dependabot-common 0.139.0 → 0.140.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: de2abf02275016c9c8d0ecd543e0646e08aa6551edec39a6567d8d5ac53af14f
-  data.tar.gz: 5c9e219a03dbdeee3c9d3c8adab6ea0db8bf0c7331749149c43ae846290cc481
+  metadata.gz: 41a832731ce83e798f434d6266bd6947f107b939be2594febf5ccd5651793c5e
+  data.tar.gz: a3c195255893ba76b999aba1f664fbbc4e8bb1447b0d8f3d35d770798e894b38
 SHA512:
-  metadata.gz: 381cf5957178c14ca1654367bac15f3e9626320afead493c142790eb374a593efaa039c512a384c6b749fc8a8fe9956957532d61c7a8c006e65dfb00a6f51b48
-  data.tar.gz: 1e76b8f2721fbc1ceb99a96d06a38d6b4ada860a9daed49e96857c39d1d44351fa4b796d4ce434a3aac9001519147de6add25c06261463d8e5a31bf29fa97bc7
+  metadata.gz: 11779b84b2bea46d8ad47f9ce0857cb8cf29359687c6908d950637ea60411dd85f4bb108c7728cecb49c237acdb09c86706ce873216ef3f363bb9e91bf93fcc2
+  data.tar.gz: 8007aac05e097eb667545988474c792ba86e48eda770e1725629d19307ee46198828189b36f1603f05d53bf3ec3e3bcf4751c0d172af3891fceb94b94b7bb72e

data/lib/dependabot/dependency_file.rb

@@ -5,23 +5,33 @@ require "pathname"
 module Dependabot
   class DependencyFile
     attr_accessor :name, :content, :directory, :type, :support_file,
-                  :symlink_target, :content_encoding, :deleted
+                  :symlink_target, :content_encoding, :operation
 
     class ContentEncoding
       UTF_8 = "utf-8"
       BASE64 = "base64"
     end
 
+    class Operation
+      UPDATE = "update"
+      CREATE = "create"
+      DELETE = "delete"
+    end
+
     def initialize(name:, content:, directory: "/", type: "file",
                    support_file: false, symlink_target: nil,
-                   content_encoding: ContentEncoding::UTF_8, deleted: false)
+                   content_encoding: ContentEncoding::UTF_8, deleted: false, operation: Operation::UPDATE)
       @name = name
       @content = content
       @directory = clean_directory(directory)
       @symlink_target = symlink_target
       @support_file = support_file
       @content_encoding = content_encoding
-      @deleted = deleted
+      @operation = operation
+
+      # Make deleted override the operation. Deleted is kept when operation
+      # was introduced to keep compatibility with downstream dependants.
+      @operation = Operation::DELETE if deleted
 
       # Type is used *very* sparingly. It lets the git_modules updater know that
       # a "file" is actually a submodule, and lets our Go updaters know which
@@ -44,7 +54,8 @@ module Dependabot
         "type" => type,
         "support_file" => support_file,
         "content_encoding" => content_encoding,
-        "deleted" => deleted
+        "deleted" => deleted,
+        "operation" => operation
       }
 
       details["symlink_target"] = symlink_target if symlink_target
@@ -75,8 +86,16 @@ module Dependabot
       @support_file
     end
 
+    def deleted
+      @operation == Operation::DELETE
+    end
+
+    def deleted=(deleted)
+      @operation = deleted ? Operation::DELETE : Operation::UPDATE
+    end
+
     def deleted?
-      @deleted
+      deleted
     end
 
     def binary?

data/lib/dependabot/file_updaters/vendor_updater.rb

@@ -27,12 +27,20 @@ module Dependabot
           )
           changed_paths = status.split("\n").map { |l| l.split(" ") }
           changed_paths.map do |type, path|
-            deleted = type == "D"
+            # The following types are possible to be returned:
+            # M = Modified = Default for DependencyFile
+            # D = Deleted
+            # ?? = Untracked = Created
+            operation = Dependabot::DependencyFile::Operation::UPDATE
+            operation = Dependabot::DependencyFile::Operation::DELETE if type == "D"
+            operation = Dependabot::DependencyFile::Operation::CREATE if type == "??"
             encoding = ""
-            encoded_content = File.read(path) unless deleted
+            encoded_content = File.read(path) unless operation == Dependabot::DependencyFile::Operation::DELETE
             if binary_file?(path)
               encoding = Dependabot::DependencyFile::ContentEncoding::BASE64
-              encoded_content = Base64.encode64(encoded_content) unless deleted
+              if operation != Dependabot::DependencyFile::Operation::DELETE
+                encoded_content = Base64.encode64(encoded_content)
+              end
             end
 
             project_root =
@@ -44,7 +52,7 @@ module Dependabot
               name: file_path.to_s,
               content: encoded_content,
               directory: base_directory,
-              deleted: deleted,
+              operation: operation,
               content_encoding: encoding
             )
           end

data/lib/dependabot/pull_request_creator/github.rb

@@ -177,7 +177,7 @@ module Dependabot
               sha: file.content
             }
           else
-            content = if file.deleted?
+            content = if file.operation == Dependabot::DependencyFile::Operation::DELETE
                         { sha: nil }
                       elsif file.binary?
                         sha = github_client_for_source.create_blob(

data/lib/dependabot/pull_request_creator/gitlab.rb

@@ -91,23 +91,26 @@ module Dependabot
         )
       end
 
+      # @param [DependencyFile] file
+      def file_action(file)
+        if file.operation == Dependabot::DependencyFile::Operation::DELETE
+          "delete"
+        elsif file.operation == Dependabot::DependencyFile::Operation::CREATE
+          "create"
+        else
+          "update"
+        end
+      end
+
       def create_commit
         return create_submodule_update_commit if files.count == 1 && files.first.type == "submodule"
 
         actions = files.map do |file|
-          if file.type == "symlink"
-            {
-              action: "update",
-              file_path: file.symlink_target,
-              content: file.content
-            }
-          else
-            {
-              action: "update",
-              file_path: file.path,
-              content: file.content
-            }
-          end
+          {
+            action: file_action(file),
+            file_path: file.type == "symlink" ? file.symlink_target : file.path,
+            content: file.content
+          }
         end
 
         gitlab_client_for_source.create_commit(

data/lib/dependabot/pull_request_creator/message_builder/link_and_mention_sanitizer.rb

@@ -15,6 +15,8 @@ module Dependabot
           (?:issue|pull)s?/(?<number>\d+)
         }x.freeze
         MENTION_REGEX = %r{(?<![A-Za-z0-9`~])@#{GITHUB_USERNAME}/?}.freeze
+        # regex to match a team mention on github
+        TEAM_MENTION_REGEX = %r{(?<![A-Za-z0-9`~])@(?<org>#{GITHUB_USERNAME})/(?<team>#{GITHUB_USERNAME})/?}.freeze
         # End of string
         EOS_REGEX = /\z/.freeze
         COMMONMARKER_OPTIONS = %i(
@@ -35,8 +37,10 @@ module Dependabot
             text, :LIBERAL_HTML_TAG, COMMONMARKER_EXTENSIONS
           )
 
+          sanitize_team_mentions(doc)
           sanitize_mentions(doc)
           sanitize_links(doc)
+
           mode = unsafe ? :UNSAFE : :DEFAULT
           doc.to_html(([mode] + COMMONMARKER_OPTIONS), COMMONMARKER_EXTENSIONS)
         end
@@ -62,6 +66,26 @@ module Dependabot
           end
         end
 
+        # When we come across something that looks like a team mention (e.g. @dependabot/reviewers),
+        # we replace it with a text node.
+        # This is because there are ecosystems that have packages that follow the same pattern
+        # (e.g. @angular/angular-cli), and we don't want to create an invalid link, since
+        # team mentions link to `https://github.com/org/:organization_name/teams/:team_name`.
+        def sanitize_team_mentions(doc)
+          doc.walk do |node|
+            if node.type == :text &&
+               node.string_content.match?(TEAM_MENTION_REGEX)
+
+              nodes = build_team_mention_nodes(node.string_content)
+
+              nodes.each do |n|
+                node.insert_before(n)
+              end
+              node.delete
+            end
+          end
+        end
+
         def sanitize_links(doc)
           doc.walk do |node|
             if node.type == :link && node.url.match?(GITHUB_REF_REGEX)
@@ -87,7 +111,7 @@ module Dependabot
 
         def replace_github_host(text)
           text.gsub(
-            "github.com", github_redirection_service || "github.com"
+            /(www\.)?github.com/, github_redirection_service || "github.com"
           )
         end
 
@@ -117,6 +141,30 @@ module Dependabot
           nodes
         end
 
+        def build_team_mention_nodes(text)
+          nodes = []
+
+          scan = StringScanner.new(text)
+          until scan.eos?
+            line = scan.scan_until(TEAM_MENTION_REGEX) ||
+                   scan.scan_until(EOS_REGEX)
+            line_match = line.match(TEAM_MENTION_REGEX)
+            mention = line_match&.to_s
+            text_node = CommonMarker::Node.new(:text)
+
+            if mention
+              text_node.string_content = line_match.pre_match
+              nodes << text_node
+              nodes += build_mention_link_text_nodes(mention.to_s)
+            else
+              text_node.string_content = line
+              nodes << text_node
+            end
+          end
+
+          nodes
+        end
+
         def build_mention_link_text_nodes(text)
           code_node = CommonMarker::Node.new(:code)
           code_node.string_content = insert_zero_width_space_in_mention(text)

data/lib/dependabot/pull_request_updater/github.rb

@@ -132,7 +132,7 @@ module Dependabot
               sha: file.content
             }
           else
-            content = if file.deleted?
+            content = if file.operation == Dependabot::DependencyFile::Operation::DELETE
                         { sha: nil }
                       elsif file.binary?
                         sha = github_client_for_source.create_blob(

data/lib/dependabot/pull_request_updater/gitlab.rb

@@ -62,10 +62,21 @@ module Dependabot
         gitlab_client_for_source.commit(source.repo, old_commit)
       end
 
