dependabot-common 0.372.0 → 0.373.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a890da786457822a31a7563f2058398af0e298c0384fe03ceeb5dd31fd84c27e
-  data.tar.gz: abfa2448c83eb522633c9f00cbea0b1e5de7dd45f1b57cf73b809a028b2d84ca
+  metadata.gz: 3813dcd4d0293e11d9da8b1425d9c800f4c94552e38bf8765d912b51b7c2643c
+  data.tar.gz: bb7a4005a51cbb9ecb432a1cd25c67f664cea48dad9f900de65de30f99d9dbcd
 SHA512:
-  metadata.gz: 23f77646a6156b56c94384f247e0a225c03b6162c0cfba440d1db475d42a124c1a315b38c4048ff0d2bebcd22e59390594ba3ab6aef6e8ca8138254930603ef9
-  data.tar.gz: 81707b4c04b6c45eab98ae9228e89a62182a5d32df91008b74364977a129eb83ddc35b5feda25ca177c8179ad9d00baf6f56f3ce4bb80832e39cd558def86c8b
+  metadata.gz: 3cb91b2676a6722670b020f805de186af35e79f73640771927070b103549a74b40fc3696890a4062b5a0045e9ad3f4ab43ddff89a46357f0113b2bd8861f4935
+  data.tar.gz: d70c62d66ea75085d88834d51d01504c412e6cd4676aba9c05e779d031ca916e614acacf021f9d71e593c7f976748096878d8aa00aa1c5a9b885c6da9165d1f4

data/lib/dependabot/command_helpers.rb

@@ -23,6 +23,13 @@ module Dependabot
       T.nilable(T.proc.params(data: String).returns(T::Hash[Symbol, T.untyped]))
     end
 
+    EnvCmdItem = T.type_alias do
+      T.any(
+        String,
+        T::Hash[T.any(String, Symbol), T.untyped]
+      )
+    end
+
     class ProcessStatus
       extend T::Sig
 
@@ -72,7 +79,7 @@ module Dependabot
     # rubocop:disable Metrics/CyclomaticComplexity
     sig do
       params(
-        env_cmd: T::Array[T.any(T::Hash[String, String], String)],
+        env_cmd: T::Array[EnvCmdItem],
         stdin_data: T.nilable(String),
         stderr_to_stdout: T::Boolean,
         timeout: Integer,
@@ -95,12 +102,15 @@ module Dependabot
       begin
         T.unsafe(Open3).popen3(*env_cmd) do |stdin, stdout_io, stderr_io, wait_thr| # rubocop:disable Metrics/BlockLength
           pid = wait_thr.pid
+          command_string = command_string_for_logging(env_cmd)
+          log_level = short_git_config_command?(command_string) ? :debug : :info
           sanitized_env_cmd = if env_cmd.first.is_a?(Hash)
                                 [SharedHelpers.send(:sanitize_env_for_logging, env_cmd.first), *env_cmd[1..]]
                               else
                                 env_cmd
                               end
-          Dependabot.logger.info("Started process PID: #{pid} with command: #{sanitized_env_cmd.join(' ')}")
+          command_for_log = sanitized_env_cmd.join(" ")
+          Dependabot.logger.public_send(log_level, "Started process PID: #{pid} with command: #{command_for_log}")
 
           # Write to stdin if input data is provided
           begin
@@ -179,7 +189,7 @@ module Dependabot
           end
 
           status = ProcessStatus.new(wait_thr.value)
-          Dependabot.logger.info("Process PID: #{pid} completed with status: #{status}")
+          Dependabot.logger.public_send(log_level, "Process PID: #{pid} completed with status: #{status}")
         end
       rescue Timeout::Error => e
         Dependabot.logger.error("Process PID: #{pid} failed due to timeout: #{e.message}")
@@ -195,7 +205,8 @@ module Dependabot
       end
 
       elapsed_time = Time.now - start_time
-      Dependabot.logger.info("Total execution time: #{elapsed_time.round(2)} seconds")
+      log_level = short_git_config_command?(command_string_for_logging(env_cmd)) ? :debug : :info
+      Dependabot.logger.public_send(log_level, "Total execution time: #{elapsed_time.round(2)} seconds")
       [stdout, stderr, status, elapsed_time]
     end
     # rubocop:enable Metrics/AbcSize
@@ -249,5 +260,19 @@ module Dependabot
       command_parts = command.split.map(&:strip).reject(&:empty?)
       Shellwords.join(command_parts)
     end
+
+    sig { params(env_cmd: T::Array[EnvCmdItem]).returns(T.nilable(String)) }
+    def self.command_string_for_logging(env_cmd)
+      T.cast(env_cmd.find { |item| item.is_a?(String) }, T.nilable(String))
+    end
+    private_class_method :command_string_for_logging
+
+    sig { params(command: T.nilable(String)).returns(T::Boolean) }
+    def self.short_git_config_command?(command)
+      return false if command.nil?
+
+      command.start_with?("git config --global ")
+    end
+    private_class_method :short_git_config_command?
   end
 end

data/lib/dependabot/config/file.rb

@@ -87,6 +87,7 @@ module Dependabot
           "pre-commit" => "pre_commit",
           "pub" => "pub",
           "rust-toolchain" => "rust_toolchain",
+          "sbt" => "sbt",
           "swift" => "swift",
           "terraform" => "terraform",
           "uv" => "uv",

data/lib/dependabot/dependency_graphers/base.rb

@@ -100,18 +100,37 @@ module Dependabot
 
       sig { params(dependency: Dependabot::Dependency).returns(T::Array[Dependabot::Dependency]) }
       def safe_fetch_subdependencies(dependency)
-        return [] if @errored_fetching_subdependencies
+        return [] if errored_fetching_subdependencies
 
         fetch_subdependencies(dependency).filter_map do |dependency_name|
           dependencies_by_name[dependency_name]
         end
       rescue StandardError => e
-        @errored_fetching_subdependencies = true
+        errored_fetching_subdependencies!
         @subdependency_error = T.let(e, T.nilable(StandardError))
         Dependabot.logger.error("Error fetching subdependencies: #{e.message}")
         []
       end
 
+      # TODO(brrygrdn): Replace this with a `degraded` flag and a `reason` string/enum
+      #
+      # Nearly all failure modes we have so far amount to 'we couldn't get the full tree for some reason' which is
+      # semantically the same as failing to fetch subdependencies, but it is elides some specific information we
+      # could use to improve user-facing errors in future, e.g.
+      # - Auth failure doing a necessary operation; fix your auth please
+      # - Auth failure generating an ephemeral lockfile; fix your auth -or- check in your lockfile
+      #
+      # The reason this isn't precise enough is that in some ecosystems, the degradation from an ephemeral lockfile
+      # goes further and we cannot actually tell versions of top-level dependencies either.
+      #
+      # To reflect this properly as we expand our ecosystems, setting a generic degraded flag along with user
+      # guidance from the ecosystem-specific implementation will allow us to be clearer on remediation in UIs
+      # in addition to the job logs.
+      sig { void }
+      def errored_fetching_subdependencies!
+        @errored_fetching_subdependencies = true
+      end
+
       # Each grapher is expected to implement a method to look up the parents of a given dependency.
       #
       # The strategy that should be used is highly dependent on the ecosystem, in some cases the parser

data/lib/dependabot/file_fetchers/base.rb

@@ -196,7 +196,8 @@ module Dependabot
 
       sig { returns(T.nilable(String)) }
       def commit
-        return T.must(cloned_commit) if cloned_commit
+        resolved_cloned_commit = cloned_commit
+        return resolved_cloned_commit if resolved_cloned_commit
         return T.must(source.commit) if source.commit
 
         branch = target_branch || default_branch_for_repo

data/lib/dependabot/pull_request_creator/message_builder.rb

@@ -214,6 +214,7 @@ module Dependabot
       sig { returns(String) }
       def solo_pr_name
         name = library? ? library_pr_name : application_pr_name
+        name += " (via audit fix)" if dependencies.any? { |dep| dep.metadata[:audit_fix_used] }
         "#{name}#{pr_name_directory}"
       end
 

data/lib/dependabot/pull_request_creator/pr_name_prefixer.rb

@@ -200,10 +200,12 @@ module Dependabot
         return unless (msg = last_dependabot_commit_title)
 
         return :gitmoji if msg.start_with?("⬆️")
-        return :conventional_prefix if msg.match?(/\A(chore|build|upgrade):/i)
-        return unless msg.match?(/\A(chore|build|upgrade)\(/i)
 
-        :conventional_prefix_with_scope
+        prefixes = (ANGULAR_PREFIXES + ESLINT_PREFIXES).uniq(&:downcase).join("|")
+        return :conventional_prefix if msg.match?(/\A(#{prefixes}):/i)
+        return :conventional_prefix_with_scope if msg.match?(/\A(#{prefixes})\(/i)
+
+        nil
       end
 
       sig { returns(T.nilable(String)) }

data/lib/dependabot.rb

@@ -2,5 +2,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.372.0"
+  VERSION = "0.373.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.372.0
+  version: 0.373.0
 platform: ruby
 authors:
 - Dependabot
@@ -617,7 +617,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.372.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.373.0
 rdoc_options: []
 require_paths:
 - lib