dependabot-common 0.239.0 → 0.241.0

data/lib/dependabot/metadata_finders/base.rb

@@ -1,24 +1,40 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
+require "sorbet-runtime"
 require "dependabot/source"
 
 module Dependabot
   module MetadataFinders
     class Base
+      extend T::Sig
+      extend T::Helpers
+
       require "dependabot/metadata_finders/base/changelog_finder"
       require "dependabot/metadata_finders/base/release_finder"
       require "dependabot/metadata_finders/base/commits_finder"
 
-      PACKAGE_MANAGERS_WITH_RELIABLE_DIRECTORIES = %w(npm_and_yarn pub).freeze
+      PACKAGE_MANAGERS_WITH_RELIABLE_DIRECTORIES = T.let(%w(npm_and_yarn pub).freeze, T::Array[String])
+
+      sig { returns(Dependabot::Dependency) }
+      attr_reader :dependency
 
-      attr_reader :dependency, :credentials
+      sig { returns(T::Array[T::Hash[String, String]]) }
+      attr_reader :credentials
 
+      sig do
+        params(
+          dependency: Dependabot::Dependency,
+          credentials: T::Array[T::Hash[String, String]]
+        )
+          .void
+      end
       def initialize(dependency:, credentials:)
         @dependency = dependency
         @credentials = credentials
       end
 
+      sig { returns(T.nilable(String)) }
       def source_url
         if reliable_source_directory?
           source&.url_with_directory
@@ -27,106 +43,144 @@ module Dependabot
         end
       end
 
+      sig { returns(T.nilable(String)) }
       def homepage_url
         source_url
       end
 
+      sig { returns(T.nilable(String)) }
       def changelog_url
-        @changelog_finder ||= ChangelogFinder.new(
-          dependency: dependency,
-          source: source,
-          credentials: credentials,
-          suggested_changelog_url: suggested_changelog_url
+        @changelog_finder ||= T.let(
+          ChangelogFinder.new(
+            dependency: dependency,
+            source: source,
+            credentials: credentials,
+            suggested_changelog_url: suggested_changelog_url
+          ),
+          T.nilable(ChangelogFinder)
         )
         @changelog_finder.changelog_url
       end
 
+      sig { returns(T.nilable(String)) }
       def changelog_text
-        @changelog_finder ||= ChangelogFinder.new(
-          dependency: dependency,
-          source: source,
-          credentials: credentials,
-          suggested_changelog_url: suggested_changelog_url
+        @changelog_finder ||= T.let(
+          ChangelogFinder.new(
+            dependency: dependency,
+            source: source,
+            credentials: credentials,
+            suggested_changelog_url: suggested_changelog_url
+          ),
+          T.nilable(ChangelogFinder)
         )
         @changelog_finder.changelog_text
       end
 
+      sig { returns(T.nilable(String)) }
       def upgrade_guide_url
-        @changelog_finder ||= ChangelogFinder.new(
-          dependency: dependency,
-          source: source,
-          credentials: credentials,
-          suggested_changelog_url: suggested_changelog_url
+        @changelog_finder ||= T.let(
+          ChangelogFinder.new(
+            dependency: dependency,
+            source: source,
+            credentials: credentials,
+            suggested_changelog_url: suggested_changelog_url
+          ),
+          T.nilable(ChangelogFinder)
         )
         @changelog_finder.upgrade_guide_url
       end
 
+      sig { returns(T.nilable(String)) }
       def upgrade_guide_text
-        @changelog_finder ||= ChangelogFinder.new(
-          dependency: dependency,
-          source: source,
-          credentials: credentials,
-          suggested_changelog_url: suggested_changelog_url
+        @changelog_finder ||= T.let(
+          ChangelogFinder.new(
+            dependency: dependency,
+            source: source,
+            credentials: credentials,
+            suggested_changelog_url: suggested_changelog_url
+          ),
+          T.nilable(ChangelogFinder)
         )
         @changelog_finder.upgrade_guide_text
       end
 
