dependabot-docker 0.208.0 → 0.211.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1c6ea326363b1f3e9c5f5adb5d511b47f3fb6c8b863c9f49b8a87d8a1f8b346c
-  data.tar.gz: 138ffefc8d307fa05faf9668ef7abc32029c2d752957429bfdf71c4e1d40932d
+  metadata.gz: 6c194c165762186cd5b9ca1048491778c1a49b1ea11d19a23c44e7eb501e6231
+  data.tar.gz: '09532e3bed9e17abe29e4c1667d1918025f081973af0eef0178477f3cd7a6919'
 SHA512:
-  metadata.gz: 36ec21f80adb2c26514407aa8377cb0dfd98941514a88077bed177fae7b87d326352d5c8a5702de4a12c2d4062c71074aa297c15c09272856d137d8ddac13d03
-  data.tar.gz: 57fa148d7b13064b4367ca8dee1fab920f12c4c5d3ee5936ecb6378cd2eb4b25870392911439256b835ff0d7118a07f967a795df8d1923f7b207f809357d7369
+  metadata.gz: e7108f82ff87b6962c1f1ec837da3078cac2c0ee1d3dddcaf0956256c5ceaf26846be9e0e7674346cdcaf19f681fa0bfd04f15d26a803b2a58c54a826f4694f0
+  data.tar.gz: 639d3a059228017338711f8292a7d2a8154b9cf9b857d2177a12ceaf0fd00f57045d3a870652b8e638fbd8e73dd2436cb6c6e5cb77a0ecdbda99c761707785a7

data/lib/dependabot/docker/file_fetcher.rb

@@ -6,27 +6,46 @@ require "dependabot/file_fetchers/base"
 module Dependabot
   module Docker
     class FileFetcher < Dependabot::FileFetchers::Base
+      YAML_REGEXP = /^[^\.]+\.ya?ml$/i.freeze
+      DOCKER_REGEXP = /dockerfile/i.freeze
+
       def self.required_files_in?(filenames)
-        filenames.any? { |f| f.match?(/dockerfile/i) }
+        filenames.any? { |f| f.match?(DOCKER_REGEXP) } or
+          filenames.any? { |f| f.match?(YAML_REGEXP) }
       end
 
       def self.required_files_message
-        "Repo must contain a Dockerfile."
+        "Repo must contain a Dockerfile or Kubernetes YAML files."
       end
 
       private
 
+      def kubernetes_enabled?
+        options.key?(:kubernetes_updates) && options[:kubernetes_updates]
+      end
+
       def fetch_files
         fetched_files = []
         fetched_files += correctly_encoded_dockerfiles
+        fetched_files += correctly_encoded_yamlfiles if kubernetes_enabled?
 
         return fetched_files if fetched_files.any?
 
-        if incorrectly_encoded_dockerfiles.none?
+        if !kubernetes_enabled? && incorrectly_encoded_dockerfiles.none?
           raise(
             Dependabot::DependencyFileNotFound,
             File.join(directory, "Dockerfile")
           )
+        elsif incorrectly_encoded_dockerfiles.none? && incorrectly_encoded_yamlfiles.none?
+          raise(
+            Dependabot::DependabotError,
+            "Found neither Kubernetes YAML nor Dockerfiles in #{directory}"
+          )
+        elsif incorrectly_encoded_dockerfiles.none?
+          raise(
+            Dependabot::DependencyFileNotParseable,
+            incorrectly_encoded_yamlfiles.first.path
+          )
         else
           raise(
             Dependabot::DependencyFileNotParseable,
@@ -38,7 +57,7 @@ module Dependabot
       def dockerfiles
         @dockerfiles ||=
           repo_contents(raise_errors: false).
-          select { |f| f.type == "file" && f.name.match?(/dockerfile/i) }.
+          select { |f| f.type == "file" && f.name.match?(DOCKER_REGEXP) }.
           map { |f| fetch_file_from_host(f.name) }
       end
 
