dependabot-docker_compose 0.298.0 → 0.299.0

data/lib/dependabot/shared/shared_file_parser.rb

@@ -1,80 +0,0 @@
-# typed: strong
-# frozen_string_literal: true
-
-require "dependabot/dependency"
-require "dependabot/file_parsers"
-require "dependabot/file_parsers/base"
-require "sorbet-runtime"
-
-module Dependabot
-  module Shared
-    class SharedFileParser < Dependabot::FileParsers::Base
-      extend T::Sig
-      extend T::Helpers
-
-      abstract!
-
-      require "dependabot/file_parsers/base/dependency_set"
-
-      # Details of Docker regular expressions is at
-      # https://github.com/docker/distribution/blob/master/reference/regexp.go
-      DOMAIN_COMPONENT = /(?:[[:alnum:]]|[[:alnum:]][[[:alnum:]]-]*[[:alnum:]])/
-      DOMAIN = /(?:#{DOMAIN_COMPONENT}(?:\.#{DOMAIN_COMPONENT})+)/
-      REGISTRY = /(?<registry>#{DOMAIN}(?::\d+)?)/
-
-      NAME_COMPONENT = /(?:[a-z\d]+(?:(?:[._]|__|[-]*)[a-z\d]+)*)/
-      IMAGE = %r{(?<image>#{NAME_COMPONENT}(?:/#{NAME_COMPONENT})*)}
-
-      TAG = /:(?<tag>[\w][\w.-]{0,127})/
-      DIGEST = /@(?<digest>[^\s]+)/
-      NAME = /\s+AS\s+(?<name>[\w-]+)/
-
-      protected
-
-      sig { params(parsed_line: T::Hash[String, T.nilable(String)]).returns(T.nilable(String)) }
-      def version_from(parsed_line)
-        parsed_line.fetch("tag") || parsed_line.fetch("digest")
-      end
-
-      sig { params(parsed_line: T::Hash[String, T.nilable(String)]).returns(T::Hash[String, T.nilable(String)]) }
-      def source_from(parsed_line)
-        source = {}
-
-        source[:registry] = parsed_line.fetch("registry") if parsed_line.fetch("registry")
-        source[:tag] = parsed_line.fetch("tag") if parsed_line.fetch("tag")
-        source[:digest] = parsed_line.fetch("digest") if parsed_line.fetch("digest")
-
-        source
-      end
-
-      sig do
-        params(file: Dependabot::DependencyFile, details: T::Hash[String, T.nilable(String)],
-               version: String).returns(Dependabot::Dependency)
-      end
-      def build_dependency(file, details, version)
-        Dependency.new(
-          name: T.must(details.fetch("image")),
-          version: version,
-          package_manager: package_manager,
-          requirements: [
-            requirement: nil,
-            groups: [],
-            file: file.name,
-            source: source_from(details)
-          ]
-        )
-      end
-
-      private
-
-      sig { override.void }
-      def check_required_files; end
-
-      sig { abstract.returns(String) }
-      def package_manager; end
-
-      sig { abstract.returns(String) }
-      def file_type; end
-    end
-  end
-end

