dependabot-github_actions 0.393.0 → 0.394.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4209eb988f4acc1fdb05b3f95694cfba5e7972ea3cd29020a5a32aca407b64ab
-  data.tar.gz: 5638cd93a7068ed55e5eb77c5f8a85d3f5a0b01c7d3591dc3ef77c5f634498ff
+  metadata.gz: 21ec9924cfc31066fa2dccd2cf7ca50e9f7969efde8940d67adbd19443a2f46d
+  data.tar.gz: e98917f3e0def956dc94d9341c2a17a4c9739a517ebaec569b3bc766ba0a3014
 SHA512:
-  metadata.gz: 93a1ad33067ffe60ffa89d0963fe22df5b949677e00184a798aa27f00cf71d6d86c513248c960459269097e89610cb4128565adb356ee9478053cd141ee7a799
-  data.tar.gz: 8ee8ecae42b4e24b50ac8ae56482553479564564f04842326baf4ecb40557edecf6adc641667f75087184fa1ecda30533df78e591404efc37a13a2c06dd90583
+  metadata.gz: f16959b6407974932411f006a734f63cdae7279624a63ffe8a956521535688d030dce0b1ec588f9c611060060377f4dad024599d617257e5be386eeaf1154919
+  data.tar.gz: 647815b9aae2a57c32f60edf7c7c03e8095227fe561769beeb9c96ed7ff97ef6d2ef905d112e377a181f797ba9a06f06a793acb03cf8830e29cd896a0c1e3704

data/lib/dependabot/github_actions/file_parser.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"
@@ -11,6 +11,7 @@ require "dependabot/file_parsers/base"
 require "dependabot/github_actions/constants"
 require "dependabot/github_actions/version"
 require "dependabot/github_actions/package_manager"
+require "dependabot/github_actions/workflow_file"
 
 # For docs, see
 # https://help.github.com/en/articles/configuring-a-workflow#referencing-actions-in-your-workflow
@@ -54,62 +55,106 @@ module Dependabot
       sig { params(file: Dependabot::DependencyFile).returns(Dependabot::FileParsers::Base::DependencySet) }
       def workfile_file_dependencies(file)
         dependency_set = DependencySet.new
-
-        json = YAML.safe_load(T.must(file.content), aliases: true, permitted_classes: [Date, Time, Symbol])
-        return dependency_set if json.nil?
-
-        uses_strings = deep_fetch_uses(json.fetch("jobs", json.fetch("runs", nil))).uniq
-
-        uses_strings.each do |string|
-          # TODO: Support Docker references and path references
-          next if string.start_with?(".", "docker://")
-          next unless string.match?(GITHUB_REPO_REFERENCE)
-
-          dep = build_github_dependency(file, string)
-          git_checker = Dependabot::GitCommitChecker.new(
-            dependency: dep,
-            credentials: credentials,
-            consider_version_branches_pinned: true
-          )
-          if git_checker.git_repo_reachable?
-            next unless git_checker.pinned?
-
-            # If dep does not have an assigned (semver) version, look for a commit that references a semver tag
-            unless dep.version
-              resolved = git_checker.version_for_pinned_sha
-
-              if resolved
-                dep = Dependency.new(
-                  name: dep.name,
-                  version: resolved.to_s,
-                  requirements: dep.requirements,
-                  package_manager: dep.package_manager
-                )
-              end
-            end
-          end
+        workflow_file = WorkflowFile.new(T.must(file.content))
+        workflow_file.uses_declarations.group_by(&:value).each do |string, declarations|
+          dep = dependency_for_declarations(file, workflow_file, string, declarations)
+          next unless dep
 
           dependency_set << dep
         end
-
         dependency_set
       rescue Psych::SyntaxError, Psych::DisallowedClass, Psych::BadAlias
         raise Dependabot::DependencyFileNotParseable, file.path
       end
 
-      sig { params(file: Dependabot::DependencyFile, string: String).returns(Dependabot::Dependency) }
-      def build_github_dependency(file, string)
+      sig do
+        params(
+          file: Dependabot::DependencyFile,
+          workflow_file: WorkflowFile,
+          string: String,
+          declarations: T::Array[WorkflowFile::UsesDeclaration]
+        ).returns(T.nilable(Dependabot::Dependency))
+      end
+      def dependency_for_declarations(file, workflow_file, string, declarations)
+        # TODO: Support Docker references and path references
+        return if string.start_with?(".", "docker://")
+        return unless string.match?(GITHUB_REPO_REFERENCE)
+
+        metadata = declarations.map do |declaration|
+          declaration_metadata(workflow_file, declaration)
+        end
+        dep = build_github_dependency(file, string, metadata)
+        git_checker = Dependabot::GitCommitChecker.new(
+          dependency: dep,
+          credentials: credentials,
+          consider_version_branches_pinned: true
+        )
+        return dep unless git_checker.git_repo_reachable?
+        return unless git_checker.pinned?
+
+        dependency_with_resolved_version(dep, git_checker) || dep
+      end
+
+      sig do
+        params(
+          workflow_file: WorkflowFile,
+          declaration: WorkflowFile::UsesDeclaration
+        ).returns(T::Hash[Symbol, Object])
+      end
+      def declaration_metadata(workflow_file, declaration)
+        metadata = T.let({ declaration_string: declaration.value }, T::Hash[Symbol, Object])
+        if workflow_file.source_metadata_required?(declaration)
+          metadata[:yaml_source] = workflow_file.source_metadata(declaration)
+        end
+        metadata
+      end
+
+      sig do
+        params(
+          dep: Dependabot::Dependency,
+          git_checker: Dependabot::GitCommitChecker
+        ).returns(T.nilable(Dependabot::Dependency))
+      end
+      def dependency_with_resolved_version(dep, git_checker)
+        return if dep.version
+
+        resolved = git_checker.version_for_pinned_sha
+        return unless resolved
+
+        Dependency.new(
+          name: dep.name,
+          version: resolved.to_s,
+          requirements: dep.requirements,
+          package_manager: dep.package_manager
+        )
+      end
+
+      sig do
+        params(
+          file: Dependabot::DependencyFile,
+          string: String,
+          metadata: T::Array[T::Hash[Symbol, Object]]
+        ).returns(Dependabot::Dependency)
+      end
+      def build_github_dependency(file, string, metadata)
         unless source&.hostname == GITHUB_COM
-          dep = github_dependency(file, string, T.must(source).hostname)
+          dep = github_dependency(file, string, T.must(source).hostname, metadata)
           git_checker = Dependabot::GitCommitChecker.new(dependency: dep, credentials: credentials)
           return dep if git_checker.git_repo_reachable?
         end
 
-        github_dependency(file, string, GITHUB_COM)
+        github_dependency(file, string, GITHUB_COM, metadata)
       end
 
-      sig { params(file: Dependabot::DependencyFile, string: String, hostname: String).returns(Dependabot::Dependency) }
-      def github_dependency(file, string, hostname)
+      sig do
+        params(
+          file: Dependabot::DependencyFile,
+          string: String,
+          hostname: String,
+          metadata: T::Array[T::Hash[Symbol, Object]]
+        ).returns(Dependabot::Dependency)
+      end
+      def github_dependency(file, string, hostname, metadata)
         details = T.must(string.match(GITHUB_REPO_REFERENCE)).named_captures
         repo_name = "#{details.fetch(OWNER_KEY)}/#{details.fetch(REPO_KEY)}"
         path = details[PATH_KEY]
@@ -130,45 +175,24 @@ module Dependabot
         Dependency.new(
           name: name,
           version: version,
-          requirements: [{
-            requirement: nil,
-            groups: [],
-            source: {
-              type: "git",
-              url: "https://#{hostname}/#{repo_name}".downcase,
-              ref: ref,
-              branch: nil
-            },
-            file: file.name,
-            metadata: { declaration_string: string }
-          }],
+          requirements: metadata.map do |details|
+            {
+              requirement: nil,
+              groups: [],
+              source: {
+                type: "git",
+                url: "https://#{hostname}/#{repo_name}".downcase,
+                ref: ref,
+                branch: nil
+              },
+              file: file.name,
+              metadata: details
+            }
+          end,
           package_manager: PackageManager::NAME
         )
       end
 
-      sig { params(json_obj: T.untyped, found_uses: T::Array[String]).returns(T::Array[String]) }
-      def deep_fetch_uses(json_obj, found_uses = [])
-        case json_obj
-        when Hash then deep_fetch_uses_from_hash(json_obj, found_uses)
-        when Array then json_obj.flat_map { |o| deep_fetch_uses(o, found_uses) }
-        else []
-        end
-      end
-
-      sig { params(json_object: T::Hash[String, T.untyped], found_uses: T::Array[String]).returns(T::Array[String]) }
-      def deep_fetch_uses_from_hash(json_object, found_uses)
-        if json_object.key?(USES_KEY)
-          found_uses << json_object[USES_KEY]
-        elsif json_object.key?(STEPS_KEY)
-          # Bypass other fields as uses are under steps if they exist
-          deep_fetch_uses(json_object[STEPS_KEY], found_uses)
-        else
-          json_object.values.flat_map { |obj| deep_fetch_uses(obj, found_uses) }
-        end
-
-        found_uses
-      end
-
       sig { returns(T::Array[Dependabot::DependencyFile]) }
       def workflow_files
         dependency_files.reject { |file| file.path.delete_prefix("/") == LOCKFILE_PATH }

data/lib/dependabot/github_actions/file_updater/workflow_updater/flow_sequence_comments.rb

@@ -0,0 +1,244 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "dependabot/github_actions/file_updater/workflow_updater"
+
+module Dependabot
+  module GithubActions
+    class FileUpdater < Dependabot::FileUpdaters::Base
+      class WorkflowUpdater
+        class FlowSequenceComments
+          extend T::Sig
+
+          class ItemComments < T::Struct
+            extend T::Sig
+
+            const :trailing, T.nilable(String)
+            const :standalone, T::Array[String]
+
+            sig { returns(T::Boolean) }
+            def any?
+              !trailing.nil? || standalone.any?
+            end
+          end
+
+          sig do
+            params(
+              workflow_file: WorkflowFile,
+              sequence: Psych::Nodes::Sequence,
+              commenter: VersionCommenter,
+              comment_locator: SourceCommentLocator,
+              item_indent: String
+            ).void
+          end
+          def initialize(workflow_file:, sequence:, commenter:, comment_locator:, item_indent:)
+            @workflow_file = workflow_file
+            @sequence = sequence
+            @commenter = commenter
+            @comment_locator = comment_locator
+            @item_indent = item_indent
+            @leading_comments = T.let(build_leading_comments, T::Array[String])
+            @source_comments = T.let(build_source_comments, T::Hash[Integer, ItemComments])
+          end
+
+          sig { params(index: Integer, updates: T::Array[SourceUpdate]).returns(ItemComments) }
+          def rendered_for(index, updates)
+            source_comments = @source_comments.fetch(index, ItemComments.new(trailing: nil, standalone: []))
+            return generated_comments(updates) unless source_comments.any?
+
+            ItemComments.new(
+              trailing: process_comment(source_comments.trailing, updates, trailing: true),
+              standalone: source_comments.standalone.filter_map do |comment|
+                process_comment(comment, updates, trailing: false)
+              end
+            )
+          end
+
+          sig do
+            params(
+              index: Integer,
+              item_count: Integer,
+              source: String,
+              updates: T::Array[SourceUpdate]
+            ).returns(String)
+          end
+          def render_item(index:, item_count:, source:, updates:)
+            comments = rendered_for(index, updates)
+            comma = index == item_count - 1 ? "" : ","
+            line = "#{item_indent}#{source}#{comma}#{comments.trailing}"
+            standalone = comments.standalone.map { |comment| "#{item_indent}#{comment}" }
+            ([line] + standalone).join(workflow_file.newline)
+          end
+
+          sig { returns(T::Array[String]) }
+          def leading_lines
+            @leading_comments.map { |comment| "#{item_indent}#{comment}" }
+          end
+
+          sig { params(updates: T::Array[SourceUpdate]).returns(T.nilable(ContentEdit)) }
+          def claim_trailing_comment(updates)
+            located_comment = comment_locator.for_sequence(sequence)
+            return unless located_comment
+
+            update = updates.find do |candidate|
+              commenter.recognized_comment?(
+                located_comment.comment,
+                candidate.old_ref,
+                candidate.new_ref
+              )
+            end
+            return unless update
+            return unless update.declaration.sequence_item_index
+
+            add_source_comment(T.must(update.declaration.sequence_item_index), located_comment.comment)
+            ContentEdit.new(
+              start_offset: located_comment.start_offset,
+              end_offset: located_comment.end_offset,
+              replacement: ""
+            )
+          end
+
+          private
+
+          sig { returns(WorkflowFile) }
+          attr_reader :workflow_file
+
+          sig { returns(Psych::Nodes::Sequence) }
+          attr_reader :sequence
+
+          sig { returns(VersionCommenter) }
+          attr_reader :commenter
+
+          sig { returns(SourceCommentLocator) }
+          attr_reader :comment_locator
+
+          sig { returns(String) }
+          attr_reader :item_indent
+
+          sig { returns(T::Hash[Integer, ItemComments]) }
+          def build_source_comments
+            children = workflow_file.node_children(sequence)
+            closing_offset = closing_bracket_offset
+
+            children.each_with_index.to_h do |child, index|
+              gap_end = children[index + 1] ? node_start_offset(T.must(children[index + 1])) : closing_offset
+              gap = workflow_file.content.byteslice(node_end_offset(child)...gap_end) || ""
+              [index, comments_from_gap(gap)]
+            end
+          end
+
+          sig { returns(T::Array[String]) }
+          def build_leading_comments
+            first_child = workflow_file.node_children(sequence).first
+            return [] unless first_child
+
+            gap = workflow_file.content.byteslice((opening_bracket_offset + 1)...node_start_offset(first_child)) || ""
+            gap.lines.filter_map { |line| find_comment(line, trailing: false) }
+          end
+
+          sig { params(gap: String).returns(ItemComments) }
+          def comments_from_gap(gap)
+            lines = gap.lines
+            first_line = lines.shift || gap
+            trailing = find_comment(first_line, trailing: true)
+            standalone = lines.filter_map { |line| find_comment(line, trailing: false) }
+
+            ItemComments.new(trailing: trailing, standalone: standalone)
+          end
+
+          sig { params(line: String, trailing: T::Boolean).returns(T.nilable(String)) }
+          def find_comment(line, trailing:)
+            body = line.delete_suffix("\n").delete_suffix("\r")
+            comment = comment_locator.find_line(body)
+            return unless comment
+
+            trailing ? " #{comment.lstrip}" : comment.lstrip
+          end
+
+          sig { params(index: Integer, comment: String).void }
+          def add_source_comment(index, comment)
+            existing = @source_comments.fetch(index, ItemComments.new(trailing: nil, standalone: []))
+            @source_comments[index] =
+              if existing.trailing
+                ItemComments.new(
+                  trailing: existing.trailing,
+                  standalone: existing.standalone + [comment.lstrip]
+                )
+              else
+                ItemComments.new(
+                  trailing: " #{comment.lstrip}",
+                  standalone: existing.standalone
+                )
+              end
+          end
+
+          sig do
+            params(
+              comment: T.nilable(String),
+              updates: T::Array[SourceUpdate],
+              trailing: T::Boolean
+            ).returns(T.nilable(String))
+          end
+          def process_comment(comment, updates, trailing:)
+            return unless comment
+
+            index = 0
+            while index < updates.length
+              update = T.must(updates[index])
+              updated = commenter.updated_comment(comment, update.old_ref, update.new_ref)
+              return normalize_comment(updated, trailing: trailing) if updated
+              return if commenter.recognized_comment?(comment, update.old_ref, update.new_ref)
+
+              index += 1
+            end
+
+            normalize_comment(comment, trailing: trailing)
+          end
+
+          sig { params(comment: String, trailing: T::Boolean).returns(String) }
+          def normalize_comment(comment, trailing:)
+            trailing ? " #{comment.lstrip}" : comment.lstrip
+          end
+
+          sig { params(updates: T::Array[SourceUpdate]).returns(ItemComments) }
+          def generated_comments(updates)
+            comments = updates.filter_map { |update| commenter.new_comment(update.old_ref, update.new_ref) }.uniq
+            raise "Conflicting version comments for one workflow step" if comments.length > 1
+
+            ItemComments.new(trailing: comments.first, standalone: [])
+          end
+
+          sig { returns(Integer) }
+          def opening_bracket_offset
+            source = workflow_file.node_source(sequence)
+            opening_bracket = T.must(source.b.index("["))
+            node_start_offset(sequence) + opening_bracket
+          end
+
+          sig { returns(Integer) }
+          def closing_bracket_offset
+            source = workflow_file.node_source(sequence)
+            closing_bracket = T.must(source.b.rindex("]"))
+            node_start_offset(sequence) + closing_bracket
+          end
+
+          sig { params(node: Psych::Nodes::Node).returns(Integer) }
+          def node_start_offset(node)
+            workflow_file.offset(
+              workflow_file.node_start_line(node),
+              workflow_file.node_start_column(node)
+            )
+          end
+
+          sig { params(node: Psych::Nodes::Node).returns(Integer) }
+          def node_end_offset(node)
+            workflow_file.offset(
+              workflow_file.node_end_line(node),
+              workflow_file.node_end_column(node)
+            )
+          end
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/github_actions/file_updater/workflow_updater/source_comment_locator.rb

@@ -0,0 +1,147 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "dependabot/github_actions/file_updater/workflow_updater"
+
+module Dependabot
+  module GithubActions
+    class FileUpdater < Dependabot::FileUpdaters::Base
+      class WorkflowUpdater
+        class SourceCommentLocator
+          extend T::Sig
+
+          class LocatedComment < T::Struct
+            const :comment, String
+            const :start_offset, Integer
+            const :end_offset, Integer
+            const :syntax_adjacent, T::Boolean
+          end
+
+          sig do
+            params(
+              workflow_file: WorkflowFile,
+              comment_finder: YamlCommentFinder,
+              metadata_builder: WorkflowFile::MetadataBuilder
+            ).void
+          end
+          def initialize(workflow_file:, comment_finder:, metadata_builder:)
+            @workflow_file = workflow_file
+            @comment_finder = comment_finder
+            @metadata_builder = metadata_builder
+          end
+
+          sig { params(declaration: WorkflowFile::UsesDeclaration).returns(T.nilable(LocatedComment)) }
+          def for_declaration(declaration)
+            anchor = metadata_builder.comment_anchor(declaration)
+            return unless anchor
+
+            locate(
+              line: anchor.first,
+              column: anchor.last,
+              owner_sequence: declaration.steps_sequence,
+              block_scalar: block_scalar?(declaration.source_node)
+            )
+          end
+
+          sig { params(sequence: Psych::Nodes::Sequence).returns(T.nilable(LocatedComment)) }
+          def for_sequence(sequence)
+            locate(
+              line: workflow_file.node_end_line(sequence),
+              column: workflow_file.node_end_column(sequence),
+              owner_sequence: sequence,
+              block_scalar: false
+            )
+          end
+
+          sig { params(source: String).returns(T.nilable(String)) }
+          def find_line(source)
+            comment_finder.find_line(source)
+          end
+
+          private
+
+          sig { returns(WorkflowFile) }
+          attr_reader :workflow_file
+
+          sig { returns(YamlCommentFinder) }
+          attr_reader :comment_finder
+
+          sig { returns(WorkflowFile::MetadataBuilder) }
+          attr_reader :metadata_builder
+
+          sig do
+            params(
+              line: Integer,
+              column: Integer,
+              owner_sequence: T.nilable(Psych::Nodes::Sequence),
+              block_scalar: T::Boolean
+            ).returns(T.nilable(LocatedComment))
+          end
+          def locate(line:, column:, owner_sequence:, block_scalar:)
+            suffix = workflow_file.line_body(line).byteslice(workflow_file.byte_column(line, column)..) || ""
+            comment = comment_finder.find(suffix)
+            return unless comment
+
+            relative_start = T.must(suffix.b.index(comment.b))
+            start_offset = workflow_file.offset(line, column) + relative_start
+            return if inside_other_sequence?(start_offset, owner_sequence)
+
+            prefix = suffix.byteslice(0...relative_start) || ""
+            LocatedComment.new(
+              comment: comment,
+              start_offset: start_offset,
+              end_offset: start_offset + comment.bytesize,
+              syntax_adjacent: adjacent_prefix?(prefix, block_scalar)
+            )
+          end
+
+          sig do
+            params(
+              offset: Integer,
+              owner_sequence: T.nilable(Psych::Nodes::Sequence)
+            ).returns(T::Boolean)
+          end
+          def inside_other_sequence?(offset, owner_sequence)
+            workflow_file.sequences.any? do |sequence|
+              next false if owner_sequence.equal?(sequence)
+
+              node_start_offset(sequence) <= offset && offset < node_end_offset(sequence)
+            end
+          end
+
+          sig { params(prefix: String, block_scalar: T::Boolean).returns(T::Boolean) }
+          def adjacent_prefix?(prefix, block_scalar)
+            return true if prefix.match?(/\A[ \t,\]\}]*\z/)
+            return false unless block_scalar
+
+            prefix.match?(/\A[>|0-9+-]+[ \t]*\z/)
+          end
+
+          sig { params(node: T.nilable(Psych::Nodes::Node)).returns(T::Boolean) }
+          def block_scalar?(node)
+            return false unless node.is_a?(Psych::Nodes::Scalar)
+
+            style = workflow_file.scalar_node_style(node)
+            [Psych::Nodes::Scalar::LITERAL, Psych::Nodes::Scalar::FOLDED].include?(style)
+          end
+
+          sig { params(node: Psych::Nodes::Node).returns(Integer) }
+          def node_start_offset(node)
+            workflow_file.offset(
+              workflow_file.node_start_line(node),
+              workflow_file.node_start_column(node)
+            )
+          end
+
+          sig { params(node: Psych::Nodes::Node).returns(Integer) }
+          def node_end_offset(node)
+            workflow_file.offset(
+              workflow_file.node_end_line(node),
+              workflow_file.node_end_column(node)
+            )
+          end
+        end
+      end
+    end
+  end
+end