dependabot-common 0.138.5 → 0.139.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9eac032406ddbc7a70c0184c27656ae12b2df486c391b4feede160a361b15502
-  data.tar.gz: 437c85e8167561e207a1b759d452c5257e21f3ae7cbf6dec01b0239c905dcd80
+  metadata.gz: 70a8b637aa9cd5c38c93bcdca2f8e26283e0bbb5bebc70f54bc1ce0f80a93e75
+  data.tar.gz: 1aebc5329c67b401cc630c815bf6abf5bf6a63748e326255ebf37e58db52d256
 SHA512:
-  metadata.gz: 6c0063c13e650eb8916dc4a3d1b4cdd8b9ac539fcc92186344ce8babce46a2cd8d6363a705643808674ef78b08dda12a7c9e7a9aaf629ea7a14d73f7e8481f1a
-  data.tar.gz: b689dfb251ca0cec502925d26ffb2d541f52bde930362154622686096ded5e00eb7cc9c72e85cf4f82c496736ba5b4720d37670596e21d0100d737c538658b93
+  metadata.gz: 75e1080fcf2a30249c962597e7fd09916584f8e4488702050dd8bbd775d2a1447c07ac09e1502f832f7e463b7c760a25e348397072f1b5273faf0dea40a8a79f
+  data.tar.gz: 4e14c9377f28242dc67767004e210e30f1f1c185a6e3e5180222a0a80f2227c7995abbcd8b3b6232edb4fea3345e5a55a995a626df6dd05fdee672ac18258f26

data/lib/dependabot/pull_request_creator/message_builder/link_and_mention_sanitizer.rb

@@ -15,6 +15,8 @@ module Dependabot
           (?:issue|pull)s?/(?<number>\d+)
         }x.freeze
         MENTION_REGEX = %r{(?<![A-Za-z0-9`~])@#{GITHUB_USERNAME}/?}.freeze
+        # regex to match a team mention on github
+        TEAM_MENTION_REGEX = %r{(?<![A-Za-z0-9`~])@(?<org>#{GITHUB_USERNAME})/(?<team>#{GITHUB_USERNAME})/?}.freeze
         # End of string
         EOS_REGEX = /\z/.freeze
         COMMONMARKER_OPTIONS = %i(
@@ -35,8 +37,10 @@ module Dependabot
             text, :LIBERAL_HTML_TAG, COMMONMARKER_EXTENSIONS
           )
 
+          sanitize_team_mentions(doc)
           sanitize_mentions(doc)
           sanitize_links(doc)
+
           mode = unsafe ? :UNSAFE : :DEFAULT
           doc.to_html(([mode] + COMMONMARKER_OPTIONS), COMMONMARKER_EXTENSIONS)
         end
@@ -62,6 +66,26 @@ module Dependabot
           end
         end
 
+        # When we come across something that looks like a team mention (e.g. @dependabot/reviewers),
+        # we replace it with a text node.
+        # This is because there are ecosystems that have packages that follow the same pattern
+        # (e.g. @angular/angular-cli), and we don't want to create an invalid link, since
+        # team mentions link to `https://github.com/org/:organization_name/teams/:team_name`.
+        def sanitize_team_mentions(doc)
+          doc.walk do |node|
+            if node.type == :text &&
+               node.string_content.match?(TEAM_MENTION_REGEX)
+
+              nodes = build_team_mention_nodes(node.string_content)
+
+              nodes.each do |n|
+                node.insert_before(n)
+              end
+              node.delete
+            end
+          end
+        end
+
         def sanitize_links(doc)
           doc.walk do |node|
             if node.type == :link && node.url.match?(GITHUB_REF_REGEX)
@@ -87,7 +111,7 @@ module Dependabot
 
         def replace_github_host(text)
           text.gsub(
-            "github.com", github_redirection_service || "github.com"
+            /(www\.)?github.com/, github_redirection_service || "github.com"
           )
         end
 
@@ -117,6 +141,30 @@ module Dependabot
           nodes
         end
 
+        def build_team_mention_nodes(text)
+          nodes = []
+
+          scan = StringScanner.new(text)
+          until scan.eos?
+            line = scan.scan_until(TEAM_MENTION_REGEX) ||
+                   scan.scan_until(EOS_REGEX)
+            line_match = line.match(TEAM_MENTION_REGEX)
+            mention = line_match&.to_s
+            text_node = CommonMarker::Node.new(:text)
+
+            if mention
+              text_node.string_content = line_match.pre_match
+              nodes << text_node
+              nodes += build_mention_link_text_nodes(mention.to_s)
+            else
+              text_node.string_content = line
+              nodes << text_node
+            end
+          end
+
+          nodes
+        end
+
         def build_mention_link_text_nodes(text)
           code_node = CommonMarker::Node.new(:code)
           code_node.string_content = insert_zero_width_space_in_mention(text)

data/lib/dependabot/shared_helpers.rb

@@ -161,47 +161,21 @@ module Dependabot
       reset_global_git_config(backup_git_config_path)
     end
 
