dependabot-common 0.385.0 → 0.387.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 58033d13e6a5c0bee14915505c98d752b8a6f2e26ffb96a4ba6d95ca66057bc3
-  data.tar.gz: 0a6c8eebbffb115434da53fbd171236690f1594a617f16fb4e29b1addfc81308
+  metadata.gz: 1af9eae7cb945bd312cf8a9fee63b2f4e42adcbc3d137208e2043b659052013d
+  data.tar.gz: f815b9a6961d5ecbd9c77ffdf296a9a048dbfadf21fae5ddebc4bbd8db6fbd2b
 SHA512:
-  metadata.gz: 5defea48ad000e82511496f0cb413945bf6ba2a5070361af5f1fa5e6411a11679a24de9e852c478f48fba3299d3678865e2faf97158c310ee429f6ac368fee5c
-  data.tar.gz: fcf737b08310353b51bc3b32a53f24546e8bf30aa58a9a0b9e91e025921728bdcba378da8b68f9dc592b1bec349ff487a5d21a2683ab1ad76fa1d8b748ca066b
+  metadata.gz: 34737076727da04d065d0163c93fe1058cfbb3a86d79d2cfef2be4cf126d2fd4d335e204087d3c337e2d97f5ec0220878a1110e139f553805c4d36574e33cb5d
+  data.tar.gz: 5885a478a01996a6f382b3c2bedb29ff59ca557c0316582f14e9136bd3881dac04d20874862bc76a93a16119653a85c868d3d08c65e8cabb9fff1ae257124323

data/lib/dependabot/dependency_graphers/base.rb

@@ -3,6 +3,8 @@
 
 require "sorbet-runtime"
 
+require "dependabot/dependency_file"
+
 module Dependabot
   module DependencyGraphers
     # This is a small value class that specifies the information we expect to be returned for each
@@ -20,6 +22,29 @@ module Dependabot
       const :dependencies, T::Array[String]
     end
 
+    # A manifest group is a subset of a directory's dependency files that stands on its own as a valid
+    # parser input, plus the single file that the group's dependencies should be attributed to.
+    #
+    # - `primary` is the attribution target (the file that owns the group's dependencies in the snapshot).
+    # - `files` is everything the parser needs to resolve the group, including the primary and any sibling
+    #   files pulled in only to satisfy cross-references.
+    #
+    # Most ecosystems have exactly one group per directory (a manifest + optional lockfile).
+    #
+    # Ecosystems where multiple independent manifests routinely share a directory override `manifest_groups`
+    # to return one group per independent manifest using ecosystem-specific rules (e.g. Python layered requirements)
+    class ManifestGroup < T::ImmutableStruct
+      const :primary, Dependabot::DependencyFile
+      const :files, T::Array[Dependabot::DependencyFile]
+    end
+
+    # The resolved output for a single manifest group: the file to attribute to, and the dependencies
+    # resolved from that group's files.
+    class ManifestGroupSnapshot < T::ImmutableStruct
+      const :manifest_file, Dependabot::DependencyFile
+      const :resolved_dependencies, T::Hash[String, ResolvedDependency]
+    end
+
     class Base
       extend T::Sig
       extend T::Helpers
@@ -78,8 +103,86 @@ module Dependabot
         end
       end
 
+      # Partitions the parsed directory into one or more manifest groups.
+      #
+      # The default is a single group spanning the whole directory, attributed to `relevant_dependency_file`.
+      #
+      # Ecosystems where multiple independent manifests share a directory should override this to return
+      # one group per manifest.
+      sig { overridable.returns(T::Array[ManifestGroup]) }
+      def manifest_groups
+        [ManifestGroup.new(primary: relevant_dependency_file, files: dependency_files)]
+      end
+
+      # Resolves each manifest group into a snapshot.
+      #
+      # When there is a single group, the common case for most ecosystems, we attribute all resolved dependencies
+      # to the group's primary without further work required.
+      #
+      # When there are multiple groups, we instantiate a new scoped grapher for the group's files and resolve each
+      # independently.
+      sig { returns(T::Array[ManifestGroupSnapshot]) }
+      def manifest_group_snapshots
+        @manifest_group_snapshots ||= T.let(
+          build_manifest_group_snapshots,
+          T.nilable(T::Array[ManifestGroupSnapshot])
+        )
+      end
+
       private
 
