dependabot-common 0.242.1 → 0.243.0

data/lib/dependabot/metadata_finders/base/release_finder.rb

@@ -1,6 +1,9 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
+require "sorbet-runtime"
+
+require "dependabot/credential"
 require "dependabot/clients/github_with_retries"
 require "dependabot/clients/gitlab_with_retries"
 require "dependabot/metadata_finders/base"
@@ -10,41 +13,61 @@ module Dependabot
   module MetadataFinders
     class Base
       class ReleaseFinder
-        attr_reader :dependency, :credentials, :source
+        extend T::Sig
+
+        sig { returns(Dependabot::Dependency) }
+        attr_reader :dependency
+
+        sig { returns(T::Array[Dependabot::Credential]) }
+        attr_reader :credentials
+
+        sig { returns(T.nilable(Dependabot::Source)) }
+        attr_reader :source
 
+        sig do
+          params(
+            source: T.nilable(Dependabot::Source),
+            dependency: Dependabot::Dependency,
+            credentials: T::Array[Dependabot::Credential]
+          )
+            .void
+        end
         def initialize(source:, dependency:, credentials:)
           @source = source
           @dependency = dependency
           @credentials = credentials
         end
 
+        sig { returns(T.nilable(String)) }
         def releases_url
           return unless source
 
           # Azure does not provide tags via API, so we can't check whether
           # there are any releases. So, optimistically return the tags location
-          return "#{source.url}/tags" if source.provider == "azure"
+          return "#{T.must(source).url}/tags" if T.must(source).provider == "azure"
 
           # If there are no releases, we won't be linking to the releases page
           return unless all_releases.any?
 
-          case source.provider
-          when "github" then "#{source.url}/releases"
-          when "gitlab" then "#{source.url}/tags"
+          case T.must(source).provider
+          when "github" then "#{T.must(source).url}/releases"
+          when "gitlab" then "#{T.must(source).url}/tags"
           when "bitbucket", "codecommit" then nil
-          else raise "Unexpected repo provider '#{source.provider}'"
+          else raise "Unexpected repo provider '#{T.must(source).provider}'"
           end
         end
 
+        sig { returns(T.nilable(String)) }
         def releases_text
-          return unless relevant_releases.any?
-          return if relevant_releases.all? { |r| r.body.nil? || r.body == "" }
+          return unless relevant_releases&.any?
+          return if relevant_releases&.all? { |r| r.body.nil? || r.body == "" }
 
-          relevant_releases.map { |r| serialize_release(r) }.join("\n\n")
+          relevant_releases&.map { |r| serialize_release(r) }&.join("\n\n")
         end
 
         private
 
+        sig { returns(T::Array[T.untyped]) }
         def all_dep_releases
           releases = all_releases
           dep_prefix = dependency.name.downcase
@@ -59,21 +82,23 @@ module Dependabot
           releases_with_dependency_name
         end
 
+        sig { returns(T::Array[T.untyped]) }
         def all_releases
-          @all_releases ||= fetch_dependency_releases
+          @all_releases ||= T.let(fetch_dependency_releases, T.nilable(T::Array[T.untyped]))
         end
 
+        sig { returns(T.nilable(T::Array[T.untyped])) }
         def relevant_releases
           releases = releases_since_previous_version
 
           # Sometimes we can't filter the releases properly (if they're
           # prefixed by a number that gets confused with the version). In this
           # case, the best we can do is return nil.
-          return [] unless releases.any?
+          return [] unless !releases.nil? && releases.any?
 
           if updated_release && version_class.correct?(new_version)
             releases = filter_releases_using_updated_release(releases)
-            filter_releases_using_updated_version(releases, conservative: true)
+            filter_releases_using_updated_version(T.must(releases), conservative: true)
           elsif updated_release
             filter_releases_using_updated_release(releases)
           elsif version_class.correct?(new_version)
@@ -83,12 +108,13 @@ module Dependabot
           end
         end
 
