dependabot-common 0.138.6 → 0.140.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: '078f6b28d97e19365ee70ecd7f2db8b13a586602285a4a1f235b2e2d3262d836'
-  data.tar.gz: 9c0a817aed80bee0ce1365f2207b0adeb38cb15163fb10abf4a41107677bec5f
+  metadata.gz: 9891079fbe9ee6f09274dd3f72dd0c5c12b40a8685e3c0747bd92b4cc0ed259b
+  data.tar.gz: 7e52789d37118447e73082cce5263693194cc70b56637495f6985f3266d166f1
 SHA512:
-  metadata.gz: 51e0d5bdb17e739d8a541983ee60bd388ff5085748e4ef392a391e968f08a2b921345b3d6f4e421a5701e2780afc21e9886206bd3ea7409160ec57d2813483d4
-  data.tar.gz: 2e363a31498207ddba53b8dccb46a7f66043722cc154182717aa5a92e908d3a6aeb4bc1453b66c3d13bcb1020c0dfe710aa91beadc19873984bb423783522185
+  metadata.gz: 8fc90ba04b2b77974f90d7a1d1917e4458038ea263f4c14270fa719e11979947a33e97cff980d19ed05b3d5dbff321e856bfb9717b175b2021e15cdc2c3d0445
+  data.tar.gz: d9aa3ee0b1b0d292de592309981c5e9309579a3ce4caf1e8a509a0f9dfc9fc10934b12944977e8bc655f38f81334203c6e280a27e4392915503c0bb4bd756144

data/lib/dependabot/pull_request_creator/message_builder/link_and_mention_sanitizer.rb

@@ -15,6 +15,8 @@ module Dependabot
           (?:issue|pull)s?/(?<number>\d+)
         }x.freeze
         MENTION_REGEX = %r{(?<![A-Za-z0-9`~])@#{GITHUB_USERNAME}/?}.freeze
+        # regex to match a team mention on github
+        TEAM_MENTION_REGEX = %r{(?<![A-Za-z0-9`~])@(?<org>#{GITHUB_USERNAME})/(?<team>#{GITHUB_USERNAME})/?}.freeze
         # End of string
         EOS_REGEX = /\z/.freeze
         COMMONMARKER_OPTIONS = %i(
@@ -35,8 +37,10 @@ module Dependabot
             text, :LIBERAL_HTML_TAG, COMMONMARKER_EXTENSIONS
           )
 
+          sanitize_team_mentions(doc)
           sanitize_mentions(doc)
           sanitize_links(doc)
+
           mode = unsafe ? :UNSAFE : :DEFAULT
           doc.to_html(([mode] + COMMONMARKER_OPTIONS), COMMONMARKER_EXTENSIONS)
         end
@@ -62,6 +66,26 @@ module Dependabot
           end
         end
 
+        # When we come across something that looks like a team mention (e.g. @dependabot/reviewers),
+        # we replace it with a text node.
+        # This is because there are ecosystems that have packages that follow the same pattern
+        # (e.g. @angular/angular-cli), and we don't want to create an invalid link, since
+        # team mentions link to `https://github.com/org/:organization_name/teams/:team_name`.
+        def sanitize_team_mentions(doc)
+          doc.walk do |node|
+            if node.type == :text &&
+               node.string_content.match?(TEAM_MENTION_REGEX)
+
+              nodes = build_team_mention_nodes(node.string_content)
+
+              nodes.each do |n|
+                node.insert_before(n)
+              end
+              node.delete
+            end
+          end
+        end
+
         def sanitize_links(doc)
           doc.walk do |node|
             if node.type == :link && node.url.match?(GITHUB_REF_REGEX)
@@ -87,7 +111,7 @@ module Dependabot
 
         def replace_github_host(text)
           text.gsub(
-            "github.com", github_redirection_service || "github.com"
+            /(www\.)?github.com/, github_redirection_service || "github.com"
           )
         end
 
@@ -117,6 +141,30 @@ module Dependabot
           nodes
         end
 
+        def build_team_mention_nodes(text)
+          nodes = []
+
+          scan = StringScanner.new(text)
+          until scan.eos?
+            line = scan.scan_until(TEAM_MENTION_REGEX) ||
+                   scan.scan_until(EOS_REGEX)
+            line_match = line.match(TEAM_MENTION_REGEX)
+            mention = line_match&.to_s
+            text_node = CommonMarker::Node.new(:text)
+
+            if mention
+              text_node.string_content = line_match.pre_match
+              nodes << text_node
+              nodes += build_mention_link_text_nodes(mention.to_s)
+            else
+              text_node.string_content = line
+              nodes << text_node
+            end
+          end
+
+          nodes
+        end
+
         def build_mention_link_text_nodes(text)
           code_node = CommonMarker::Node.new(:code)
           code_node.string_content = insert_zero_width_space_in_mention(text)

data/lib/dependabot/shared_helpers.rb

@@ -161,47 +161,21 @@ module Dependabot
       reset_global_git_config(backup_git_config_path)
     end
 
