dependabot-git_submodules 0.242.1 → 0.243.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 716dd72f8facbeeaef3091f023c30cfe54bbb375075dadacd47f5e4ae5cd9ac3
-  data.tar.gz: be4b3ddfed7bcdc7190e8840d4e2c3fa02be9a9bfe958bea7c43e5bcba22abfc
+  metadata.gz: 501cfe638fdfb8bf8da3db2bd6c77a6c355a9310c98ce0c44a5c80b304f38cb7
+  data.tar.gz: 4e430039d30a9b4e06a45fb902fe9151062d066e34c69035ae176f51167c708e
 SHA512:
-  metadata.gz: 783288c98a26fb637445c2ad00593ffe40e86c6c20282fe044be2c498210ef58ac5407bfef4737f23f7059df57a7309ddb84d80dbe537350fb384ad5a5f5021d
-  data.tar.gz: 88c00f172454bd0d23201005e0a65c6612731cf26d3b0b8ec32a6d6a21c8f45cf913403fc871fa713159a60805227392768d2aee01a920ff98e80723cd75f47d
+  metadata.gz: 2e00d73c5ea20bb0cb12c807a2ccc2d4b3555abcab5da3110c99d0457639637d23220df65bc51ae3ac7bcb5b0b2d84cafbc4e3a4c22395df78f202717126f92c
+  data.tar.gz: df68426cf7f3d3adb96e585ffa72f6a67f6e37e696fb3f7c29084d197b965694b1406aa8ebc9ab8887b0be2fec5115f78f28c28ff32fa33bb4a59c8b8c83933c

data/lib/dependabot/git_submodules/file_fetcher.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "parseconfig"
@@ -13,10 +13,12 @@ module Dependabot
       extend T::Sig
       extend T::Helpers
 
+      sig { override.params(filenames: T::Array[String]).returns(T::Boolean) }
       def self.required_files_in?(filenames)
         filenames.include?(".gitmodules")
       end
 
+      sig { override.returns(String) }
       def self.required_files_message
         "Repo must contain a .gitmodules file."
       end
@@ -31,26 +33,40 @@ module Dependabot
 
       private
 
+      sig { returns(Dependabot::DependencyFile) }
       def gitmodules_file
-        @gitmodules_file ||= fetch_file_from_host(".gitmodules")
+        @gitmodules_file ||=
+          T.let(
+            fetch_file_from_host(".gitmodules"),
+            T.nilable(Dependabot::DependencyFile)
+          )
       end
 
+      sig { returns(T::Array[Dependabot::DependencyFile]) }
       def submodule_refs
         @submodule_refs ||=
-          submodule_paths
-          .map { |path| fetch_submodule_ref_from_host(path) }
-          .tap { |refs| refs.each { |f| f.support_file = true } }
-          .uniq
+          T.let(
+            submodule_paths
+            .map { |path| fetch_submodule_ref_from_host(path) }
+            .tap { |refs| refs.each { |f| f.support_file = true } }
+            .uniq,
+            T.nilable(T::Array[Dependabot::DependencyFile])
+          )
       end
 
+      sig { returns(T::Array[String]) }
       def submodule_paths
         @submodule_paths ||=
-          Dependabot::SharedHelpers.in_a_temporary_directory do
-            File.write(".gitmodules", gitmodules_file.content)
-            ParseConfig.new(".gitmodules").params.values.map { |p| p["path"] }
-          end
+          T.let(
+            Dependabot::SharedHelpers.in_a_temporary_directory do
+              File.write(".gitmodules", gitmodules_file.content)
+              ParseConfig.new(".gitmodules").params.values.map { |p| p["path"] }
+            end,
+            T.nilable(T::Array[String])
+          )
       end
 
+      sig { params(submodule_path: T.nilable(String)).returns(Dependabot::DependencyFile) }
       def fetch_submodule_ref_from_host(submodule_path)
         path = Pathname.new(File.join(directory, submodule_path))
                        .cleanpath.to_path.gsub(%r{^/*}, "")
@@ -61,7 +77,7 @@ module Dependabot
                  tmp_path = path.gsub(%r{^/*}, "")
                  T.unsafe(gitlab_client).get_file(repo, tmp_path, commit).blob_id
                when "azure"
-                 azure_client.fetch_file_contents(commit, path)
+                 azure_client.fetch_file_contents(T.must(commit), path)
                else raise "Unsupported provider '#{source.provider}'."
                end
 
@@ -77,6 +93,7 @@ module Dependabot
         raise Dependabot::DependencyFileNotFound, path
       end
 
+      sig { params(path: String).returns(String) }
       def fetch_github_submodule_commit(path)
         content = T.unsafe(github_client).contents(
           repo,

data/lib/dependabot/git_submodules/file_parser.rb

@@ -1,7 +1,9 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "parseconfig"
+require "sorbet-runtime"
+
 require "dependabot/dependency"
 require "dependabot/file_parsers"
 require "dependabot/file_parsers/base"
@@ -10,6 +12,9 @@ require "dependabot/shared_helpers"
 module Dependabot
   module GitSubmodules
     class FileParser < Dependabot::FileParsers::Base
+      extend T::Sig
+
+      sig { override.returns(T::Array[Dependabot::Dependency]) }
       def parse
         Dependabot::SharedHelpers.in_a_temporary_directory do
           File.write(".gitmodules", gitmodules_file.content)
@@ -39,6 +44,7 @@ module Dependabot
 
       private
 
+      sig { params(url: String).returns(String) }
       def absolute_url(url)
         # Submodules can be specified with a relative URL (e.g., ../repo.git)
         # which we want to expand out into a full URL if present.
@@ -48,6 +54,7 @@ module Dependabot
         "https://#{source&.hostname}/#{path.cleanpath}"
       end
 
+      sig { params(path: String).returns(T.nilable(String)) }
       def submodule_sha(path)
         submodule = dependency_files.find { |f| f.name == path }
         raise "Submodule not found #{path}" unless submodule
@@ -55,10 +62,16 @@ module Dependabot
         submodule.content
       end
 
+      sig { returns(Dependabot::DependencyFile) }
       def gitmodules_file
-        @gitmodules_file ||= get_original_file(".gitmodules")
+        @gitmodules_file ||=
+          T.let(
+            T.must(get_original_file(".gitmodules")),
+            T.nilable(Dependabot::DependencyFile)
+          )
       end
 
+      sig { override.void }
       def check_required_files
         %w(.gitmodules).each do |filename|
           raise "No #{filename}!" unless get_original_file(filename)

data/lib/dependabot/git_submodules/file_updater.rb

@@ -1,37 +1,52 @@
-# typed: true
+# typed: strong
 # frozen_string_literal: true
 
+require "sorbet-runtime"
+
 require "dependabot/file_updaters"
 require "dependabot/file_updaters/base"
 
 module Dependabot
   module GitSubmodules
     class FileUpdater < Dependabot::FileUpdaters::Base
+      extend T::Sig
+
+      sig { override.returns(T::Array[Regexp]) }
       def self.updated_files_regex
         []
       end
 
+      sig { override.returns(T::Array[Dependabot::DependencyFile]) }
       def updated_dependency_files
-        [updated_file(file: submodule, content: dependency.version)]
+        [updated_file(file: submodule, content: T.must(dependency.version))]
       end
 
       private
 
+      sig { returns(Dependabot::Dependency) }
       def dependency
         # Git submodules will only ever be updating a single dependency
-        dependencies.first
+        T.must(dependencies.first)
       end
 
+      sig { override.void }
       def check_required_files
         %w(.gitmodules).each do |filename|
           raise "No #{filename}!" unless get_original_file(filename)
         end
       end
 
+      sig { returns(Dependabot::DependencyFile) }
       def submodule
-        @submodule ||= dependency_files.find do |file|
-          file.name == dependency.name
-        end
+        @submodule ||=
+          T.let(
+            T.must(
+              dependency_files.find do |file|
+                file.name == dependency.name
+              end
+            ),
+            T.nilable(Dependabot::DependencyFile)
+          )
       end
     end
   end

data/lib/dependabot/git_submodules/metadata_finder.rb

@@ -1,14 +1,19 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
+require "sorbet-runtime"
+
 require "dependabot/metadata_finders"
 require "dependabot/metadata_finders/base"
 
 module Dependabot
   module GitSubmodules
     class MetadataFinder < Dependabot::MetadataFinders::Base
+      extend T::Sig
+
       private
 
+      sig { override.returns(T.nilable(Dependabot::Source)) }
       def look_up_source
         url = dependency.requirements.first&.fetch(:source)&.fetch(:url) ||
               dependency.requirements.first&.fetch(:source)&.fetch("url")

data/lib/dependabot/git_submodules/requirement.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"
@@ -21,9 +21,10 @@ module Dependabot
 
       # Patches Gem::Requirement to make it accept requirement strings like
       # "~> 4.2.5, >= 4.2.5.1" without first needing to split them.
+      sig { params(requirements: T.nilable(String)).void }
       def initialize(*requirements)
         requirements = requirements.flatten.flat_map do |req_string|
-          req_string.split(",").map(&:strip)
+          req_string&.split(",")&.map(&:strip)
         end
 
         super(requirements)

data/lib/dependabot/git_submodules/update_checker.rb

@@ -1,6 +1,8 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
+require "sorbet-runtime"
+
 require "dependabot/update_checkers"
 require "dependabot/update_checkers/base"
 require "dependabot/git_submodules/version"
@@ -10,20 +12,30 @@ require "dependabot/git_submodules/requirement"
 module Dependabot
   module GitSubmodules
     class UpdateChecker < Dependabot::UpdateCheckers::Base
+      extend T::Sig
+
+      sig { override.returns(T.nilable(T.any(String, Gem::Version))) }
       def latest_version
-        @latest_version ||= fetch_latest_version
+        @latest_version ||=
+          T.let(
+            fetch_latest_version,
+            T.nilable(T.any(String, Gem::Version))
+          )
       end
 
+      sig { override.returns(T.nilable(T.any(String, Gem::Version))) }
       def latest_resolvable_version
         # Resolvability isn't an issue for submodules.
         latest_version
       end
 
+      sig { override.returns(T.nilable(T.any(String, Gem::Version))) }
       def latest_resolvable_version_with_no_unlock
         # No concept of "unlocking" for submodules
         latest_version
       end
 
+      sig { override.returns(T::Array[T::Hash[Symbol, T.untyped]]) }
       def updated_requirements
         # Submodule requirements are the URL and branch to use for the
         # submodule. We never want to update either.
@@ -32,15 +44,18 @@ module Dependabot
 
       private
 
+      sig { override.returns(T::Boolean) }
       def latest_version_resolvable_with_full_unlock?
         # Full unlock checks aren't relevant for submodules
         false
       end
 
+      sig { override.returns(T::Array[Dependabot::Dependency]) }
       def updated_dependencies_after_full_unlock
         raise NotImplementedError
       end
 
+      sig { returns(T.nilable(String)) }
       def fetch_latest_version
         git_commit_checker = Dependabot::GitCommitChecker.new(
           dependency: dependency,

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-git_submodules
 version: !ruby/object:Gem::Version
-  version: 0.242.1
+  version: 0.243.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-01-23 00:00:00.000000000 Z
+date: 2024-02-13 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.242.1
+        version: 0.243.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.242.1
+        version: 0.243.0
 - !ruby/object:Gem::Dependency
   name: parseconfig
   requirement: !ruby/object:Gem::Requirement
@@ -261,7 +261,7 @@ licenses:
 - Nonstandard
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.242.1
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.243.0
 post_install_message: 
 rdoc_options: []
 require_paths: