dependabot-common 0.142.1 → 0.143.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8c9dc9b0f20806bf74ca6015aeaaf9fd33574d66d2170bca6c0605927c4160f9
-  data.tar.gz: d058e21f7402cc5f6f4105686d6c975130a165a98a4bded064cb6b18ff500fb1
+  metadata.gz: 57330557c4c6b5c67064d741415cf5ec79dcb8f43bf9f3919048a3464260ab3c
+  data.tar.gz: c2c2540484356b1beeb3b72dfff70a4d0da24ee20cfbeb4b9c2e465bdd4dc2e1
 SHA512:
-  metadata.gz: 8d54f958fe2243db610fb5264442242b1407a7186e631a28697007d1da4260995beeecf3721cff9825c03a5ddf22cac51f49dcea9ce57a1d13efbfbe17eb897b
-  data.tar.gz: ea4d8ce7034b84f8a71cebc347ec8e460ce5a7c87588299192b5922ee433fdc257b7c9d756b4d82da5d07b751690c1091fbbb46f2c4a3377bfd050607a2c7ba0
+  metadata.gz: ab1843750e40351dd4a63830cb45e466bda21006140c4b39540010b0cd00e30a09dec6bf08aa744a42e870d2693e09d861aed43b0ec59b0854910f4dfcdbde8f
+  data.tar.gz: be02824d97291c474f1074e3070abf82fa1576bc9f5898fea338734bd4f11d811526bccb3888a3a279b893dec717fffe77fd7218b47d0b16025e3e680372109e

data/lib/dependabot/config.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+module Dependabot
+  module Config
+    class InvalidConfigError < StandardError; end
+  end
+end

data/lib/dependabot/config/file.rb

@@ -0,0 +1,54 @@
+# frozen_string_literal: true
+
+require "dependabot/config/update_config"
+
+module Dependabot
+  module Config
+    # Configuration for the repository, a parsed dependabot.yaml.
+    class File
+      attr_reader :updates, :registries
+
+      def initialize(updates:, registries: nil)
+        @updates = updates || []
+        @registries = registries || []
+      end
+
+      def update_config(package_manager, directory: nil, target_branch: nil)
+        dir = directory || "/"
+        package_ecosystem = PACKAGE_MANAGER_LOOKUP.invert.fetch(package_manager)
+        cfg = updates.find do |u|
+          u[:"package-ecosystem"] == package_ecosystem && u[:directory] == dir &&
+            (target_branch.nil? || u[:"target-branch"] == target_branch)
+        end
+        Dependabot::Config::UpdateConfig.new(cfg)
+      end
+
+      PACKAGE_MANAGER_LOOKUP = {
+        "bundler" => "bundler",
+        "cargo" => "cargo",
+        "composer" => "composer",
+        "docker" => "docker",
+        "elm" => "elm",
+        "github-actions" => "github_actions",
+        "gitsubmodule" => "submodules",
+        "gomod" => "go_modules",
+        "gradle" => "gradle",
+        "maven" => "maven",
+        "mix" => "hex",
+        "nuget" => "nuget",
+        "npm" => "npm_and_yarn",
+        "pip" => "pip",
+        "terraform" => "terraform"
+      }.freeze
+
+      # Parse the YAML config file
+      def self.parse(config)
+        parsed = YAML.safe_load(config, symbolize_names: true)
+        version = parsed[:version]
+        raise InvalidConfigError, "invalid version #{version}" if version && version != 2
+
+        File.new(updates: parsed[:updates], registries: parsed[:registries])
+      end
+    end
+  end
+end

data/lib/dependabot/config/file_fetcher.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+require "dependabot/file_fetchers/base"
+require "dependabot/config/file"
+
+module Dependabot
+  module Config
+    class FileFetcher < Dependabot::FileFetchers::Base
+      CONFIG_FILE_PATHS = %w(.github/dependabot.yml .github/dependabot.yaml).freeze
+
+      def self.required_files_in?(filenames)
+        CONFIG_FILE_PATHS.any? { |file| filenames.include?(file) }
+      end
+
+      def self.required_files_message
+        "Repo must contain either a #{CONFIG_FILE_PATHS.join(' or a ')} file"
+      end
+
+      def config_file
+        @config_file ||= files.first
+      end
+
+      private
+
+      def fetch_files
+        fetched_files = []
+
+        CONFIG_FILE_PATHS.each do |file|
+          fn = Pathname.new("/#{file}").relative_path_from(directory)
+
+          begin
+            config_file = fetch_file_from_host(fn)
+            if config_file
+              fetched_files << config_file
+              break
+            end
+          rescue Dependabot::DependencyFileNotFound
+            next
+          end
+        end
+
+        unless self.class.required_files_in?(fetched_files.map(&:name))
+          raise Dependabot::DependencyFileNotFound, self.class.required_files_message
+        end
+
+        fetched_files
+      end
+    end
+  end
+end

data/lib/dependabot/config/update_config.rb

@@ -0,0 +1,49 @@
+# frozen_string_literal: true
+
+module Dependabot
+  module Config
+    # Configuration for a single ecosystem
+    class UpdateConfig
+      module Interval
+        DAILY = "daily"
+        WEEKLY = "weekly"
+        MONTHLY = "monthly"
+      end
+
+      def initialize(config)
+        @config = config || {}
+      end
+
+      def ignored_versions_for(dep)
+        return [] unless @config[:ignore]
+
+        @config[:ignore].
+          select { |ic| ic[:"dependency-name"] == dep.name }. # FIXME: wildcard support
+          map { |ic| ic[:versions] }.
+          flatten
+      end
+
+      def commit_message_options
+        commit_message = @config[:"commit-message"] || {}
+        {
+          prefix: commit_message[:prefix],
+          prefix_development: commit_message[:"prefix-development"],
+          include_scope: commit_message[:include] == "scope"
+        }
+      end
+
+      def interval
+        return unless @config[:schedule]
+        return unless @config[:schedule][:interval]
+
+        interval = @config[:schedule][:interval]
+        case interval.downcase
+        when Interval::DAILY, Interval::WEEKLY, Interval::MONTHLY
+          interval.downcase
+        else
+          raise InvalidConfigError, "unknown interval: #{interval}"
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/file_fetchers/base.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require "dependabot/config"
 require "dependabot/dependency_file"
 require "dependabot/source"
 require "dependabot/errors"