+    def self.credential_helper_path
+      File.join(__dir__, "../../bin/git-credential-store-immutable")
+    end
+
+    # rubocop:disable Metrics/AbcSize
+    # rubocop:disable Metrics/PerceivedComplexity
     def self.configure_git_to_use_https_with_credentials(credentials)
       File.open(GIT_CONFIG_GLOBAL_PATH, "w") do |file|
         file << "# Generated by dependabot/dependabot-core"
       end
-      configure_git_to_use_https
-      configure_git_credentials(credentials)
-    end
-
-    def self.configure_git_to_use_https
-      # NOTE: we use --global here (rather than --system) so that Dependabot
-      # can be run without privileged access
-      run_shell_command(
-        "git config --global --replace-all url.https://github.com/."\
-        "insteadOf ssh://git@github.com/"
-      )
-      run_shell_command(
-        "git config --global --add url.https://github.com/."\
-        "insteadOf ssh://git@github.com:"
-      )
-      run_shell_command(
-        "git config --global --add url.https://github.com/."\
-        "insteadOf git@github.com:"
-      )
-      run_shell_command(
-        "git config --global --add url.https://github.com/."\
-        "insteadOf git@github.com/"
-      )
-      run_shell_command(
-        "git config --global --add url.https://github.com/."\
-        "insteadOf git://github.com/"
-      )
-    end
 
-    # rubocop:disable Metrics/PerceivedComplexity
-    def self.configure_git_credentials(credentials)
       # Then add a file-based credential store that loads a file in this repo.
       # Under the hood this uses git credential-store, but it's invoked through
       # a wrapper binary that only allows non-mutating commands. Without this,
       # whenever the credentials are deemed to be invalid, they're erased.
-      credential_helper_path =
-        File.join(__dir__, "../../bin/git-credential-store-immutable")
       run_shell_command(
         "git config --global credential.helper "\
         "'!#{credential_helper_path} --file #{Dir.pwd}/git.store'",
@@ -219,6 +193,9 @@ module Dependabot
         github_credentials.find { |c| !c["password"]&.start_with?("v1.") } ||
         github_credentials.first
 
+      # Make sure we always have https alternatives for github.com.
+      configure_git_to_use_https("github.com") if github_credential.nil?
+
       deduped_credentials = credentials -
                             github_credentials +
                             [github_credential].compact
@@ -234,13 +211,40 @@ module Dependabot
           "@#{cred.fetch('host')}"
 
         git_store_content += authenticated_url + "\n"
+        configure_git_to_use_https(cred.fetch("host"))
       end
 
       # Save the file
       File.write("git.store", git_store_content)
     end
+    # rubocop:enable Metrics/AbcSize
     # rubocop:enable Metrics/PerceivedComplexity
 
+    def self.configure_git_to_use_https(host)
+      # NOTE: we use --global here (rather than --system) so that Dependabot
+      # can be run without privileged access
+      run_shell_command(
+        "git config --global --replace-all url.https://#{host}/."\
+        "insteadOf ssh://git@#{host}/"
+      )
+      run_shell_command(
+        "git config --global --add url.https://#{host}/."\
+        "insteadOf ssh://git@#{host}:"
+      )
+      run_shell_command(
+        "git config --global --add url.https://#{host}/."\
+        "insteadOf git@#{host}:"
+      )
+      run_shell_command(
+        "git config --global --add url.https://#{host}/."\
+        "insteadOf git@#{host}/"
+      )
+      run_shell_command(
+        "git config --global --add url.https://#{host}/."\
+        "insteadOf git://#{host}/"
+      )
+    end
+
     def self.reset_git_repo(path)
       Dir.chdir(path) do
         run_shell_command("git reset HEAD --hard")

data/lib/dependabot/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.138.5"
+  VERSION = "0.139.2"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.138.5
+  version: 0.139.2
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-03-26 00:00:00.000000000 Z
+date: 2021-04-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -298,14 +298,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.11.0
+        version: 1.12.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.11.0
+        version: 1.12.0
 - !ruby/object:Gem::Dependency
   name: simplecov
   requirement: !ruby/object:Gem::Requirement