+        sig { returns(T.nilable(T::Array[T.untyped])) }
         def releases_since_previous_version
           return [updated_release].compact unless previous_version
 
           if previous_release && version_class.correct?(previous_version)
             releases = filter_releases_using_previous_release(all_dep_releases)
-            filter_releases_using_previous_version(releases, conservative: true)
+            filter_releases_using_previous_version(T.must(releases), conservative: true)
           elsif previous_release
             filter_releases_using_previous_release(all_dep_releases)
           elsif version_class.correct?(previous_version)
@@ -101,18 +127,21 @@ module Dependabot
           end
         end
 
+        sig { params(releases: T::Array[T.untyped]).returns(T.nilable(T::Array[T.untyped])) }
         def filter_releases_using_previous_release(releases)
           return releases if releases.index(previous_release).nil?
 
-          releases.first(releases.index(previous_release))
+          releases.first(T.must(releases.index(previous_release)))
         end
 
+        sig { params(releases: T::Array[T.untyped]).returns(T.nilable(T::Array[T.untyped])) }
         def filter_releases_using_updated_release(releases)
           return releases if releases.index(updated_release).nil?
 
           releases[releases.index(updated_release)..-1]
         end
 
+        sig { params(releases: T::Array[T.untyped], conservative: T::Boolean).returns(T::Array[T.untyped]) }
         def filter_releases_using_previous_version(releases, conservative:)
           releases.reject do |release|
             cleaned_tag = release.tag_name.gsub(/^[^0-9]*/, "")
@@ -133,6 +162,7 @@ module Dependabot
           end
         end
 
+        sig { params(releases: T::Array[T.untyped], conservative: T::Boolean).returns(T::Array[T.untyped]) }
         def filter_releases_using_updated_version(releases, conservative:)
           updated_version = version_class.new(new_version)
 
@@ -155,14 +185,17 @@ module Dependabot
           end
         end
 
+        sig { returns(T.untyped) }
         def updated_release
           release_for_version(new_version)
         end
 
+        sig { returns(T.untyped) }
         def previous_release
           release_for_version(previous_version)
         end
 
+        sig { params(version: T.nilable(String)).returns(T.untyped) }
         def release_for_version(version)
           return nil unless version
 
@@ -172,6 +205,7 @@ module Dependabot
             all_dep_releases.find { |r| release_regex.match?(r.name.to_s) }
         end
 
+        sig { params(release: T.untyped).returns(String) }
         def serialize_release(release)
           rel = release
           title = "## #{rel.name.to_s == '' ? rel.tag_name : rel.name}\n"
@@ -184,34 +218,39 @@ module Dependabot
           release_body_includes_title?(rel) ? body : title + body
         end
 
+        sig { params(release: T.untyped).returns(T::Boolean) }
         def release_body_includes_title?(release)
           title = release.name.to_s == "" ? release.tag_name : release.name
           release.body.to_s.match?(/\A\s*\#*\s*#{Regexp.quote(title)}/m)
         end
 
+        sig { params(version: T.nilable(String)).returns(Regexp) }
         def version_regex(version)
           /(?:[^0-9\.]|\A)#{Regexp.escape(version || 'unknown')}\z/
         end
 
+        sig { returns(T.class_of(Dependabot::Version)) }
         def version_class
           dependency.version_class
         end
 
+        sig { returns(T::Array[T.untyped]) }
         def fetch_dependency_releases
           return [] unless source
 
-          case source.provider
+          case T.must(source).provider
           when "github" then fetch_github_releases
           # Bitbucket and CodeCommit don't support releases and
           # Azure can't list API for annotated tags
           when "bitbucket", "azure", "codecommit" then []
           when "gitlab" then fetch_gitlab_releases
-          else raise "Unexpected repo provider '#{source.provider}'"
+          else raise "Unexpected repo provider '#{T.must(source).provider}'"
           end
         end
 
+        sig { returns(T::Array[T.untyped]) }
         def fetch_github_releases
-          releases = github_client.releases(source.repo, per_page: 100)
+          releases = T.unsafe(github_client).releases(T.must(source).repo, per_page: 100)
 
           # Remove any releases without a tag name. These are draft releases and
           # aren't yet associated with a tag, so shouldn't be used.
@@ -231,26 +270,28 @@ module Dependabot
           []
         end
 
