dependabot-common 0.214.0 → 0.215.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1fab7bc375e03e37b65e94e3e05e7c9ad945d982295b6c9a030083ed038dbaf3
-  data.tar.gz: 9924a1980357d1833988bd19a8119a05162a28cc20cbdf157626744ef93be0ba
+  metadata.gz: e671c74d96743b47570682e512064ebb84774d5b63ce1090278f34d0f6ea857d
+  data.tar.gz: 32956c64580c84d9592253981318c2e442511988e21887f5c3bb5757d95adb2f
 SHA512:
-  metadata.gz: 88069b0acbe42180a064046ab55cba565da0f9a3e00d40582a3fb406aee9e3b357cf8e3bdf34dc84da959c931c1519a87e02022e994baf947193f7d6fb949be8
-  data.tar.gz: 785cddd10adbed3413e7fdfcbfcc9b5fa00fde7a55f6e171db0c62f4e4a9f17000dc06d7e4c75d312fda6c7801e9fa6428642ea2b3473dc1b4d7f14e0a660bff
+  metadata.gz: 35725326642881096654be6bf9e0278555078763c4003a676fcea4ae55115ecda3358866398f39ca5e0626853070e177b827f90d3f63b4701db1092a3bacc948
+  data.tar.gz: efbfb8bf7609d0ddae2e9294fedbcfd592b016c41cede8010760c8bb81d32ed005fafac040b98f9222310a92bec2c4ce9ec0c0dacfb459309ac85ea3e001538c

data/lib/dependabot/clients/github_with_retries.rb

@@ -6,16 +6,21 @@ module Dependabot
   module Clients
     class GithubWithRetries
       DEFAULT_OPEN_TIMEOUT_IN_SECONDS = 2
+      DEFAULT_READ_TIMEOUT_IN_SECONDS = 5
 
       def self.open_timeout_in_seconds
         ENV.fetch("DEPENDABOT_OPEN_TIMEOUT_IN_SECONDS", DEFAULT_OPEN_TIMEOUT_IN_SECONDS).to_i
       end
 
+      def self.read_timeout_in_seconds
+        ENV.fetch("DEPENDABOT_READ_TIMEOUT_IN_SECONDS", DEFAULT_READ_TIMEOUT_IN_SECONDS).to_i
+      end
+
       DEFAULT_CLIENT_ARGS = {
         connection_options: {
           request: {
             open_timeout: open_timeout_in_seconds,
-            timeout: 5
+            timeout: read_timeout_in_seconds
           }
         }
       }.freeze

data/lib/dependabot/file_updaters/vendor_updater.rb

@@ -23,7 +23,8 @@ module Dependabot
           # rubocop:enable Performance/DeletePrefix
 
           status = SharedHelpers.run_shell_command(
-            "git status --untracked-files all --porcelain v1 #{relative_dir}"
+            "git status --untracked-files all --porcelain v1 #{relative_dir}",
+            fingerprint: "git status --untracked-files all --porcelain v1 <relative_dir>"
           )
           changed_paths = status.split("\n").map(&:split)
           changed_paths.map do |type, path|

data/lib/dependabot/git_commit_checker.rb

@@ -99,12 +99,10 @@ module Dependabot
       local_repo_git_metadata_fetcher.head_commit_for_ref(name)
     end
 
-    def local_tag_for_latest_version_matching_existing_precision
-      max_local_tag_for_current_precision(allowed_version_tags)
-    end
-
     def local_ref_for_latest_version_matching_existing_precision
-      max_local_tag_for_current_precision(allowed_version_refs)
+      allowed_refs = local_tag_for_pinned_sha ? allowed_version_tags : allowed_version_refs
+
+      max_local_tag_for_current_precision(allowed_refs)
     end
 
     def local_tag_for_latest_version
@@ -151,6 +149,8 @@ module Dependabot
     end
 
     def local_tag_for_pinned_sha
+      return unless pinned_ref_looks_like_commit_sha?
+
       commit_sha = dependency_source_details.fetch(:ref)
       most_specific_version_tag_for_sha(commit_sha)
     end

data/lib/dependabot/shared_helpers.rb

@@ -59,12 +59,12 @@ module Dependabot
         super(message)
         @error_class = error_class || ""
         @error_context = error_context
-        @command = error_context[:command]
+        @fingerprint = error_context[:fingerprint] || error_context[:command]
         @trace = trace
       end
 
       def raven_context
-        { fingerprint: [@command], extra: @error_context }
+        { fingerprint: [@fingerprint], extra: @error_context.except(:stderr_output, :fingerprint) }
       end
     end
 
@@ -190,7 +190,8 @@ module Dependabot
       run_shell_command(
         "git config --global credential.helper " \
         "'!#{credential_helper_path} --file #{Dir.pwd}/git.store'",
-        allow_unsafe_shell_command: true
+        allow_unsafe_shell_command: true,
+        fingerprint: "git config --global credential.helper '<helper_command>'"
       )
 
       # see https://github.blog/2022-04-12-git-security-vulnerability-announced/
@@ -295,7 +296,7 @@ module Dependabot
       FileUtils.mv(backup_path, GIT_CONFIG_GLOBAL_PATH)
     end
 
-    def self.run_shell_command(command, allow_unsafe_shell_command: false, env: {})
+    def self.run_shell_command(command, allow_unsafe_shell_command: false, env: {}, fingerprint: nil)
       start = Time.now
       cmd = allow_unsafe_shell_command ? command : escape_command(command)
       stdout, process = Open3.capture2e(env || {}, cmd)
@@ -307,6 +308,7 @@ module Dependabot
 
       error_context = {
         command: cmd,
+        fingerprint: fingerprint,
         time_taken: time_taken,
         process_exit_value: process.to_s
       }

data/lib/dependabot/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.214.0"
+  VERSION = "0.215.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.214.0
+  version: 0.215.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-12-01 00:00:00.000000000 Z
+date: 2022-12-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport