dependabot-conda 0.325.1

data/lib/dependabot/conda/metadata_finder.rb

@@ -0,0 +1,71 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+require "dependabot/metadata_finders"
+require "dependabot/metadata_finders/base"
+require "dependabot/conda/python_package_classifier"
+require "dependabot/python/metadata_finder"
+
+module Dependabot
+  module Conda
+    class MetadataFinder < Dependabot::MetadataFinders::Base
+      extend T::Sig
+
+      sig { override.returns(T.nilable(String)) }
+      def homepage_url
+        return super unless python_package?(dependency.name)
+
+        # Delegate to Python metadata finder for enhanced PyPI-based homepage URLs
+        python_metadata_finder.homepage_url
+      end
+
+      private
+
+      sig { override.returns(T.nilable(Dependabot::Source)) }
+      def look_up_source
+        return nil unless python_package?(dependency.name)
+
+        # Delegate to Python metadata finder for Python packages
+        python_metadata_finder.send(:look_up_source)
+      end
+
+      sig { params(package_name: String).returns(T::Boolean) }
+      def python_package?(package_name)
+        PythonPackageClassifier.python_package?(package_name)
+      end
+
+      sig { returns(Dependabot::Python::MetadataFinder) }
+      def python_metadata_finder
+        # Cache the Python metadata finder instance for reuse across method calls
+        # Credentials are passed through as-is since conda manifests don't specify pip-index credentials
+        # TODO: If we decide to support non python packages for Conda we will have to review this
+        @python_metadata_finder ||= T.let(
+          Dependabot::Python::MetadataFinder.new(
+            dependency: python_dependency,
+            credentials: credentials
+          ),
+          T.nilable(Dependabot::Python::MetadataFinder)
+        )
+        @python_metadata_finder
+      end
+
+      sig { returns(Dependabot::Dependency) }
+      def python_dependency
+        Dependabot::Dependency.new(
+          name: dependency.name,
+          version: dependency.version,
+          requirements: dependency.requirements.map do |req|
+            req.merge(
+              file: req[:file]&.gsub(/environment\.ya?ml/, "requirements.txt"),
+              source: nil # No private pip-index in conda manifests
+            )
+          end,
+          package_manager: "pip"
+        )
+      end
+    end
+  end
+end
+
+Dependabot::MetadataFinders.register("conda", Dependabot::Conda::MetadataFinder)

data/lib/dependabot/conda/name_normaliser.rb

@@ -0,0 +1,19 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+
+module Dependabot
+  module Conda
+    class NameNormaliser
+      extend T::Sig
+
+      sig { params(name: String).returns(String) }
+      def self.normalise(name)
+        # Conda package names follow similar rules to Python packages
+        # Convert to lowercase and replace underscores/dots with hyphens
+        name.downcase.tr("_.", "-")
+      end
+    end
+  end
+end

data/lib/dependabot/conda/package_manager.rb

@@ -0,0 +1,45 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+require "dependabot/ecosystem"
+require "dependabot/conda/version"
+
+module Dependabot
+  module Conda
+    ECOSYSTEM = "conda"
+
+    SUPPORTED_VERSIONS = T.let([].freeze, T::Array[Dependabot::Version])
+    DEPRECATED_VERSIONS = T.let([].freeze, T::Array[Dependabot::Version])
+
+    class CondaPackageManager < Dependabot::Ecosystem::VersionManager
+      extend T::Sig
+
+      NAME = "conda"
+      VERSION = "latest"
+
+      SUPPORTED_VERSIONS = T.let([].freeze, T::Array[Dependabot::Version])
+      DEPRECATED_VERSIONS = T.let([].freeze, T::Array[Dependabot::Version])
+
+      sig { void }
+      def initialize
+        super(
+          name: NAME,
+          version: Dependabot::Conda::Version.new(VERSION),
+          deprecated_versions: DEPRECATED_VERSIONS,
+          supported_versions: SUPPORTED_VERSIONS
+        )
+      end
+
+      sig { override.returns(T::Boolean) }
+      def deprecated?
+        false
+      end
+
+      sig { override.returns(T::Boolean) }
+      def unsupported?
+        false
+      end
+    end
+  end
+end

data/lib/dependabot/conda/python_package_classifier.rb

@@ -0,0 +1,85 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+
+module Dependabot
+  module Conda
+    class PythonPackageClassifier
+      extend T::Sig
+
+      # Known non-Python packages that should be ignored
+      NON_PYTHON_PATTERNS = T.let([
+        /^r-/i,           # R packages (r-base, r-essentials, etc.)
+        /^r$/i,           # R language itself
+        /^python$/i,      # Python interpreter (conda-specific, not on PyPI)
+        /^git$/i,         # Git version control
+        /^gcc$/i,         # GCC compiler
+        /^cmake$/i,       # CMake build system
+        /^make$/i,        # Make build tool
+        /^curl$/i,        # cURL utility
+        /^wget$/i,        # Wget utility
+        /^vim$/i,         # Vim editor
+        /^nano$/i,        # Nano editor
+        /^nodejs$/i,      # Node.js runtime
+        /^java$/i,        # Java runtime
+        /^go$/i,          # Go language
+        /^rust$/i,        # Rust language
+        /^julia$/i,       # Julia language
+        /^perl$/i,        # Perl language
+        /^ruby$/i,        # Ruby language
+        # System libraries
+        /^openssl$/i,     # OpenSSL
+        /^zlib$/i,        # zlib compression
+        /^libffi$/i,      # Foreign Function Interface library
+        /^ncurses$/i,     # Terminal control library
+        /^readline$/i,    # Command line editing
+        # Compiler and build tools
+        /^_libgcc_mutex$/i,
+        /^_openmp_mutex$/i,
+        /^binutils$/i,
+        /^gxx_linux-64$/i,
+        # Multimedia libraries
+        /^ffmpeg$/i,      # Video processing
+        /^opencv$/i,      # Computer vision (note: opencv-python is different)
+        /^imageio$/i      # Image I/O (note: imageio python package is different)
+      ].freeze, T::Array[Regexp])
+
+      # Determine if a package name represents a Python package
+      sig { params(package_name: String).returns(T::Boolean) }
+      def self.python_package?(package_name)
+        return false if package_name.empty?
+
+        # Extract just the package name without version or channel information
+        normalized_name = extract_package_name(package_name).downcase.strip
+        return false if normalized_name.empty?
+
+        # Check if it's explicitly a non-Python package
+        return false if NON_PYTHON_PATTERNS.any? { |pattern| normalized_name.match?(pattern) }
+
+        # Block obvious binary/system files
+        return false if normalized_name.match?(/\.(exe|dll|so|dylib)$/i)
+        return false if normalized_name.match?(/^lib.+\.a$/i) # Static libraries
+
+        # Block system mutexes
+        return false if normalized_name.match?(/^_[a-z0-9]+_mutex$/i)
+
+        # Default: treat as Python package
+        # This aligns with the strategic decision to focus on Python packages
+        # Most packages in conda environments are Python packages
+        true
+      end
+
+      # Extract package name from conda specification (remove channel prefix if present)
+      sig { params(spec: String).returns(String) }
+      def self.extract_package_name(spec)
+        # Handle channel specifications like "conda-forge::numpy=1.21.0"
+        parts = spec.split("::")
+        package_spec = parts.last || spec
+
+        # Extract package name (before = or space or version operators)
+        package_spec.split(/[=<>!~\s]/).first&.strip || spec
+      end
+    end
+  end
+end

