dependabot-docker 0.208.0 → 0.209.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1c6ea326363b1f3e9c5f5adb5d511b47f3fb6c8b863c9f49b8a87d8a1f8b346c
-  data.tar.gz: 138ffefc8d307fa05faf9668ef7abc32029c2d752957429bfdf71c4e1d40932d
+  metadata.gz: 00f4377178bcfeb2dab9cd43cfc073184f3889bfc58c6775e43cb4af74d6d51a
+  data.tar.gz: 4688f5144e93f55a744a5c78b0f27b0c976147ac0f947b7898525dbdee4dc77a
 SHA512:
-  metadata.gz: 36ec21f80adb2c26514407aa8377cb0dfd98941514a88077bed177fae7b87d326352d5c8a5702de4a12c2d4062c71074aa297c15c09272856d137d8ddac13d03
-  data.tar.gz: 57fa148d7b13064b4367ca8dee1fab920f12c4c5d3ee5936ecb6378cd2eb4b25870392911439256b835ff0d7118a07f967a795df8d1923f7b207f809357d7369
+  metadata.gz: '08567ef1cd81d990857e8f028ec982fdb263469a3eab619cc84cdc4deb6d7bed1d5d85135d9585f88871404279bf6be47571b7896a92c5e32952f99df0aee821'
+  data.tar.gz: 04b846444b46050a0a899f7a510a07b7be67e97e60e3fbea3d5d822940a45b9301f86bd0a37d36e4a4e97d369acd8ab92e9a25ba4263facd2b322db4dd4bf9af

data/lib/dependabot/docker/file_fetcher.rb

@@ -6,27 +6,46 @@ require "dependabot/file_fetchers/base"
 module Dependabot
   module Docker
     class FileFetcher < Dependabot::FileFetchers::Base
+      YAML_REGEXP = /^[^\.]+\.ya?ml$/i.freeze
+      DOCKER_REGEXP = /dockerfile/i.freeze
+
       def self.required_files_in?(filenames)
-        filenames.any? { |f| f.match?(/dockerfile/i) }
+        filenames.any? { |f| f.match?(DOCKER_REGEXP) } or
+          filenames.any? { |f| f.match?(YAML_REGEXP) }
       end
 
       def self.required_files_message
-        "Repo must contain a Dockerfile."
+        "Repo must contain a Dockerfile or Kubernetes YAML files."
       end
 
       private
 
+      def kubernetes_enabled?
+        options.key?(:kubernetes_updates) && options[:kubernetes_updates]
+      end
+
       def fetch_files
         fetched_files = []
         fetched_files += correctly_encoded_dockerfiles
+        fetched_files += correctly_encoded_yamlfiles if kubernetes_enabled?
 
         return fetched_files if fetched_files.any?
 
-        if incorrectly_encoded_dockerfiles.none?
+        if !kubernetes_enabled? && incorrectly_encoded_dockerfiles.none?
           raise(
             Dependabot::DependencyFileNotFound,
             File.join(directory, "Dockerfile")
           )
+        elsif incorrectly_encoded_dockerfiles.none? && incorrectly_encoded_yamlfiles.none?
+          raise(
+            Dependabot::DependabotError,
+            "Found neither Kubernetes YAML nor Dockerfiles in #{directory}"
+          )
+        elsif incorrectly_encoded_dockerfiles.none?
+          raise(
+            Dependabot::DependencyFileNotParseable,
+            incorrectly_encoded_yamlfiles.first.path
+          )
         else
           raise(
             Dependabot::DependencyFileNotParseable,
@@ -38,7 +57,7 @@ module Dependabot
       def dockerfiles
         @dockerfiles ||=
           repo_contents(raise_errors: false).
-          select { |f| f.type == "file" && f.name.match?(/dockerfile/i) }.
+          select { |f| f.type == "file" && f.name.match?(DOCKER_REGEXP) }.
           map { |f| fetch_file_from_host(f.name) }
       end
 
@@ -49,6 +68,34 @@ module Dependabot
       def incorrectly_encoded_dockerfiles
         dockerfiles.reject { |f| f.content.valid_encoding? }
       end
+
+      def yamlfiles
+        @yamlfiles ||=
+          repo_contents(raise_errors: false).
+          select { |f| f.type == "file" && f.name.match?(YAML_REGEXP) }.
+          map { |f| fetch_file_from_host(f.name) }
+      end
+
+      def likely_kubernetes_resource?(resource)
+        # Heuristic for being a Kubernetes resource. We could make this tighter but this probably works well.
+        resource.is_a?(::Hash) && resource.key?("apiVersion") && resource.key?("kind")
+      end
+
+      def correctly_encoded_yamlfiles
+        candidate_files = yamlfiles.select { |f| f.content.valid_encoding? }
+        candidate_files.select do |f|
+          # This doesn't handle multi-resource files, but it shouldn't matter, since the first resource
+          # in a multi-resource file had better be a valid k8s resource
+          content = ::YAML.safe_load(f.content, aliases: true)
+          likely_kubernetes_resource?(content)
+        rescue ::Psych::Exception
+          false
+        end
+      end
+
+      def incorrectly_encoded_yamlfiles
+        yamlfiles.reject { |f| f.content.valid_encoding? }
+      end
     end
   end
 end

data/lib/dependabot/docker/file_parser.rb

@@ -34,6 +34,9 @@ module Dependabot
 
       AWS_ECR_URL = /dkr\.ecr\.(?<region>[^.]+)\.amazonaws\.com/.freeze
 
+      IMAGE_SPEC =
+        %r{^(#{REGISTRY}/)?#{IMAGE}#{TAG}?#{DIGEST}?#{NAME}?}x.freeze
+
       def parse
         dependency_set = DependencySet.new
 
@@ -61,15 +64,18 @@ module Dependabot
           end
         end
 
+        manifest_files.each do |file|
+          dependency_set += workfile_file_dependencies(file)
+        end
+
         dependency_set.dependencies
       end
 
       private
 
       def dockerfiles
-        # The Docker file fetcher only fetches Dockerfiles, so no need to
-        # filter here
-        dependency_files
+        # The Docker file fetcher fetches Dockerfiles and yaml files. Reject yaml files.
+        dependency_files.reject { |f| f.type == "file" && f.name.match?(/^[^\.]+\.ya?ml/i) }
       end
 
       def version_from(parsed_from_line)
@@ -154,6 +160,71 @@ module Dependabot
 
         raise "No Dockerfile!"
       end
+
+      def workfile_file_dependencies(file)
+        dependency_set = DependencySet.new
+
+        resources = file.content.split(/^---$/).map(&:strip).reject(&:empty?) # assuming a yaml file
+        resources.flat_map do |resource|
+          json = YAML.safe_load(resource, aliases: true)
+          images = deep_fetch_images(json).uniq
+
+          images.each do |string|
+            # TODO: Support Docker references and path references
+            details = string.match(IMAGE_SPEC).named_captures
+            details["registry"] = nil if details["registry"] == "docker.io"
+
+            version = version_from(details)
+            next unless version
+
+            dependency_set << build_image_dependency(file, details, version)
+          end
+        end
+
+        dependency_set
+      rescue Psych::SyntaxError, Psych::DisallowedClass, Psych::BadAlias
+        raise Dependabot::DependencyFileNotParseable, file.path
+      end
+
+      def build_image_dependency(file, details, version)
+        Dependency.new(
+          name: details.fetch("image"),
+          version: version,
+          package_manager: "docker",
+          requirements: [
+            requirement: nil,
+            groups: [],
+            file: file.name,
+            source: source_from(details)
+          ]
+        )
+      end
+
+      def deep_fetch_images(json_obj)
+        case json_obj
+        when Hash then deep_fetch_images_from_hash(json_obj)
+        when Array then json_obj.flat_map { |o| deep_fetch_images(o) }
+        else []
+        end
+      end
+
+      def deep_fetch_images_from_hash(json_object)
+        img = json_object.fetch("image", nil)
+
+        images =
+          if !img.nil? && img.is_a?(String) && !img.empty?
+            [img]
+          else
+            []
+          end
+
+        images + json_object.values.flat_map { |obj| deep_fetch_images(obj) }
+      end
+
+      def manifest_files
+        # Dependencies include both Dockerfiles and yaml, select yaml.
+        dependency_files.select { |f| f.type == "file" && f.name.match?(/^[^\.]+\.ya?ml/i) }
+      end
     end
   end
 end