+    def self.credential_helper_path
+      File.join(__dir__, "../../bin/git-credential-store-immutable")
+    end
+
+    # rubocop:disable Metrics/AbcSize
+    # rubocop:disable Metrics/PerceivedComplexity
     def self.configure_git_to_use_https_with_credentials(credentials)
       File.open(GIT_CONFIG_GLOBAL_PATH, "w") do |file|
         file << "# Generated by dependabot/dependabot-core"
       end
-      configure_git_to_use_https
-      configure_git_credentials(credentials)
-    end
-
-    def self.configure_git_to_use_https
-      # NOTE: we use --global here (rather than --system) so that Dependabot
-      # can be run without privileged access
-      run_shell_command(
-        "git config --global --replace-all url.https://github.com/."\
-        "insteadOf ssh://git@github.com/"
-      )
-      run_shell_command(
-        "git config --global --add url.https://github.com/."\
-        "insteadOf ssh://git@github.com:"
-      )
-      run_shell_command(
-        "git config --global --add url.https://github.com/."\
-        "insteadOf git@github.com:"
-      )
-      run_shell_command(
-        "git config --global --add url.https://github.com/."\
-        "insteadOf git@github.com/"
-      )
-      run_shell_command(
-        "git config --global --add url.https://github.com/."\
-        "insteadOf git://github.com/"
-      )
-    end
 
-    # rubocop:disable Metrics/PerceivedComplexity
-    def self.configure_git_credentials(credentials)
       # Then add a file-based credential store that loads a file in this repo.
       # Under the hood this uses git credential-store, but it's invoked through
       # a wrapper binary that only allows non-mutating commands. Without this,
       # whenever the credentials are deemed to be invalid, they're erased.
-      credential_helper_path =
-        File.join(__dir__, "../../bin/git-credential-store-immutable")
       run_shell_command(
         "git config --global credential.helper "\
         "'!#{credential_helper_path} --file #{Dir.pwd}/git.store'",
@@ -219,6 +193,9 @@ module Dependabot
         github_credentials.find { |c| !c["password"]&.start_with?("v1.") } ||
         github_credentials.first
 
+      # Make sure we always have https alternatives for github.com.
+      configure_git_to_use_https("github.com") if github_credential.nil?
+
       deduped_credentials = credentials -
                             github_credentials +
                             [github_credential].compact
@@ -234,13 +211,40 @@ module Dependabot
           "@#{cred.fetch('host')}"
 
         git_store_content += authenticated_url + "\n"
+        configure_git_to_use_https(cred.fetch("host"))
       end
 
       # Save the file
       File.write("git.store", git_store_content)
     end
+    # rubocop:enable Metrics/AbcSize
     # rubocop:enable Metrics/PerceivedComplexity
 
+    def self.configure_git_to_use_https(host)
+      # NOTE: we use --global here (rather than --system) so that Dependabot
+      # can be run without privileged access
+      run_shell_command(
+        "git config --global --replace-all url.https://#{host}/."\
+        "insteadOf ssh://git@#{host}/"
+      )
+      run_shell_command(
+        "git config --global --add url.https://#{host}/."\
+        "insteadOf ssh://git@#{host}:"
+      )
+      run_shell_command(
+        "git config --global --add url.https://#{host}/."\
+        "insteadOf git@#{host}:"
+      )
+      run_shell_command(
+        "git config --global --add url.https://#{host}/."\
+        "insteadOf git@#{host}/"
+      )
+      run_shell_command(
+        "git config --global --add url.https://#{host}/."\
+        "insteadOf git://#{host}/"
+      )
+    end
+
     def self.reset_git_repo(path)
       Dir.chdir(path) do
         run_shell_command("git reset HEAD --hard")

data/lib/dependabot/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.138.6"
+  VERSION = "0.140.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.138.6
+  version: 0.140.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-03-29 00:00:00.000000000 Z
+date: 2021-04-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -298,14 +298,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.11.0
+        version: 1.12.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.11.0
+        version: 1.12.0
 - !ruby/object:Gem::Dependency
   name: simplecov
   requirement: !ruby/object:Gem::Requirement