+        sig { returns(T::Array[T.untyped]) }
         def fetch_gitlab_releases
           releases =
-            gitlab_client
-            .tags(source.repo)
-            .select(&:release)
-            .sort_by { |r| r.commit.authored_date }
-            .reverse
+            T.unsafe(gitlab_client)
+             .tags(T.must(source).repo)
+             .select(&:release)
+             .sort_by { |r| r.commit.authored_date }
+             .reverse
 
           releases.map do |tag|
             OpenStruct.new(
               name: tag.name,
               tag_name: tag.release.tag_name,
               body: tag.release.description,
-              html_url: "#{source.url}/tags/#{tag.name}"
+              html_url: "#{T.must(source).url}/tags/#{tag.name}"
             )
           end
         rescue Gitlab::Error::NotFound
           []
         end
 
+        sig { returns(T.nilable(String)) }
         def previous_version
           # If we don't have a previous version, we *may* still be able to
           # figure one out if a ref was provided and has been changed (in which
@@ -262,7 +303,7 @@ module Dependabot
           # Previous version looks like a git SHA and there's a previous ref, we
           # could be changing to a nil previous ref in which case we want to
           # fall back to tge sha version
-          if dependency.previous_version.match?(/^[0-9a-f]{40}$/) &&
+          if T.must(dependency.previous_version).match?(/^[0-9a-f]{40}$/) &&
              ref_changed? && previous_ref
             previous_ref
           else
@@ -270,11 +311,12 @@ module Dependabot
           end
         end
 
+        sig { returns(T.nilable(String)) }
         def new_version
           # New version looks like a git SHA and there's a new ref, guarding
           # against changes to a nil new_ref (not certain this can actually
           # happen atm)
-          if dependency.version.match?(/^[0-9a-f]{40}$/) && ref_changed? &&
+          if T.must(dependency.version).match?(/^[0-9a-f]{40}$/) && ref_changed? &&
              new_ref
             return new_ref
           end
@@ -282,13 +324,15 @@ module Dependabot
           dependency.version
         end
 
+        sig { returns(T.nilable(String)) }
         def previous_ref
-          previous_refs = dependency.previous_requirements.filter_map do |r|
+          previous_refs = T.must(dependency.previous_requirements).filter_map do |r|
             r.dig(:source, "ref") || r.dig(:source, :ref)
           end.uniq
           previous_refs.first if previous_refs.count == 1
         end
 
+        sig { returns(T.nilable(String)) }
         def new_ref
           new_refs = dependency.requirements.filter_map do |r|
             r.dig(:source, "ref") || r.dig(:source, :ref)
@@ -296,19 +340,28 @@ module Dependabot
           new_refs.first if new_refs.count == 1
         end
 
+        sig { returns(T::Boolean) }
         def ref_changed?
           # We could go from multiple previous refs (nil) to a single new ref
           previous_ref != new_ref
         end
 
+        sig { returns(Dependabot::Clients::GitlabWithRetries) }
         def gitlab_client
-          @gitlab_client ||= Dependabot::Clients::GitlabWithRetries
-                             .for_gitlab_dot_com(credentials: credentials)
+          @gitlab_client ||=
+            T.let(
+              Dependabot::Clients::GitlabWithRetries.for_gitlab_dot_com(credentials: credentials),
+              T.nilable(Dependabot::Clients::GitlabWithRetries)
+            )
         end
 
+        sig { returns(Dependabot::Clients::GithubWithRetries) }
         def github_client
-          @github_client ||= Dependabot::Clients::GithubWithRetries
-                             .for_source(source: source, credentials: credentials)
+          @github_client ||=
+            T.let(
+              Dependabot::Clients::GithubWithRetries.for_source(source: source, credentials: credentials),
+              T.nilable(Dependabot::Clients::GithubWithRetries)
+            )
         end
       end
     end

data/lib/dependabot/metadata_finders/base.rb

@@ -3,6 +3,7 @@
 
 require "sorbet-runtime"
 require "dependabot/source"
+require "dependabot/credential"
 
 module Dependabot
   module MetadataFinders
@@ -19,13 +20,13 @@ module Dependabot
       sig { returns(Dependabot::Dependency) }
       attr_reader :dependency
 
