154,8 @@ module Dependabot
         pr_description: message_builder.pr_message,
         pr_name: message_builder.pr_name,
         author_details: author_details,
-        labeler: labeler
+        labeler: labeler,
+        work_item: provider_metadata&.fetch(:work_item, nil)
       )
     end
 

data/lib/dependabot/pull_request_creator/azure.rb

@@ -8,11 +8,11 @@ module Dependabot
     class Azure
       attr_reader :source, :branch_name, :base_commit, :credentials,
                   :files, :commit_message, :pr_description, :pr_name,
-                  :author_details, :labeler
+                  :author_details, :labeler, :work_item
 
       def initialize(source:, branch_name:, base_commit:, credentials:,
                      files:, commit_message:, pr_description:, pr_name:,
-                     author_details:, labeler:)
+                     author_details:, labeler:, work_item: nil)
         @source         = source
         @branch_name    = branch_name
         @base_commit    = base_commit
@@ -23,6 +23,7 @@ module Dependabot
         @pr_name        = pr_name
         @author_details = author_details
         @labeler        = labeler
+        @work_item      = work_item
       end
 
       def create
@@ -46,9 +47,7 @@ module Dependabot
       end
 
       def branch_exists?
-        @branch_ref ||= azure_client_for_source.branch(branch_name)
-
-        @branch_ref
+        azure_client_for_source.branch(branch_name)
       rescue ::Azure::Error::NotFound
         false
       end
@@ -79,7 +78,8 @@ module Dependabot
           branch_name,
           source.branch || default_branch,
           pr_description,
-          labeler.labels_for_pr
+          labeler.labels_for_pr,
+          work_item
         )
       end
 

data/lib/dependabot/pull_request_creator/github.rb

@@ -7,6 +7,7 @@ require "dependabot/pull_request_creator"
 require "dependabot/pull_request_creator/commit_signer"
 module Dependabot
   class PullRequestCreator
+    # rubocop:disable Metrics/ClassLength
     class Github
       attr_reader :source, :branch_name, :base_commit, :credentials,
                   :files, :pr_description, :pr_name, :commit_message,
@@ -41,7 +42,7 @@ module Dependabot
         return if require_up_to_date_base? && !base_commit_is_up_to_date?
 
         create_annotated_pull_request
-      rescue Octokit::Error => e
+      rescue AnnotationError, Octokit::Error => e
         handle_error(e)
       end
 
@@ -111,7 +112,11 @@ module Dependabot
         pull_request = create_pull_request
         return unless pull_request
 
-        annotate_pull_request(pull_request)
+        begin
+          annotate_pull_request(pull_request)
+        rescue StandardError => e
+          raise AnnotationError.new(e, pull_request)
+        end
 
         pull_request
       end
@@ -417,24 +422,49 @@ module Dependabot
       end
 
       def handle_error(err)
-        case err
+        cause = case err
+                when AnnotationError
+                  err.cause
+                else
+                  err
+                end
+
+        case cause
         when Octokit::Forbidden
-          raise RepoDisabled, err.message if err.message.include?("disabled")
-          raise RepoArchived, err.message if err.message.include?("archived")
+          if err.message.include?("disabled")
+            raise_custom_error err, RepoDisabled, err.message
+          elsif err.message.include?("archived")
+            raise_custom_error err, RepoArchived, err.message
+          end
 
           raise err
         when Octokit::NotFound
           raise err if repo_exists?
 
-          raise RepoNotFound, err.message
+          raise_custom_error err, RepoNotFound, err.message
         when Octokit::UnprocessableEntity
-          raise err unless err.message.include?("no history in common")
+          if err.message.include?("no history in common")
+            raise_custom_error err, NoHistoryInCommon, err.message
+          end
 
-          raise NoHistoryInCommon, err.message
+          raise err
         else
           raise err
         end
       end
+
+      def raise_custom_error(base_err, type, message)
+        case base_err
+        when AnnotationError
+          raise AnnotationError.new(
+            type.new(message),
+            base_err.pull_request
+          )
+        else
+          raise type, message
+        end
+      end
     end
+    # rubocop:enable Metrics/ClassLength
   end
 end

data/lib/dependabot/pull_request_creator/message_builder.rb

@@ -323,10 +323,30 @@ module Dependabot
         ).to_s
       end
 
+      def changelog_url(dependency)
+        metadata_finder(dependency).changelog_url
+      end
+
+      def commits_url(dependency)
+        metadata_finder(dependency).commits_url
+      end
+
+      def homepage_url(dependency)
+        metadata_finder(dependency).homepage_url
+      end
+
+      def releases_url(dependency)
+        metadata_finder(dependency).releases_url
+      end
+
       def source_url(dependency)
         metadata_finder(dependency).source_url
       end
 
