dependabot-docker 0.207.0 → 0.210.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c9a1d777566ba278eab2e06a3498f71e91cdd35d050265f9091656f85135ea9f
-  data.tar.gz: d235d9cb2341ea6550a9456be349776f241bba41c3f935284181350801ff1480
+  metadata.gz: e4ddf4a4c6b6027ae68581a6cf6e8aab2223e15c5ab2c3206037a47f2862489d
+  data.tar.gz: d618678f873182d7e9551d7eab0177adc1e3d81052bba60c6f618a824773f331
 SHA512:
-  metadata.gz: b5d989f207e3d7aa3fe89aac7c55cc4ddfa584fa391c5718b38a4c2b551f6f2c61772e4cfa0aba3645923b2bba886458f89baa7b215796034abc58bd7eafe3f9
-  data.tar.gz: 7b751732ec705abc646bfece20f37833a0300bd2a041c585e2e4bb97f1d703b331ecbbc8f3c04afcaa0275effd51b6e3ee81d76a42227195b0b629d180d70a50
+  metadata.gz: 42860ccf2e85d2ddf2190d9baaa04926f04956a8e8245982c952104a8a182c00de3d44587c1efa5d680fbb2b74aeeb799fd08f8d7a6b22fc7c9275ca9614de74
+  data.tar.gz: 6321b1c1c824e8afb24f4c5eb4856e408e3cac41de4fb5ddd18f1471dbdaac9cd946f19f834714381354c2a904d20ebcb1f863af2c69b3d3819b71942b27882a

data/lib/dependabot/docker/file_fetcher.rb

@@ -6,27 +6,46 @@ require "dependabot/file_fetchers/base"
 module Dependabot
   module Docker
     class FileFetcher < Dependabot::FileFetchers::Base
+      YAML_REGEXP = /^[^\.]+\.ya?ml$/i.freeze
+      DOCKER_REGEXP = /dockerfile/i.freeze
+
       def self.required_files_in?(filenames)
-        filenames.any? { |f| f.match?(/dockerfile/i) }
+        filenames.any? { |f| f.match?(DOCKER_REGEXP) } or
+          filenames.any? { |f| f.match?(YAML_REGEXP) }
       end
 
       def self.required_files_message
-        "Repo must contain a Dockerfile."
+        "Repo must contain a Dockerfile or Kubernetes YAML files."
       end
 
       private
 
+      def kubernetes_enabled?
+        options.key?(:kubernetes_updates) && options[:kubernetes_updates]
+      end
+
       def fetch_files
         fetched_files = []
         fetched_files += correctly_encoded_dockerfiles
+        fetched_files += correctly_encoded_yamlfiles if kubernetes_enabled?
 
         return fetched_files if fetched_files.any?
 
-        if incorrectly_encoded_dockerfiles.none?
+        if !kubernetes_enabled? && incorrectly_encoded_dockerfiles.none?
           raise(
             Dependabot::DependencyFileNotFound,
             File.join(directory, "Dockerfile")
           )
+        elsif incorrectly_encoded_dockerfiles.none? && incorrectly_encoded_yamlfiles.none?
+          raise(
+            Dependabot::DependabotError,
+            "Found neither Kubernetes YAML nor Dockerfiles in #{directory}"
+          )
+        elsif incorrectly_encoded_dockerfiles.none?
+          raise(
+            Dependabot::DependencyFileNotParseable,
+            incorrectly_encoded_yamlfiles.first.path
+          )
         else
           raise(
             Dependabot::DependencyFileNotParseable,
@@ -38,7 +57,7 @@ module Dependabot
       def dockerfiles
         @dockerfiles ||=
           repo_contents(raise_errors: false).
-          select { |f| f.type == "file" && f.name.match?(/dockerfile/i) }.
+          select { |f| f.type == "file" && f.name.match?(DOCKER_REGEXP) }.
           map { |f| fetch_file_from_host(f.name) }
       end
 