data/lib/dependabot/docker/file_updater.rb

@@ -10,7 +10,10 @@ module Dependabot
       FROM_REGEX = /FROM(\s+--platform\=\S+)?/i.freeze
 
       def self.updated_files_regex
-        [/dockerfile/i]
+        [
+          /dockerfile/i,
+          /^[^\.]+\.ya?ml/i
+        ]
       end
 
       def updated_dependency_files
@@ -19,11 +22,17 @@ module Dependabot
         dependency_files.each do |file|
           next unless requirement_changed?(file, dependency)
 
-          updated_files <<
-            updated_file(
-              file: file,
-              content: updated_dockerfile_content(file)
-            )
+          updated_files << if file.name.match?(/^[^\.]+\.ya?ml/i)
+                             updated_file(
+                               file: file,
+                               content: updated_yaml_content(file)
+                             )
+                           else
+                             updated_file(
+                               file: file,
+                               content: updated_dockerfile_content(file)
+                             )
+                           end
         end
 
         updated_files.reject! { |f| dependency_files.include?(f) }
@@ -138,6 +147,49 @@ module Dependabot
           find { |r| r[:file] == file.name }.
           fetch(:source)[:registry]
       end
+
+      def updated_yaml_content(file)
+        updated_content = update_image(file)
+
+        raise "Expected content to change!" if updated_content == file.content
+
+        updated_content
+      end
+
+      def update_image(file)
+        old_images = old_yaml_images(file)
+        return if old_images.empty?
+
+        modified_content = file.content
+
+        old_images.each do |old_image|
+          old_image_regex = /^\s+image:\s+#{old_image}(?=\s|$)/
+          modified_content = modified_content.gsub(old_image_regex) do |old_img|
+            old_img.gsub(old_image.to_s, new_yaml_image(file).to_s)
+          end
+        end
+
+        modified_content
+      end
+
+      def new_yaml_image(file)
+        elt = dependency.requirements.find { |r| r[:file] == file.name }
+        prefix = elt.fetch(:source)[:registry] ? "#{elt.fetch(:source)[:registry]}/" : ""
+        digest = elt.fetch(:source)[:digest] ? "@#{elt.fetch(:source)[:digest]}" : ""
+        tag = elt.fetch(:source)[:tag] ? ":#{elt.fetch(:source)[:tag]}" : ""
+        "#{prefix}#{dependency.name}#{tag}#{digest}"
+      end
+
+      def old_yaml_images(file)
+        dependency.
+          previous_requirements.
+          select { |r| r[:file] == file.name }.map do |r|
+            prefix = r.fetch(:source)[:registry] ? "#{r.fetch(:source)[:registry]}/" : ""
+            digest = r.fetch(:source)[:digest] ? "@#{r.fetch(:source)[:digest]}" : ""
+            tag = r.fetch(:source)[:tag] ? ":#{r.fetch(:source)[:tag]}" : ""
+            "#{prefix}#{dependency.name}#{tag}#{digest}"
+          end
+      end
     end
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-docker
 version: !ruby/object:Gem::Version
-  version: 0.208.0
+  version: 0.209.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-08-16 00:00:00.000000000 Z
+date: 2022-08-17 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.208.0
+        version: 0.209.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.208.0
+        version: 0.209.0
 - !ruby/object:Gem::Dependency
   name: debase
   requirement: !ruby/object:Gem::Requirement