dependabot-common 0.335.0 → 0.336.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ca29ec928a5e569aa377708755f29f998ca87ddb68ed2722a5171386427e3f87
-  data.tar.gz: 206f507ef450d40f3a002187a7890dc5b5abc88c7d8df5e53a87a27a14aa9f71
+  metadata.gz: 6874d956be44fe350f122548152a4b6c294111a1cd0b79526836d76eabf4e4d1
+  data.tar.gz: 71fed0ab9fd538efed8d22c499b7f3ba136cb861c8d734f1e3a8e8faa5e0944a
 SHA512:
-  metadata.gz: 3a3baf81472a1b7528fb6f95f9c5ed76f79186fd4aa442e073b2f0bc60e676186f592ab16a18f1f6bb747e652e522d0f1af2a7ac077a3dbce0d89001c001fc93
-  data.tar.gz: 26a4aaa04570ec094267b7e2739a394fe4d279807ad03453ac6cec8c766d18cb3b13e73665923cf8e58ca64ab6fad7b8b8a20656a0feaa93b80bcdaed6119503
+  metadata.gz: 4fe1b1678e71b8ba9c53afecc2645718bed248166c4c522a1fbf57ea9071458225f832983360d3d75bace9bf958b941b50530faee228bc0697417593616877b2
+  data.tar.gz: 733d2e22f20673cc0ce3aa9cbf75f882aac2d939f1cb2586543d9c775794a1b5c3234acbaed3b0efa1cfccd5266fd9c08c37b23603df2d7656d026655a2f831c

data/lib/dependabot/dependency_graphers/README.md

@@ -2,7 +2,7 @@
 
 Dependency graphers are used to convert a set of parsed dependencies into a data structure we can use to output the dependency graph of a project in a generic data structure based on GitHub's [Dependency submission API](https://docs.github.com/en/rest/dependency-graph/dependency-submission).
 
-We will expect each language Dependabot supports to implement a `Dependabot::DependencyGraphers` class in future, but for now any modules that do not implement a specific class fail over to a 'best effort' generic implementation that works in most cases.
+We will expect each language Dependabot supports to implement a `Dependabot::DependencyGraphers` class in future, but for now any modules that do not implement a specific class fail over to a 'best effort' generic implementation.
 
 ## Public API
 
@@ -39,9 +39,9 @@ An example of a `.resolved_dependencies` hash for a Bundler project:
 }
 ```
 
-## Writing a file fetcher for a new language
+## Writing a dependency grapher for a new language
 
-All new file fetchers should inherit from `Dependabot::DependencyGraphers::Base` and
+All new dependency graphers should inherit from `Dependabot::DependencyGraphers::Base` and
 implement the following methods:
 
 | Method                           | Description                                                                                   |
@@ -52,3 +52,10 @@ implement the following methods:
 
 > [!WARNING]
 > While PURLs are preferred in all languages for `.fetch_subdependencies`, for languages where multiple versions of a single dependency are permitted they _must_ be provided to be precise.
+
+## Overriding file parser behaviour
+
+In most cases, an ecosystem's file parser should provide us the dependency data we need to build the graph, but in some cases we may need to tweak this behaviour or experiment with alternative parsing strategies.
+
+The `Dependabot::DependencyGraphers::Base` class provides the `prepare!` method as the hook that is called to generate the dependency list - if required this method can be redefined for a specific ecosystem to make
+additional or alternative calls.

data/lib/dependabot/dependency_graphers/base.rb

@@ -13,23 +13,16 @@ module Dependabot
 
       abstract!
 
-      # TODO(brrygrdn): Inject the Dependency parser instead of pre-parsed `dependencies`
-      #
-      # Semantically it makes sense for the grapher to wrap the parser as a higher order function, but we already know
-      # that some package managers will require extra native commands before, after or during the parse - in extreme
-      # cases it may make sense to use an alternative parser that is more optimal.
-      #
-      # By injecting the parser, this allows the ecosystem to encapsulate the package manager specifics without the
-      # executor needing to manage parser modes / feature flags.
+      sig { returns(T::Boolean) }
+      attr_reader :prepared
+
       sig do
-        params(
-          dependency_files: T::Array[Dependabot::DependencyFile],
-          dependencies: T::Array[Dependabot::Dependency]
-        ).void
+        params(file_parser: Dependabot::FileParsers::Base).void
       end
-      def initialize(dependency_files:, dependencies:)
-        @dependency_files = dependency_files
-        @dependencies = dependencies
+      def initialize(file_parser:)
+        @file_parser = file_parser
+        @dependencies = T.let([], T::Array[Dependabot::Dependency])
+        @prepared = T.let(false, T::Boolean)
       end
 
       # Each grapher must implement a heuristic to determine which dependency file should be used as the owner
@@ -40,8 +33,18 @@ module Dependabot
       sig { abstract.returns(Dependabot::DependencyFile) }
       def relevant_dependency_file; end
 
-      sig { returns(T::Hash[Symbol, T.untyped]) }
+      # A grapher may override this method if it needs to perform extra steps around the normal file parser for
+      # the ecosystem.
+      sig { void }
+      def prepare!
+        @dependencies = @file_parser.parse
+        @prepared = true
+      end
+
+      sig { returns(T::Hash[String, T.untyped]) }
       def resolved_dependencies
+        prepare! unless prepared
+
         @dependencies.each_with_object({}) do |dep, resolved|
           resolved[dep.name] = {
             package_url: build_purl(dep),
@@ -55,6 +58,14 @@ module Dependabot
 
       private
 
+      sig { returns(Dependabot::FileParsers::Base) }
+      attr_reader :file_parser
+
+      sig { returns(T::Array[Dependabot::DependencyFile]) }
+      def dependency_files
+        file_parser.dependency_files
+      end
+
       # Each grapher is expected to implement a method to look up the parents of a given dependency.
       #
       # The strategy that should be used is highly dependent on the ecosystem, in some cases the parser

data/lib/dependabot/dependency_graphers/generic.rb

@@ -25,7 +25,7 @@ module Dependabot
 
       sig { returns(T::Array[Dependabot::DependencyFile]) }
       def filtered_dependency_files
-        @dependency_files.reject { |f| f.support_file? || f.vendored_file? }
+        dependency_files.reject { |f| f.support_file? || f.vendored_file? }
       end
 
       # Our generic strategy is to check if the parser has attached a `depends_on` key to the Dependency's

data/lib/dependabot.rb

@@ -2,5 +2,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.335.0"
+  VERSION = "0.336.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.335.0
+  version: 0.336.0
 platform: ruby
 authors:
 - Dependabot
@@ -630,7 +630,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.335.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.336.0
 rdoc_options: []
 require_paths:
 - lib