-      sig { returns(T::Array[T::Hash[String, String]]) }
+      sig { returns(T::Array[Dependabot::Credential]) }
       attr_reader :credentials
 
       sig do
         params(
           dependency: Dependabot::Dependency,
-          credentials: T::Array[T::Hash[String, String]]
+          credentials: T::Array[Dependabot::Credential]
         )
           .void
       end
@@ -175,7 +176,7 @@ module Dependabot
         @source = T.let(look_up_source, T.nilable(Dependabot::Source))
       end
 
-      sig { overridable.returns(Dependabot::Source) }
+      sig { overridable.returns(T.nilable(Dependabot::Source)) }
       def look_up_source
         raise NotImplementedError
       end

data/lib/dependabot/pull_request_creator/azure.rb

@@ -56,7 +56,7 @@ module Dependabot
 
       def branch_exists?
         azure_client_for_source.branch(branch_name)
-      rescue ::Azure::Error::NotFound
+      rescue ::Dependabot::Clients::Azure::NotFound
         false
       end
 

data/lib/dependabot/pull_request_creator/branch_namer/solo_strategy.rb

@@ -185,10 +185,10 @@ module Dependabot
         end
 
         # TODO: Bring this in line with existing library checks that we do in the
-        # update checkers, which are also overriden by passing an explicit
+        # update checkers, which are also overridden by passing an explicit
         # `requirements_update_strategy`.
         #
-        # TODO re-use in MessageBuilder
+        # TODO reuse in MessageBuilder
         sig { returns(T::Boolean) }
         def library?
           dependencies.any? { |d| !d.appears_in_lockfile? }

data/lib/dependabot/pull_request_creator/labeler.rb

@@ -4,6 +4,7 @@
 require "octokit"
 require "sorbet-runtime"
 require "dependabot/pull_request_creator"
+require "dependabot/credential"
 
 module Dependabot
   class PullRequestCreator
@@ -41,7 +42,7 @@ module Dependabot
         params(
           source: Dependabot::Source,
           custom_labels: T.nilable(T::Array[String]),
-          credentials: T::Array[T::Hash[String, String]],
+          credentials: T::Array[Dependabot::Credential],
           dependencies: T::Array[Dependency],
           includes_security_fixes: T::Boolean,
           label_language: T::Boolean,
@@ -107,7 +108,7 @@ module Dependabot
       sig { returns(T.nilable(T::Array[String])) }
       attr_reader :custom_labels
 
-      sig { returns(T::Array[T::Hash[String, String]]) }
+      sig { returns(T::Array[Dependabot::Credential]) }
       attr_reader :credentials
 
       sig { returns(T::Array[Dependency]) }

data/lib/dependabot/pull_request_creator/message_builder/issue_linker.rb

@@ -1,37 +1,45 @@
-# typed: true
+# typed: strong
 # frozen_string_literal: true
 
+require "sorbet-runtime"
 require "dependabot/pull_request_creator/message_builder"
 
 module Dependabot
   class PullRequestCreator
     class MessageBuilder
       class IssueLinker
+        extend T::Sig
+
         REPO_REGEX = %r{(?<repo>[\w.-]+/(?:(?!\.git|\.\s)[\w.-])+)}
         TAG_REGEX = /(?<tag>(?:\#|GH-)\d+)/i
-        ISSUE_LINK_REGEXS = [
+        ISSUE_LINK_REGEXS = T.let([
           /
             (?:(?<=[^A-Za-z0-9\[\\]|^)\\*#{TAG_REGEX}(?=[^A-Za-z0-9\-]|$))|
             (?:(?<=\s|^)#{REPO_REGEX}#{TAG_REGEX}(?=[^A-Za-z0-9\-]|$))
           /x,
           /\[#{TAG_REGEX}\](?=[^A-Za-z0-9\-\(])/,
           /\[(?<tag>(?:\#|GH-)?\d+)\]\(\)/i
-        ].freeze
+        ].freeze, T::Array[Regexp])
 
+        sig { returns(String) }
         attr_reader :source_url
 
+        sig { params(source_url: String).void }
         def initialize(source_url:)
           @source_url = source_url
         end
 
+        sig { params(text: String).returns(String) }
         def link_issues(text:)
           # Loop through each of the issue link regexes, replacing any instances
           # of them with an absolute link that uses the source URL
           ISSUE_LINK_REGEXS.reduce(text) do |updated_text, regex|
             updated_text.gsub(regex) do |issue_link|
-              tag = issue_link
-                    .match(/(?<tag>(?:\#|GH-)?\d+)/i)
-                    .named_captures.fetch("tag")
+              tag = T.must(
+                T.must(issue_link
+                    .match(/(?<tag>(?:\#|GH-)?\d+)/i))
+                     .named_captures.fetch("tag")
+              )
               number = tag.match(/\d+/).to_s
 
               repo = issue_link

data/lib/dependabot/pull_request_creator/message_builder/metadata_presenter.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "sorbet-runtime"
@@ -11,8 +11,20 @@ module Dependabot
         extend T::Sig
         extend Forwardable
 
-        attr_reader :dependency, :source, :metadata_finder,
-                    :vulnerabilities_fixed, :github_redirection_service
+        sig { returns(Dependabot::Dependency) }
+        attr_reader :dependency
+
+        sig { returns(Dependabot::Source) }
+        attr_reader :source
+
+        sig { returns(Dependabot::MetadataFinders::Base) }
+        attr_reader :metadata_finder
+
+        sig { returns(T.nilable(T::Array[T::Hash[String, String]])) }
+        attr_reader :vulnerabilities_fixed
+
+        sig { returns(T.nilable(String)) }
+        attr_reader :github_redirection_service
 
         def_delegators :metadata_finder,
                        :changelog_url,
@@ -26,6 +38,16 @@ module Dependabot
                        :upgrade_guide_url,
                        :upgrade_guide_text
 
+        sig do
+          params(
+            dependency: Dependabot::Dependency,
+            source: Dependabot::Source,
+            metadata_finder: Dependabot::MetadataFinders::Base,
+            vulnerabilities_fixed: T.nilable(T::Array[T::Hash[String, String]]),
+            github_redirection_service: T.nilable(String)
+          )
+            .void
+        end
         def initialize(dependency:, source:, metadata_finder:,
                        vulnerabilities_fixed:, github_redirection_service:)
           @dependency = dependency
@@ -35,6 +57,7 @@ module Dependabot
           @github_redirection_service = github_redirection_service
         end
 
+        sig { returns(String) }
         def to_s
           msg = ""
           msg += vulnerabilities_cascade
@@ -49,11 +72,12 @@ module Dependabot
 
         private
 
+        sig { returns(String) }
         def vulnerabilities_cascade
           return "" unless vulnerabilities_fixed&.any?
 
           msg = ""
-          vulnerabilities_fixed.each do |v|
+          T.must(vulnerabilities_fixed).each do |v|
             msg += serialized_vulnerability_details(v)
           end
 
@@ -63,6 +87,7 @@ module Dependabot
           build_details_tag(summary: "Vulnerabilities fixed", body: msg)
         end
 
+        sig { returns(String) }
         def release_cascade
           return "" unless releases_text && releases_url
 
@@ -80,6 +105,7 @@ module Dependabot
           build_details_tag(summary: "Release notes", body: msg)
         end
 
+        sig { returns(String) }
         def changelog_cascade
           return "" unless changelog_url && changelog_text
 
@@ -95,6 +121,7 @@ module Dependabot
           build_details_tag(summary: "Changelog", body: msg)
         end
 
+        sig { returns(String) }
         def upgrade_guide_cascade
           return "" unless upgrade_guide_url && upgrade_guide_text
 
@@ -110,6 +137,7 @@ module Dependabot
           build_details_tag(summary: "Upgrade guide", body: msg)
         end
 
+        sig { returns(String) }
         def commits_cascade
           return "" unless commits_url && commits
 
@@ -138,6 +166,7 @@ module Dependabot
           build_details_tag(summary: "Commits", body: msg)
         end
 
+        sig { returns(String) }
         def maintainer_changes_cascade
           return "" unless maintainer_changes
 