+      def upgrade_url(dependency)
+        metadata_finder(dependency).upgrade_guide_url
+      end
+
       def metadata_finder(dependency)
         @metadata_finder ||= {}
         @metadata_finder[dependency.name] ||=

data/lib/dependabot/pull_request_creator/message_builder/metadata_presenter.rb

@@ -65,16 +65,7 @@ module Dependabot
 
           msg = "*Sourced from [#{dependency.display_name}'s releases]"\
                 "(#{releases_url}).*\n\n"
-          msg +=
-            begin
-              release_note_lines = releases_text.split("\n").first(50)
-              release_note_lines =
-                release_note_lines.map { |line| "> #{line}\n" }
-              if release_note_lines.count == 50
-                release_note_lines << truncated_line
-              end
-              release_note_lines.join
-            end
+          msg += quote_and_truncate(releases_text)
           msg = link_issues(text: msg)
           msg = fix_relative_links(
             text: msg,
@@ -92,13 +83,7 @@ module Dependabot
           msg = "*Sourced from "\
                 "[#{dependency.display_name}'s changelog]"\
                 "(#{changelog_url}).*\n\n"
-          msg +=
-            begin
-              changelog_lines = changelog_text.split("\n").first(50)
-              changelog_lines = changelog_lines.map { |line| "> #{line}\n" }
-              changelog_lines << truncated_line if changelog_lines.count == 50
-              changelog_lines.join
-            end
+          msg += quote_and_truncate(changelog_text)
           msg = link_issues(text: msg)
           msg = fix_relative_links(text: msg, base_url: changelog_url)
           msg = sanitize_template_tags(msg)
@@ -113,13 +98,7 @@ module Dependabot
           msg = "*Sourced from "\
                 "[#{dependency.display_name}'s upgrade guide]"\
                 "(#{upgrade_guide_url}).*\n\n"
-          msg +=
-            begin
-              upgrade_lines = upgrade_guide_text.split("\n").first(50)
-              upgrade_lines = upgrade_lines.map { |line| "> #{line}\n" }
-              upgrade_lines << truncated_line if upgrade_lines.count == 50
-              upgrade_lines.join
-            end
+          msg += quote_and_truncate(upgrade_guide_text)
           msg = link_issues(text: msg)
           msg = fix_relative_links(text: msg, base_url: upgrade_guide_url)
           msg = sanitize_template_tags(msg)
@@ -245,6 +224,14 @@ module Dependabot
           end
         end
 
+        def quote_and_truncate(text, limit: 50)
+          lines = text.split("\n")
+          lines.first(limit).tap do |limited_lines|
+            limited_lines.map! { |line| "> #{line}\n" }
+            limited_lines << truncated_line if lines.count > limit
+          end.join
+        end
+
         def truncated_line
           # Tables can spill out of truncated details, so we close them
           "></tr></table> \n ... (truncated)\n"

data/lib/dependabot/shared_helpers.rb

@@ -8,11 +8,17 @@ require "digest"
 require "open3"
 require "shellwords"
 
+require "dependabot/version"
+
 module Dependabot
   module SharedHelpers
     BUMP_TMP_FILE_PREFIX = "dependabot_"
     BUMP_TMP_DIR_PATH = "tmp"
     GIT_CONFIG_GLOBAL_PATH = File.expand_path("~/.gitconfig")
+    USER_AGENT = "dependabot-core/#{Dependabot::VERSION} "\
+                 "#{Excon::USER_AGENT} ruby/#{RUBY_VERSION} "\
+                 "(#{RUBY_PLATFORM}) "\
+                 "(+https://github.com/dependabot/dependabot-core)"
 
     class ChildProcessFailed < StandardError
       attr_reader :error_class, :error_message, :error_backtrace
@@ -138,14 +144,24 @@ module Dependabot
         [Excon::Middleware::RedirectFollower]
     end
 
-    def self.excon_defaults
+    def self.excon_headers(headers = nil)
+      headers ||= {}
+      {
+        "User-Agent" => USER_AGENT
+      }.merge(headers)
+    end
+
+    def self.excon_defaults(options = nil)
+      options ||= {}
+      headers = options.delete(:headers)
       {
         connect_timeout: 5,
         write_timeout: 5,
         read_timeout: 20,
         omit_default_port: true,
-        middlewares: excon_middleware
-      }
+        middlewares: excon_middleware,
+        headers: excon_headers(headers)
+      }.merge(options)
     end
 
     def self.with_git_configured(credentials:)

data/lib/dependabot/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.119.5"
+  VERSION = "0.120.3"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.119.5
+  version: 0.120.3
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-09-21 00:00:00.000000000 Z
+date: 2020-09-28 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aws-sdk-codecommit
@@ -292,14 +292,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.90.0
+        version: 0.91.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.90.0
+        version: 0.91.0
 - !ruby/object:Gem::Dependency
   name: vcr
   requirement: !ruby/object:Gem::Requirement