+      # @param [DependencyFile] file
+      def file_action(file)
+        if file.operation == Dependabot::DependencyFile::Operation::DELETE
+          "delete"
+        elsif file.operation == Dependabot::DependencyFile::Operation::CREATE
+          "create"
+        else
+          "update"
+        end
+      end
+
       def create_commit
         actions = files.map do |file|
           {
-            action: "update",
+            action: file_action(file),
             file_path: file.type == "symlink" ? file.symlink_target : file.path,
             content: file.content
           }

data/lib/dependabot/shared_helpers.rb

@@ -161,47 +161,21 @@ module Dependabot
       reset_global_git_config(backup_git_config_path)
     end
 
+    def self.credential_helper_path
+      File.join(__dir__, "../../bin/git-credential-store-immutable")
+    end
+
+    # rubocop:disable Metrics/AbcSize
+    # rubocop:disable Metrics/PerceivedComplexity
     def self.configure_git_to_use_https_with_credentials(credentials)
       File.open(GIT_CONFIG_GLOBAL_PATH, "w") do |file|
         file << "# Generated by dependabot/dependabot-core"
       end
-      configure_git_to_use_https
-      configure_git_credentials(credentials)
-    end
-
-    def self.configure_git_to_use_https
-      # NOTE: we use --global here (rather than --system) so that Dependabot
-      # can be run without privileged access
-      run_shell_command(
-        "git config --global --replace-all url.https://github.com/."\
-        "insteadOf ssh://git@github.com/"
-      )
-      run_shell_command(
-        "git config --global --add url.https://github.com/."\
-        "insteadOf ssh://git@github.com:"
-      )
-      run_shell_command(
-        "git config --global --add url.https://github.com/."\
-        "insteadOf git@github.com:"
-      )
-      run_shell_command(
-        "git config --global --add url.https://github.com/."\
-        "insteadOf git@github.com/"
-      )
-      run_shell_command(
-        "git config --global --add url.https://github.com/."\
-        "insteadOf git://github.com/"
-      )
-    end
 
-    # rubocop:disable Metrics/PerceivedComplexity
-    def self.configure_git_credentials(credentials)
       # Then add a file-based credential store that loads a file in this repo.
       # Under the hood this uses git credential-store, but it's invoked through
       # a wrapper binary that only allows non-mutating commands. Without this,
       # whenever the credentials are deemed to be invalid, they're erased.
-      credential_helper_path =
-        File.join(__dir__, "../../bin/git-credential-store-immutable")
       run_shell_command(
         "git config --global credential.helper "\
         "'!#{credential_helper_path} --file #{Dir.pwd}/git.store'",
@@ -219,6 +193,9 @@ module Dependabot
         github_credentials.find { |c| !c["password"]&.start_with?("v1.") } ||
         github_credentials.first
 
+      # Make sure we always have https alternatives for github.com.
+      configure_git_to_use_https("github.com") if github_credential.nil?
+
       deduped_credentials = credentials -
                             github_credentials +
                             [github_credential].compact
@@ -234,13 +211,40 @@ module Dependabot
           "@#{cred.fetch('host')}"
 
         git_store_content += authenticated_url + "\n"
+        configure_git_to_use_https(cred.fetch("host"))
       end
 
       # Save the file
       File.write("git.store", git_store_content)
     end
+    # rubocop:enable Metrics/AbcSize
     # rubocop:enable Metrics/PerceivedComplexity
 
+    def self.configure_git_to_use_https(host)
+      # NOTE: we use --global here (rather than --system) so that Dependabot
+      # can be run without privileged access
+      run_shell_command(
+        "git config --global --replace-all url.https://#{host}/."\
+        "insteadOf ssh://git@#{host}/"
+      )
+      run_shell_command(
+        "git config --global --add url.https://#{host}/."\
+        "insteadOf ssh://git@#{host}:"
+      )
+      run_shell_command(
+        "git config --global --add url.https://#{host}/."\
+        "insteadOf git@#{host}:"
+      )
+      run_shell_command(
+        "git config --global --add url.https://#{host}/."\
+        "insteadOf git@#{host}/"
+      )
+      run_shell_command(
+        "git config --global --add url.https://#{host}/."\
+        "insteadOf git://#{host}/"
+      )
+    end
+
     def self.reset_git_repo(path)
       Dir.chdir(path) do
         run_shell_command("git reset HEAD --hard")

data/lib/dependabot/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.139.0"
+  VERSION = "0.140.2"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.139.0
+  version: 0.140.2
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-03-30 00:00:00.000000000 Z
+date: 2021-04-08 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport