dependabot-common 0.392.0 → 0.394.0

data/lib/dependabot/pull_request_creator/github.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "octokit"
@@ -6,6 +6,7 @@ require "securerandom"
 require "sorbet-runtime"
 
 require "dependabot/clients/github_with_retries"
+require "dependabot/clients/github_resource_parser"
 require "dependabot/pull_request_creator"
 require "dependabot/pull_request_creator/commit_signer"
 
@@ -14,6 +15,7 @@ module Dependabot
     # rubocop:disable Metrics/ClassLength
     class Github
       extend T::Sig
+      include Dependabot::Clients::GithubResourceParser
 
       # GitHub limits PR descriptions to a max of 65,536 characters:
       # https://github.com/orgs/community/discussions/27190#discussioncomment-3726017
@@ -121,7 +123,7 @@ module Dependabot
         @require_up_to_date_base = require_up_to_date_base
       end
 
-      sig { returns(T.untyped) }
+      sig { returns(Sawyer::Resource) }
       def create
         Dependabot.logger.info(
           "Initiating Github pull request."
@@ -135,7 +137,8 @@ module Dependabot
         end
 
         if branch_exists?(branch_name) && open_pull_request_exists?
-          raise UnmergedPRExists, "PR ##{open_pull_requests.first.number} already exists"
+          number = github_integer(T.must(open_pull_requests.first), :number, "pull request")
+          raise UnmergedPRExists, "PR ##{number} already exists"
         end
         if require_up_to_date_base? && !base_commit_is_up_to_date?
           raise BaseCommitNotUpToDate, "HEAD #{head_commit} does not match base #{base_commit}"
@@ -186,12 +189,22 @@ module Dependabot
         open_pull_requests.any?
       end
 
-      sig { returns(T::Array[T.untyped]) }
+      sig { returns(T::Array[Sawyer::Resource]) }
       def open_pull_requests
-        pull_requests_for_branch.reject(&:closed).reject(&:merged)
+        pull_requests_for_branch
+          .reject { |pull_request| github_pull_request_merged?(pull_request) }
       end
 
-      sig { returns(T::Array[T.untyped]) }
+      sig { params(pull_request: Sawyer::Resource).returns(T::Boolean) }
+      def github_pull_request_merged?(pull_request)
+        merged_at = T.cast(pull_request[:merged_at], Object)
+        return false if merged_at.nil?
+        return true if merged_at.is_a?(String) || merged_at.is_a?(Time)
+
+        raise_bad_github_response("pull request merged_at must be a time, string, or nil")
+      end
+
+      sig { returns(T::Array[Sawyer::Resource]) }
       def pull_requests_for_branch
         @pull_requests_for_branch ||=
           T.let(
@@ -217,7 +230,7 @@ module Dependabot
               )
               [*open_prs, *closed_prs]
             end,
-            T.nilable(T::Array[T.untyped])
+            T.nilable(T::Array[Sawyer::Resource])
           )
       end
 
@@ -234,7 +247,7 @@ module Dependabot
         )
       end
 
-      sig { returns(T.untyped) }
+      sig { returns(Sawyer::Resource) }
       def create_annotated_pull_request
         commit = create_commit
         branch = create_or_update_branch(commit)
@@ -260,7 +273,7 @@ module Dependabot
         false
       end
 
-      sig { returns(T.untyped) }
+      sig { returns(Sawyer::Resource) }
       def create_commit
         tree = create_tree
 
@@ -268,7 +281,7 @@ module Dependabot
           github_client_for_source.create_commit(
             source.repo,
             commit_message,
-            tree.sha,
+            github_string(tree, :sha, "tree"),
             base_commit,
             commit_options(tree)
           )
@@ -291,19 +304,21 @@ module Dependabot
         retry
       end
 
-      sig { params(tree: T.untyped).returns(T::Hash[Symbol, T.untyped]) }
+      sig { params(tree: Sawyer::Resource).returns(T::Hash[Symbol, Object]) }
       def commit_options(tree)
-        options = author_details&.any? ? { author: author_details } : {}
+        options = T.let({}, T::Hash[Symbol, Object])
+        author = author_details&.dup
+        options[:author] = author if author&.any?
 
-        if options[:author]&.any? && signature_key
-          options[:author][:date] = Time.now.utc.iso8601
-          options[:signature] = commit_signature(tree, options[:author])
+        if author&.any? && signature_key
+          author[:date] = Time.now.utc.iso8601
+          options[:signature] = commit_signature(tree, author)
         end
 
         options
       end
 
-      sig { returns(T.untyped) }
+      sig { returns(Sawyer::Resource) }
       def create_tree
         file_trees = files.map do |file|
           if file.type == "submodule"
@@ -340,7 +355,7 @@ module Dependabot
         )
       end
 
-      sig { params(commit: T.untyped).returns(T.untyped) }
+      sig { params(commit: Sawyer::Resource).returns(T.nilable(Sawyer::Resource)) }
       def create_or_update_branch(commit)
         if branch_exists?(branch_name)
           update_branch(commit)
@@ -359,13 +374,13 @@ module Dependabot
         retry
       end
 
-      sig { params(commit: T.untyped).returns(T.untyped) }
+      sig { params(commit: Sawyer::Resource).returns(Sawyer::Resource) }
       def create_branch(commit)
         ref = "refs/heads/#{branch_name}"
 
         begin
           branch =
-            github_client_for_source.create_ref(source.repo, ref, commit.sha)
+            github_client_for_source.create_ref(source.repo, ref, github_string(commit, :sha, "commit"))
           @branch_name = ref.gsub(%r{^refs/heads/}, "")
           branch
         rescue Octokit::UnprocessableEntity => e
@@ -383,32 +398,32 @@ module Dependabot
         end
       end
 
-      sig { params(commit: T.untyped).void }
+      sig { params(commit: Sawyer::Resource).returns(Sawyer::Resource) }
       def update_branch(commit)
         github_client_for_source.update_ref(
           source.repo,
           "heads/#{branch_name}",
-          commit.sha,
+          github_string(commit, :sha, "commit"),
           true
         )
       end
 
-      sig { params(pull_request: T.untyped).void }
+      sig { params(pull_request: Sawyer::Resource).void }
       def annotate_pull_request(pull_request)
-        labeler.label_pull_request(pull_request.number)
+        labeler.label_pull_request(github_integer(pull_request, :number, "pull request"))
         add_reviewers_to_pull_request(pull_request) if reviewers&.any?
         add_assignees_to_pull_request(pull_request) if assignees&.any?
         add_milestone_to_pull_request(pull_request) if milestone
       end
 
-      sig { params(pull_request: T.untyped).void }
+      sig { params(pull_request: Sawyer::Resource).void }
       def add_reviewers_to_pull_request(pull_request)
         reviewers_hash =
           T.must(reviewers).keys.to_h { |k| [k.to_sym, T.must(reviewers)[k]] }
 
         github_client_for_source.request_pull_request_review(
           source.repo,
-          pull_request.number,
+          github_integer(pull_request, :number, "pull request"),
           reviewers: reviewers_hash[:reviewers] || [],
           team_reviewers: reviewers_hash[:team_reviewers] || []
         )
@@ -434,7 +449,7 @@ module Dependabot
         false
       end
 
-      sig { params(pull_request: T.untyped, message: String).void }
+      sig { params(pull_request: Sawyer::Resource, message: String).void }
       def comment_with_invalid_reviewer(pull_request, message)
         reviewers_hash =
           T.must(reviewers).keys.to_h { |k| [k.to_sym, T.must(reviewers)[k]] }
@@ -460,16 +475,16 @@ module Dependabot
 
         github_client_for_source.add_comment(
           source.repo,
-          pull_request.number,
+          github_integer(pull_request, :number, "pull request"),
           msg
         )
       end
 
-      sig { params(pull_request: T.untyped).void }
+      sig { params(pull_request: Sawyer::Resource).void }
       def add_assignees_to_pull_request(pull_request)
         github_client_for_source.add_assignees(
           source.repo,
-          pull_request.number,
+          github_integer(pull_request, :number, "pull request"),
           T.must(assignees)
         )
       rescue Octokit::NotFound
@@ -480,18 +495,18 @@ module Dependabot
         raise unless e.message.include?("Could not add assignees")
       end
 
-      sig { params(pull_request: T.untyped).void }
+      sig { params(pull_request: Sawyer::Resource).void }
       def add_milestone_to_pull_request(pull_request)
         github_client_for_source.update_issue(
           source.repo,
-          pull_request.number,
+          github_integer(pull_request, :number, "pull request"),
           milestone: milestone
         )
       rescue Octokit::UnprocessableEntity => e
         raise unless e.message.include?("code: invalid")
       end
 
-      sig { returns(T.untyped) }
+      sig { returns(T.nilable(Sawyer::Resource)) }
       def create_pull_request
         github_client_for_source.create_pull_request(
           source.repo,
@@ -521,7 +536,7 @@ module Dependabot
       def default_branch
         @default_branch ||=
           T.let(
-            T.unsafe(github_client_for_source.repo(source.repo)).default_branch,
+            github_client_for_source.fetch_default_branch(source.repo),
             T.nilable(String)
           )
       end
@@ -539,13 +554,13 @@ module Dependabot
       end
 
       sig do
-        params(tree: T.untyped, author_details_with_date: T::Hash[Symbol, String]).returns(String)
+        params(tree: Sawyer::Resource, author_details_with_date: T::Hash[Symbol, String]).returns(String)
       end
       def commit_signature(tree, author_details_with_date)
         CommitSigner.new(
           author_details: author_details_with_date,
           commit_message: commit_message,
-          tree_sha: tree.sha,
+          tree_sha: github_string(tree, :sha, "tree"),
           parent_sha: base_commit,
           signature_key: T.must(signature_key)
         ).signature
@@ -570,6 +585,11 @@ module Dependabot
           )
       end
 
+      sig { returns(String) }
+      def github_response_source
+        source.url
+      end
+
       sig { params(err: StandardError).returns(T.noreturn) }
       def handle_error(err)
         cause = case err

data/lib/dependabot/pull_request_creator/gitlab.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "gitlab"
@@ -6,6 +6,7 @@ require "sorbet-runtime"
 
 require "dependabot/clients/gitlab_with_retries"
 require "dependabot/pull_request_creator"
+require "dependabot/errors"
 
 module Dependabot
   class PullRequestCreator
@@ -158,18 +159,19 @@ module Dependabot
             gitlab_client_for_source.commits(source.repo, ref_name: branch_name),
             T.nilable(::Gitlab::PaginatedResponse)
           )
-        T.unsafe(@commits).first.message == commit_message
+        commit = @commits.first
+        return false unless commit
+
+        gitlab_string(commit, "message", "commit") == commit_message
       end
 
       sig { returns(T::Boolean) }
       def merge_request_exists?
-        T.unsafe(
-          gitlab_client_for_source.merge_requests(
-            (target_project_id || source.repo).to_s,
-            source_branch: branch_name,
-            target_branch: source.branch || default_branch,
-            state: "all"
-          )
+        gitlab_client_for_source.merge_requests(
+          (target_project_id || source.repo).to_s,
+          source_branch: branch_name,
+          target_branch: source.branch || default_branch,
+          state: "all"
         ).any?
       end
 
@@ -240,7 +242,7 @@ module Dependabot
 
         gitlab_client_for_source.create_merge_request_level_rule(
           (target_project_id || source.repo).to_s,
-          T.unsafe(merge_request).iid,
+          gitlab_integer(merge_request, "iid", "merge request"),
           name: "dependency-updates",
           approvals_required: 1,
           user_ids: approvers_hash[:approvers],
@@ -260,10 +262,34 @@ module Dependabot
       def default_branch
         @default_branch ||=
           T.let(
-            T.unsafe(gitlab_client_for_source.project(source.repo)).default_branch,
+            gitlab_client_for_source.fetch_default_branch(source.repo),
             T.nilable(String)
           )
       end
+
+      sig { params(resource: ::Gitlab::ObjectifiedHash, key: String, context: String).returns(String) }
+      def gitlab_string(resource, key, context)
+        value = T.cast(resource[key], Object)
+        return value if value.is_a?(String)
+
+        raise_bad_gitlab_response("#{context} #{key} must be a string")
+      end
+
+      sig { params(resource: ::Gitlab::ObjectifiedHash, key: String, context: String).returns(Integer) }
+      def gitlab_integer(resource, key, context)
+        value = T.cast(resource[key], Object)
+        return value if value.is_a?(Integer)
+
+        raise_bad_gitlab_response("#{context} #{key} must be an integer")
+      end
+
+      sig { params(message: String).returns(T.noreturn) }
+      def raise_bad_gitlab_response(message)
+        raise Dependabot::PrivateSourceBadResponse.new(
+          source.url,
+          "Malformed GitLab response: #{message}"
+        )
+      end
     end
   end
 end

data/lib/dependabot/pull_request_creator/labeler.rb

@@ -1,9 +1,10 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "octokit"
 require "sorbet-runtime"
 require "dependabot/pull_request_creator"
+require "dependabot/errors"
 require "dependabot/credential"
 
 module Dependabot
@@ -313,16 +314,13 @@ module Dependabot
       def fetch_github_labels
         client = github_client_for_source
 
-        labels = T.let(
-          T.unsafe(client.labels(source.repo, per_page: 100)).map(&:name),
-          T::Array[String]
-        )
-
+        raw_labels = client.labels(source.repo, per_page: 100)
+        labels = github_label_names(raw_labels)
         next_link = T.let(client.last_response.rels[:next], T.nilable(Sawyer::Relation))
 
         while next_link
           next_page = T.let(next_link.get, Sawyer::Response)
-          labels += T.unsafe(next_page.data).map(&:name)
+          labels.concat(github_labels_from_page(next_page))
           next_link = next_page.rels[:next]
         end
 
@@ -331,12 +329,51 @@ module Dependabot
 
       sig { returns(T::Array[String]) }
       def fetch_gitlab_labels
-        T.unsafe(
-          gitlab_client_for_source
-                   .labels(source.repo, per_page: 100)
-                   .auto_paginate
+        gitlab_client_for_source
+          .labels(source.repo, per_page: 100)
+          .auto_paginate
+          .map { |label| gitlab_label_name(label) }
+      end
+
+      sig { params(label: Sawyer::Resource).returns(String) }
+      def github_label_name(label)
+        value = T.cast(label[:name], Object)
+        return value if value.is_a?(String)
+
+        raise_bad_label_response("GitHub", "name must be a string")
+      end
+
+      sig { params(response: Sawyer::Response).returns(T::Array[String]) }
+      def github_labels_from_page(response)
+        github_label_names(T.cast(response.data, Object))
+      end
+
+      sig { params(data: Object).returns(T::Array[String]) }
+      def github_label_names(data)
+        raise_bad_label_response("GitHub", "page data must be an array") unless data.is_a?(Array)
+
+        data.map do |raw_label|
+          label = T.cast(raw_label, Object)
+          raise_bad_label_response("GitHub", "label must be an object") unless label.is_a?(Sawyer::Resource)
+
+          github_label_name(label)
+        end
+      end
+
+      sig { params(label: ::Gitlab::ObjectifiedHash).returns(String) }
+      def gitlab_label_name(label)
+        value = T.cast(label["name"], Object)
+        return value if value.is_a?(String)
+
+        raise_bad_label_response("GitLab", "name must be a string")
+      end
+
+      sig { params(provider: String, message: String).returns(T.noreturn) }
+      def raise_bad_label_response(provider, message)
+        raise Dependabot::PrivateSourceBadResponse.new(
+          source.url,
+          "Malformed #{provider} label response: #{message}"
         )
-         .map(&:name)
       end
 
       sig { returns(T::Array[String]) }
@@ -394,7 +431,7 @@ module Dependabot
         )
         @labels = [*@labels, DEFAULT_DEPENDENCIES_LABEL].uniq
       rescue Octokit::UnprocessableEntity => e
-        raise unless e.errors.first.fetch(:code) == "already_exists"
+        raise unless github_label_already_exists?(e)
 
         @labels = [*@labels, DEFAULT_DEPENDENCIES_LABEL].uniq
       end
@@ -421,7 +458,7 @@ module Dependabot
         )
         @labels = [*@labels, DEFAULT_SECURITY_LABEL].uniq
       rescue Octokit::UnprocessableEntity => e
-        raise unless e.errors.first.fetch(:code) == "already_exists"
+        raise unless github_label_already_exists?(e)
 
         @labels = [*@labels, DEFAULT_SECURITY_LABEL].uniq
       end
@@ -450,11 +487,24 @@ module Dependabot
         )
         @labels = [*@labels, language_name].uniq
       rescue Octokit::UnprocessableEntity => e
-        raise unless e.errors.first.fetch(:code) == "already_exists"
+        raise unless github_label_already_exists?(e)
 
         @labels = [*@labels, language_name].uniq.compact
       end
 
+      sig { params(error: Octokit::UnprocessableEntity).returns(T::Boolean) }
+      def github_label_already_exists?(error)
+        errors = T.cast(error.errors, Object)
+        return false unless errors.is_a?(Array)
+
+        first_error = T.cast(errors.first, Object)
+        return false unless first_error.is_a?(Hash)
+
+        typed_error = T.let(first_error, T::Hash[T.any(Symbol, String), Object])
+        code = typed_error[:code] || typed_error["code"]
+        code == "already_exists"
+      end
+
       sig { params(language: String).returns(String) }
       def default_description_for(language)
         "Pull requests that update #{language.capitalize} code"