+      sig { returns(T::Array[ManifestGroupSnapshot]) }
+      def build_manifest_group_snapshots
+        groups = manifest_groups
+
+        if groups.one?
+          group = T.must(groups.first)
+          return [ManifestGroupSnapshot.new(
+            manifest_file: group.primary,
+            resolved_dependencies: resolved_dependencies
+          )]
+        end
+
+        groups.map do |group|
+          scoped = scoped_grapher(group.files)
+          snapshot = ManifestGroupSnapshot.new(
+            manifest_file: group.primary,
+            resolved_dependencies: scoped.resolved_dependencies
+          )
+          # Ensure we propagate any error flags from the scoped grapher.
+          absorb_error_state(scoped)
+          snapshot
+        end
+      end
+
+      # Propagates a scoped grapher's subdependency error state onto this grapher so callers can inspect the
+      # aggregate result of resolving every group.
+      sig { params(scoped: Dependabot::DependencyGraphers::Base).void }
+      def absorb_error_state(scoped)
+        return unless scoped.errored_fetching_subdependencies
+
+        errored_fetching_subdependencies!
+        # We keep the last subdependency error we see - the full error dialogue will be present in the logs,
+        # this just ensures job summary dialogues have something to show.
+        @subdependency_error = scoped.subdependency_error unless scoped.subdependency_error.nil?
+      end
+
+      # Builds a grapher of the same class scoped to a subset of the directory's files, reusing the current
+      # file parser's configuration. Used to resolve a single manifest group in isolation.
+      sig { params(files: T::Array[Dependabot::DependencyFile]).returns(Dependabot::DependencyGraphers::Base) }
+      def scoped_grapher(files)
+        scoped_parser = file_parser.class.new(
+          dependency_files: files,
+          source: file_parser.source,
+          repo_contents_path: file_parser.repo_contents_path,
+          credentials: file_parser.credentials,
+          reject_external_code: file_parser.reject_external_code?,
+          options: file_parser.options
+        )
+
+        self.class.new(file_parser: scoped_parser)
+      end
+
       sig { returns(Dependabot::FileParsers::Base) }
       attr_reader :file_parser
 

data/lib/dependabot/git_commit_checker/source_details.rb

@@ -0,0 +1,42 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+
+module Dependabot
+  class GitCommitChecker
+    # Typed view over the source hash attached to a git dependency.
+    class SourceDetails < T::ImmutableStruct
+      extend T::Sig
+
+      const :type, T.nilable(String)
+      const :url, T.nilable(String)
+      const :branch, T.nilable(String)
+      const :ref, T.nilable(String)
+
+      sig do
+        params(details: T::Hash[T.any(String, Symbol), Object]).returns(SourceDetails)
+      end
+      def self.from_hash(details)
+        new(
+          type: string_value(details, :type),
+          url: string_value(details, :url),
+          branch: string_value(details, :branch),
+          ref: string_value(details, :ref)
+        )
+      end
+
+      sig do
+        params(
+          details: T::Hash[T.any(String, Symbol), Object],
+          key: Symbol
+        ).returns(T.nilable(String))
+      end
+      def self.string_value(details, key)
+        value = details.key?(key) ? details[key] : details[key.to_s]
+        value.is_a?(String) ? value : nil
+      end
+      private_class_method :string_value
+    end
+  end
+end

data/lib/dependabot/git_commit_checker.rb

@@ -15,6 +15,7 @@ require "dependabot/source"
 require "dependabot/dependency"
 require "dependabot/credential"
 require "dependabot/git_metadata_fetcher"
+require "dependabot/git_commit_checker/source_details"
 require "dependabot/git_tag_details"
 require "dependabot/package/package_release"
 require "dependabot/package/release_cooldown_options"
@@ -46,7 +47,7 @@ module Dependabot
         ignored_versions: T::Array[String],
         raise_on_ignored: T::Boolean,
         consider_version_branches_pinned: T::Boolean,
-        dependency_source_details: T.nilable(T::Hash[Symbol, String])
+        dependency_source_details: T.nilable(T::Hash[Symbol, Object])
       )
         .void
     end
@@ -63,14 +64,15 @@ module Dependabot
       @ignored_versions = ignored_versions
       @raise_on_ignored = raise_on_ignored
       @consider_version_branches_pinned = consider_version_branches_pinned
-      @dependency_source_details = dependency_source_details
+      @dependency_source_details = T.let(
+        dependency_source_details && SourceDetails.from_hash(dependency_source_details),
+        T.nilable(SourceDetails)
+      )
     end
 
     sig { returns(T::Boolean) }
     def git_dependency?
-      return false if dependency_source_details.nil?
-
-      dependency_source_details&.fetch(:type) == "git"
+      dependency_source_details&.type == "git"
     end
 
     # rubocop:disable Metrics/PerceivedComplexity
@@ -78,7 +80,7 @@ module Dependabot
     def pinned?
       raise "Not a git dependency!" unless git_dependency?
 
-      branch = dependency_source_details&.fetch(:branch)
+      branch = dependency_source_details&.branch
 
       return false if ref.nil?
       return false if branch == ref
@@ -118,7 +120,7 @@ module Dependabot
     sig { returns(T::Array[GitRef]) }
     def tags
       GitMetadataFetcher.new(
-        url: dependency.source_details&.fetch(:url, nil),
+        url: T.must(source_details&.url),
         credentials: credentials
       ).tags
     end
@@ -128,7 +130,7 @@ module Dependabot
       T.must(
         T.let(
           GitMetadataFetcher.new(
-            url: dependency.source_details&.fetch(:url, nil),
+            url: T.must(source_details&.url),
             credentials: credentials
           ).ref_details_for_pinned_ref(ref),
           T.nilable(Excon::Response)
@@ -282,9 +284,12 @@ module Dependabot
       false
     end
 
-    sig { returns(T.nilable(T::Hash[T.any(Symbol, String), T.untyped])) }
+    sig { returns(T.nilable(SourceDetails)) }
     def dependency_source_details
-      @dependency_source_details || dependency.source_details(allowed_types: ["git"])
+      @dependency_source_details ||= begin
+        details = dependency.source_details(allowed_types: ["git"])
+        SourceDetails.from_hash(details) if details
+      end
     end
 
     sig { returns(T::Array[Dependabot::GitTagWithDetail]) }
@@ -333,7 +338,7 @@ module Dependabot
 
     sig { override.returns(T.nilable(String)) }
     def cooldown_source_url
-      dependency_source_details&.fetch(:url, nil)
+      dependency_source_details&.url
     end
 
     sig { override.returns(T::Array[Dependabot::Credential]) }
@@ -478,7 +483,7 @@ module Dependabot
 
     sig { params(tags: T::Array[Dependabot::GitRef]).returns(T::Array[Dependabot::GitRef]) }
     def handle_tag_prefix(tags)
-      if dependency_source_details&.fetch(:ref, nil)&.start_with?("tags/")
+      if dependency_source_details&.ref&.start_with?("tags/")
         tags = tags.map do |tag|
           tag.dup.tap { |t| t.name = "tags/#{tag.name}" }
         end
@@ -558,12 +563,12 @@ module Dependabot
 
     sig { returns(T.nilable(String)) }
     def ref_or_branch
-      ref || dependency_source_details&.fetch(:branch)
+      ref || dependency_source_details&.branch
     end
 
     sig { returns(T.nilable(String)) }
     def ref
-      dependency_source_details&.fetch(:ref)
+      dependency_source_details&.ref
     end
 
     sig { params(tag: String).returns(T::Boolean) }
@@ -667,7 +672,7 @@ module Dependabot
         begin
           tags = listing_repo_git_metadata_fetcher.tags
 
-          if dependency_source_details&.fetch(:ref, nil)&.start_with?("tags/")
+          if dependency_source_details&.ref&.start_with?("tags/")
             tags = tags.map do |tag|
               tag.dup.tap { |t| t.name = "tags/#{tag.name}" }
             end
@@ -695,7 +700,7 @@ module Dependabot
 
     sig { returns(T::Boolean) }
     def wants_prerelease?
-      return false unless dependency_source_details&.fetch(:ref, nil)
+      return false unless dependency_source_details&.ref
       return false unless pinned_ref_looks_like_version?
 
       version = version_from_ref(T.must(ref))
@@ -892,7 +897,7 @@ module Dependabot
       @local_repo_git_metadata_fetcher ||=
         T.let(
           GitMetadataFetcher.new(
-            url: dependency_source_details&.fetch(:url),
+            url: T.must(dependency_source_details&.url),
             credentials: credentials
           ),
           T.nilable(Dependabot::GitMetadataFetcher)
@@ -913,8 +918,14 @@ module Dependabot
 
     sig { returns(String) }
     def ref_pinned
-      dependency.source_details&.fetch(:ref, nil) ||
-        dependency.source_details&.fetch(:branch, nil) || "HEAD"
+      details = source_details
+      details&.ref || details&.branch || "HEAD"
+    end
+
+    sig { returns(T.nilable(SourceDetails)) }
+    def source_details
+      details = dependency.source_details
+      SourceDetails.from_hash(details) if details
     end
   end
   # rubocop:enable Metrics/ClassLength

data/lib/dependabot/git_metadata_fetcher.rb

@@ -147,12 +147,6 @@ module Dependabot
         raise "Unexpected response: #{response_with_git.status} - #{response_with_git.body}"
       end
 
-      if uri.match?(/github\.com/i)
-        response = response_with_git.data
-        response[:response_headers] = response[:headers] unless response.nil?
-        raise Octokit::Error.from_response(response)
-      end
-
       raise "Server error at #{uri}: #{response_with_git.body}" if response_with_git.status >= 500
 
       raise Dependabot::GitDependenciesNotReachable, [uri]
@@ -213,7 +207,7 @@ module Dependabot
       )
     end
 
-    sig { params(uri: String).returns(T.untyped) }
+    sig { params(uri: String).returns(GitResponse) }
     def fetch_raw_upload_pack_with_git_for(uri)
       service_pack_uri = uri
       service_pack_uri += ".git" unless service_pack_uri.end_with?(".git") || skip_git_suffix(uri)
@@ -329,7 +323,7 @@ module Dependabot
       T.must(line.split.first).chars.last(40).join
     end
 
-    sig { returns(T::Hash[Symbol, T.untyped]) }
+    sig { returns(T::Hash[Symbol, Object]) }
     def excon_defaults
       # Some git hosts are slow when returning a large number of tags
       SharedHelpers.excon_defaults(read_timeout: 20)
@@ -344,7 +338,7 @@ module Dependabot
 
     # Added method to fetch tags with their creation dates from a git repository. In case
     # private registry is used, it will clone the repository and fetch tags with their creation dates.
-    sig { params(uri: String).returns(T.untyped) }
+    sig { params(uri: String).returns(GitResponse) }
     def fetch_tags_with_detail_from_git_for(uri)
       uri_ending_with_git = uri
       uri_ending_with_git += ".git" unless uri_ending_with_git.end_with?(".git") || skip_git_suffix(uri)

data/lib/dependabot/pull_request_creator/branch_name_template.rb

@@ -0,0 +1,138 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+
+require "dependabot/errors"
+require "dependabot/pull_request_creator"
+
+module Dependabot
+  class PullRequestCreator
+    class BranchNameTemplate
+      extend T::Sig
+
+      class Error < Dependabot::DependabotError; end
+
+      SOLO_PLACEHOLDERS = T.let(
+        %w(prefix package_manager directory target_branch dependency version name).freeze,
+        T::Array[String]
+      )
+      GROUP_PLACEHOLDERS = T.let(
+        %w(prefix package_manager directory target_branch group_name name).freeze,
+        T::Array[String]
+      )
+      MULTI_ECO_PLACEHOLDERS = T.let(
+        %w(prefix target_branch group_name name).freeze,
+        T::Array[String]
+      )
+
+      # ---------------------------------------------------------------
+      # 1. validate_template(template, strategy:)
+      #    Ensures every {token} is allowed for the given strategy,
+      #    brackets are well-formed, and no forbidden placeholders used.
+      # ---------------------------------------------------------------
+      sig { params(template: String, strategy: Symbol).returns(T::Boolean) }
+      def self.validate_template(template, strategy:) # rubocop:disable Naming/PredicateMethod
+        raise Error, "Template must be a non-empty string." if template.empty?
+
+        allowed = allowed_placeholders(strategy)
+        messages = collect_template_errors(template, allowed, strategy)
+
+        raise Error, "#{messages.join("\n")}\nAllowed: #{allowed.map { |v| "{#{v}}" }.join(', ')}" if messages.any?
+
+        true
+      end
+
+      sig { params(strategy: Symbol).returns(T::Array[String]) }
+      def self.allowed_placeholders(strategy)
+        case strategy
+        when :solo then SOLO_PLACEHOLDERS
+        when :group then GROUP_PLACEHOLDERS
+        when :multi_ecosystem then MULTI_ECO_PLACEHOLDERS
+        else
+          raise Error, "Unknown strategy: #{strategy}"
+        end
+      end
+
+      sig { params(template: String, allowed: T::Array[String], strategy: Symbol).returns(T::Array[String]) }
+      def self.collect_template_errors(template, allowed, strategy)
+        used = template.scan(/\{(\w+)\}/).flatten
+        unknown = used.uniq.reject { |t| allowed.include?(t) }
+        unknown -= ["package_manager"] if strategy == :multi_ecosystem && used.include?("package_manager")
+        malformed = template.gsub(/\{\w+\}/, "").match?(/[{}]/)
+
+        messages = T.let([], T::Array[String])
+        messages << "Unknown placeholder(s): #{unknown.map { |v| "{#{v}}" }.join(', ')}" unless unknown.empty?
+        messages << "Malformed or unclosed braces detected." if malformed
+
+        if strategy == :multi_ecosystem && used.include?("package_manager")
+          messages << "{package_manager} is not available for multi-ecosystem groups (spans multiple ecosystems)."
+        end
+
+        messages
+      end
+
+      # ---------------------------------------------------------------
+      # 2. validate_ref_name(name)
+      #    Validates the final branch name against Git ref rules.
+      # ---------------------------------------------------------------
+      sig { params(name: String).returns(T::Boolean) }
+      def self.validate_ref_name(name) # rubocop:disable Naming/PredicateMethod
+        illegal = %r{
+          [\x00-\x1F\x7F\ ~^:?*\[\\] |
+          \.\.                         |
+          @\{                          |
+          //                           |
+          /\.                          |
+          \A/                          |
+          /\z                          |
+          \.lock\z                     |
+          \A-                          |
+          \.\z                         |
+          \A@\z
+        }x
+
+        raise Error, "Resolved branch name \"#{name}\" is not a valid Git ref." if name.match?(illegal)
+
+        true
+      end
+
+      # ---------------------------------------------------------------
+      # 3. render(template, vars, strategy:, digest: nil)
+      #    Full pipeline: validate template -> substitute -> append digest
+      #    -> validate ref.
+      # ---------------------------------------------------------------
+      sig do
+        params(
+          template: String,
+          vars: T::Hash[String, String],
+          strategy: Symbol,
+          digest: T.nilable(String)
+        ).returns(String)
+      end
+      def self.render(template, vars, strategy:, digest: nil)
+        validate_template(template, strategy: strategy)
+
+        # Substitute placeholders
+        name = template.gsub(/\{(\w+)\}/) do
+          key = T.must(Regexp.last_match(1))
+          raise Error, "Missing value for placeholder \"{#{key}}\"." unless vars.key?(key)
+
+          T.must(vars[key])
+        end
+
+        # Auto-append digest for Group/MultiEcosystem
+        name = "#{name}-#{digest}" if digest && strategy != :solo
+
+        # Collapse empty path segments (e.g. {target_branch} when nil) and strip edge slashes
+        name = name.squeeze("/").gsub(%r{\A/|/\z}, "")
+        raise Error, "Resolved branch name is empty." if name.empty?
+
+        # Validate git ref after all transformations
+        validate_ref_name(name)
+
+        name
+      end
+    end
+  end
+end

data/lib/dependabot/pull_request_creator/branch_namer/base.rb

@@ -4,6 +4,8 @@
 require "digest"
 require "sorbet-runtime"
 
+require "dependabot/pull_request_creator/branch_name_template"
+
 module Dependabot
   class PullRequestCreator
     class BranchNamer
@@ -28,6 +30,15 @@ module Dependabot
         sig { returns(T.nilable(Integer)) }
         attr_reader :max_length
 
+        sig { returns(T.nilable(String)) }
+        attr_reader :word_separator
+
+        sig { returns(T.nilable(String)) }
+        attr_reader :branch_name_case
+
+        sig { returns(T.nilable(String)) }
+        attr_reader :template
+
         sig do
           params(
             dependencies: T::Array[Dependency],
@@ -35,7 +46,10 @@ module Dependabot
             target_branch: T.nilable(String),
             separator: String,
             prefix: String,
-            max_length: T.nilable(Integer)
+            max_length: T.nilable(Integer),
+            word_separator: T.nilable(String),
+            branch_name_case: T.nilable(String),
+            template: T.nilable(String)
           )
             .void
         end
@@ -45,7 +59,10 @@ module Dependabot
           target_branch:,
           separator: "/",
           prefix: "dependabot",
-          max_length: nil
+          max_length: nil,
+          word_separator: nil,
+          branch_name_case: nil,
+          template: nil
         )
           @dependencies      = dependencies
           @files             = files
@@ -53,6 +70,9 @@ module Dependabot
           @separator         = separator
           @prefix            = prefix
           @max_length        = max_length
+          @word_separator    = word_separator
+          @branch_name_case  = branch_name_case
+          @template          = template
         end
 
         sig { overridable.returns(String) }
@@ -62,6 +82,25 @@ module Dependabot
 
         private
 
+        sig do
+          params(
+            vars: T::Hash[String, String],
+            strategy: Symbol,
+            digest: T.nilable(String)
+          ).returns(String)
+        end
+        def render_from_template(vars:, strategy:, digest: nil)
+          rendered = BranchNameTemplate.render(
+            T.must(template),
+            vars,
+            strategy: strategy,
+            digest: digest
+          )
+
+          # Apply post-processing (separator, word_separator, case) and max-length
+          sanitize_branch_name(rendered)
+        end
+
         sig { params(ref_name: String).returns(String) }
         def sanitize_branch_name(ref_name)
           # General git ref validation
@@ -70,6 +109,27 @@ module Dependabot
           # Some users need branch names without slashes
           sanitized_name = sanitized_name.gsub("/", separator)
 
+          # Apply word_separator and case transformation only to content after the prefix,
+          # preserving the user-configured prefix as-is.
+          if word_separator || branch_name_case
+            prefix_with_sep = "#{prefix}#{separator}"
+            prefix_part = sanitized_name.start_with?(prefix_with_sep) ? prefix_with_sep : ""
+            content = sanitized_name.delete_prefix(prefix_with_sep)
+
+            # Replace underscores with word_separator in the content after prefix
+            content = content.gsub("_", T.must(word_separator)) if word_separator
+
+            # Apply case transformation to content after prefix
+            case branch_name_case
+            when "lowercase"
+              content = content.downcase
+            when "uppercase"
+              content = content.upcase
+            end
+
+            sanitized_name = "#{prefix_part}#{content}"
+          end
+
           # Shorten the ref in case users refs have length limits
           branch_name_max_length = max_length
           if branch_name_max_length && (sanitized_name.length > branch_name_max_length)

data/lib/dependabot/pull_request_creator/branch_namer/dependency_group_strategy.rb

@@ -19,7 +19,10 @@ module Dependabot
             includes_security_fixes: T::Boolean,
             separator: String,
             prefix: String,
-            max_length: T.nilable(Integer)
+            max_length: T.nilable(Integer),
+            word_separator: T.nilable(String),
+            branch_name_case: T.nilable(String),
+            template: T.nilable(String)
           )
             .void
         end
@@ -31,7 +34,10 @@ module Dependabot
           includes_security_fixes:,
           separator: "/",
           prefix: "dependabot",
-          max_length: nil
+          max_length: nil,
+          word_separator: nil,
+          branch_name_case: nil,
+          template: nil
         )
           super(
             dependencies: dependencies,
@@ -40,6 +46,9 @@ module Dependabot
             separator: separator,
             prefix: prefix,
             max_length: max_length,
+            word_separator: word_separator,
+            branch_name_case: branch_name_case,
+            template: template,
           )
 
           @dependency_group = dependency_group
@@ -48,6 +57,14 @@ module Dependabot
 
         sig { override.returns(String) }
         def new_branch_name
+          if template
+            return render_from_template(
+              vars: template_vars,
+              strategy: :group,
+              digest: dependency_digest
+            )
+          end
+
           sanitize_branch_name(File.join(prefixes, group_name_with_dependency_digest))
         end
 
@@ -56,6 +73,24 @@ module Dependabot
         sig { returns(Dependabot::DependencyGroup) }
         attr_reader :dependency_group
 
+        sig { returns(T::Hash[String, String]) }
+        def template_vars
+          directory_part = (directory || "/").sub(%r{^/}, "")
+          directory_part = "root" if directory_part.empty?
+
+          group_name = sanitize_ref(dependency_group.name.tr(" ", "-"))
+
+          vars = {
+            "prefix" => prefix,
+            "package_manager" => package_manager,
+            "directory" => directory_part,
+            "group_name" => group_name,
+            "name" => group_name,
+            "target_branch" => target_branch || ""
+          }
+          vars
+        end
+
         sig { returns(T::Array[String]) }
         def prefixes
           [

data/lib/dependabot/pull_request_creator/branch_namer/multi_ecosystem_strategy.rb

@@ -19,7 +19,10 @@ module Dependabot
             multi_ecosystem_name: String,
             separator: String,
             prefix: String,
-            max_length: T.nilable(Integer)
+            max_length: T.nilable(Integer),
+            word_separator: T.nilable(String),
+            branch_name_case: T.nilable(String),
+            template: T.nilable(String)
           )
             .void
         end
@@ -31,7 +34,10 @@ module Dependabot
           multi_ecosystem_name:,
           separator: "/",
           prefix: "dependabot",
-          max_length: nil
+          max_length: nil,
+          word_separator: nil,
+          branch_name_case: nil,
+          template: nil
         )
           super(
             dependencies: dependencies,
@@ -40,6 +46,9 @@ module Dependabot
             separator: separator,
             prefix: prefix,
             max_length: max_length,
+            word_separator: word_separator,
+            branch_name_case: branch_name_case,
+            template: template,
           )
 
           @multi_ecosystem_name = multi_ecosystem_name
@@ -48,6 +57,14 @@ module Dependabot
 
         sig { override.returns(String) }
         def new_branch_name
+          if template
+            return render_from_template(
+              vars: template_vars,
+              strategy: :multi_ecosystem,
+              digest: dependency_digest
+            )
+          end
+
           sanitize_branch_name(File.join(prefixes, group_name_with_dependency_digest))
         end
 
@@ -56,6 +73,19 @@ module Dependabot
         sig { returns(String) }
         attr_reader :multi_ecosystem_name
 
+        sig { returns(T::Hash[String, String]) }
+        def template_vars
+          multi_name = sanitize_ref(multi_ecosystem_name.tr(" ", "-"))
+
+          vars = {
+            "prefix" => prefix,
+            "group_name" => multi_name,
+            "name" => multi_name,
+            "target_branch" => target_branch || ""
+          }
+          vars
+        end
+
         sig { returns(T::Array[String]) }
         def prefixes
           [

data/lib/dependabot/pull_request_creator/branch_namer/solo_strategy.rb

@@ -15,26 +15,18 @@ module Dependabot
 
         sig { override.returns(String) }
         def new_branch_name
+          if template
+            return render_from_template(
+              vars: template_vars,
+              strategy: :solo
+            )
+          end
+
           return short_branch_name if branch_name_might_be_long?
 
           @name ||=
             T.let(
-              begin
-                dependency_name_part =
-                  if dependencies.count > 1 && updating_a_property?
-                    property_name
-                  elsif dependencies.count > 1 && updating_a_dependency_set?
-                    dependency_set.fetch(:group)
-                  else
-                    dependencies
-                      .map(&:name)
-                      .join("-and-")
-                      .tr(":[]", "-")
-                      .tr("@", "")
-                  end
-
-                "#{dependency_name_part}-#{branch_version_suffix}"
-              end,
+              "#{template_dependency_name}-#{branch_version_suffix}",
               T.nilable(String)
             )
 
@@ -53,6 +45,40 @@ module Dependabot
           ].compact
         end
 
+        sig { returns(T::Hash[String, String]) }
+        def template_vars
+          dep_name = template_dependency_name
+          version = branch_version_suffix || ""
+
+          vars = {
+            "prefix" => prefix,
+            "package_manager" => package_manager,
+            "directory" => sanitized_directory,
+            "dependency" => dep_name,
+            "version" => version,
+            "name" => "#{dep_name}-#{version}",
+            "target_branch" => target_branch || ""
+          }
+          vars
+        end
+
+        sig { returns(String) }
+        def template_dependency_name
+          if dependencies.count > 1 && updating_a_property?
+            property_name
+          elsif dependencies.count > 1 && updating_a_dependency_set?
+            dependency_set.fetch(:group)
+          else
+            dependencies.map(&:name).join("-and-").tr(":[]", "-").tr("@", "")
+          end
+        end
+
+        sig { returns(String) }
+        def sanitized_directory
+          dir = (files.first&.directory&.tr(" ", "-") || "/").sub(%r{^/}, "")
+          dir.empty? ? "root" : dir
+        end
+
         sig { returns(String) }
         def package_manager
           T.must(dependencies.first).package_manager

data/lib/dependabot/pull_request_creator/branch_namer.rb

@@ -9,6 +9,7 @@ require "dependabot/pull_request_creator"
 require "dependabot/pull_request_creator/branch_namer/solo_strategy"
 require "dependabot/pull_request_creator/branch_namer/dependency_group_strategy"
 require "dependabot/pull_request_creator/branch_namer/multi_ecosystem_strategy"
+require "dependabot/pull_request_creator/branch_name_template"
 
 module Dependabot
   class PullRequestCreator
@@ -33,6 +34,15 @@ module Dependabot
       sig { returns(T.nilable(Integer)) }
       attr_reader :max_length
 
+      sig { returns(T.nilable(String)) }
+      attr_reader :word_separator
+
+      sig { returns(T.nilable(String)) }
+      attr_reader :branch_name_case
+
+      sig { returns(T.nilable(String)) }
+      attr_reader :template
+
       sig { returns(T.nilable(Dependabot::DependencyGroup)) }
       attr_reader :dependency_group
 
@@ -51,6 +61,9 @@ module Dependabot
           separator: String,
           prefix: String,
           max_length: T.nilable(Integer),
+          word_separator: T.nilable(String),
+          branch_name_case: T.nilable(String),
+          template: T.nilable(String),
           includes_security_fixes: T::Boolean,
           multi_ecosystem_name: T.nilable(String)
         )
@@ -64,6 +77,9 @@ module Dependabot
         separator: "/",
         prefix: "dependabot",
         max_length: nil,
+        word_separator: nil,
+        branch_name_case: nil,
+        template: nil,
         includes_security_fixes: false,
         multi_ecosystem_name: nil
       )
@@ -74,6 +90,9 @@ module Dependabot
         @separator     = separator
         @prefix        = prefix
         @max_length    = max_length
+        @word_separator = word_separator
+        @branch_name_case = branch_name_case
+        @template = template
         @includes_security_fixes = includes_security_fixes
         @multi_ecosystem_name = multi_ecosystem_name
       end
@@ -109,6 +128,9 @@ module Dependabot
           separator: separator,
           prefix: prefix,
           max_length: max_length,
+          word_separator: word_separator,
+          branch_name_case: branch_name_case,
+          template: template,
           multi_ecosystem_name: T.must(multi_ecosystem_name)
         )
       end
@@ -121,7 +143,10 @@ module Dependabot
           target_branch: target_branch,
           separator: separator,
           prefix: prefix,
-          max_length: max_length
+          max_length: max_length,
+          word_separator: word_separator,
+          branch_name_case: branch_name_case,
+          template: template
         )
       end
 
@@ -135,7 +160,10 @@ module Dependabot
           includes_security_fixes: includes_security_fixes,
           separator: separator,
           prefix: prefix,
-          max_length: max_length
+          max_length: max_length,
+          word_separator: word_separator,
+          branch_name_case: branch_name_case,
+          template: template
         )
       end
     end

data/lib/dependabot/pull_request_creator.rb

@@ -126,6 +126,15 @@ module Dependabot
     sig { returns(T.nilable(Integer)) }
     attr_reader :branch_name_max_length
 
+    sig { returns(T.nilable(String)) }
+    attr_reader :branch_name_word_separator
+
+    sig { returns(T.nilable(String)) }
+    attr_reader :branch_name_case
+
+    sig { returns(T.nilable(String)) }
+    attr_reader :branch_name_template
+
     sig { returns(String) }
     attr_reader :github_redirection_service
 
@@ -144,7 +153,7 @@ module Dependabot
     sig { returns(T.nilable(Encoding)) }
     attr_reader :pr_message_encoding
 
-    sig do
+    sig do # rubocop:disable Metrics/BlockLength
       params(
         source: Dependabot::Source,
         base_commit: String,
@@ -164,6 +173,9 @@ module Dependabot
         branch_name_separator: String,
         branch_name_prefix: String,
         branch_name_max_length: T.nilable(Integer),
+        branch_name_word_separator: T.nilable(String),
+        branch_name_case: T.nilable(String),
+        branch_name_template: T.nilable(String),
         label_language: T::Boolean,
         automerge_candidate: T::Boolean,
         github_redirection_service: String,
@@ -198,6 +210,9 @@ module Dependabot
       branch_name_separator: "/",
       branch_name_prefix: "dependabot",
       branch_name_max_length: 100,
+      branch_name_word_separator: nil,
+      branch_name_case: nil,
+      branch_name_template: nil,
       label_language: false,
       automerge_candidate: false,
       github_redirection_service: DEFAULT_GITHUB_REDIRECTION_SERVICE,
@@ -227,6 +242,9 @@ module Dependabot
       @branch_name_separator      = branch_name_separator
       @branch_name_prefix         = branch_name_prefix
       @branch_name_max_length     = branch_name_max_length
+      @branch_name_word_separator = branch_name_word_separator
+      @branch_name_case = branch_name_case
+      @branch_name_template = branch_name_template
       @label_language             = label_language
       @automerge_candidate        = automerge_candidate
       @github_redirection_service = github_redirection_service
@@ -420,6 +438,9 @@ module Dependabot
           separator: branch_name_separator,
           prefix: branch_name_prefix,
           max_length: branch_name_max_length,
+          word_separator: branch_name_word_separator,
+          branch_name_case: branch_name_case,
+          template: branch_name_template,
           includes_security_fixes: includes_security_fixes?
         ),
         T.nilable(Dependabot::PullRequestCreator::BranchNamer)

data/lib/dependabot/source.rb

@@ -126,16 +126,36 @@ module Dependabot
       )
     end
 
+    @github_enterprise_cache = T.let({}, T::Hash[String, T::Boolean])
+
+    sig { void }
+    def self.reset_github_enterprise_cache!
+      @github_enterprise_cache.clear
+    end
+
     sig { params(base_url: String).returns(T::Boolean) }
     def self.github_enterprise?(base_url)
+      return T.must(@github_enterprise_cache[base_url]) if @github_enterprise_cache.key?(base_url)
+
+      result = detect_github_enterprise(base_url)
+      @github_enterprise_cache[base_url] = result unless result.nil?
+      result || false
+    end
+
+    sig { params(base_url: String).returns(T.nilable(T::Boolean)) }
+    def self.detect_github_enterprise(base_url)
       resp = Excon.get(File.join(base_url, "status"))
-      resp.status == 200 &&
-        # Alternatively: resp.headers["Server"] == "GitHub.com", but this
-        # currently doesn't work with development environments
-        ((resp.headers["X-GitHub-Request-Id"] && !resp.headers["X-GitHub-Request-Id"]&.empty?) || false)
+      return false if resp.status == 404
+
+      return unless resp.status == 200
+
+      # Alternatively: resp.headers["Server"] == "GitHub.com", but this
+      # currently doesn't work with development environments
+      (resp.headers["X-GitHub-Request-Id"] && !resp.headers["X-GitHub-Request-Id"]&.empty?) || false
     rescue StandardError
-      false
+      nil
     end
+    private_class_method :detect_github_enterprise
 
     sig do
       params(

data/lib/dependabot.rb

@@ -2,5 +2,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.385.0"
+  VERSION = "0.387.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.385.0
+  version: 0.387.0
 platform: ruby
 authors:
 - Dependabot
@@ -552,6 +552,7 @@ files:
 - lib/dependabot/file_updaters/base.rb
 - lib/dependabot/file_updaters/vendor_updater.rb
 - lib/dependabot/git_commit_checker.rb
+- lib/dependabot/git_commit_checker/source_details.rb
 - lib/dependabot/git_cooldown_date_resolver.rb
 - lib/dependabot/git_metadata_fetcher.rb
 - lib/dependabot/git_ref.rb
@@ -574,6 +575,7 @@ files:
 - lib/dependabot/pull_request_creator.rb
 - lib/dependabot/pull_request_creator/azure.rb
 - lib/dependabot/pull_request_creator/bitbucket.rb
+- lib/dependabot/pull_request_creator/branch_name_template.rb
 - lib/dependabot/pull_request_creator/branch_namer.rb
 - lib/dependabot/pull_request_creator/branch_namer/base.rb
 - lib/dependabot/pull_request_creator/branch_namer/dependency_group_strategy.rb
@@ -621,7 +623,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.385.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.387.0
 rdoc_options: []
 require_paths:
 - lib