data/lib/dependabot/shared/shared_file_updater.rb

@@ -1,261 +0,0 @@
-# typed: strict
-# frozen_string_literal: true
-
-require "dependabot/file_updaters"
-require "dependabot/file_updaters/base"
-require "dependabot/errors"
-require "sorbet-runtime"
-require "dependabot/shared/utils/helpers"
-
-module Dependabot
-  module Shared
-    class SharedFileUpdater < Dependabot::FileUpdaters::Base
-      extend T::Sig
-      extend T::Helpers
-
-      abstract!
-
-      FROM_REGEX = /FROM(\s+--platform\=\S+)?/i
-
-      sig { override.returns(T::Array[Dependabot::DependencyFile]) }
-      def updated_dependency_files
-        updated_files = []
-        dependency_files.each do |file|
-          next unless requirement_changed?(file, T.must(dependency))
-
-          updated_files << if file.name.match?(T.must(yaml_file_pattern))
-                             updated_file(
-                               file: file,
-                               content: T.must(updated_yaml_content(file))
-                             )
-                           else
-                             updated_file(
-                               file: file,
-                               content: T.must(updated_dockerfile_content(file))
-                             )
-                           end
-        end
-
-        updated_files.reject! { |f| dependency_files.include?(f) }
-        raise "No files changed!" if updated_files.none?
-
-        updated_files
-      end
-
-      sig { abstract.returns(T.nilable(Regexp)) }
-      def yaml_file_pattern; end
-
-      sig { abstract.returns(T.nilable(Regexp)) }
-      def container_image_regex; end
-
-      private
-
-      sig { params(file: Dependabot::DependencyFile).returns(T.nilable(String)) }
-      def updated_dockerfile_content(file)
-        old_sources = previous_sources(file)
-        new_sources = sources(file)
-
-        updated_content = T.let(file.content, T.untyped)
-
-        T.must(old_sources).zip(new_sources).each do |old_source, new_source|
-          updated_content = update_digest_and_tag(updated_content, old_source, T.must(new_source))
-        end
-
-        raise "Expected content to change!" if updated_content == file.content
-
-        updated_content
-      end
-
-      sig do
-        params(previous_content: String, old_source: T::Hash[Symbol, T.nilable(String)],
-               new_source: T::Hash[Symbol, T.nilable(String)]).returns(String)
-      end
-      def update_digest_and_tag(previous_content, old_source, new_source)
-        old_digest = old_source[:digest]
-        new_digest = new_source[:digest]
-
-        old_tag = old_source[:tag]
-        new_tag = new_source[:tag]
-
-        old_declaration =
-          if private_registry_url(old_source)
-            "#{private_registry_url(old_source)}/"
-          else
-            ""
-          end
-        old_declaration += T.must(dependency).name
-        old_declaration +=
-          if specified_with_tag?(old_source)
-            ":#{old_tag}"
-          else
-            ""
-          end
-        old_declaration +=
-          if specified_with_digest?(old_source)
-            "@sha256:#{old_digest}"
-          else
-            ""
-          end
-
-        escaped_declaration = Regexp.escape(old_declaration)
-
-        old_declaration_regex = build_old_declaration_regex(escaped_declaration)
-
-        previous_content.gsub(old_declaration_regex) do |old_dec|
-          old_dec
-            .gsub("@sha256:#{old_digest}", "@sha256:#{new_digest}")
-            .gsub(":#{old_tag}", ":#{new_tag}")
-        end
-      end
-
-      sig { params(escaped_declaration: String).returns(Regexp) }
-      def build_old_declaration_regex(escaped_declaration)
-        %r{^#{FROM_REGEX}\s+(docker\.io/)?#{escaped_declaration}(?=\s|$)}
-      end
-
-      sig { params(file: Dependabot::DependencyFile).returns(T.nilable(String)) }
-      def updated_yaml_content(file)
-        updated_content = file.content
-        updated_content = update_helm(file, updated_content) if Shared::Utils.likely_helm_chart?(file)
-        updated_content = update_image(file, updated_content)
-
-        raise "Expected content to change!" if updated_content == file.content
-
-        updated_content
-      end
-
-      sig { params(file: Dependabot::DependencyFile, content: T.nilable(String)).returns(T.nilable(String)) }
-      def update_helm(file, content)
-        old_tags = old_helm_tags(file)
-        return if old_tags.empty?
-
-        modified_content = content
-
-        old_tags.each do |old_tag|
-          old_tag_regex = /^\s*(?:-\s)?(?:tag|version):\s+["']?#{old_tag}["']?(?=\s|$)/
-          modified_content = modified_content&.gsub(old_tag_regex) do |old_img_tag|
-            old_img_tag.gsub(old_tag.to_s, new_helm_tag(file).to_s)
-          end
-        end
-        modified_content
-      end
-
-      sig { params(file: Dependabot::DependencyFile, content: T.nilable(String)).returns(T.nilable(String)) }
-      def update_image(file, content)
-        old_images = old_yaml_images(file)
-        return if old_images.empty?
-
-        modified_content = content
-
-        old_images.each do |old_image|
-          old_image_regex = /^\s*(?:-\s)?image:\s+#{old_image}(?=\s|$)/
-          modified_content = modified_content&.gsub(old_image_regex) do |old_img|
-            old_img.gsub(old_image.to_s, new_yaml_image(file).to_s)
-          end
-        end
-        modified_content
-      end
-
-      sig { params(file: Dependabot::DependencyFile).returns(String) }
-      def new_yaml_image(file)
-        element = T.must(dependency).requirements.find { |r| r[:file] == file.name }
-        prefix = element&.dig(:source, :registry) ? "#{element.fetch(:source)[:registry]}/" : ""
-        digest = element&.dig(:source, :digest) ? "@sha256:#{element.fetch(:source)[:digest]}" : ""
-        tag = element&.dig(:source, :tag) ? ":#{element.fetch(:source)[:tag]}" : ""
-        "#{prefix}#{T.must(dependency).name}#{tag}#{digest}"
-      end
-
-      sig { params(file: Dependabot::DependencyFile).returns(T::Array[String]) }
-      def old_yaml_images(file)
-        T.must(previous_requirements(file)).map do |r|
-          prefix = r.fetch(:source)[:registry] ? "#{r.fetch(:source)[:registry]}/" : ""
-          digest = r.fetch(:source)[:digest] ? "@sha256:#{r.fetch(:source)[:digest]}" : ""
-          tag = r.fetch(:source)[:tag] ? ":#{r.fetch(:source)[:tag]}" : ""
-          "#{prefix}#{T.must(dependency).name}#{tag}#{digest}"
-        end
-      end
-
-      sig { params(file: Dependabot::DependencyFile).returns(T::Array[String]) }
-      def old_helm_tags(file)
-        T.must(previous_requirements(file)).map do |r|
-          tag = r.fetch(:source)[:tag] || ""
-          digest = r.fetch(:source)[:digest] ? "@sha256:#{r.fetch(:source)[:digest]}" : ""
-          "#{tag}#{digest}"
-        end
-      end
-
-      sig { params(file: Dependabot::DependencyFile).returns(String) }
-      def new_helm_tag(file)
-        element = T.must(dependency).requirements.find { |r| r[:file] == file.name }
-        tag = T.must(element).dig(:source, :tag) || ""
-        digest = T.must(element).dig(:source, :digest) ? "@sha256:#{T.must(element).dig(:source, :digest)}" : ""
-        "#{tag}#{digest}"
-      end
-
-      protected
-
-      sig { params(file: Dependabot::DependencyFile, dependency: Dependabot::Dependency).returns(T::Boolean) }
-      def requirement_changed?(file, dependency)
-        changed_requirements =
-          dependency.requirements - T.must(dependency.previous_requirements)
-
-        changed_requirements.any? { |f| f[:file] == file.name }
-      end
-
-      sig { params(source: T::Hash[Symbol, T.nilable(String)]).returns(T::Boolean) }
-      def specified_with_tag?(source)
-        !source[:tag].nil?
-      end
-
-      sig { params(source: T::Hash[Symbol, T.nilable(String)]).returns(T::Boolean) }
-      def specified_with_digest?(source)
-        !source[:digest].nil?
-      end
-
-      sig { params(file: Dependabot::DependencyFile).returns(T::Array[T::Hash[Symbol, T.untyped]]) }
-      def requirements(file)
-        T.must(dependency).requirements
-         .select { |r| r[:file] == file.name }
-      end
-
-      sig { params(file: Dependabot::DependencyFile).returns(T.nilable(T::Array[T::Hash[Symbol, T.untyped]])) }
-      def previous_requirements(file)
-        T.must(dependency).previous_requirements
-         &.select { |r| r[:file] == file.name }
-      end
-
-      sig { params(source: T::Hash[Symbol, T.nilable(String)]).returns(T.nilable(String)) }
-      def private_registry_url(source)
-        source[:registry]
-      end
-
-      sig { params(file: Dependabot::DependencyFile).returns(T::Array[T::Hash[Symbol, T.nilable(String)]]) }
-      def sources(file)
-        requirements(file).map { |r| r.fetch(:source) }
-      end
-
-      sig { params(file: Dependabot::DependencyFile).returns(T.nilable(T::Array[T::Hash[Symbol, T.nilable(String)]])) }
-      def previous_sources(file)
-        previous_requirements(file)&.map { |r| r.fetch(:source) }
-      end
-
-      sig { returns(T.nilable(Dependabot::Dependency)) }
-      def dependency
-        # Files will only ever be updating a single dependency
-        dependencies.first
-      end
-
-      sig { override.void }
-      def check_required_files
-        return if dependency_files.any?
-
-        raise "No #{file_type}!"
-      end
-
-      private
-
-      sig { abstract.returns(String) }
-      def file_type; end
-    end
-  end
-end

data/lib/dependabot/shared/utils/credentials_finder.rb

@@ -1,101 +0,0 @@
-# typed: strict
-# frozen_string_literal: true
-
-require "aws-sdk-ecr"
-require "base64"
-require "sorbet-runtime"
-
-require "dependabot/credential"
-require "dependabot/errors"
-
-module Dependabot
-  module Shared
-    module Utils
-      class CredentialsFinder
-        extend T::Sig
-
-        AWS_ECR_URL = /dkr\.ecr\.(?<region>[^.]+)\.amazonaws\.com/
-        DEFAULT_DOCKER_HUB_REGISTRY = "registry.hub.docker.com"
-
-        sig { params(credentials: T::Array[Dependabot::Credential]).void }
-        def initialize(credentials)
-          @credentials = credentials
-        end
-
-        sig { params(registry_hostname: T.nilable(String)).returns(T.nilable(Dependabot::Credential)) }
-        def credentials_for_registry(registry_hostname)
-          registry_details =
-            credentials
-            .select { |cred| cred["type"] == "docker_registry" }
-            .find { |cred| cred.fetch("registry") == registry_hostname }
-          return unless registry_details
-          return registry_details unless registry_hostname&.match?(AWS_ECR_URL)
-
-          build_aws_credentials(registry_details)
-        end
-
-        sig { returns(T.nilable(String)) }
-        def base_registry
-          @base_registry ||= T.let(
-            credentials.find do |cred|
-              cred["type"] == "docker_registry" && cred.replaces_base?
-            end,
-            T.nilable(Dependabot::Credential)
-          )
-          @base_registry ||= Dependabot::Credential.new({ "registry" => DEFAULT_DOCKER_HUB_REGISTRY,
-                                                          "credentials" => nil })
-          @base_registry["registry"]
-        end
-
-        sig { params(registry: String).returns(T::Boolean) }
-        def using_dockerhub?(registry)
-          registry == DEFAULT_DOCKER_HUB_REGISTRY
-        end
-
-        private
-
-        sig { returns(T::Array[Dependabot::Credential]) }
-        attr_reader :credentials
-
-        sig { params(registry_details: Dependabot::Credential).returns(Dependabot::Credential) }
-        def build_aws_credentials(registry_details)
-          # If credentials have been generated from AWS we can just return them
-          return registry_details if registry_details["username"] == "AWS"
-
-          # Build a client either with explicit creds or default creds
-          registry_hostname = registry_details.fetch("registry")
-          region = registry_hostname.match(AWS_ECR_URL).named_captures.fetch("region")
-          aws_credentials = Aws::Credentials.new(
-            registry_details["username"],
-            registry_details["password"]
-          )
-
-          ecr_client =
-            if aws_credentials.set?
-              Aws::ECR::Client.new(region: region, credentials: aws_credentials)
-            else
-              # Let the client check default locations for credentials
-              Aws::ECR::Client.new(region: region)
-            end
-
-          # If the client still lacks credentials, we might be running within GitHub's
-          # Dependabot Service, in which case we might get them from the proxy
-          return registry_details if ecr_client.config.credentials.nil?
-
-          # Otherwise, we need to use the provided Access Key ID and secret to
-          # generate a temporary username and password
-          @authorization_tokens ||= T.let({}, T.nilable(T::Hash[String, String]))
-          @authorization_tokens[registry_hostname] ||=
-            ecr_client.get_authorization_token.authorization_data.first.authorization_token
-          username, password =
-            Base64.decode64(T.must(@authorization_tokens[registry_hostname])).split(":")
-          registry_details.merge(Dependabot::Credential.new({ "username" => username, "password" => password }))
-        rescue Aws::Errors::MissingCredentialsError,
-               Aws::ECR::Errors::UnrecognizedClientException,
-               Aws::ECR::Errors::InvalidSignatureException
-          raise PrivateSourceAuthenticationFailure, registry_hostname
-        end
-      end
-    end
-  end
-end

data/lib/dependabot/shared/utils/helpers.rb

@@ -1,19 +0,0 @@
-# typed: strong
-# frozen_string_literal: true
-
-require "sorbet-runtime"
-
-module Dependabot
-  module Shared
-    module Utils
-      HELM_REGEXP = /values[\-a-zA-Z_0-9]*\.ya?ml$/i
-
-      extend T::Sig
-
-      sig { params(file: Dependabot::DependencyFile).returns(T::Boolean) }
-      def self.likely_helm_chart?(file)
-        file.name.match?(HELM_REGEXP)
-      end
-    end
-  end
-end