data/lib/dependabot/conda/requirement.rb

@@ -0,0 +1,133 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+require "dependabot/requirement"
+require "dependabot/python/version"
+require "dependabot/conda/version"
+
+module Dependabot
+  module Conda
+    class Requirement < Dependabot::Requirement
+      extend T::Sig
+
+      # Conda uses different operators than pip:
+      # conda: =, >=, >, <, <=, !=, ~
+      # pip: ==, >=, >, <, <=, !=, ~=
+
+      # Support both conda and pip operators
+      OPS = T.let(OPS.merge(
+                    "=" => ->(v, r) { v == r },         # conda equality
+                    "==" => ->(v, r) { v == r },        # pip equality
+                    "~=" => ->(v, r) { v >= r && v.release < r.bump } # pip compatible release
+                  ), T::Hash[String, T.proc.params(arg0: T.untyped, arg1: T.untyped).returns(T.untyped)])
+
+      quoted = OPS.keys.sort_by(&:length).reverse
+                  .map { |k| Regexp.quote(k) }.join("|")
+      # Use Python version pattern since conda version inherits from it
+      version_pattern = Dependabot::Python::Version::VERSION_PATTERN
+
+      PATTERN_RAW = T.let("\\s*(?<op>#{quoted})?\\s*(?<version>#{version_pattern})\\s*".freeze, String)
+      PATTERN = T.let(/\A#{PATTERN_RAW}\z/, Regexp)
+
+      sig { params(obj: T.any(Gem::Version, String)).returns([String, Gem::Version]) }
+      def self.parse(obj)
+        return ["=", obj] if obj.is_a?(Gem::Version)
+
+        unless (matches = PATTERN.match(obj.to_s))
+          msg = "Illformed requirement [#{obj.inspect}]"
+          raise BadRequirementError, msg
+        end
+
+        return DefaultRequirement if matches[:op] == ">=" && matches[:version] == "0"
+
+        [matches[:op] || "=", Dependabot::Conda::Version.new(T.must(matches[:version]))]
+      end
+
+      sig { override.params(requirement_string: T.nilable(String)).returns(T::Array[Requirement]) }
+      def self.requirements_array(requirement_string)
+        return [new(nil)] if requirement_string.nil?
+
+        # Handle complex requirements like ">=1.0.0,<2.0.0"
+        requirement_string.strip.split(",").map do |req_string|
+          new(req_string.strip)
+        end
+      end
+
+      sig { params(requirements: T.nilable(T.any(String, T::Array[String]))).void }
+      def initialize(*requirements)
+        @original_string = T.let(requirements.first&.to_s, T.nilable(String))
+
+        requirements = requirements.flatten.flat_map do |req_string|
+          next if req_string.nil?
+
+          # Handle complex requirements and convert to Ruby-compatible format
+          req_string.split(",").map(&:strip).map do |r|
+            convert_conda_constraint_to_ruby_constraint(r)
+          end
+        end.compact
+
+        super(requirements)
+      end
+
+      sig { params(version: T.any(Gem::Version, String)).returns(T::Boolean) }
+      def satisfied_by?(version)
+        version = Dependabot::Conda::Version.new(version.to_s)
+
+        requirements.all? { |op, rv| T.must(OPS[op] || OPS["="]).call(version, rv) }
+      end
+
+      sig { returns(T::Boolean) }
+      def exact?
+        return false unless requirements.size == 1
+
+        %w(= == ===).include?(requirements[0][0])
+      end
+
+      sig { returns(String) }
+      def to_s
+        @original_string || super
+      end
+
+      private
+
+      sig { params(req_string: String).returns(T.nilable(T.any(String, T::Array[String]))) }
+      def convert_conda_constraint_to_ruby_constraint(req_string)
+        return nil if req_string.strip.empty?
+        return nil if req_string == "*"
+
+        # Handle conda wildcard patterns like "=1.2.*"
+        return convert_wildcard_requirement(req_string) if req_string.match?(/=\s*\d+(\.\d+)*\.\*/)
+
+        # Handle pip-style compatible release operator
+        req_string = req_string.gsub("~=", "~>") if req_string.include?("~=")
+
+        # Convert conda single = to Ruby = for internal processing
+        req_string
+      end
+
+      sig { params(req_string: String).returns(T.any(String, T::Array[String])) }
+      def convert_wildcard_requirement(req_string)
+        # Convert "=1.2.*" to appropriate range constraints
+        version_part = req_string.gsub(/^=\s*/, "").gsub(/\.\*$/, "")
+        parts = version_part.split(".")
+
+        if parts.length == 1
+          # "=1.*" becomes ">= 1.0.0, < 2.0.0"
+          major = parts[0].to_i
+          [">= #{major}.0.0", "< #{major + 1}.0.0"]
+        elsif parts.length == 2
+          # "=1.2.*" becomes ">= 1.2.0, < 1.3.0"
+          major = parts[0].to_i
+          minor = parts[1].to_i
+          [">= #{major}.#{minor}.0", "< #{major}.#{minor + 1}.0"]
+        else
+          # Fallback to exact match without wildcard
+          "= #{version_part}.0"
+        end
+      end
+    end
+  end
+end
+
+Dependabot::Utils.register_requirement_class("conda", Dependabot::Conda::Requirement)

