dependabot-common 0.180.2 → 0.180.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ac9e012745f0fea5e47eda90f3c6ed888b6aaea281d8467d5e7db0c70c822510
-  data.tar.gz: aea88499b949b0b6f4b4b7fa3dc071566589497d9a70f25b61c32aceef59a9e8
+  metadata.gz: e96320c0d005a01e60eb0dbda0ecbef317564c601ea749f2e7161f5078af74c7
+  data.tar.gz: 55fede508dc3d1e527d82565a5a3516fe618645e106d4bec9821e1216d8d87d5
 SHA512:
-  metadata.gz: 2989802bd0a6e6aafafb367c6280be61ef838287dc6f4bf43ee3c8c08901705ae1c39d533368ee39deaca9a90f21826ea11c50ccea448d7374d59be4a0d48f69
-  data.tar.gz: 6e8d0658b12140c6f57c1a7b0629382f9ae5fd558d33684c1a63f0408ba1735ce5edc807b894857923d3a3a66f308bef735d6d67a502ad62bf68d30d9b0a9b91
+  metadata.gz: f833e1abb07f8feb45f08c0c9bf6601a612cca37d5e61b6e2a8be5f4e72987dcc37669b6313428dfb7ece40f59c420c6bf923e152d2bc52be93eec97213cd2d0
+  data.tar.gz: 55f7f4c31e3caf18f4b3c9897dee9b9edfbd2c71616516411022902fefa30ee63a15d0fa0ab07bf8105178d323c41ea657397b8eea589ecad672b4599df67678

data/lib/dependabot/clients/github_with_retries.rb

@@ -5,10 +5,16 @@ require "octokit"
 module Dependabot
   module Clients
     class GithubWithRetries
+      DEFAULT_OPEN_TIMEOUT_IN_SECONDS = 2
+
+      def self.open_timeout_in_seconds
+        ENV.fetch("DEPENDABOT_OPEN_TIMEOUT_IN_SECONDS", DEFAULT_OPEN_TIMEOUT_IN_SECONDS).to_i
+      end
+
       DEFAULT_CLIENT_ARGS = {
         connection_options: {
           request: {
-            open_timeout: 2,
+            open_timeout: open_timeout_in_seconds,
             timeout: 5
           }
         }

data/lib/dependabot/git_commit_checker.rb

@@ -50,7 +50,7 @@ module Dependabot
       return true if dependency.version&.start_with?(ref)
 
       # Check the specified `ref` isn't actually a branch
-      !local_upload_pack.match?("refs/heads/#{ref}")
+      !local_upload_pack.match?(%r{ refs/heads/#{ref}$})
     end
 
     def pinned_ref_looks_like_version?
@@ -86,25 +86,27 @@ module Dependabot
       raise Dependabot::GitDependencyReferenceNotFound, dependency.name
     end
 
-    # rubocop:disable Metrics/PerceivedComplexity
-    # rubocop:disable Metrics/AbcSize
-    def local_tag_for_latest_version
-      tags =
-        local_tags.
-        select { |t| version_tag?(t.name) && matches_existing_prefix?(t.name) }
-      filtered = tags.
-                 reject { |t| tag_included_in_ignore_requirements?(t) }
-      if @raise_on_ignored && filter_lower_versions(filtered).empty? && filter_lower_versions(tags).any?
-        raise Dependabot::AllVersionsIgnored
-      end
+    def local_tags_for_latest_version_commit_sha
+      tags = allowed_version_tags
+      max_tag = max_version_tag(tags)
+
+      return [] unless max_tag
 
-      tag = filtered.
-            reject { |t| tag_is_prerelease?(t) && !wants_prerelease? }.
-            max_by do |t|
-              version = t.name.match(VERSION_REGEX).named_captures.
-                        fetch("version")
-              version_class.new(version)
-            end
+      tags.
+        select { |t| t.commit_sha == max_tag.commit_sha }.
+        map do |t|
+          version = t.name.match(VERSION_REGEX).named_captures.fetch("version")
+          {
+            tag: t.name,
+            version: version_class.new(version),
+            commit_sha: t.commit_sha,
+            tag_sha: t.tag_sha
+          }
+        end
+    end
+
+    def local_tag_for_latest_version
+      tag = max_version_tag(allowed_version_tags)
 
       return unless tag
 
@@ -116,8 +118,29 @@ module Dependabot
         tag_sha: tag.tag_sha
       }
     end
-    # rubocop:enable Metrics/AbcSize
-    # rubocop:enable Metrics/PerceivedComplexity
+
+    def max_version_tag(tags)
+      tags.
+        max_by do |t|
+        version = t.name.match(VERSION_REGEX).named_captures.
+                  fetch("version")
+        version_class.new(version)
+      end
+    end
+
+    def allowed_version_tags
+      tags =
+        local_tags.
+        select { |t| version_tag?(t.name) && matches_existing_prefix?(t.name) }
+      filtered = tags.
+                 reject { |t| tag_included_in_ignore_requirements?(t) }
+      if @raise_on_ignored && filter_lower_versions(filtered).empty? && filter_lower_versions(tags).any?
+        raise Dependabot::AllVersionsIgnored
+      end
+
+      filtered.
+        reject { |t| tag_is_prerelease?(t) && !wants_prerelease? }
+    end
 
     def current_version
       return unless dependency.version && version_tag?(dependency.version)

data/lib/dependabot/metadata_finders/base/changelog_finder.rb

@@ -271,6 +271,7 @@ module Dependabot
         end
 
         def fetch_gitlab_file_list
+          branch = default_gitlab_branch
           gitlab_client.repo_tree(source.repo).map do |file|
             type = case file.type
                    when "blob" then "file"
@@ -281,8 +282,8 @@ module Dependabot
               name: file.name,
               type: type,
               size: 100, # GitLab doesn't return file size
-              html_url: "#{source.url}/blob/master/#{file.path}",
-              download_url: "#{source.url}/raw/master/#{file.path}"
+              html_url: "#{source.url}/blob/#{branch}/#{file.path}",
+              download_url: "#{source.url}/raw/#{branch}/#{file.path}"
             )
           end
         rescue Gitlab::Error::NotFound
@@ -355,6 +356,11 @@ module Dependabot
           @default_bitbucket_branch ||=
             bitbucket_client.fetch_default_branch(source.repo)
         end
+
+        def default_gitlab_branch
+          @default_gitlab_branch ||=
+            gitlab_client.fetch_default_branch(source.repo)
+        end
       end
     end
   end

data/lib/dependabot/metadata_finders/base/commits_finder.rb

@@ -210,7 +210,7 @@ module Dependabot
           elsif new_tag
             "commits/#{new_tag}"
           else
-            "commits/master"
+            "commits/#{default_gitlab_branch}"
           end
         end
 
@@ -321,6 +321,11 @@ module Dependabot
           MetadataFinders::Base::PACKAGE_MANAGERS_WITH_RELIABLE_DIRECTORIES.
             include?(dependency.package_manager)
         end
+
+        def default_gitlab_branch
+          @default_gitlab_branch ||=
+            gitlab_client.fetch_default_branch(source.repo)
+        end
       end
     end
   end

data/lib/dependabot/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.180.2"
+  VERSION = "0.180.5"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.180.2
+  version: 0.180.5
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-03-28 00:00:00.000000000 Z
+date: 2022-04-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport