dependabot-go_modules 0.121.1 → 0.124.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d399469f8a61821f96b70b4665ef9037c9c103194ae3aa7224fa7bbf45e19cc6
-  data.tar.gz: 041406a7f88713b93f2c91b3fcf903934037975c82a8a7facebc9849baba4488
+  metadata.gz: d13f4d2b870711a4a373e4880421aca48e9a2257c6d4520326a007a352317908
+  data.tar.gz: 7724d54a036c5f8b5beb73d3a43e6d17dd5117d2fce87c9e077fc2f3e9976514
 SHA512:
-  metadata.gz: df43946eea402a831d37a56637c69afe605b0c7ea3ad8e387d5e74175b13f629861b71073f7e0548b5630025089bdbc3fd8f7f8d6d00f6a9a08f9b20d96f84b9
-  data.tar.gz: beb0a877aa9c40b20d499da92c26aa03ebfdb9737e61ca1d296bbbb02ead76ec5ab2f953b3430cb7051de9a8bc58405ee6e0ddb105fe1b43f30136850e231594
+  metadata.gz: d8ef02592caf94dcf6ee7fdd9ff78dffef8839ee94b9697c51c0ee1b6da756782500c29a9df706c6af65ef9413201659d1b7aa6610786ee61f04b57725a9d865
+  data.tar.gz: 4421f494f65e3e7dae5aa397a5cf21dcad19daf82acadeb848806771a8ada685da7e9d8dca2798b679ad5920ca197ea85469607db7865e8569da029d90622270

data/lib/dependabot/go_modules/file_updater.rb

@@ -3,6 +3,7 @@
 require "dependabot/shared_helpers"
 require "dependabot/file_updaters"
 require "dependabot/file_updaters/base"
+require "dependabot/file_updaters/vendor_updater"
 
 module Dependabot
   module GoModules
@@ -12,22 +13,8 @@ module Dependabot
       def initialize(dependencies:, dependency_files:, repo_contents_path: nil,
                      credentials:, options: {})
         super
-        return unless repo_contents_path.nil?
 
-        # masquerade repo_contents_path for GoModUpdater during transition
-        tmp = Dir.mktmpdir
-        Dir.chdir(tmp) do
-          dependency_files.each do |file|
-            File.write(file.name, file.content)
-          end
-          `git config --global user.email "no-reply@github.com"`
-          `git config --global user.name "Dependabot"`
-          `git init .`
-          `git add .`
-          `git commit -m'fake repo_contents_path'`
-        end
-        @repo_contents_path = tmp
-        @repo_contents_stub = true
+        use_repo_contents_stub if repo_contents_path.nil?
       end
 
       def self.updated_files_regex
@@ -54,6 +41,12 @@ module Dependabot
                 content: file_updater.updated_go_sum_content
               )
           end
+
+          vendor_updater.
+            updated_vendor_cache_files(base_directory: directory).
+            each do |file|
+            updated_files << file
+          end
         end
 
         raise "No files changed!" if updated_files.none?
@@ -69,6 +62,21 @@ module Dependabot
         raise "No go.mod!"
       end
 
+      def use_repo_contents_stub
+        @repo_contents_stub = true
+        @repo_contents_path = Dir.mktmpdir
+        Dir.chdir(@repo_contents_path) do
+          dependency_files.each do |file|
+            File.write(file.name, file.content)
+          end
+          `git config --global user.email "no-reply@github.com"`
+          `git config --global user.name "Dependabot"`
+          `git init .`
+          `git add .`
+          `git commit -m'fake repo_contents_path'`
+        end
+      end
+
       def go_mod
         @go_mod ||= get_original_file("go.mod")
       end
@@ -81,6 +89,17 @@ module Dependabot
         dependency_files.first.directory
       end
 
+      def vendor_dir
+        File.join(repo_contents_path, directory, "vendor")
+      end
+
+      def vendor_updater
+        Dependabot::FileUpdaters::VendorUpdater.new(
+          repo_contents_path: repo_contents_path,
+          vendor_dir: vendor_dir
+        )
+      end
+
       def file_updater
         @file_updater ||=
           GoModUpdater.new(
@@ -88,9 +107,17 @@ module Dependabot
             credentials: credentials,
             repo_contents_path: repo_contents_path,
             directory: directory,
-            tidy: !@repo_contents_stub && options.fetch(:go_mod_tidy, false)
+            options: { tidy: tidy?, vendor: vendor? }
           )
       end
+
+      def tidy?
+        !@repo_contents_stub
+      end
+
+      def vendor?
+        File.exist?(File.join(vendor_dir, "modules.txt"))
+      end
     end
   end
 end

data/lib/dependabot/go_modules/file_updater/go_mod_updater.rb

@@ -14,9 +14,14 @@ module Dependabot
         ENVIRONMENT = { "GOPRIVATE" => "*" }.freeze
 
         RESOLVABILITY_ERROR_REGEXES = [
+          # (Private) module could not be fetched
           /go: .*: git fetch .*: exit status 128/.freeze,
+          # The checksum in go.sum does not match the dowloaded content
           /verifying .*: checksum mismatch/.freeze,
-          /build .*: cannot find module providing package/.freeze
+          # (Private) module could not be found
+          /cannot find module providing package/.freeze,
+          # Package in module was likely renamed or removed
+          /module .* found \(.*\), but does not contain package/m.freeze
         ].freeze
 
         MODULE_PATH_MISMATCH_REGEXES = [
@@ -26,12 +31,13 @@ module Dependabot
         ].freeze
 
         def initialize(dependencies:, credentials:, repo_contents_path:,
-                       directory:, tidy:)
+                       directory:, options:)
           @dependencies = dependencies
           @credentials = credentials
           @repo_contents_path = repo_contents_path
           @directory = directory
-          @tidy = tidy
+          @tidy = options.fetch(:tidy, false)
+          @vendor = options.fetch(:vendor, false)
         end
 
         def updated_go_mod_content
@@ -51,7 +57,7 @@ module Dependabot
           @updated_files ||= update_files
         end
 
-        def update_files
+        def update_files # rubocop:disable Metrics/AbcSize
           in_repo_path do
             # Map paths in local replace directives to path hashes
 
@@ -71,6 +77,7 @@ module Dependabot
             # Then run `go get` to pick up other changes to the file caused by
             # the upgrade
             run_go_get
+            run_go_vendor
             run_go_mod_tidy
 
             # At this point, the go.mod returned from run_go_get contains the
@@ -111,6 +118,14 @@ module Dependabot
           handle_subprocess_error(stderr) unless status.success?
         end
 
+        def run_go_vendor
+          return unless vendor?
+
+          command = "go mod vendor"
+          _, stderr, status = Open3.capture3(ENVIRONMENT, command)
+          handle_subprocess_error(stderr) unless status.success?
+        end
+
         def update_go_mod(dependencies)
           deps = dependencies.map do |dep|
             {
@@ -273,6 +288,10 @@ module Dependabot
         def tidy?
           !!@tidy
         end
+
+        def vendor?
+          !!@vendor
+        end
       end
     end
   end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-go_modules
 version: !ruby/object:Gem::Version
-  version: 0.121.1
+  version: 0.124.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-10-07 00:00:00.000000000 Z
+date: 2020-10-20 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.121.1
+        version: 0.124.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.121.1
+        version: 0.124.0
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement
@@ -100,14 +100,42 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.92.0
+        version: 0.93.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.92.0
+        version: 0.93.0
+- !ruby/object:Gem::Dependency
+  name: simplecov
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 0.19.0
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 0.19.0
+- !ruby/object:Gem::Dependency
+  name: simplecov-console
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 0.7.2
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 0.7.2
 - !ruby/object:Gem::Dependency
   name: vcr
   requirement: !ruby/object:Gem::Requirement