+      sig { returns(T.nilable(String)) }
       def releases_url
-        @release_finder ||= ReleaseFinder.new(
-          dependency: dependency,
-          source: source,
-          credentials: credentials
+        @release_finder ||= T.let(
+          ReleaseFinder.new(
+            dependency: dependency,
+            source: source,
+            credentials: credentials
+          ),
+          T.nilable(ReleaseFinder)
         )
         @release_finder.releases_url
       end
 
+      sig { returns(T.nilable(String)) }
       def releases_text
-        @release_finder ||= ReleaseFinder.new(
-          dependency: dependency,
-          source: source,
-          credentials: credentials
+        @release_finder ||= T.let(
+          ReleaseFinder.new(
+            dependency: dependency,
+            source: source,
+            credentials: credentials
+          ),
+          T.nilable(ReleaseFinder)
         )
         @release_finder.releases_text
       end
 
+      sig { returns(T.nilable(String)) }
       def commits_url
-        @commits_finder ||= CommitsFinder.new(
-          dependency: dependency,
-          source: source,
-          credentials: credentials
+        @commits_finder ||= T.let(
+          CommitsFinder.new(
+            dependency: dependency,
+            source: source,
+            credentials: credentials
+          ),
+          T.nilable(CommitsFinder)
         )
         @commits_finder.commits_url
       end
 
+      sig { returns(T::Array[T::Hash[Symbol, String]]) }
       def commits
-        @commits_finder ||= CommitsFinder.new(
-          dependency: dependency,
-          source: source,
-          credentials: credentials
+        @commits_finder ||= T.let(
+          CommitsFinder.new(
+            dependency: dependency,
+            source: source,
+            credentials: credentials
+          ),
+          T.nilable(CommitsFinder)
         )
         @commits_finder.commits
       end
 
+      sig { overridable.returns(T.nilable(String)) }
       def maintainer_changes
         nil
       end
 
       private
 
+      sig { overridable.returns(T.nilable(String)) }
       def suggested_changelog_url
         nil
       end
 
+      sig { returns(T.nilable(Dependabot::Source)) }
       def source
         return @source if defined?(@source)
 
-        @source = look_up_source
+        @source = T.let(look_up_source, T.nilable(Dependabot::Source))
       end
 
+      sig { overridable.returns(Dependabot::Source) }
       def look_up_source
         raise NotImplementedError
       end
 
+      sig { returns(T::Boolean) }
       def reliable_source_directory?
         MetadataFinders::Base::PACKAGE_MANAGERS_WITH_RELIABLE_DIRECTORIES
           .include?(dependency.package_manager)

data/lib/dependabot/pull_request_creator/branch_namer/base.rb

@@ -48,6 +48,11 @@ module Dependabot
           @max_length    = max_length
         end
 
+        sig { overridable.returns(String) }
+        def new_branch_name
+          raise NotImplementedError
+        end
+
         private
 
         sig { params(ref_name: String).returns(String) }

data/lib/dependabot/pull_request_creator/branch_namer/dependency_group_strategy.rb

@@ -1,14 +1,30 @@
-# typed: true
+# typed: strong
 # frozen_string_literal: true
 
+require "sorbet-runtime"
 require "dependabot/pull_request_creator/branch_namer/base"
 
 module Dependabot
   class PullRequestCreator
     class BranchNamer
       class DependencyGroupStrategy < Base
-        def initialize(dependencies:, files:, target_branch:, dependency_group:,
-                       separator: "/", prefix: "dependabot", max_length: nil, includes_security_fixes:)
+        extend T::Sig
+
+        sig do
+          params(
+            dependencies: T::Array[Dependabot::Dependency],
+            files: T::Array[Dependabot::DependencyFile],
+            target_branch: T.nilable(String),
+            dependency_group: Dependabot::DependencyGroup,
+            includes_security_fixes: T::Boolean,
+            separator: String,
+            prefix: String,
+            max_length: T.nilable(Integer)
+          )
+            .void
+        end
+        def initialize(dependencies:, files:, target_branch:, dependency_group:, includes_security_fixes:,
+                       separator: "/", prefix: "dependabot", max_length: nil)
           super(
             dependencies: dependencies,
             files: files,
@@ -22,14 +38,17 @@ module Dependabot
           @includes_security_fixes = includes_security_fixes
         end
 