@@ -49,6 +68,34 @@ module Dependabot
       def incorrectly_encoded_dockerfiles
         dockerfiles.reject { |f| f.content.valid_encoding? }
       end
+
+      def yamlfiles
+        @yamlfiles ||=
+          repo_contents(raise_errors: false).
+          select { |f| f.type == "file" && f.name.match?(YAML_REGEXP) }.
+          map { |f| fetch_file_from_host(f.name) }
+      end
+
+      def likely_kubernetes_resource?(resource)
+        # Heuristic for being a Kubernetes resource. We could make this tighter but this probably works well.
+        resource.is_a?(::Hash) && resource.key?("apiVersion") && resource.key?("kind")
+      end
+
+      def correctly_encoded_yamlfiles
+        candidate_files = yamlfiles.select { |f| f.content.valid_encoding? }
+        candidate_files.select do |f|
+          # This doesn't handle multi-resource files, but it shouldn't matter, since the first resource
+          # in a multi-resource file had better be a valid k8s resource
+          content = ::YAML.safe_load(f.content, aliases: true)
+          likely_kubernetes_resource?(content)
+        rescue ::Psych::Exception
+          false
+        end
+      end
+
+      def incorrectly_encoded_yamlfiles
+        yamlfiles.reject { |f| f.content.valid_encoding? }
+      end
     end
   end
 end

data/lib/dependabot/docker/file_parser.rb

@@ -34,6 +34,9 @@ module Dependabot
 
       AWS_ECR_URL = /dkr\.ecr\.(?<region>[^.]+)\.amazonaws\.com/.freeze
 
+      IMAGE_SPEC =
+        %r{^(#{REGISTRY}/)?#{IMAGE}#{TAG}?#{DIGEST}?#{NAME}?}x.freeze
+
       def parse
         dependency_set = DependencySet.new
 
@@ -61,15 +64,18 @@ module Dependabot
           end
         end
 
+        manifest_files.each do |file|
+          dependency_set += workfile_file_dependencies(file)
+        end
+
         dependency_set.dependencies
       end
 
       private
 
       def dockerfiles
-        # The Docker file fetcher only fetches Dockerfiles, so no need to
-        # filter here
-        dependency_files
+        # The Docker file fetcher fetches Dockerfiles and yaml files. Reject yaml files.
+        dependency_files.reject { |f| f.type == "file" && f.name.match?(/^[^\.]+\.ya?ml/i) }
       end
 
       def version_from(parsed_from_line)
@@ -154,6 +160,71 @@ module Dependabot
 
         raise "No Dockerfile!"
       end
+
+      def workfile_file_dependencies(file)
+        dependency_set = DependencySet.new
+
+        resources = file.content.split(/^---$/).map(&:strip).reject(&:empty?) # assuming a yaml file
+        resources.flat_map do |resource|
+          json = YAML.safe_load(resource, aliases: true)
+          images = deep_fetch_images(json).uniq
+
+          images.each do |string|
+            # TODO: Support Docker references and path references
+            details = string.match(IMAGE_SPEC).named_captures
+            details["registry"] = nil if details["registry"] == "docker.io"
+
+            version = version_from(details)
+            next unless version
+
+            dependency_set << build_image_dependency(file, details, version)
+          end
+        end
+
+        dependency_set
+      rescue Psych::SyntaxError, Psych::DisallowedClass, Psych::BadAlias
+        raise Dependabot::DependencyFileNotParseable, file.path
+      end
+
+      def build_image_dependency(file, details, version)
+        Dependency.new(
+          name: details.fetch("image"),
+          version: version,
+          package_manager: "docker",
+          requirements: [
+            requirement: nil,
+            groups: [],
+            file: file.name,
+            source: source_from(details)
+          ]
+        )
+      end
+
+      def deep_fetch_images(json_obj)
+        case json_obj
+        when Hash then deep_fetch_images_from_hash(json_obj)
+        when Array then json_obj.flat_map { |o| deep_fetch_images(o) }
+        else []
+        end
+      end
+
+      def deep_fetch_images_from_hash(json_object)
+        img = json_object.fetch("image", nil)
+
+        images =
+          if !img.nil? && img.is_a?(String) && !img.empty?
+            [img]
+          else
+            []
+          end
+
+        images + json_object.values.flat_map { |obj| deep_fetch_images(obj) }
+      end
+
+      def manifest_files
+        # Dependencies include both Dockerfiles and yaml, select yaml.
+        dependency_files.select { |f| f.type == "file" && f.name.match?(/^[^\.]+\.ya?ml/i) }
+      end
     end
   end
 end

data/lib/dependabot/docker/file_updater.rb

@@ -10,7 +10,10 @@ module Dependabot
       FROM_REGEX = /FROM(\s+--platform\=\S+)?/i.freeze
 
       def self.updated_files_regex
-        [/dockerfile/i]
+        [
+          /dockerfile/i,
+          /^[^\.]+\.ya?ml/i
+        ]
       end
 
       def updated_dependency_files
@@ -19,11 +22,17 @@ module Dependabot
         dependency_files.each do |file|
           next unless requirement_changed?(file, dependency)
 
-          updated_files <<
-            updated_file(
-              file: file,
-              content: updated_dockerfile_content(file)
-            )
+          updated_files << if file.name.match?(/^[^\.]+\.ya?ml/i)
+                             updated_file(
+                               file: file,
+                               content: updated_yaml_content(file)
+                             )
+                           else
+                             updated_file(
+                               file: file,
+                               content: updated_dockerfile_content(file)
+                             )
+                           end
         end
 
         updated_files.reject! { |f| dependency_files.include?(f) }
@@ -76,7 +85,11 @@ module Dependabot
 
         modified_content = file.content
 
-        old_tags.each do |old_tag|
+        new_tags = new_tags(file)
+
+        old_tags.zip(new_tags).each do |old_tag, new_tag|
+          new_tag ||= new_tags.first
+
           old_declaration =
             if private_registry_url(file) then "#{private_registry_url(file)}/"
             else
@@ -90,7 +103,7 @@ module Dependabot
 
           modified_content = modified_content.
                              gsub(old_declaration_regex) do |old_dec|
-            old_dec.gsub(":#{old_tag}", ":#{new_tag(file)}")
+            old_dec.gsub(":#{old_tag}", ":#{new_tag}")
           end
         end
 
@@ -120,10 +133,10 @@ module Dependabot
           fetch(:source).fetch(:digest)
       end
 
-      def new_tag(file)
+      def new_tags(file)
         dependency.requirements.
-          find { |r| r[:file] == file.name }.
-          fetch(:source)[:tag]
+          select { |r| r[:file] == file.name }.
+          map { |r| r.fetch(:source)[:tag] }
       end
 
       def old_tags(file)
@@ -138,6 +151,48 @@ module Dependabot
           find { |r| r[:file] == file.name }.
           fetch(:source)[:registry]
       end
+
+      def updated_yaml_content(file)
+        updated_content = update_image(file)
+
+        raise "Expected content to change!" if updated_content == file.content
+
+        updated_content
+      end
+
+      def update_image(file)
+        old_images = old_yaml_images(file)
+        return if old_images.empty?
+
+        modified_content = file.content
+
+        old_images.each do |old_image|
+          old_image_regex = /^\s+(?:-\s)?image:\s+#{old_image}(?=\s|$)/
+          modified_content = modified_content.gsub(old_image_regex) do |old_img|
+            old_img.gsub(old_image.to_s, new_yaml_image(file).to_s)
+          end
+        end
+        modified_content
+      end
+
+      def new_yaml_image(file)
+        elt = dependency.requirements.find { |r| r[:file] == file.name }
+        prefix = elt.fetch(:source)[:registry] ? "#{elt.fetch(:source)[:registry]}/" : ""
+        digest = elt.fetch(:source)[:digest] ? "@#{elt.fetch(:source)[:digest]}" : ""
+        tag = elt.fetch(:source)[:tag] ? ":#{elt.fetch(:source)[:tag]}" : ""
+        "#{prefix}#{dependency.name}#{tag}#{digest}"
+      end
+
+      def old_yaml_images(file)
+        dependency.
+          previous_requirements.
+          select { |r| r[:file] == file.name }.map do |r|
+            prefix = r.fetch(:source)[:registry] ? "#{r.fetch(:source)[:registry]}/" : ""
+            digest = r.fetch(:source)[:digest] ? "@#{r.fetch(:source)[:digest]}" : ""
+            tag = r.fetch(:source)[:tag] ? ":#{r.fetch(:source)[:tag]}" : ""
+            "#{prefix}#{dependency.name}#{tag}#{digest}"
+          end
+      end
     end
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-docker
 version: !ruby/object:Gem::Version
-  version: 0.208.0
+  version: 0.211.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-08-16 00:00:00.000000000 Z
+date: 2022-08-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.208.0
+        version: 0.211.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.208.0
+        version: 0.211.0
 - !ruby/object:Gem::Dependency
   name: debase
   requirement: !ruby/object:Gem::Requirement
@@ -80,6 +80,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '2.0'
+- !ruby/object:Gem::Dependency
+  name: parallel_tests
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 3.11.1
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 3.11.1
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
@@ -128,14 +142,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.33.0
+        version: 1.35.1
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.33.0
+        version: 1.35.1
 - !ruby/object:Gem::Dependency
   name: ruby-debug-ide
   requirement: !ruby/object:Gem::Requirement