dependabot-common 0.392.0 → 0.393.0

data/lib/dependabot/metadata_finders/base/commits_finder.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"
@@ -10,6 +10,8 @@ require "dependabot/git_metadata_fetcher"
 require "dependabot/git_commit_checker"
 require "dependabot/metadata_finders/base"
 require "dependabot/credential"
+require "dependabot/errors"
+require_relative "commit_response_parser"
 
 module Dependabot
   module MetadataFinders
@@ -283,24 +285,21 @@ module Dependabot
 
               args = { sha: previous_tag, path: path }.compact
               previous_commit_shas =
-                T.unsafe(github_client.commits(repo, **args)).map(&:sha)
+                github_client.commits(repo, args).map { |commit| commit_response_parser.github_commit_sha(commit) }
 
               # NOTE: We reverse this so it's consistent with the array we get
               # from `github_client.compare(...)`
               args = { sha: new_tag, path: path }.compact
-              T.unsafe(
-                github_client
-                               .commits(repo, **args)
-              )
-               .reject { |c| previous_commit_shas.include?(c.sha) }.reverse
+              github_client
+                .commits(repo, args)
+                .reject { |commit| previous_commit_shas.include?(commit_response_parser.github_commit_sha(commit)) }
+                .reverse
             end
-          return [] unless commits
-
           commits.map do |commit|
             {
-              message: commit.commit.message,
-              sha: commit.sha,
-              html_url: commit.html_url
+              message: commit_response_parser.github_commit_message(commit),
+              sha: commit_response_parser.github_commit_sha(commit),
+              html_url: commit_response_parser.sawyer_string(commit, :html_url, "commit")
             }
           end
         rescue Octokit::NotFound
@@ -312,10 +311,13 @@ module Dependabot
           bitbucket_client
             .compare(T.must(source).repo, T.must(previous_tag), T.must(new_tag))
             .map do |commit|
+            summary = T.cast(commit.fetch("summary"), Dependabot::Clients::Bitbucket::JsonObject)
+            links = T.cast(commit.fetch("links"), Dependabot::Clients::Bitbucket::JsonObject)
+            html = T.cast(links.fetch("html"), Dependabot::Clients::Bitbucket::JsonObject)
             {
-              message: commit.dig("summary", "raw"),
-              sha: commit["hash"],
-              html_url: commit.dig("links", "html", "href")
+              message: T.cast(summary.fetch("raw"), String),
+              sha: T.cast(commit.fetch("hash"), String),
+              html_url: T.cast(html.fetch("href"), String)
             }
           end
         rescue Dependabot::Clients::Bitbucket::NotFound,
@@ -329,16 +331,20 @@ module Dependabot
 
         sig { returns(T::Array[T::Hash[Symbol, String]]) }
         def fetch_gitlab_commits
-          T.unsafe(
-            gitlab_client
-                       .compare(T.must(source).repo, T.must(previous_tag), T.must(new_tag))
-          )
-           .commits
-           .map do |commit|
+          comparison = gitlab_client.compare(T.must(source).repo, T.must(previous_tag), T.must(new_tag))
+          commits = T.cast(comparison["commits"], Object)
+          commit_response_parser.raise_bad_response("GitLab", "commits must be an array") unless commits.is_a?(Array)
+
+          commits.map do |raw_commit|
+            commit = T.cast(raw_commit, Object)
+            commit_response_parser.raise_bad_response("GitLab", "commit must be an object") unless
+              commit.is_a?(Gitlab::ObjectifiedHash)
+
+            id = commit_response_parser.gitlab_string(commit, "id", "commit")
             {
-              message: commit["message"],
-              sha: commit["id"],
-              html_url: "#{T.must(source).url}/commit/#{commit['id']}"
+              message: commit_response_parser.gitlab_string(commit, "message", "commit"),
+              sha: id,
+              html_url: "#{T.must(source).url}/commit/#{id}"
             }
           end
         rescue Gitlab::Error::NotFound
@@ -352,9 +358,9 @@ module Dependabot
             .compare(previous_tag, new_tag, type)
             .map do |commit|
             {
-              message: commit["comment"],
-              sha: commit["commitId"],
-              html_url: commit["remoteUrl"]
+              message: commit_response_parser.object_string(commit, "comment", "commit"),
+              sha: commit_response_parser.object_string(commit, "commitId", "commit"),
+              html_url: commit_response_parser.object_string(commit, "remoteUrl", "commit")
             }
           end
         rescue Dependabot::Clients::Azure::NotFound,
@@ -366,6 +372,14 @@ module Dependabot
           []
         end
 
+        sig { returns(CommitResponseParser) }
+        def commit_response_parser
+          @commit_response_parser ||= T.let(
+            CommitResponseParser.new(source_url: T.must(source).url),
+            T.nilable(CommitResponseParser)
+          )
+        end
+
         sig { returns(Dependabot::Clients::GitlabWithRetries) }
         def gitlab_client
           @gitlab_client ||=
@@ -410,21 +424,13 @@ module Dependabot
         end
 
         sig { returns(T.class_of(Dependabot::Version)) }
-        def version_class
-          dependency.version_class
-        end
+        def version_class = dependency.version_class
 
         sig { returns(T.class_of(Dependabot::Requirement)) }
-        def requirement_class
-          dependency.requirement_class
-        end
+        def requirement_class = dependency.requirement_class
 
         sig { params(version: T.nilable(String)).returns(T::Boolean) }
-        def git_sha?(version)
-          return false unless version
-
-          version.match?(/^[0-9a-f]{40}$/)
-        end
+        def git_sha?(version) = version&.match?(/^[0-9a-f]{40}$/) || false
 
         sig { returns(T::Boolean) }
         def reliable_source_directory?

data/lib/dependabot/pull_request_creator/azure.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"

data/lib/dependabot/pull_request_creator/codecommit.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"
@@ -110,7 +110,7 @@ module Dependabot
         ) == base_commit
       end
 
-      sig { returns(T.nilable(Aws::CodeCommit::Types::CreatePullRequestOutput)) }
+      sig { returns(T.nilable(Seahorse::Client::Response)) }
       def create_pull_request
         branch = create_or_get_branch(base_commit)
         return unless branch
@@ -124,7 +124,6 @@ module Dependabot
           pr_description
           # codecommit doesn't support PR labels
         )
-        return unless pull_request
 
         pull_request
       end
@@ -167,7 +166,7 @@ module Dependabot
       def branch_exists?(branch_name)
         @branch_ref ||= T.let(
           codecommit_client_for_source.branch(branch_name),
-          T.nilable(String)
+          T.nilable(Seahorse::Client::Response)
         )
         !@branch_ref.nil?
       rescue Aws::CodeCommit::Errors::BranchDoesNotExistException
@@ -178,15 +177,14 @@ module Dependabot
       def unmerged_pull_request_exists?
         unmerged_prs = []
         pull_requests_for_branch.each do |pr|
-          unless T.unsafe(pr).pull_request
-                  .pull_request_targets[0].merge_metadata.is_merged
-            unmerged_prs << pr
-          end
+          output = T.cast(pr.data, Aws::CodeCommit::Types::GetPullRequestOutput)
+          target = T.must(output.pull_request.pull_request_targets[0])
+          unmerged_prs << pr unless target.merge_metadata&.is_merged
         end
         unmerged_prs.any?
       end
 
-      sig { returns(T::Array[Aws::CodeCommit::Types::PullRequest]) }
+      sig { returns(T::Array[Seahorse::Client::Response]) }
       def pull_requests_for_branch
         @pull_requests_for_branch ||=
           T.let(
@@ -194,17 +192,17 @@ module Dependabot
               open_prs = codecommit_client_for_source.pull_requests(
                 source.repo,
                 "open",
-                source.branch || default_branch
+                branch_name
               )
               closed_prs = codecommit_client_for_source.pull_requests(
                 source.repo,
                 "closed",
-                source.branch || default_branch
+                branch_name
               )
 
               [*open_prs, *closed_prs]
             end,
-            T.nilable(T::Array[Aws::CodeCommit::Types::PullRequest])
+            T.nilable(T::Array[Seahorse::Client::Response])
           )
       end
 

data/lib/dependabot/pull_request_creator/github.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "octokit"
@@ -6,6 +6,7 @@ require "securerandom"
 require "sorbet-runtime"
 
 require "dependabot/clients/github_with_retries"
+require "dependabot/clients/github_resource_parser"
 require "dependabot/pull_request_creator"
 require "dependabot/pull_request_creator/commit_signer"
 
@@ -14,6 +15,7 @@ module Dependabot
     # rubocop:disable Metrics/ClassLength
     class Github
       extend T::Sig
+      include Dependabot::Clients::GithubResourceParser
 
       # GitHub limits PR descriptions to a max of 65,536 characters:
       # https://github.com/orgs/community/discussions/27190#discussioncomment-3726017
@@ -121,7 +123,7 @@ module Dependabot
         @require_up_to_date_base = require_up_to_date_base
       end
 
-      sig { returns(T.untyped) }
+      sig { returns(Sawyer::Resource) }
       def create
         Dependabot.logger.info(
           "Initiating Github pull request."
@@ -135,7 +137,8 @@ module Dependabot
         end
 
         if branch_exists?(branch_name) && open_pull_request_exists?
-          raise UnmergedPRExists, "PR ##{open_pull_requests.first.number} already exists"
+          number = github_integer(T.must(open_pull_requests.first), :number, "pull request")
+          raise UnmergedPRExists, "PR ##{number} already exists"
         end
         if require_up_to_date_base? && !base_commit_is_up_to_date?
           raise BaseCommitNotUpToDate, "HEAD #{head_commit} does not match base #{base_commit}"
@@ -186,12 +189,22 @@ module Dependabot
         open_pull_requests.any?
       end
 
-      sig { returns(T::Array[T.untyped]) }
+      sig { returns(T::Array[Sawyer::Resource]) }
       def open_pull_requests
-        pull_requests_for_branch.reject(&:closed).reject(&:merged)
+        pull_requests_for_branch
+          .reject { |pull_request| github_pull_request_merged?(pull_request) }
       end
 
-      sig { returns(T::Array[T.untyped]) }
+      sig { params(pull_request: Sawyer::Resource).returns(T::Boolean) }
+      def github_pull_request_merged?(pull_request)
+        merged_at = T.cast(pull_request[:merged_at], Object)
+        return false if merged_at.nil?
+        return true if merged_at.is_a?(String) || merged_at.is_a?(Time)
+
+        raise_bad_github_response("pull request merged_at must be a time, string, or nil")
+      end
+
+      sig { returns(T::Array[Sawyer::Resource]) }
       def pull_requests_for_branch
         @pull_requests_for_branch ||=
           T.let(
@@ -217,7 +230,7 @@ module Dependabot
               )
               [*open_prs, *closed_prs]
             end,
-            T.nilable(T::Array[T.untyped])
+            T.nilable(T::Array[Sawyer::Resource])
           )
       end
 
@@ -234,7 +247,7 @@ module Dependabot
         )
       end
 
-      sig { returns(T.untyped) }
+      sig { returns(Sawyer::Resource) }
       def create_annotated_pull_request
         commit = create_commit
         branch = create_or_update_branch(commit)
@@ -260,7 +273,7 @@ module Dependabot
         false
       end
 
-      sig { returns(T.untyped) }
+      sig { returns(Sawyer::Resource) }
       def create_commit
         tree = create_tree
 
@@ -268,7 +281,7 @@ module Dependabot
           github_client_for_source.create_commit(
             source.repo,
             commit_message,
-            tree.sha,
+            github_string(tree, :sha, "tree"),
             base_commit,
             commit_options(tree)
           )
@@ -291,19 +304,21 @@ module Dependabot
         retry
       end
 
-      sig { params(tree: T.untyped).returns(T::Hash[Symbol, T.untyped]) }
+      sig { params(tree: Sawyer::Resource).returns(T::Hash[Symbol, Object]) }
       def commit_options(tree)
-        options = author_details&.any? ? { author: author_details } : {}
+        options = T.let({}, T::Hash[Symbol, Object])
+        author = author_details&.dup
+        options[:author] = author if author&.any?
 
-        if options[:author]&.any? && signature_key
-          options[:author][:date] = Time.now.utc.iso8601
-          options[:signature] = commit_signature(tree, options[:author])
+        if author&.any? && signature_key
+          author[:date] = Time.now.utc.iso8601
+          options[:signature] = commit_signature(tree, author)
         end
 
         options
       end
 
-      sig { returns(T.untyped) }
+      sig { returns(Sawyer::Resource) }
       def create_tree
         file_trees = files.map do |file|
           if file.type == "submodule"
@@ -340,7 +355,7 @@ module Dependabot
         )
       end
 
-      sig { params(commit: T.untyped).returns(T.untyped) }
+      sig { params(commit: Sawyer::Resource).returns(T.nilable(Sawyer::Resource)) }
       def create_or_update_branch(commit)
         if branch_exists?(branch_name)
           update_branch(commit)
@@ -359,13 +374,13 @@ module Dependabot
         retry
       end
 
-      sig { params(commit: T.untyped).returns(T.untyped) }
+      sig { params(commit: Sawyer::Resource).returns(Sawyer::Resource) }
       def create_branch(commit)
         ref = "refs/heads/#{branch_name}"
 
         begin
           branch =
-            github_client_for_source.create_ref(source.repo, ref, commit.sha)
+            github_client_for_source.create_ref(source.repo, ref, github_string(commit, :sha, "commit"))
           @branch_name = ref.gsub(%r{^refs/heads/}, "")
           branch
         rescue Octokit::UnprocessableEntity => e
@@ -383,32 +398,32 @@ module Dependabot
         end
       end
 
-      sig { params(commit: T.untyped).void }
+      sig { params(commit: Sawyer::Resource).returns(Sawyer::Resource) }
       def update_branch(commit)
         github_client_for_source.update_ref(
           source.repo,
           "heads/#{branch_name}",
-          commit.sha,
+          github_string(commit, :sha, "commit"),
           true
         )
       end
 
-      sig { params(pull_request: T.untyped).void }
+      sig { params(pull_request: Sawyer::Resource).void }
       def annotate_pull_request(pull_request)
-        labeler.label_pull_request(pull_request.number)
+        labeler.label_pull_request(github_integer(pull_request, :number, "pull request"))
         add_reviewers_to_pull_request(pull_request) if reviewers&.any?
         add_assignees_to_pull_request(pull_request) if assignees&.any?
         add_milestone_to_pull_request(pull_request) if milestone
       end
 
-      sig { params(pull_request: T.untyped).void }
+      sig { params(pull_request: Sawyer::Resource).void }
       def add_reviewers_to_pull_request(pull_request)
         reviewers_hash =
           T.must(reviewers).keys.to_h { |k| [k.to_sym, T.must(reviewers)[k]] }
 
         github_client_for_source.request_pull_request_review(
           source.repo,
-          pull_request.number,
+          github_integer(pull_request, :number, "pull request"),
           reviewers: reviewers_hash[:reviewers] || [],
           team_reviewers: reviewers_hash[:team_reviewers] || []
         )
@@ -434,7 +449,7 @@ module Dependabot
         false
       end
 
-      sig { params(pull_request: T.untyped, message: String).void }
+      sig { params(pull_request: Sawyer::Resource, message: String).void }
       def comment_with_invalid_reviewer(pull_request, message)
         reviewers_hash =
           T.must(reviewers).keys.to_h { |k| [k.to_sym, T.must(reviewers)[k]] }
@@ -460,16 +475,16 @@ module Dependabot
 
         github_client_for_source.add_comment(
           source.repo,
-          pull_request.number,
+          github_integer(pull_request, :number, "pull request"),
           msg
         )
       end
 
-      sig { params(pull_request: T.untyped).void }
+      sig { params(pull_request: Sawyer::Resource).void }
       def add_assignees_to_pull_request(pull_request)
         github_client_for_source.add_assignees(
           source.repo,
-          pull_request.number,
+          github_integer(pull_request, :number, "pull request"),
           T.must(assignees)
         )
       rescue Octokit::NotFound
@@ -480,18 +495,18 @@ module Dependabot
         raise unless e.message.include?("Could not add assignees")
       end
 
-      sig { params(pull_request: T.untyped).void }
+      sig { params(pull_request: Sawyer::Resource).void }
       def add_milestone_to_pull_request(pull_request)
         github_client_for_source.update_issue(
           source.repo,
-          pull_request.number,
+          github_integer(pull_request, :number, "pull request"),
           milestone: milestone
         )
       rescue Octokit::UnprocessableEntity => e
         raise unless e.message.include?("code: invalid")
       end
 
