dependabot-common 0.389.0 → 0.390.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b9781413c952e486c9417d63fc70301e7ba10d4283555831df79a6e9b5f2067d
-  data.tar.gz: f54e1d3bda0a1126fefa4246c4a7f0f30951bf5995711b4b376fdd152a81352b
+  metadata.gz: 9647e43655c1fb5b645ad6a5635c619fd681f12b926c6c2195492aba565b9401
+  data.tar.gz: b50b9ac87807039b87a1c2c34fe2620bf332ceb607cd0c1acfb32189e78e3705
 SHA512:
-  metadata.gz: 48591da2ac8712a8f2db6f9a8cd8c7c5debe954fa1470d7e6a625f18d5249e668cf5d48a338813c4c9ffe080d43628bf168d1dc81e463fa8753fc4edb819568e
-  data.tar.gz: 276ee23ea7c643fb0daac14664c83dea4c4fd4070bda5d616278d94eb01cad4722bd32d022667e5f9affe802dcb986c1131dbcb4c5a5eebef359854f0b83d136
+  metadata.gz: '0749c51d303699690aa4e89b2f29084d4082a83f1e1f986c023ad4089284a4a1b145729be61d8759f267c8951878a8c36537eb87037c59278f0fbd249daf71bb'
+  data.tar.gz: 8de0c799f886104e9cd1bedd0fad7ca6e004dec5adb6f939ada8b496d37b41e324a89065542f9603b011d3ef60a9105d397f22e1c24440c029752ce94b52a56d

data/lib/dependabot/dependency_requirement.rb

@@ -115,6 +115,44 @@ module Dependabot
       optional_object_hash(:metadata)
     end
 
+    # The source as a hash, or nil when the requirement has no source or
+    # names a registry as a bare string (e.g. Python's "internal" index).
+    sig { returns(T.nilable(ObjectHash)) }
+    def source_hash
+      value = source
+      return if value.nil? || value.is_a?(String)
+
+      value
+    end
+
+    # Reads a known source field such as "type", "ref", "url", or "digest".
+    # Accepts either key style because file parsers emit symbols while
+    # deserialised job definitions emit strings. Returns nil when the source
+    # is absent or a bare registry name.
+    sig { params(key: String).returns(T.nilable(String)) }
+    def source_string(key)
+      details = source_hash
+      return if details.nil?
+
+      value = details[key.to_sym] || details[key]
+      return if value.nil?
+      return value if value.is_a?(String)
+
+      raise TypeError, "source #{key} must be a string or nil"
+    end
+
+    # The requirement as a plain string. Nil when the requirement is absent,
+    # and a TypeError for the `:unfixable` sentinel, which callers that build
+    # manifest content cannot render.
+    sig { returns(T.nilable(String)) }
+    def requirement_string
+      value = requirement
+      return if value.nil?
+      return value if value.is_a?(String)
+
+      raise TypeError, "requirement must be a string or nil"
+    end
+
     private
 
     sig { params(key: Symbol).returns(T.nilable(String)) }

data/lib/dependabot/git_commit_checker.rb

@@ -48,7 +48,8 @@ module Dependabot
         ignored_versions: T::Array[String],
         raise_on_ignored: T::Boolean,
         consider_version_branches_pinned: T::Boolean,
-        dependency_source_details: T.nilable(T::Hash[Symbol, Object])
+        dependency_source_details: T.nilable(T::Hash[Symbol, Object]),
+        git_metadata_fetcher: T.nilable(Dependabot::GitMetadataFetcher)
       )
         .void
     end
@@ -58,7 +59,8 @@ module Dependabot
       ignored_versions: [],
       raise_on_ignored: false,
       consider_version_branches_pinned: false,
-      dependency_source_details: nil
+      dependency_source_details: nil,
+      git_metadata_fetcher: nil
     )
       @dependency = dependency
       @credentials = credentials
@@ -69,6 +71,7 @@ module Dependabot
         dependency_source_details && SourceDetails.from_hash(dependency_source_details),
         T.nilable(SourceDetails)
       )
+      @git_metadata_fetcher = git_metadata_fetcher
     end
 
     sig { returns(T::Boolean) }
@@ -918,7 +921,7 @@ module Dependabot
     def local_repo_git_metadata_fetcher
       @local_repo_git_metadata_fetcher ||=
         T.let(
-          GitMetadataFetcher.new(
+          @git_metadata_fetcher || GitMetadataFetcher.new(
             url: T.must(dependency_source_details&.url),
             credentials: credentials
           ),
@@ -930,10 +933,14 @@ module Dependabot
     def listing_repo_git_metadata_fetcher
       @listing_repo_git_metadata_fetcher ||=
         T.let(
-          GitMetadataFetcher.new(
-            url: T.must(listing_source_url),
-            credentials: credentials
-          ),
+          if @git_metadata_fetcher && listing_source_url == dependency_source_details&.url
+            @git_metadata_fetcher
+          else
+            GitMetadataFetcher.new(
+              url: T.must(listing_source_url),
+              credentials: credentials
+            )
+          end,
           T.nilable(Dependabot::GitMetadataFetcher)
         )
     end

data/lib/dependabot.rb

@@ -2,5 +2,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.389.0"
+  VERSION = "0.390.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.389.0
+  version: 0.390.0
 platform: ruby
 authors:
 - Dependabot
@@ -625,7 +625,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.389.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.390.0
 rdoc_options: []
 require_paths:
 - lib