@@ -147,6 +176,7 @@ module Dependabot
           )
         end
 
+        sig { params(summary: String, body: String).returns(String) }
         def build_details_tag(summary:, body:)
           # Bitbucket does not support <details> tag (https://jira.atlassian.com/browse/BCLOUD-20231)
           # CodeCommit does not support the <details> tag (no url available)
@@ -159,10 +189,11 @@ module Dependabot
           end
         end
 
+        sig { params(details: T::Hash[String, String]).returns(String) }
         def serialized_vulnerability_details(details)
           msg = vulnerability_source_line(details)
 
-          msg += "> **#{details['title'].lines.map(&:strip).join(' ')}**\n" if details["title"]
+          msg += "> **#{T.must(details['title']).lines.map(&:strip).join(' ')}**\n" if details["title"]
 
           if (description = details["description"])
             description.strip.lines.first(20).each { |line| msg += "> #{line}" }
@@ -175,6 +206,7 @@ module Dependabot
           msg + "\n"
         end
 
+        sig { params(details: T::Hash[String, String]).returns(String) }
         def vulnerability_source_line(details)
           if details["source_url"] && details["source_name"]
             "*Sourced from [#{details['source_name']}]" \
@@ -186,6 +218,7 @@ module Dependabot
           end
         end
 
+        sig { params(details: T::Hash[String, T.untyped]).returns(String) }
         def vulnerability_version_range_lines(details)
           msg = ""
           %w(
@@ -203,18 +236,20 @@ module Dependabot
           msg
         end
 
+        sig { params(text: String).returns(String) }
         def link_issues(text:)
           IssueLinker
             .new(source_url: source_url)
             .link_issues(text: text)
         end
 
+        sig { params(text: String, base_url: String).returns(String) }
         def fix_relative_links(text:, base_url:)
           text.gsub(/\[.*?\]\([^)]+\)/) do |link|
             next link if link.include?("://")
 
-            relative_path = link.match(/\((.*?)\)/).captures.last
-            base = base_url.split("://").last.gsub(%r{[^/]*$}, "")
+            relative_path = T.must(T.must(link.match(/\((.*?)\)/)).captures.last)
+            base = T.must(base_url.split("://").last).gsub(%r{[^/]*$}, "")
             path = File.join(base, relative_path)
             absolute_path =
               base_url.sub(
@@ -225,6 +260,7 @@ module Dependabot
           end
         end
 
+        sig { params(text: String, limit: Integer).returns(String) }
         def quote_and_truncate(text, limit: 50)
           lines = text.split("\n")
           lines.first(limit).tap do |limited_lines|
@@ -233,32 +269,37 @@ module Dependabot
           end.join
         end
 
+        sig { returns(String) }
         def truncated_line
           # Tables can spill out of truncated details, so we close them
           "></tr></table> \n ... (truncated)\n"
         end
 
+        sig { returns(String) }
         def break_tag
           source_provider_supports_html? ? "\n<br />" : "\n\n"
         end
 
+        sig { returns(T::Boolean) }
         def source_provider_supports_html?
           !%w(bitbucket codecommit).include?(source.provider)
         end
 
+        sig { params(text: String, unsafe: T::Boolean).returns(String) }
         def sanitize_links_and_mentions(text, unsafe: false)
           LinkAndMentionSanitizer
             .new(github_redirection_service: github_redirection_service)
             .sanitize_links_and_mentions(text: text, unsafe: unsafe, format_html: source_provider_supports_html?)
         end
 
+        sig { params(text: String).returns(String) }
         def sanitize_template_tags(text)
           text.gsub(/\<.*?\>/) do |tag|
-            tag_contents = tag.match(/\<(.*?)\>/).captures.first.strip
+            tag_contents = tag.match(/\<(.*?)\>/)&.captures&.first&.strip
 
             # Unclosed calls to template overflow out of the blockquote block,
             # wrecking the rest of our PRs. Other tags don't share this problem.
-            next "\\#{tag}" if tag_contents.start_with?("template")
+            next "\\#{tag}" if tag_contents&.start_with?("template")
 
             tag
           end