data/lib/dependabot/conda/update_checker/latest_version_finder.rb

@@ -0,0 +1,91 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+require "dependabot/package/package_latest_version_finder"
+require "dependabot/python/update_checker/latest_version_finder"
+require "dependabot/dependency"
+require_relative "requirement_translator"
+
+module Dependabot
+  module Conda
+    class UpdateChecker
+      class LatestVersionFinder < Dependabot::Package::PackageLatestVersionFinder
+        extend T::Sig
+
+        sig do
+          params(
+            dependency: Dependabot::Dependency,
+            dependency_files: T::Array[Dependabot::DependencyFile],
+            credentials: T::Array[Dependabot::Credential],
+            ignored_versions: T::Array[String],
+            raise_on_ignored: T::Boolean,
+            security_advisories: T::Array[Dependabot::SecurityAdvisory],
+            cooldown_options: T.nilable(Dependabot::Package::ReleaseCooldownOptions)
+          ).void
+        end
+        def initialize(dependency:, dependency_files:, credentials:,
+                       ignored_versions:, raise_on_ignored:, security_advisories:,
+                       cooldown_options:)
+          @raise_on_ignored = T.let(raise_on_ignored, T::Boolean)
+          @cooldown_options = T.let(cooldown_options, T.nilable(Dependabot::Package::ReleaseCooldownOptions))
+
+          super
+        end
+
+        sig { override.returns(T.nilable(Dependabot::Package::PackageDetails)) }
+        def package_details
+          @package_details ||= python_latest_version_finder.package_details
+        end
+
+        sig { override.returns(T::Boolean) }
+        def cooldown_enabled?
+          true
+        end
+
+        private
+
+        sig { returns(Dependabot::Python::UpdateChecker::LatestVersionFinder) }
+        def python_latest_version_finder
+          @python_latest_version_finder ||= T.let(
+            Dependabot::Python::UpdateChecker::LatestVersionFinder.new(
+              dependency: python_compatible_dependency,
+              dependency_files: dependency_files,
+              credentials: credentials,
+              ignored_versions: ignored_versions,
+              raise_on_ignored: @raise_on_ignored,
+              security_advisories: security_advisories,
+              cooldown_options: @cooldown_options
+            ),
+            T.nilable(Dependabot::Python::UpdateChecker::LatestVersionFinder)
+          )
+        end
+
+        sig { returns(Dependabot::Dependency) }
+        def python_compatible_dependency
+          # Convert conda dependency to python-compatible dependency
+          Dependabot::Dependency.new(
+            name: dependency.name,
+            version: dependency.version,
+            requirements: python_compatible_requirements,
+            package_manager: "pip" # Use pip for PyPI compatibility
+          )
+        end
+
+        sig { returns(T::Array[T::Hash[Symbol, T.untyped]]) }
+        def python_compatible_requirements
+          dependency.requirements.map do |req|
+            req.merge(
+              requirement: convert_conda_requirement_to_pip(req[:requirement])
+            )
+          end
+        end
+
+        sig { params(conda_requirement: T.nilable(String)).returns(T.nilable(String)) }
+        def convert_conda_requirement_to_pip(conda_requirement)
+          RequirementTranslator.conda_to_pip(conda_requirement)
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/conda/update_checker/requirement_translator.rb

@@ -0,0 +1,57 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+
+module Dependabot
+  module Conda
+    class UpdateChecker
+      class RequirementTranslator
+        extend T::Sig
+
+        # Convert conda-style requirements to pip-compatible requirements
+        sig { params(conda_requirement: T.nilable(String)).returns(T.nilable(String)) }
+        def self.conda_to_pip(conda_requirement)
+          return nil unless conda_requirement
+
+          # Handle different conda requirement patterns
+          case conda_requirement
+          when /^=([0-9]+(?:\.[0-9]+)*)\.\*$/
+            # Handle wildcards: =1.21.* -> >=1.21.0,<1.22.0
+            convert_wildcard_requirement(conda_requirement)
+          when /^=([0-9]+(?:\.[0-9]+)*)$/
+            # Handle exact equality: =1.2.3 -> ==1.2.3
+            conda_requirement.gsub(/^=/, "==")
+          when /^(>=|>|<=|<|!=)(.+)$/
+            # Handle comparison operators: >=1.2.0 -> >=1.2.0 (no change)
+            conda_requirement
+          when /^([0-9]+(?:\.[0-9]+)*)$/
+            # Handle bare version: 1.2.3 -> ==1.2.3
+            "==#{conda_requirement}"
+          else
+            # Handle complex constraints: >=3.8,<3.11 -> >=3.8,<3.11 (no change)
+            conda_requirement
+          end
+        end
+
+        sig { params(wildcard_requirement: String).returns(String) }
+        def self.convert_wildcard_requirement(wildcard_requirement)
+          # Extract version pattern: =1.21.* -> 1.21
+          version_match = wildcard_requirement.match(/^=([0-9]+(?:\.[0-9]+)*)\.\*$/)
+          return wildcard_requirement unless version_match
+
+          base_version = version_match[1]
+          version_parts = T.must(base_version).split(".")
+
+          # Calculate next version for upper bound
+          next_version_parts = version_parts.dup
+          next_version_parts[-1] = (next_version_parts[-1].to_i + 1).to_s
+          next_version = next_version_parts.join(".")
+
+          # Return range: >=1.21.0,<1.22.0
+          ">=#{base_version}.0,<#{next_version}.0"
+        end
+      end
+    end
+  end
+end