dependabot-common 0.95.33 → 0.95.34

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8dfd5401844f55514737de21d8b0a99447d9645417c07fdc8f823ffa10e8f433
-  data.tar.gz: 2e7f54e29584a74139a356065c9fba6ee14e15033dc898b1ffa2824ea6192676
+  metadata.gz: 9d3d3f49b2d13d093c0c8494171c48203613f0ea6205d31c960e553a6e092b14
+  data.tar.gz: cbf675a4f176c180ba658e6fe41726be6f82c4663fac58390695da6eba81acd1
 SHA512:
-  metadata.gz: ed6f3c654bfa794abcb9cf057dc81e7423206ed487aee599d929af2479c7b25c2dc303bc261ddaefbaa373fef6691a921ce73bed052e7f36707b4047856a1f38
-  data.tar.gz: 807133c70b3bad038db7f8aac333196e4bd8d455b9a8bfa9685c329784b2d5d147aebdcc125d96600654a437deccdf4a4d3c86044aa32d7a6d1e458a92e07767
+  metadata.gz: 94918b26c0036cae34aa8111b97e66a656a693c2a81d0a78ed05fa1ccc90565fe160b9aa0734c50a1df0b2683e5ab8b4191adb5215e4a11a4949de96de8eef96
+  data.tar.gz: dd5633fa6f0ae81aeb5a405d90f8aabf6c49680b6560325adb4db3067a7ebc5dac1c86a0b119a2643acd45d5c4fe85994c21d43ee14e5c253cf049a4b832f84e

data/lib/dependabot/metadata_finders/base.rb

@@ -9,6 +9,8 @@ module Dependabot
       require "dependabot/metadata_finders/base/release_finder"
       require "dependabot/metadata_finders/base/commits_finder"
 
+      PACKAGE_MANAGERS_WITH_RELIABLE_DIRECTORIES = %w(npm_and_yarn).freeze
+
       attr_reader :dependency, :credentials
 
       def initialize(dependency:, credentials:)
@@ -17,7 +19,11 @@ module Dependabot
       end
 
       def source_url
-        source&.url
+        if reliable_source_directory?
+          source&.url_with_directory
+        else
+          source&.url
+        end
       end
 
       def homepage_url
@@ -112,6 +118,11 @@ module Dependabot
       def look_up_source
         raise NotImplementedError
       end
+
+      def reliable_source_directory?
+        MetadataFinders::Base::PACKAGE_MANAGERS_WITH_RELIABLE_DIRECTORIES.
+          include?(dependency.package_manager)
+      end
     end
   end
 end

data/lib/dependabot/metadata_finders/base/commits_finder.rb

@@ -145,12 +145,17 @@ module Dependabot
 
         def github_compare_path(new_tag, previous_tag)
           if new_tag && previous_tag
-            "compare/#{previous_tag}...#{new_tag}"
-          elsif new_tag
-            "commits/#{new_tag}"
-          else
-            "commits"
+            return "compare/#{previous_tag}...#{new_tag}"
           end
+
+          unless reliable_source_directory? &&
+                 ![nil, ".", "/"].include?(source.directory)
+            return new_tag ? "commits/#{new_tag}" : "commits"
+          end
+
+          Pathname.
+            new(File.join("commits/#{new_tag || 'HEAD'}", source.directory)).
+            cleanpath.to_path
         end
 
         def bitbucket_compare_path(new_tag, previous_tag)
@@ -244,6 +249,11 @@ module Dependabot
             dependency.package_manager
           )
         end
+
+        def reliable_source_directory?
+          MetadataFinders::Base::PACKAGE_MANAGERS_WITH_RELIABLE_DIRECTORIES.
+            include?(dependency.package_manager)
+        end
       end
     end
   end

data/lib/dependabot/source.rb

@@ -36,7 +36,8 @@ module Dependabot
       (?:#{AZURE_SOURCE})
     /x.freeze
 
-    attr_reader :provider, :repo, :directory, :branch, :hostname, :api_endpoint
+    attr_accessor :provider, :repo, :directory, :branch, :hostname,
+                  :api_endpoint
 
     def self.from_url(url_string)
       return unless url_string&.match?(SOURCE_REGEX)
@@ -78,6 +79,24 @@ module Dependabot
       end
     end
 
+    def url_with_directory
+      return url if [nil, ".", "/"].include?(directory)
+
+      case provider
+      when "github", "gitlab"
+        path = Pathname.new(File.join("tree/#{branch || 'HEAD'}", directory)).
+               cleanpath.to_path
+        url + "/" + path
+      when "bitbucket"
+        path = Pathname.new(File.join("src/#{branch || 'default'}", directory)).
+               cleanpath.to_path
+        url + "/" + path
+      when "azure"
+        url + "?path=#{directory}"
+      else raise "Unexpected repo provider '#{provider}'"
+      end
+    end
+
     def organization
       repo.split("/").first
     end

data/lib/dependabot/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.95.33"
+  VERSION = "0.95.34"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.95.33
+  version: 0.95.34
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-02-16 00:00:00.000000000 Z
+date: 2019-02-17 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aws-sdk-ecr