dependabot-common 0.392.0 → 0.394.0

data/lib/dependabot/metadata_finders/base/commits_finder.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"
@@ -10,6 +10,8 @@ require "dependabot/git_metadata_fetcher"
 require "dependabot/git_commit_checker"
 require "dependabot/metadata_finders/base"
 require "dependabot/credential"
+require "dependabot/errors"
+require_relative "commit_response_parser"
 
 module Dependabot
   module MetadataFinders
@@ -283,24 +285,21 @@ module Dependabot
 
               args = { sha: previous_tag, path: path }.compact
               previous_commit_shas =
-                T.unsafe(github_client.commits(repo, **args)).map(&:sha)
+                github_client.commits(repo, args).map { |commit| commit_response_parser.github_commit_sha(commit) }
 
               # NOTE: We reverse this so it's consistent with the array we get
               # from `github_client.compare(...)`
               args = { sha: new_tag, path: path }.compact
-              T.unsafe(
-                github_client
-                               .commits(repo, **args)
-              )
-               .reject { |c| previous_commit_shas.include?(c.sha) }.reverse
+              github_client
+                .commits(repo, args)
+                .reject { |commit| previous_commit_shas.include?(commit_response_parser.github_commit_sha(commit)) }
+                .reverse
             end
-          return [] unless commits
-
           commits.map do |commit|
             {
-              message: commit.commit.message,
-              sha: commit.sha,
-              html_url: commit.html_url
+              message: commit_response_parser.github_commit_message(commit),
+              sha: commit_response_parser.github_commit_sha(commit),
+              html_url: commit_response_parser.sawyer_string(commit, :html_url, "commit")
             }
           end
         rescue Octokit::NotFound
@@ -312,10 +311,13 @@ module Dependabot
           bitbucket_client
             .compare(T.must(source).repo, T.must(previous_tag), T.must(new_tag))
             .map do |commit|
+            summary = T.cast(commit.fetch("summary"), Dependabot::Clients::Bitbucket::JsonObject)
+            links = T.cast(commit.fetch("links"), Dependabot::Clients::Bitbucket::JsonObject)
+            html = T.cast(links.fetch("html"), Dependabot::Clients::Bitbucket::JsonObject)
             {
-              message: commit.dig("summary", "raw"),
-              sha: commit["hash"],
-              html_url: commit.dig("links", "html", "href")
+              message: T.cast(summary.fetch("raw"), String),
+              sha: T.cast(commit.fetch("hash"), String),
+              html_url: T.cast(html.fetch("href"), String)
             }
           end
         rescue Dependabot::Clients::Bitbucket::NotFound,
@@ -329,16 +331,20 @@ module Dependabot
 
         sig { returns(T::Array[T::Hash[Symbol, String]]) }
         def fetch_gitlab_commits
-          T.unsafe(
-            gitlab_client
-                       .compare(T.must(source).repo, T.must(previous_tag), T.must(new_tag))
-          )
-           .commits
-           .map do |commit|
+          comparison = gitlab_client.compare(T.must(source).repo, T.must(previous_tag), T.must(new_tag))
+          commits = T.cast(comparison["commits"], Object)
+          commit_response_parser.raise_bad_response("GitLab", "commits must be an array") unless commits.is_a?(Array)
+
+          commits.map do |raw_commit|
+            commit = T.cast(raw_commit, Object)
+            commit_response_parser.raise_bad_response("GitLab", "commit must be an object") unless
+              commit.is_a?(Gitlab::ObjectifiedHash)
+
+            id = commit_response_parser.gitlab_string(commit, "id", "commit")
             {
-              message: commit["message"],
-              sha: commit["id"],
-              html_url: "#{T.must(source).url}/commit/#{commit['id']}"
+              message: commit_response_parser.gitlab_string(commit, "message", "commit"),
+              sha: id,
+              html_url: "#{T.must(source).url}/commit/#{id}"
             }
           end
         rescue Gitlab::Error::NotFound
@@ -352,9 +358,9 @@ module Dependabot
             .compare(previous_tag, new_tag, type)
             .map do |commit|
             {
-              message: commit["comment"],
-              sha: commit["commitId"],
-              html_url: commit["remoteUrl"]
+              message: commit_response_parser.object_string(commit, "comment", "commit"),
+              sha: commit_response_parser.object_string(commit, "commitId", "commit"),
+              html_url: commit_response_parser.object_string(commit, "remoteUrl", "commit")
             }
           end
         rescue Dependabot::Clients::Azure::NotFound,
@@ -366,6 +372,14 @@ module Dependabot
           []
         end
 
+        sig { returns(CommitResponseParser) }
+        def commit_response_parser
+          @commit_response_parser ||= T.let(
+            CommitResponseParser.new(source_url: T.must(source).url),
+            T.nilable(CommitResponseParser)
+          )
+        end
+
         sig { returns(Dependabot::Clients::GitlabWithRetries) }
         def gitlab_client
           @gitlab_client ||=
@@ -410,21 +424,13 @@ module Dependabot
         end
 
         sig { returns(T.class_of(Dependabot::Version)) }
-        def version_class
-          dependency.version_class
-        end
+        def version_class = dependency.version_class
 
         sig { returns(T.class_of(Dependabot::Requirement)) }
-        def requirement_class
-          dependency.requirement_class
-        end
+        def requirement_class = dependency.requirement_class
 
         sig { params(version: T.nilable(String)).returns(T::Boolean) }
-        def git_sha?(version)
-          return false unless version
-
-          version.match?(/^[0-9a-f]{40}$/)
-        end
+        def git_sha?(version) = version&.match?(/^[0-9a-f]{40}$/) || false
 
         sig { returns(T::Boolean) }
         def reliable_source_directory?

data/lib/dependabot/package/npm_package_manager_config.rb

@@ -0,0 +1,72 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+
+module Dependabot
+  module Package
+    class NpmPackageManagerConfig < T::ImmutableStruct
+      extend T::Sig
+
+      ObjectHash = T.type_alias { T::Hash[String, Object] }
+
+      const :package_manager, T.nilable(String), default: nil
+      const :engines, T.nilable(T::Hash[String, String]), default: nil
+
+      sig { params(package_json: T.nilable(Object)).returns(NpmPackageManagerConfig) }
+      def self.from_package_json(package_json)
+        return new if package_json.nil?
+
+        manifest = object_hash(package_json, "package.json")
+
+        new(
+          package_manager: optional_string(manifest["packageManager"], "packageManager"),
+          engines: parse_engines(manifest)
+        )
+      end
+
+      sig { params(manifest: ObjectHash).returns(T.nilable(T::Hash[String, String])) }
+      def self.parse_engines(manifest)
+        return unless manifest.key?("engines")
+
+        raw_engines = manifest["engines"]
+        return if raw_engines.nil?
+
+        engines = T.let({}, T::Hash[String, String])
+        object_hash(raw_engines, "engines").each do |name, raw_requirement|
+          next if raw_requirement.nil?
+
+          raise TypeError, "engines.#{name} must be a string" unless raw_requirement.is_a?(String)
+
+          engines[name] = raw_requirement
+        end
+        engines
+      end
+      private_class_method :parse_engines
+
+      sig { params(value: Object, context: String).returns(ObjectHash) }
+      def self.object_hash(value, context)
+        raise TypeError, "#{context} must be an object" unless value.is_a?(Hash)
+
+        result = T.let({}, ObjectHash)
+        value.each do |raw_key, raw_value|
+          key = T.cast(raw_key, Object)
+          raise TypeError, "#{context} keys must be strings" unless key.is_a?(String)
+
+          result[key] = T.cast(raw_value, Object)
+        end
+        result
+      end
+      private_class_method :object_hash
+
+      sig { params(value: T.nilable(Object), context: String).returns(T.nilable(String)) }
+      def self.optional_string(value, context)
+        return if value.nil?
+        return value if value.is_a?(String)
+
+        raise TypeError, "#{context} must be a string"
+      end
+      private_class_method :optional_string
+    end
+  end
+end