-      sig { returns(T.untyped) }
+      sig { returns(T.nilable(Sawyer::Resource)) }
       def create_pull_request
         github_client_for_source.create_pull_request(
           source.repo,
@@ -521,7 +536,7 @@ module Dependabot
       def default_branch
         @default_branch ||=
           T.let(
-            T.unsafe(github_client_for_source.repo(source.repo)).default_branch,
+            github_client_for_source.fetch_default_branch(source.repo),
             T.nilable(String)
           )
       end
@@ -539,13 +554,13 @@ module Dependabot
       end
 
       sig do
-        params(tree: T.untyped, author_details_with_date: T::Hash[Symbol, String]).returns(String)
+        params(tree: Sawyer::Resource, author_details_with_date: T::Hash[Symbol, String]).returns(String)
       end
       def commit_signature(tree, author_details_with_date)
         CommitSigner.new(
           author_details: author_details_with_date,
           commit_message: commit_message,
-          tree_sha: tree.sha,
+          tree_sha: github_string(tree, :sha, "tree"),
           parent_sha: base_commit,
           signature_key: T.must(signature_key)
         ).signature
@@ -570,6 +585,11 @@ module Dependabot
           )
       end
 
+      sig { returns(String) }
+      def github_response_source
+        source.url
+      end
+
       sig { params(err: StandardError).returns(T.noreturn) }
       def handle_error(err)
         cause = case err

data/lib/dependabot/pull_request_creator/gitlab.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "gitlab"
@@ -6,6 +6,7 @@ require "sorbet-runtime"
 
 require "dependabot/clients/gitlab_with_retries"
 require "dependabot/pull_request_creator"
+require "dependabot/errors"
 
 module Dependabot
   class PullRequestCreator
@@ -158,18 +159,19 @@ module Dependabot
             gitlab_client_for_source.commits(source.repo, ref_name: branch_name),
             T.nilable(::Gitlab::PaginatedResponse)
           )
-        T.unsafe(@commits).first.message == commit_message
+        commit = @commits.first
+        return false unless commit
+
+        gitlab_string(commit, "message", "commit") == commit_message
       end
 
       sig { returns(T::Boolean) }
       def merge_request_exists?
-        T.unsafe(
-          gitlab_client_for_source.merge_requests(
-            (target_project_id || source.repo).to_s,
-            source_branch: branch_name,
-            target_branch: source.branch || default_branch,
-            state: "all"
-          )
+        gitlab_client_for_source.merge_requests(
+          (target_project_id || source.repo).to_s,
+          source_branch: branch_name,
+          target_branch: source.branch || default_branch,
+          state: "all"
         ).any?
       end
 
@@ -240,7 +242,7 @@ module Dependabot
 
         gitlab_client_for_source.create_merge_request_level_rule(
           (target_project_id || source.repo).to_s,
-          T.unsafe(merge_request).iid,
+          gitlab_integer(merge_request, "iid", "merge request"),
           name: "dependency-updates",
           approvals_required: 1,
           user_ids: approvers_hash[:approvers],
@@ -260,10 +262,34 @@ module Dependabot
       def default_branch
         @default_branch ||=
           T.let(
-            T.unsafe(gitlab_client_for_source.project(source.repo)).default_branch,
+            gitlab_client_for_source.fetch_default_branch(source.repo),
             T.nilable(String)
           )
       end
+
+      sig { params(resource: ::Gitlab::ObjectifiedHash, key: String, context: String).returns(String) }
+      def gitlab_string(resource, key, context)
+        value = T.cast(resource[key], Object)
+        return value if value.is_a?(String)
+
+        raise_bad_gitlab_response("#{context} #{key} must be a string")
+      end
+
+      sig { params(resource: ::Gitlab::ObjectifiedHash, key: String, context: String).returns(Integer) }
+      def gitlab_integer(resource, key, context)
+        value = T.cast(resource[key], Object)
+        return value if value.is_a?(Integer)
+
+        raise_bad_gitlab_response("#{context} #{key} must be an integer")
+      end
+
+      sig { params(message: String).returns(T.noreturn) }
+      def raise_bad_gitlab_response(message)
+        raise Dependabot::PrivateSourceBadResponse.new(
+          source.url,
+          "Malformed GitLab response: #{message}"
+        )
+      end
     end
   end
 end