dependabot-common 0.236.0 → 0.237.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 945c135096f005a7d416b56d1e8f9e6b91e1a02b0590758887eba5a110fb5b19
-  data.tar.gz: 0cc101754418b3b1aa682c273e5c6ed2fa72b796d72a9b4d30b3c0f0aa41c39b
+  metadata.gz: e29557fff3ec856a4ebcb95a2b53dd70f91b5d7f2ea66cd6230e90dbcbbc2dc0
+  data.tar.gz: f6b2ce2a845422872e58b37681909fb4357bb1ebcac22c1085db113dc2429426
 SHA512:
-  metadata.gz: 76e41c5707a11e8a5b17df8fa71fc81a4ebbf1a3fd71469931d84cebe1573588afa6605751af2a65c849884bcdf0dd79b5bc4a1d63b9ac69d39466cf8a4b952e
-  data.tar.gz: 53204ad41f102502301e483b3175280673849b0ab0d530b8458aa77289251dfaf287f9ee051e90bd5b39722a7b25a2993e8a49aa15c03982e82990df475fd9dd
+  metadata.gz: 367d715ab3cb1b0c2c498555419e2212e9986c8e824128ce56695c00cdc190371fa0b7b9115258146ff0573f2e4a8461e1c66651b9d84bb2fdb7b0fe00b901ff
+  data.tar.gz: 4e5b3e040476f17cb7cf268ccc0cae90f17178da6a5954b14ca2a2ce280cf0f067b1ce8b88ecc8da5c04ae919cc34b670258b1555f9bfb707fb061cc8439acb3

data/lib/dependabot/clients/azure.rb

@@ -271,9 +271,9 @@ module Dependabot
             )
           )
 
-          raise InternalServerError if response&.status == 500
-          raise BadGateway if response&.status == 502
-          raise ServiceNotAvailable if response&.status == 503
+          raise InternalServerError if response.status == 500
+          raise BadGateway if response.status == 502
+          raise ServiceNotAvailable if response.status == 503
         end
 
         raise Unauthorized if response&.status == 401

data/lib/dependabot/config/file.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "dependabot/config/update_config"
@@ -10,11 +10,22 @@ module Dependabot
     class File
       extend T::Sig
 
-      attr_reader :updates, :registries
+      sig { returns(T::Array[T::Hash[Symbol, String]]) }
+      attr_reader :updates
 
+      sig { returns T::Array[T.untyped] }
+      attr_reader :registries
+
+      sig do
+        params(
+          updates: T.nilable(T::Array[T::Hash[Symbol, String]]),
+          registries: T.nilable(T::Array[T.untyped])
+        )
+          .void
+      end
       def initialize(updates:, registries: nil)
-        @updates = updates || []
-        @registries = registries || []
+        @updates = T.let(updates || [], T::Array[T::Hash[Symbol, String]])
+        @registries = T.let(registries || [], T::Array[T.untyped])
       end
 
       sig do
@@ -46,7 +57,7 @@ module Dependabot
 
       private
 
-      PACKAGE_MANAGER_LOOKUP = {
+      PACKAGE_MANAGER_LOOKUP = T.let({
         "bundler" => "bundler",
         "cargo" => "cargo",
         "composer" => "composer",
@@ -64,7 +75,7 @@ module Dependabot
         "pub" => "pub",
         "swift" => "swift",
         "terraform" => "terraform"
-      }.freeze
+      }.freeze, T::Hash[String, String])
 
       sig { params(cfg: T.nilable(T::Hash[Symbol, T.untyped])).returns(T::Array[IgnoreCondition]) }
       def ignore_conditions(cfg)

data/lib/dependabot/config/update_config.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "dependabot/config/ignore_condition"
@@ -23,17 +23,17 @@ module Dependabot
         ).void
       end
       def initialize(ignore_conditions: nil, commit_message_options: nil)
-        @ignore_conditions = ignore_conditions || []
+        @ignore_conditions = T.let(ignore_conditions || [], T::Array[IgnoreCondition])
         @commit_message_options = commit_message_options
       end
 
       sig { params(dependency: Dependency, security_updates_only: T::Boolean).returns(T::Array[String]) }
       def ignored_versions_for(dependency, security_updates_only: false)
         normalizer = name_normaliser_for(dependency)
-        dep_name = normalizer.call(dependency.name)
+        dep_name = T.must(normalizer).call(dependency.name)
 
         @ignore_conditions
-          .select { |ic| self.class.wildcard_match?(normalizer.call(ic.dependency_name), dep_name) }
+          .select { |ic| self.class.wildcard_match?(T.must(normalizer).call(ic.dependency_name), dep_name) }
           .map { |ic| ic.ignored_versions(dependency, security_updates_only) }
           .flatten
           .compact
@@ -53,6 +53,7 @@ module Dependabot
 
       private
 
+      sig { params(dep: Dependency).returns(T.nilable(T.proc.params(arg0: String).returns(String))) }
       def name_normaliser_for(dep)
         name_normaliser ||= {}
         name_normaliser[dep] ||= Dependency.name_normaliser_for_package_manager(dep.package_manager)
@@ -61,18 +62,35 @@ module Dependabot
       class CommitMessageOptions
         extend T::Sig
 