+        sig { override.returns(String) }
         def new_branch_name
           sanitize_branch_name(File.join(prefixes, group_name_with_dependency_digest))
         end
 
         private
 
+        sig { returns(Dependabot::DependencyGroup) }
         attr_reader :dependency_group
 
+        sig { returns(T::Array[String]) }
         def prefixes
           [
             prefix,
@@ -45,6 +64,7 @@ module Dependabot
         #
         # Let's append a short hash digest of the dependency changes so that we can
         # meet this guarantee.
+        sig { returns(String) }
         def group_name_with_dependency_digest
           if @includes_security_fixes
             "group-security-#{package_manager}-#{dependency_digest}"
@@ -53,16 +73,22 @@ module Dependabot
           end
         end
 
+        sig { returns(T.nilable(String)) }
         def dependency_digest
-          @dependency_digest ||= Digest::MD5.hexdigest(dependencies.map do |dependency|
-            "#{dependency.name}-#{dependency.removed? ? 'removed' : dependency.version}"
-          end.sort.join(",")).slice(0, 10)
+          @dependency_digest ||= T.let(
+            Digest::MD5.hexdigest(dependencies.map do |dependency|
+                                    "#{dependency.name}-#{dependency.removed? ? 'removed' : dependency.version}"
+                                  end.sort.join(",")).slice(0, 10),
+            T.nilable(String)
+          )
         end
 
+        sig { returns(String) }
         def package_manager
           T.must(dependencies.first).package_manager
         end
 
+        sig { returns(String) }
         def directory
           T.must(files.first).directory.tr(" ", "-")
         end

data/lib/dependabot/pull_request_creator/branch_namer/solo_strategy.rb

@@ -1,7 +1,8 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "digest"
+require "sorbet-runtime"
 
 require "dependabot/metadata_finders"
 require "dependabot/pull_request_creator/branch_namer/base"
@@ -10,30 +11,37 @@ module Dependabot
   class PullRequestCreator
     class BranchNamer
       class SoloStrategy < Base
+        extend T::Sig
+
+        sig { override.returns(String) }
         def new_branch_name
           @name ||=
-            begin
-              dependency_name_part =
-                if dependencies.count > 1 && updating_a_property?
-                  property_name
-                elsif dependencies.count > 1 && updating_a_dependency_set?
-                  dependency_set.fetch(:group)
-                else
-                  dependencies
-                    .map(&:name)
-                    .join("-and-")
-                    .tr(":[]", "-")
-                    .tr("@", "")
-                end
-
-              "#{dependency_name_part}-#{branch_version_suffix}"
-            end
+            T.let(
+              begin
+                dependency_name_part =
+                  if dependencies.count > 1 && updating_a_property?
+                    property_name
+                  elsif dependencies.count > 1 && updating_a_dependency_set?
+                    dependency_set.fetch(:group)
+                  else
+                    dependencies
+                      .map(&:name)
+                      .join("-and-")
+                      .tr(":[]", "-")
+                      .tr("@", "")
+                  end
+
+                "#{dependency_name_part}-#{branch_version_suffix}"
+              end,
+              T.nilable(String)
+            )
 
           sanitize_branch_name(File.join(prefixes, @name))
         end
 
         private
 
+        sig { returns(T::Array[String]) }
         def prefixes
           [
             prefix,
@@ -43,46 +51,58 @@ module Dependabot
           ].compact
         end
 
+        sig { returns(String) }
         def package_manager
           T.must(dependencies.first).package_manager
         end
 
+        sig { returns(T::Boolean) }
         def updating_a_property?
           T.must(dependencies.first)
            .requirements
            .any? { |r| r.dig(:metadata, :property_name) }
         end
 
+        sig { returns(T::Boolean) }
         def updating_a_dependency_set?
           T.must(dependencies.first)
            .requirements
            .any? { |r| r.dig(:metadata, :dependency_set) }
         end
 