data/lib/dependabot/package/npm_registry_package.rb

@@ -0,0 +1,186 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "json"
+require "time"
+require "sorbet-runtime"
+
+module Dependabot
+  module Package
+    class NpmRegistryPackage < T::ImmutableStruct
+      extend T::Sig
+
+      ObjectHash = T.type_alias { T::Hash[String, Object] }
+      VersionFilter = T.type_alias { T.proc.params(version: String).returns(T::Boolean) }
+
+      class Repository < T::ImmutableStruct
+        extend T::Sig
+
+        const :git, T::Boolean
+        const :url, T.nilable(String), default: nil
+        const :type, T.nilable(String), default: nil
+
+        sig { returns(T::Boolean) }
+        def git?
+          git
+        end
+      end
+
+      class Release < T::ImmutableStruct
+        extend T::Sig
+
+        const :version, String
+        const :released_at, T.nilable(Time), default: nil
+        const :node_requirement, T.nilable(String), default: nil
+        const :repository, T.nilable(Repository), default: nil
+        const :details, ObjectHash
+
+        sig { returns(String) }
+        def package_type
+          repository&.git? ? "git" : "npm"
+        end
+      end
+
+      const :releases, T::Hash[String, Release]
+      const :dist_tags, T.nilable(T::Hash[String, String]), default: nil
+
+      sig { params(json: String, version_filter: VersionFilter).returns(NpmRegistryPackage) }
+      def self.from_json(json, &version_filter)
+        parsed = T.cast(JSON.parse(json), Object)
+        package = object_hash(parsed, "npm registry package")
+
+        versions = package["versions"]
+        times = package["time"]
+        dist_tags = package["dist-tags"]
+
+        release_details = versions.nil? ? {} : object_hash(versions, "versions")
+        accepted_versions = T.let({}, T::Hash[String, T::Boolean])
+        release_details.each_key do |version|
+          accepted_versions[version] = true if yield(version)
+        end
+
+        release_times = if times.nil?
+                          {}
+                        else
+                          string_map(times, "time", included_keys: accepted_versions)
+                        end
+
+        releases = T.let({}, T::Hash[String, Release])
+        release_details.each do |version, details|
+          next unless accepted_versions.key?(version)
+
+          releases[version] = parse_release(
+            version: version,
+            details: details,
+            released_at: release_times[version]
+          )
+        end
+
+        new(
+          releases: releases,
+          dist_tags: dist_tags.nil? ? nil : string_map(dist_tags, "dist-tags")
+        )
+      end
+
+      sig do
+        params(
+          version: String,
+          details: Object,
+          released_at: T.nilable(String)
+        ).returns(Release)
+      end
+      def self.parse_release(version:, details:, released_at:)
+        details_hash = object_hash(details, "version #{version} details")
+
+        Release.new(
+          version: version,
+          released_at: released_at && Time.parse(released_at),
+          node_requirement: parse_node_requirement(details_hash, version),
+          repository: parse_repository(details_hash["repository"], version),
+          details: details_hash
+        )
+      end
+      private_class_method :parse_release
+
+      sig { params(details: ObjectHash, version: String).returns(T.nilable(String)) }
+      def self.parse_node_requirement(details, version)
+        engines = details["engines"]
+        return unless engines.is_a?(Hash)
+
+        engines_hash = object_hash(engines, "version #{version} engines")
+        optional_string(
+          engines_hash["node"],
+          "version #{version} engines.node"
+        )
+      end
+      private_class_method :parse_node_requirement
+
+      sig { params(value: T.nilable(Object), version: String).returns(T.nilable(Repository)) }
+      def self.parse_repository(value, version)
+        case value
+        when nil
+          nil
+        when String
+          Repository.new(url: value, git: value.start_with?("git+"))
+        when Hash
+          repository = object_hash(value, "version #{version} repository")
+          url = optional_string(repository["url"], "version #{version} repository.url")
+          type = optional_string(repository["type"], "version #{version} repository.type")
+
+          Repository.new(
+            url: url,
+            type: type,
+            git: type == "git"
+          )
+        else
+          raise TypeError, "version #{version} repository must be a string or object"
+        end
+      end
+      private_class_method :parse_repository
+
+      sig { params(value: Object, context: String).returns(ObjectHash) }
+      def self.object_hash(value, context)
+        raise TypeError, "#{context} must be an object" unless value.is_a?(Hash)
+
+        result = T.let({}, ObjectHash)
+        value.each do |raw_key, raw_value|
+          key = T.cast(raw_key, Object)
+          raise TypeError, "#{context} keys must be strings" unless key.is_a?(String)
+
+          result[key] = T.cast(raw_value, Object)
+        end
+        result
+      end
+      private_class_method :object_hash
+
+      sig do
+        params(
+          value: Object,
+          context: String,
+          included_keys: T.nilable(T::Hash[String, T::Boolean])
+        ).returns(T::Hash[String, String])
+      end
+      def self.string_map(value, context, included_keys: nil)
+        result = T.let({}, T::Hash[String, String])
+        object_hash(value, context).each do |key, raw_value|
+          next if included_keys && !included_keys.key?(key)
+
+          raise TypeError, "#{context} values must be strings" unless raw_value.is_a?(String)
+
+          result[key] = raw_value
+        end
+        result
+      end
+      private_class_method :string_map
+
+      sig { params(value: T.nilable(Object), context: String).returns(T.nilable(String)) }
+      def self.optional_string(value, context)
+        return if value.nil?
+        return value if value.is_a?(String)
+
+        raise TypeError, "#{context} must be a string"
+      end
+      private_class_method :optional_string
+    end
+  end
+end

data/lib/dependabot/pull_request_creator/azure.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"

data/lib/dependabot/pull_request_creator/codecommit.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"
@@ -110,7 +110,7 @@ module Dependabot
         ) == base_commit
       end
 
-      sig { returns(T.nilable(Aws::CodeCommit::Types::CreatePullRequestOutput)) }
+      sig { returns(T.nilable(Seahorse::Client::Response)) }
       def create_pull_request
         branch = create_or_get_branch(base_commit)
         return unless branch
@@ -124,7 +124,6 @@ module Dependabot
           pr_description
           # codecommit doesn't support PR labels
         )
-        return unless pull_request
 
         pull_request
       end
@@ -167,7 +166,7 @@ module Dependabot
       def branch_exists?(branch_name)
         @branch_ref ||= T.let(
           codecommit_client_for_source.branch(branch_name),
-          T.nilable(String)
+          T.nilable(Seahorse::Client::Response)
         )
         !@branch_ref.nil?
       rescue Aws::CodeCommit::Errors::BranchDoesNotExistException
@@ -178,15 +177,14 @@ module Dependabot
       def unmerged_pull_request_exists?
         unmerged_prs = []
         pull_requests_for_branch.each do |pr|
-          unless T.unsafe(pr).pull_request
-                  .pull_request_targets[0].merge_metadata.is_merged
-            unmerged_prs << pr
-          end
+          output = T.cast(pr.data, Aws::CodeCommit::Types::GetPullRequestOutput)
+          target = T.must(output.pull_request.pull_request_targets[0])
+          unmerged_prs << pr unless target.merge_metadata&.is_merged
         end
         unmerged_prs.any?
       end
 
-      sig { returns(T::Array[Aws::CodeCommit::Types::PullRequest]) }
+      sig { returns(T::Array[Seahorse::Client::Response]) }
       def pull_requests_for_branch
         @pull_requests_for_branch ||=
           T.let(
@@ -194,17 +192,17 @@ module Dependabot
               open_prs = codecommit_client_for_source.pull_requests(
                 source.repo,
                 "open",
-                source.branch || default_branch
+                branch_name
               )
               closed_prs = codecommit_client_for_source.pull_requests(
                 source.repo,
                 "closed",
-                source.branch || default_branch
+                branch_name
               )
 
               [*open_prs, *closed_prs]
             end,
-            T.nilable(T::Array[Aws::CodeCommit::Types::PullRequest])
+            T.nilable(T::Array[Seahorse::Client::Response])
           )
       end