-        attr_reader :prefix, :prefix_development, :include
+        sig { returns(T.nilable(String)) }
+        attr_reader :prefix
 
+        sig { returns(T.nilable(String)) }
+        attr_reader :prefix_development
+
+        sig { returns(T.nilable(String)) }
+        attr_reader :include
+
+        sig do
+          params(
+            prefix: T.nilable(String),
+            prefix_development: T.nilable(String),
+            include: T.nilable(String)
+          )
+            .void
+        end
         def initialize(prefix:, prefix_development:, include:)
           @prefix = prefix
           @prefix_development = prefix_development
           @include = include
         end
 
+        sig { returns(T::Boolean) }
         def include_scope?
           @include == "scope"
         end
 
+        sig { returns(T::Hash[Symbol, String]) }
         def to_h
           {
             prefix: @prefix,

data/lib/dependabot/dependency_file.rb

@@ -1,13 +1,47 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "pathname"
+require "sorbet-runtime"
 
 module Dependabot
   class DependencyFile
-    attr_accessor :name, :content, :directory, :type, :support_file,
-                  :vendored_file, :symlink_target, :content_encoding,
-                  :operation, :mode
+    extend T::Sig
+
+    sig { returns(String) }
+    attr_accessor :name
+
+    sig { returns(T.nilable(String)) }
+    attr_accessor :content
+
+    sig { returns(String) }
+    attr_accessor :directory
+
+    sig { returns(String) }
+    attr_accessor :type
+
+    sig { returns(T::Boolean) }
+    attr_accessor :support_file
+
+    sig { returns(T::Boolean) }
+    attr_accessor :vendored_file
+
+    sig { returns(T.nilable(String)) }
+    attr_accessor :symlink_target
+
+    sig { returns(String) }
+    attr_accessor :content_encoding
+
+    sig { returns(String) }
+    attr_accessor :operation
+
+    sig { returns(T.nilable(String)) }
+    attr_accessor :mode
+
+    # The directory that this file was fetched for. This is useful for multi-directory
+    # updates, where a set of files that are related to each other are updated together.
+    sig { returns(T.nilable(String)) }
+    attr_accessor :job_directory
 
     class ContentEncoding
       UTF_8 = "utf-8"
@@ -25,18 +59,36 @@ module Dependabot
       SUBMODULE = "160000"
     end
 
+    sig do
+      params(
+        name: String,
+        content: T.nilable(String),
+        directory: String,
+        type: String,
+        support_file: T::Boolean,
+        vendored_file: T::Boolean,
+        symlink_target: T.nilable(String),
+        content_encoding: String,
+        deleted: T::Boolean,
+        operation: String,
+        mode: T.nilable(String),
+        job_directory: T.nilable(String)
+      )
+        .void
+    end
     def initialize(name:, content:, directory: "/", type: "file",
                    support_file: false, vendored_file: false, symlink_target: nil,
                    content_encoding: ContentEncoding::UTF_8, deleted: false,
-                   operation: Operation::UPDATE, mode: nil)
+                   operation: Operation::UPDATE, mode: nil, job_directory: nil)
       @name = name
       @content = content
-      @directory = clean_directory(directory)
+      @directory = T.let(clean_directory(directory), String)
       @symlink_target = symlink_target
       @support_file = support_file
       @vendored_file = vendored_file
       @content_encoding = content_encoding
       @operation = operation
+      @job_directory = job_directory
 
       # Make deleted override the operation. Deleted is kept when operation
       # was introduced to keep compatibility with downstream dependants.
@@ -50,7 +102,7 @@ module Dependabot
       @type = type
 
       begin
-        @mode = File.stat(realpath).mode.to_s(8)
+        @mode = T.let(File.stat(realpath).mode.to_s(8), T.nilable(String))
       rescue StandardError
         @mode = mode
       end
@@ -61,6 +113,7 @@ module Dependabot
       raise "Only symlinked files must specify a target!" if symlink_target
     end
 
+    sig { returns(T::Hash[String, T.untyped]) }
     def to_h
       details = {
         "name" => name,
@@ -74,66 +127,83 @@ module Dependabot
         "mode" => mode
       }
 
+      details["job_directory"] = job_directory if job_directory
       details["symlink_target"] = symlink_target if symlink_target
       details
     end
 
+    sig { returns(String) }
     def path
       Pathname.new(File.join(directory, name)).cleanpath.to_path
     end
 
+    sig { returns(String) }
     def realpath
       (symlink_target || path).sub(%r{^/}, "")
     end
 
+    sig { params(other: BasicObject).returns(T::Boolean) }
     def ==(other)
-      return false unless other.instance_of?(self.class)
-
-      my_hash = to_h.reject { |k| k == "support_file" }
-      their_hash = other.to_h.reject { |k| k == "support_file" }
-      my_hash == their_hash
+      case other
+      when DependencyFile
+        my_hash = to_h.reject { |k| k == "support_file" }
+        their_hash = other.to_h.reject { |k| k == "support_file" }
+        my_hash == their_hash
+      else
+        false
+      end
     end
 
+    sig { returns(Integer) }
     def hash
       to_h.hash
     end
 
+    sig { params(other: BasicObject).returns(T::Boolean) }
     def eql?(other)
       self == other
     end
 
+    sig { returns(T::Boolean) }
     def support_file?
       @support_file
     end
 
+    sig { returns(T::Boolean) }
     def vendored_file?
       @vendored_file
     end
 
+    sig { returns(T::Boolean) }
     def deleted
       @operation == Operation::DELETE
     end
 
+    sig { params(deleted: T::Boolean).void }
     def deleted=(deleted)
       @operation = deleted ? Operation::DELETE : Operation::UPDATE
     end
 
+    sig { returns(T::Boolean) }
     def deleted?
       deleted
     end
 
+    sig { returns(T::Boolean) }
     def binary?
       content_encoding == ContentEncoding::BASE64
     end
 
+    sig { returns(String) }
     def decoded_content
-      return Base64.decode64(content) if binary?
+      return Base64.decode64(T.must(content)) if binary?
 
-      content
+      T.must(content)
     end
 
     private
 
+    sig { params(directory: String).returns(String) }
     def clean_directory(directory)
       # Directory should always start with a `/`
       directory.sub(%r{^/*}, "/")

data/lib/dependabot/dependency_group.rb

@@ -1,23 +1,41 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "dependabot/experiments"
 require "dependabot/config/ignore_condition"
 require "dependabot/logger"
 
+require "sorbet-runtime"
 require "wildcard_matcher"
 require "yaml"
 
 module Dependabot
   class DependencyGroup
-    attr_reader :name, :rules, :dependencies
+    extend T::Sig
 
+    sig { returns(String) }
+    attr_reader :name
+
+    sig { returns(T::Hash[String, T.any(String, T::Array[String])]) }
+    attr_reader :rules
+
+    sig { returns(T::Array[Dependabot::Dependency]) }
+    attr_reader :dependencies
+
+    sig do
+      params(
+        name: String,
+        rules: T::Hash[String, T.untyped]
+      )
+        .void
+    end
     def initialize(name:, rules:)
       @name = name
       @rules = rules
-      @dependencies = []
+      @dependencies = T.let([], T::Array[Dependabot::Dependency])
     end
 
+    sig { params(dependency: Dependabot::Dependency).returns(T::Boolean) }
     def contains?(dependency)
       return true if @dependencies.include?(dependency)
       return false if matches_excluded_pattern?(dependency.name)
@@ -25,11 +43,13 @@ module Dependabot
       matches_pattern?(dependency.name) && matches_dependency_type?(dependency)
     end
 
+    sig { returns(T::Hash[String, String]) }
     def to_h
       { "name" => name }
     end
 
     # Provides a debug utility to view the group as it appears in the config file.
+    sig { returns(String) }
     def to_config_yaml
       {
         "groups" => { name => rules }
@@ -38,18 +58,21 @@ module Dependabot
 
     private
 
+    sig { params(dependency_name: String).returns(T::Boolean) }
     def matches_pattern?(dependency_name)
       return true unless rules.key?("patterns") # If no patterns are defined, we pass this check by default
 
-      rules["patterns"].any? { |rule| WildcardMatcher.match?(rule, dependency_name) }
+      T.unsafe(rules["patterns"]).any? { |rule| WildcardMatcher.match?(rule, dependency_name) }
     end
 
+    sig { params(dependency_name: String).returns(T::Boolean) }
     def matches_excluded_pattern?(dependency_name)
       return false unless rules.key?("exclude-patterns") # If there are no exclusions, fail by default
 
-      rules["exclude-patterns"].any? { |rule| WildcardMatcher.match?(rule, dependency_name) }
+      T.unsafe(rules["exclude-patterns"]).any? { |rule| WildcardMatcher.match?(rule, dependency_name) }
     end
 
+    sig { params(dependency: Dependabot::Dependency).returns(T::Boolean) }
     def matches_dependency_type?(dependency)
       return true unless rules.key?("dependency-type") # If no dependency-type is set, match by default
 
@@ -60,6 +83,7 @@ module Dependabot
                                   end
     end
 
+    sig { returns(T::Boolean) }
     def experimental_rules_enabled?
       Dependabot::Experiments.enabled?(:grouped_updates_experimental_rules)
     end