dependabot-common 0.391.0 → 0.393.0

data/lib/dependabot/command_helpers.rb

@@ -1,7 +1,6 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
-require "open3"
 require "timeout"
 require "sorbet-runtime"
 require "shellwords"
@@ -23,10 +22,15 @@ module Dependabot
       T.nilable(T.proc.params(data: String).returns(T::Hash[Symbol, T.anything]))
     end
 
+    Environment = T.type_alias { T::Hash[String, String] }
+    SpawnOptions = T.type_alias { T::Hash[Symbol, T.anything] }
+
     EnvCmdItem = T.type_alias do
       T.any(
         String,
-        T::Hash[T.any(String, Symbol), T.anything]
+        T::Array[String],
+        Environment,
+        SpawnOptions
       )
     end
 
@@ -100,25 +104,31 @@ module Dependabot
       start_time = Time.now
 
       begin
-        T.unsafe(Open3).popen3(*env_cmd) do |stdin, stdout_io, stderr_io, wait_thr| # rubocop:disable Metrics/BlockLength
+        stdout_io, stderr_io, wait_thr = open_process(env_cmd)
+        begin
           pid = wait_thr.pid
           command_string = command_string_for_logging(env_cmd)
           log_level = short_git_config_command?(command_string) ? :debug : :info
-          sanitized_env_cmd = if env_cmd.first.is_a?(Hash)
-                                [SharedHelpers.send(:sanitize_env_for_logging, env_cmd.first), *env_cmd[1..]]
-                              else
-                                env_cmd
-                              end
-          command_for_log = sanitized_env_cmd.join(" ")
+          first_item = env_cmd.first
+          sanitized_env_cmd = T.let(
+            if first_item.is_a?(Hash)
+              environment = extract_environment(env_cmd.dup)
+              [T.must(SharedHelpers.sanitize_env_for_logging(environment)), *env_cmd.drop(1)]
+            else
+              env_cmd
+            end,
+            T::Array[EnvCmdItem]
+          )
+          command_for_log = sanitized_env_cmd.map { |item| item.is_a?(Array) ? item.first : item }.join(" ")
           Dependabot.logger.public_send(log_level, "Started process PID: #{pid} with command: #{command_for_log}")
 
           # Write to stdin if input data is provided
           begin
-            stdin&.write(stdin_data) if stdin_data
+            stdout_io.write(stdin_data) if stdin_data
           rescue Errno::EPIPE
             # Process exited before reading stdin - continue to collect output
           end
-          stdin&.close
+          stdout_io.close_write
 
           stdout_io.sync = true
           stderr_io.sync = true
@@ -190,6 +200,10 @@ module Dependabot
 
           status = ProcessStatus.new(wait_thr.value)
           Dependabot.logger.public_send(log_level, "Process PID: #{pid} completed with status: #{status}")
+        ensure
+          stdout_io.close unless stdout_io.closed?
+          stderr_io.close unless stderr_io.closed?
+          wait_thr.join
         end
       rescue Timeout::Error => e
         Dependabot.logger.error("Process PID: #{pid} failed due to timeout: #{e.message}")
@@ -214,6 +228,61 @@ module Dependabot
     # rubocop:enable Metrics/PerceivedComplexity
     # rubocop:enable Metrics/CyclomaticComplexity
 
+    sig { params(env_cmd: T::Array[EnvCmdItem]).returns([IO, IO, Process::Waiter]) }
+    def self.open_process(env_cmd)
+      process_io = T.let(nil, T.nilable(IO))
+      stderr_io = T.let(nil, T.nilable(IO))
+      stderr_writer = T.let(nil, T.nilable(IO))
+      arguments = env_cmd.dup
+      environment = extract_environment(arguments)
+      options = extract_options(arguments)
+      command = command_for_popen(arguments)
+
+      stderr_io, stderr_writer = IO.pipe
+      options[:err] = stderr_writer
+      process_io = T.cast(IO.popen(environment, command, "r+", options), IO)
+      stderr_writer.close
+
+      wait_thread = T.cast(Process.detach(process_io.pid), Process::Waiter)
+      [process_io, stderr_io, wait_thread]
+    rescue StandardError
+      process_io.close if process_io && !process_io.closed?
+      stderr_io.close if stderr_io && !stderr_io.closed?
+      stderr_writer.close if stderr_writer && !stderr_writer.closed?
+      raise
+    end
+    private_class_method :open_process
+
+    sig { params(arguments: T::Array[EnvCmdItem]).returns(Environment) }
+    def self.extract_environment(arguments)
+      return {} unless arguments.first.is_a?(Hash)
+
+      T.cast(arguments.shift, Environment)
+    end
+    private_class_method :extract_environment
+
+    sig { params(arguments: T::Array[EnvCmdItem]).returns(SpawnOptions) }
+    def self.extract_options(arguments)
+      return {} unless arguments.last.is_a?(Hash)
+
+      T.cast(arguments.pop, SpawnOptions).dup
+    end
+    private_class_method :extract_options
+
+    sig do
+      params(arguments: T::Array[EnvCmdItem])
+        .returns(T.any(String, T::Array[T.any(String, T::Array[String])]))
+    end
+    def self.command_for_popen(arguments)
+      raise ArgumentError, "command must not be empty" if arguments.empty?
+
+      first_argument = arguments.first
+      return first_argument if arguments.one? && first_argument.is_a?(String)
+
+      T.cast(arguments, T::Array[T.any(String, T::Array[String])])
+    end
+    private_class_method :command_for_popen
+
     # Terminate a process by PID
     sig { params(pid: T.nilable(Integer)).void }
     def self.terminate_process(pid)
@@ -263,7 +332,14 @@ module Dependabot
 
     sig { params(env_cmd: T::Array[EnvCmdItem]).returns(T.nilable(String)) }
     def self.command_string_for_logging(env_cmd)
-      T.cast(env_cmd.find { |item| item.is_a?(String) }, T.nilable(String))
+      command_parts = env_cmd.filter_map do |item|
+        case item
+        when Array then item.first
+        when String then item
+        end
+      end
+
+      command_parts.join(" ") unless command_parts.empty?
     end
     private_class_method :command_string_for_logging
 

data/lib/dependabot/credential.rb

@@ -9,9 +9,11 @@ module Dependabot
     extend T::Sig
     extend Forwardable
 
+    Value = T.type_alias { T.nilable(String) }
+
     def_delegators :@credential, :fetch, :keys, :[]=, :delete, :slice, :values, :entries
 
-    sig { params(credential: T::Hash[String, T.any(T::Boolean, String, T::Array[String])]).void }
+    sig { params(credential: T::Hash[String, T.nilable(T.any(T::Boolean, String, T::Array[String]))]).void }
     def initialize(credential)
       @replaces_base = T.let(credential["replaces-base"] == true, T::Boolean)
       credential.delete("replaces-base")
@@ -25,7 +27,14 @@ module Dependabot
         T.nilable(T::Array[String])
       )
 
-      @credential = T.let(T.unsafe(credential), T::Hash[String, String])
+      @credential = T.let(
+        credential.to_h do |key, value|
+          raise TypeError, "credential #{key} must be a string or nil" unless value.nil? || value.is_a?(String)
+
+          [key, value]
+        end,
+        T::Hash[String, Value]
+      )
     end
 
     sig { returns(T::Boolean) }
@@ -46,7 +55,7 @@ module Dependabot
       Credential.new(@credential.merge(other.to_h))
     end
 
-    sig { returns(T::Hash[String, String]) }
+    sig { returns(T::Hash[String, Value]) }
     def to_h
       @credential
     end

data/lib/dependabot/dependency_requirement.rb

@@ -16,7 +16,7 @@ module Dependabot
   #
   # Subclasses Hash so it is a drop-in replacement at call sites (and in
   # type annotations) that treat requirement entries as
-  # T::Hash[Symbol, T.untyped], while exposing typed readers for the
+  # T::Hash[Symbol, Object], while exposing typed readers for the
   # well-known keys. New code should prefer the typed readers; hash-style
   # access remains supported while call sites are migrated gradually.
   #
@@ -37,15 +37,11 @@ module Dependabot
     ObjectHash = T.type_alias { T::Hash[T.any(Symbol, String), Object] }
     Requirement = T.type_alias { T.any(String, Symbol) }
     Source = T.type_alias { T.any(String, ObjectHash) }
-    Input = T.type_alias { T.any(DependencyRequirement, ObjectHash) }
+    Input = T.type_alias { T::Hash[T.any(Symbol, String), T.anything] }
 
     K = type_member { { fixed: Symbol } }
-    # Hash-style access remains dynamic until ecosystem callers migrate to the
-    # typed readers. Keeping that compatibility here avoids a flag-day change.
-    # rubocop:disable Sorbet/ForbidTUntyped
-    V = type_member { { fixed: T.untyped } }
-    Elem = type_member { { fixed: [Symbol, T.untyped] } }
-    # rubocop:enable Sorbet/ForbidTUntyped
+    V = type_member { { fixed: Object } }
+    Elem = type_member { { fixed: [Symbol, Object] } }
 
     # Builds a DependencyRequirement from a requirement hash, symbolising
     # top-level keys. Accepts both plain hashes and existing
@@ -53,7 +49,12 @@ module Dependabot
     sig { params(hash: Input).returns(DependencyRequirement) }
     def self.create(hash)
       requirement = new
-      requirement.replace(hash.keys.to_h { |k| [k.to_sym, hash[k]] })
+      hash.each do |key, value|
+        case value
+        when Object then requirement[key.to_sym] = value
+        else raise TypeError, "requirement values must inherit Object"
+        end
+      end
       requirement
     end
 
@@ -62,7 +63,7 @@ module Dependabot
     # or :unfixable when no valid updated requirement can be generated.
     sig { returns(T.nilable(Requirement)) }
     def requirement
-      value = T.cast(self[:requirement], T.nilable(Object))
+      value = self[:requirement]
       return if value.nil?
       return value if value.is_a?(String) || value == :unfixable
 
@@ -82,7 +83,7 @@ module Dependabot
     # the underlying hash access under sorbet-runtime.
     sig { returns(T.nilable(T::Array[Group])) }
     def groups
-      value = T.cast(self[:groups], T.nilable(Object))
+      value = self[:groups]
       return if value.nil?
       raise TypeError, "groups must be an array of strings or symbols, or nil" unless value.is_a?(Array)
 
@@ -101,7 +102,7 @@ module Dependabot
     # parser or deserialised from a job definition.
     sig { returns(T.nilable(Source)) }
     def source
-      value = T.cast(self[:source], T.nilable(Object))
+      value = self[:source]
       return if value.nil?
       return value if value.is_a?(String)
 
@@ -175,6 +176,16 @@ module Dependabot
       raise TypeError, "metadata #{key} must be a symbol or nil"
     end
 
+    # Reads a boolean metadata field such as "include_debug_script".
+    sig { params(key: String).returns(T.nilable(T::Boolean)) }
+    def metadata_boolean(key)
+      value = metadata_value(key)
+      return if value.nil?
+      return value if value == true || value == false
+
+      raise TypeError, "metadata #{key} must be a boolean or nil"
+    end
+
     # Reads a nested metadata hash whose values are all strings, such as
     # "dependency_set" (`{ group: "my.group", version: "1.4.0" }`). Keys are
     # symbolised so callers can read them with symbols regardless of how the
@@ -205,12 +216,14 @@ module Dependabot
       details = metadata
       return if details.nil?
 
-      details[key.to_sym] || details[key]
+      return details[key.to_sym] if details.key?(key.to_sym)
+
+      details[key]
     end
 
     sig { params(key: Symbol).returns(T.nilable(String)) }
     def optional_string(key)
-      value = T.cast(self[key], T.nilable(Object))
+      value = self[key]
       return if value.nil?
       return value if value.is_a?(String)
 
@@ -219,7 +232,7 @@ module Dependabot
 
     sig { params(key: Symbol).returns(T.nilable(ObjectHash)) }
     def optional_object_hash(key)
-      value = T.cast(self[key], T.nilable(Object))
+      value = self[key]
       return if value.nil?
 
       object_hash(value, key)

data/lib/dependabot/errors.rb

@@ -246,6 +246,11 @@ module Dependabot
         "error-type": "dependency_file_not_resolvable",
         "error-detail": { message: error.message }
       }
+    when Dependabot::BranchNameFormattingError
+      {
+        "error-type": "branch_name_formatting_error",
+        "error-detail": { message: error.message }
+      }
     when Dependabot::BlockedDependencyVersion
       {
         "error-type": "blocked_dependency_version",
@@ -509,6 +514,8 @@ module Dependabot
 
   class RefNamespaceConflictError < DependabotError; end
 
+  class BranchNameFormattingError < DependabotError; end
+
   #####################
   # Repo level errors #
   #####################