data/lib/dependabot/git_commit_checker.rb

@@ -92,7 +92,7 @@ module Dependabot
         local_tags.
         select { |t| version_tag?(t.name) && matches_existing_prefix?(t.name) }
       filtered = tags.
-                 reject { |t| tag_included_in_ignore_reqs?(t) }
+                 reject { |t| tag_included_in_ignore_requirements?(t) }
       raise Dependabot::AllVersionsIgnored if @raise_on_ignored && tags.any? && filtered.empty?
 
       tag = filtered.
@@ -317,8 +317,8 @@ module Dependabot
       listing_repo_git_metadata_fetcher.upload_pack
     end
 
-    def ignore_reqs
-      ignored_versions.map { |req| requirement_class.new(req.split(",")) }
+    def ignore_requirements
+      ignored_versions.flat_map { |req| requirement_class.requirements_array(req) }
     end
 
     def wants_prerelease?
@@ -330,9 +330,9 @@ module Dependabot
       version_class.new(version).prerelease?
     end
 
-    def tag_included_in_ignore_reqs?(tag)
+    def tag_included_in_ignore_requirements?(tag)
       version = tag.name.match(VERSION_REGEX).named_captures.fetch("version")
-      ignore_reqs.any? { |r| r.satisfied_by?(version_class.new(version)) }
+      ignore_requirements.any? { |r| r.satisfied_by?(version_class.new(version)) }
     end
 
     def tag_is_prerelease?(tag)

data/lib/dependabot/pull_request_creator/branch_namer.rb

@@ -17,7 +17,6 @@ module Dependabot
         @prefix        = prefix
       end
 
-      # rubocop:disable Metrics/PerceivedComplexity
       def new_branch_name
         @name ||=
           begin
@@ -34,23 +33,13 @@ module Dependabot
                   tr("@", "")
               end
 
-            dep = dependencies.first
-
-            if library? && ref_changed?(dep) && new_ref(dep)
-              "#{dependency_name_part}-#{new_ref(dep)}"
-            elsif library?
-              "#{dependency_name_part}-#{sanitized_requirement(dep)}"
-            else
-              "#{dependency_name_part}-#{new_version(dep)}"
-            end
+            "#{dependency_name_part}-#{branch_version_suffix}"
           end
 
         # Some users need branch names without slashes
         sanitize_ref(File.join(prefixes, @name).gsub("/", separator))
       end
 
-      # rubocop:enable Metrics/PerceivedComplexity
-
       private
 
       def prefixes
@@ -98,6 +87,18 @@ module Dependabot
         @dependency_set
       end
 
+      def branch_version_suffix
+        dep = dependencies.first
+
+        if library? && ref_changed?(dep) && new_ref(dep)
+          new_ref(dep)
+        elsif library?
+          sanitized_requirement(dep)
+        else
+          new_version(dep)
+        end
+      end
+
       def sanitized_requirement(dependency)
         new_library_requirement(dependency).
           delete(" ").

data/lib/dependabot/update_checkers/base.rb

@@ -38,7 +38,7 @@ module Dependabot
 
       def can_update?(requirements_to_unlock:)
         # Can't update if all versions are being ignored
-        return false if ignore_reqs.include?(requirement_class.new(">= 0"))
+        return false if ignore_requirements.include?(requirement_class.new(">= 0"))
 
         if dependency.version
           version_can_update?(requirements_to_unlock: requirements_to_unlock)
@@ -141,6 +141,10 @@ module Dependabot
         security_advisories.any? { |a| a.vulnerable?(version) }
       end
 
+      def ignore_requirements
+        ignored_versions.flat_map { |req| requirement_class.requirements_array(req) }
+      end
+
       private
 
       def latest_version_resolvable_with_full_unlock?
@@ -296,10 +300,6 @@ module Dependabot
 
         changed_requirements.none? { |r| r[:requirement] == :unfixable }
       end
-
-      def ignore_reqs
-        ignored_versions.map { |req| requirement_class.new(req.split(",")) }
-      end
     end
   end
 end

data/lib/dependabot/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.142.1"
+  VERSION = "0.143.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.142.1
+  version: 0.143.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-04-16 00:00:00.000000000 Z
+date: 2021-04-21 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -298,14 +298,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.12.0
+        version: 1.13.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.12.0
+        version: 1.13.0
 - !ruby/object:Gem::Dependency
   name: simplecov
   requirement: !ruby/object:Gem::Requirement
@@ -391,6 +391,10 @@ files:
 - lib/dependabot/clients/codecommit.rb
 - lib/dependabot/clients/github_with_retries.rb
 - lib/dependabot/clients/gitlab_with_retries.rb
+- lib/dependabot/config.rb
+- lib/dependabot/config/file.rb
+- lib/dependabot/config/file_fetcher.rb
+- lib/dependabot/config/update_config.rb
 - lib/dependabot/dependency.rb
 - lib/dependabot/dependency_file.rb
 - lib/dependabot/errors.rb