+        sig { returns(String) }
         def property_name
-          @property_name ||= T.must(dependencies.first).requirements
-                              .find { |r| r.dig(:metadata, :property_name) }
-                              &.dig(:metadata, :property_name)
+          @property_name ||=
+            T.let(T.must(dependencies.first).requirements
+                                .find { |r| r.dig(:metadata, :property_name) }
+                                &.dig(:metadata, :property_name),
+                  T.nilable(String))
 
           raise "No property name!" unless @property_name
 
           @property_name
         end
 
+        sig { returns(T::Hash[Symbol, String]) }
         def dependency_set
-          @dependency_set ||= T.must(dependencies.first).requirements
-                               .find { |r| r.dig(:metadata, :dependency_set) }
-                               &.dig(:metadata, :dependency_set)
+          @dependency_set ||=
+            T.let(
+              T.must(dependencies.first).requirements
+                                 .find { |r| r.dig(:metadata, :dependency_set) }
+                                 &.dig(:metadata, :dependency_set),
+              T.nilable(T::Hash[String, String])
+            )
 
           raise "No dependency set!" unless @dependency_set
 
           @dependency_set
         end
 
+        sig { returns(T.nilable(String)) }
         def branch_version_suffix
-          dep = dependencies.first
+          dep = T.must(dependencies.first)
 
-          if T.must(dep).removed?
+          if dep.removed?
             "-removed"
           elsif library? && ref_changed?(dep) && new_ref(dep)
             new_ref(dep)
@@ -93,6 +113,7 @@ module Dependabot
           end
         end
 
+        sig { params(dependency: Dependabot::Dependency).returns(String) }
         def sanitized_requirement(dependency)
           new_library_requirement(dependency)
             .delete(" ")
@@ -111,13 +132,14 @@ module Dependabot
             .gsub(",", "-and-")
         end
 
+        sig { params(dependency: Dependabot::Dependency).returns(T.nilable(String)) }
         def new_version(dependency)
           # Version looks like a git SHA and we could be updating to a specific
           # ref in which case we return that otherwise we return a shorthand sha
-          if dependency.version.match?(/^[0-9a-f]{40}$/)
+          if dependency.version&.match?(/^[0-9a-f]{40}$/)
             return new_ref(dependency) if ref_changed?(dependency) && new_ref(dependency)
 
-            dependency.version[0..6]
+            T.must(dependency.version)[0..6]
           elsif dependency.version == dependency.previous_version &&
                 package_manager == "docker"
             dependency.requirements
@@ -128,13 +150,15 @@ module Dependabot
           end
         end
 
+        sig { params(dependency: Dependabot::Dependency).returns(T.nilable(String)) }
         def previous_ref(dependency)
-          previous_refs = dependency.previous_requirements.filter_map do |r|
+          previous_refs = T.must(dependency.previous_requirements).filter_map do |r|
             r.dig(:source, "ref") || r.dig(:source, :ref)
           end.uniq
           previous_refs.first if previous_refs.count == 1
         end
 
+        sig { params(dependency: Dependabot::Dependency).returns(T.nilable(String)) }
         def new_ref(dependency)
           new_refs = dependency.requirements.filter_map do |r|
             r.dig(:source, "ref") || r.dig(:source, :ref)
@@ -142,20 +166,22 @@ module Dependabot
           new_refs.first if new_refs.count == 1
         end
 
+        sig { params(dependency: Dependabot::Dependency).returns(T::Boolean) }
         def ref_changed?(dependency)
           # We could go from multiple previous refs (nil) to a single new ref
           previous_ref(dependency) != new_ref(dependency)
         end
 
+        sig { params(dependency: Dependabot::Dependency).returns(T.untyped) }
         def new_library_requirement(dependency)
           updated_reqs =
-            dependency.requirements - dependency.previous_requirements
+            dependency.requirements - T.must(dependency.previous_requirements)
 
           gemspec =
             updated_reqs.find { |r| r[:file].match?(%r{^[^/]*\.gemspec$}) }
           return gemspec[:requirement] if gemspec
 
-          updated_reqs.first[:requirement]
+          updated_reqs.first&.fetch(:requirement)
         end
 
         # TODO: Bring this in line with existing library checks that we do in the
@@ -163,12 +189,14 @@ module Dependabot
         # `requirements_update_strategy`.
         #
         # TODO re-use in MessageBuilder
+        sig { returns(T::Boolean) }
         def library?
           dependencies.any? { |d| !d.appears_in_lockfile? }
         end
 
+        sig { params(dependency: Dependabot::Dependency).returns(T::Boolean) }
         def requirements_changed?(dependency)
-          (dependency.requirements - dependency.previous_requirements).any?
+          (dependency.requirements - T.must(dependency.previous_requirements)).any?
         end
       end
     end

data/lib/dependabot/pull_request_creator/branch_namer.rb

@@ -1,7 +1,8 @@
-# typed: true
+# typed: strong
 # frozen_string_literal: true
 
 require "digest"
+require "sorbet-runtime"
 
 require "dependabot/metadata_finders"
 require "dependabot/pull_request_creator"
@@ -11,9 +12,45 @@ require "dependabot/pull_request_creator/branch_namer/dependency_group_strategy"
 module Dependabot
   class PullRequestCreator
     class BranchNamer
-      attr_reader :dependencies, :files, :target_branch, :separator, :prefix, :max_length, :dependency_group,
-                  :includes_security_fixes
+      extend T::Sig
 
+      sig { returns(T::Array[Dependabot::Dependency]) }
+      attr_reader :dependencies
+
+      sig { returns(T::Array[Dependabot::DependencyFile]) }
+      attr_reader :files
+
+      sig { returns(T.nilable(String)) }
+      attr_reader :target_branch
+
+      sig { returns(String) }
+      attr_reader :separator
+
+      sig { returns(String) }
+      attr_reader :prefix
+
+      sig { returns(T.nilable(Integer)) }
+      attr_reader :max_length
+
+      sig { returns(T.nilable(Dependabot::DependencyGroup)) }
+      attr_reader :dependency_group
+
+      sig { returns(T::Boolean) }
+      attr_reader :includes_security_fixes
+
+      sig do
+        params(
+          dependencies: T::Array[Dependabot::Dependency],
+          files: T::Array[Dependabot::DependencyFile],
+          target_branch: T.nilable(String),
+          dependency_group: T.nilable(Dependabot::DependencyGroup),
+          separator: String,
+          prefix: String,
+          max_length: T.nilable(Integer),
+          includes_security_fixes: T::Boolean
+        )
+          .void
+      end
       def initialize(dependencies:, files:, target_branch:, dependency_group: nil,
                      separator: "/", prefix: "dependabot", max_length: nil, includes_security_fixes: false)
         @dependencies  = dependencies
@@ -26,14 +63,16 @@ module Dependabot
         @includes_security_fixes = includes_security_fixes
       end
 
+      sig { returns(String) }
       def new_branch_name
         strategy.new_branch_name
       end
 
       private
 
+      sig { returns(Dependabot::PullRequestCreator::BranchNamer::Base) }
       def strategy
-        @strategy ||=
+        @strategy ||= T.let(
           if dependency_group.nil?
             SoloStrategy.new(
               dependencies: dependencies,
@@ -48,13 +87,15 @@ module Dependabot
               dependencies: dependencies,
               files: files,
               target_branch: target_branch,
-              dependency_group: dependency_group,
+              dependency_group: T.must(dependency_group),
+              includes_security_fixes: includes_security_fixes,
               separator: separator,
               prefix: prefix,
-              max_length: max_length,
-              includes_security_fixes: includes_security_fixes
+              max_length: max_length
             )
-          end
+          end,
+          T.nilable(Dependabot::PullRequestCreator::BranchNamer::Base)
+        )
       end
     end
   end

data/lib/dependabot/pull_request_creator/gitlab.rb

@@ -150,7 +150,7 @@ module Dependabot
       end
 
       def approvers_hash
-        @approvers_hash ||= approvers&.transform_keys(&:to_sym) || {}
+        @approvers_hash ||= approvers || {}
       end
 
       def default_branch