@@ -49,6 +68,34 @@ module Dependabot
       def incorrectly_encoded_dockerfiles
         dockerfiles.reject { |f| f.content.valid_encoding? }
       end
+
+      def yamlfiles
+        @yamlfiles ||=
+          repo_contents(raise_errors: false).
+          select { |f| f.type == "file" && f.name.match?(YAML_REGEXP) }.
+          map { |f| fetch_file_from_host(f.name) }
+      end
+
+      def likely_kubernetes_resource?(resource)
+        # Heuristic for being a Kubernetes resource. We could make this tighter but this probably works well.
+        resource.is_a?(::Hash) && resource.key?("apiVersion") && resource.key?("kind")
+      end
+
+      def correctly_encoded_yamlfiles
+        candidate_files = yamlfiles.select { |f| f.content.valid_encoding? }
+        candidate_files.select do |f|
+          # This doesn't handle multi-resource files, but it shouldn't matter, since the first resource
+          # in a multi-resource file had better be a valid k8s resource
+          content = ::YAML.safe_load(f.content, aliases: true)
+          likely_kubernetes_resource?(content)
+        rescue ::Psych::Exception
+          false
+        end
+      end
+
+      def incorrectly_encoded_yamlfiles
+        yamlfiles.reject { |f| f.content.valid_encoding? }
+      end
     end
   end
 end

data/lib/dependabot/docker/file_parser.rb

@@ -34,6 +34,9 @@ module Dependabot
 
       AWS_ECR_URL = /dkr\.ecr\.(?<region>[^.]+)\.amazonaws\.com/.freeze
 
+      IMAGE_SPEC =
+        %r{^(#{REGISTRY}/)?#{IMAGE}#{TAG}?#{DIGEST}?#{NAME}?}x.freeze
+
       def parse
         dependency_set = DependencySet.new
 
@@ -61,15 +64,18 @@ module Dependabot
           end
         end
 
+        manifest_files.each do |file|
+          dependency_set += workfile_file_dependencies(file)
+        end
+
         dependency_set.dependencies
       end
 
       private
 
       def dockerfiles
-        # The Docker file fetcher only fetches Dockerfiles, so no need to
-        # filter here
-        dependency_files
+        # The Docker file fetcher fetches Dockerfiles and yaml files. Reject yaml files.
+        dependency_files.reject { |f| f.type == "file" && f.name.match?(/^[^\.]+\.ya?ml/i) }
       end
 
       def version_from(parsed_from_line)
@@ -154,6 +160,71 @@ module Dependabot
 
         raise "No Dockerfile!"
       end
+
+      def workfile_file_dependencies(file)
+        dependency_set = DependencySet.new
+
+        resources = file.content.split(/^---$/).map(&:strip).reject(&:empty?) # assuming a yaml file
+        resources.flat_map do |resource|
+          json = YAML.safe_load(resource, aliases: true)
+          images = deep_fetch_images(json).uniq
+
+          images.each do |string|
+            # TODO: Support Docker references and path references
+            details = string.match(IMAGE_SPEC).named_captures
+            details["registry"] = nil if details["registry"] == "docker.io"
+
+            version = version_from(details)
+            next unless version
+
+            dependency_set << build_image_dependency(file, details, version)
+          end
+        end
+
+        dependency_set
+      rescue Psych::SyntaxError, Psych::DisallowedClass, Psych::BadAlias
+        raise Dependabot::DependencyFileNotParseable, file.path
+      end
+
+      def build_image_dependency(file, details, version)
+        Dependency.new(
+          name: details.fetch("image"),
+          version: version,
+          package_manager: "docker",
+          requirements: [
+            requirement: nil,
+            groups: [],
+            file: file.name,
+            source: source_from(details)
+          ]
+        )
+      end
+
+      def deep_fetch_images(json_obj)
+        case json_obj
+        when Hash then deep_fetch_images_from_hash(json_obj)
+        when Array then json_obj.flat_map { |o| deep_fetch_images(o) }
+        else []
+        end
+      end
+
+      def deep_fetch_images_from_hash(json_object)
+        img = json_object.fetch("image", nil)
+
+        images =
+          if !img.nil? && img.is_a?(String) && !img.empty?
+            [img]
+          else
+            []
+          end
+
+        images + json_object.values.flat_map { |obj| deep_fetch_images(obj) }
+      end
+
+      def manifest_files
+        # Dependencies include both Dockerfiles and yaml, select yaml.
+        dependency_files.select { |f| f.type == "file" && f.name.match?(/^[^\.]+\.ya?ml/i) }
+      end
     end
   end
 end

data/lib/dependabot/docker/file_updater.rb

@@ -10,7 +10,10 @@ module Dependabot
       FROM_REGEX = /FROM(\s+--platform\=\S+)?/i.freeze
 
       def self.updated_files_regex
-        [/dockerfile/i]
+        [
+          /dockerfile/i,
+          /^[^\.]+\.ya?ml/i
+        ]
       end
 
       def updated_dependency_files
@@ -19,11 +22,17 @@ module Dependabot
         dependency_files.each do |file|
           next unless requirement_changed?(file, dependency)
 
-          updated_files <<
-            updated_file(
-              file: file,
-              content: updated_dockerfile_content(file)
-            )
+          updated_files << if file.name.match?(/^[^\.]+\.ya?ml/i)
+                             updated_file(
+                               file: file,
+                               content: updated_yaml_content(file)
+                             )
+                           else
+                             updated_file(
+                               file: file,
+                               content: updated_dockerfile_content(file)
+                             )
+                           end
         end
 
         updated_files.reject! { |f| dependency_files.include?(f) }
@@ -76,7 +85,11 @@ module Dependabot
 
         modified_content = file.content
 
-        old_tags.each do |old_tag|
+        new_tags = new_tags(file)
+
+        old_tags.zip(new_tags).each do |old_tag, new_tag|
+          new_tag ||= new_tags.first
+
           old_declaration =
             if private_registry_url(file) then "#{private_registry_url(file)}/"
             else
@@ -90,7 +103,7 @@ module Dependabot
 
           modified_content = modified_content.
                              gsub(old_declaration_regex) do |old_dec|
-            old_dec.gsub(":#{old_tag}", ":#{new_tag(file)}")
+            old_dec.gsub(":#{old_tag}", ":#{new_tag}")
           end
         end
 
@@ -120,10 +133,10 @@ module Dependabot
           fetch(:source).fetch(:digest)
       end
 
-      def new_tag(file)
+      def new_tags(file)
         dependency.requirements.
-          find { |r| r[:file] == file.name }.
-          fetch(:source)[:tag]
+          select { |r| r[:file] == file.name }.
+          map { |r| r.fetch(:source)[:tag] }
       end
 
       def old_tags(file)
@@ -138,6 +151,48 @@ module Dependabot
           find { |r| r[:file] == file.name }.
           fetch(:source)[:registry]
       end
+
+      def updated_yaml_content(file)
+        updated_content = update_image(file)
+
+        raise "Expected content to change!" if updated_content == file.content
+
+        updated_content
+      end
+
+      def update_image(file)
+        old_images = old_yaml_images(file)
+        return if old_images.empty?
+
+        modified_content = file.content
+
+        old_images.each do |old_image|
+          old_image_regex = /^\s+(?:-\s)?image:\s+#{old_image}(?=\s|$)/
+          modified_content = modified_content.gsub(old_image_regex) do |old_img|
+            old_img.gsub(old_image.to_s, new_yaml_image(file).to_s)
+          end
+        end
+        modified_content
+      end
+
+      def new_yaml_image(file)
+        elt = dependency.requirements.find { |r| r[:file] == file.name }
+        prefix = elt.fetch(:source)[:registry] ? "#{elt.fetch(:source)[:registry]}/" : ""
+        digest = elt.fetch(:source)[:digest] ? "@#{elt.fetch(:source)[:digest]}" : ""
+        tag = elt.fetch(:source)[:tag] ? ":#{elt.fetch(:source)[:tag]}" : ""
+        "#{prefix}#{dependency.name}#{tag}#{digest}"
+      end
+
+      def old_yaml_images(file)
+        dependency.
+          previous_requirements.
+          select { |r| r[:file] == file.name }.map do |r|
+            prefix = r.fetch(:source)[:registry] ? "#{r.fetch(:source)[:registry]}/" : ""
+            digest = r.fetch(:source)[:digest] ? "@#{r.fetch(:source)[:digest]}" : ""
+            tag = r.fetch(:source)[:tag] ? ":#{r.fetch(:source)[:tag]}" : ""
+            "#{prefix}#{dependency.name}#{tag}#{digest}"
+          end
+      end
     end
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-docker
 version: !ruby/object:Gem::Version
-  version: 0.207.0
+  version: 0.210.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-08-11 00:00:00.000000000 Z
+date: 2022-08-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.207.0
+        version: 0.210.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.207.0
+        version: 0.210.0
 - !ruby/object:Gem::Dependency
   name: debase
   requirement: !ruby/object:Gem::Requirement
@@ -80,6 +80,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '2.0'
+- !ruby/object:Gem::Dependency
+  name: parallel_tests
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 3.11.1
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 3.11.1
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
@@ -128,14 +142,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.33.0
+        version: 1.35.1
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.33.0
+        version: 1.35.1
 - !ruby/object:Gem::Dependency
   name: ruby-debug-ide
   requirement: !ruby/object:Gem::Requirement