dependabot-go_modules 0.125.0 → 0.125.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7f82b946870f3261b65081ac3aa1b56c3e965f986afb66d083b85204bfe19ec7
-  data.tar.gz: b2d70637d23ce5ba04bd4f6a6d5fdef06ed9fdad1f32b87b768f5ec75d1c36a6
+  metadata.gz: cd62ff6232afe4365ad9b9002071442a96d4c4c162b895cc333149c3f1e91665
+  data.tar.gz: 573009b5dc3a1d8690fcd1443e75c34ced9770c592748e11e56d645d699bce55
 SHA512:
-  metadata.gz: 64d513d3498bbe3d4d8e03476006bfbf3b0b431f3bda89a00746bd0da3a5f78b746b766836233245103550ff79537da5d9831f01a8f3af77cb080c8ebd854529
-  data.tar.gz: 6a826d07d6a64d375154ddf9e4a6d075f5702f26416cf3240d5fda2a827d08aa209d9c03395e7241ae1b63f8552aa9cac7cc8908b185793260c802587f8912ed
+  metadata.gz: 0be90c879799b94ced28ff90d02c7a1f44faec42a6a74455bb4795bf3ededc7bbc60f8df778ee772f8933f4ecf88f2541d936ad533fc65c3a887e15a55866370
+  data.tar.gz: 9521cad48c80f5fe26d9679f7c0e5cb4d3f430ea32d7c8399e5ad26f04c4c5e9f4a6b9a80904c0dbd551c53568e0e1817c98e2e01c5e7870962ba0fdf71c3161

data/helpers/build

@@ -24,3 +24,4 @@ os="$(uname -s | tr '[:upper:]' '[:lower:]')"
 echo "building $install_dir/bin/helper"
 
 GO111MODULE=on GOOS="$os" GOARCH=amd64 go build -o "$install_dir/bin/helper" .
+go clean -cache -modcache

data/lib/dependabot/go_modules/file_parser.rb

@@ -139,8 +139,9 @@ module Dependabot
       def handle_parser_error(path, stderr)
         case stderr
         when /go: .*: unknown revision/m
-          line = stderr.lines.grep(/unknown revision/).first
-          raise Dependabot::DependencyFileNotResolvable, line.strip
+          line = stderr.lines.grep(/unknown revision/).first.strip
+          handle_github_unknown_revision(line) if line.start_with?("go: github.com/")
+          raise Dependabot::DependencyFileNotResolvable, line
         when /go: .*: unrecognized import path/m
           line = stderr.lines.grep(/unrecognized import/).first
           raise Dependabot::DependencyFileNotResolvable, line.strip
@@ -156,6 +157,26 @@ module Dependabot
         end
       end
 
+      GITHUB_REPO_REGEX = %r{github.com/[^@]*}.freeze
+      def handle_github_unknown_revision(line)
+        repo_path = line.scan(GITHUB_REPO_REGEX).first
+        return unless repo_path
+
+        # Query for _any_ version of this module, to know if it doesn't exist (or is private)
+        # or we were just given a bad revision by this manifest
+        SharedHelpers.in_a_temporary_directory do
+          SharedHelpers.with_git_configured(credentials: credentials) do
+            File.write("go.mod", "module dummy\n")
+
+            env = { "GOPRIVATE" => "*" }
+            _, _, status = Open3.capture3(env, SharedHelpers.escape_command("go get #{repo_path}"))
+            raise Dependabot::DependencyFileNotResolvable, line if status.success?
+
+            raise Dependabot::GitDependenciesNotReachable, [repo_path]
+          end
+        end
+      end
+
       def rev_identifier?(dep)
         dep["Version"]&.match?(GIT_VERSION_REGEX)
       end

data/lib/dependabot/go_modules/requirement.rb

@@ -91,9 +91,7 @@ module Dependabot
       def replace_wildcard_in_lower_bound(req_string)
         after_wildcard = false
 
-        if req_string.start_with?("~")
-          req_string = req_string.gsub(/(?:(?:\.|^)[xX*])(\.[xX*])+/, "")
-        end
+        req_string = req_string.gsub(/(?:(?:\.|^)[xX*])(\.[xX*])+/, "") if req_string.start_with?("~")
 
         req_string.split(".").
           map do |part|

data/lib/dependabot/go_modules/update_checker.rb

@@ -121,9 +121,7 @@ module Dependabot
       def version_from_tag(tag)
         # To compare with the current version we either use the commit SHA
         # (if that's what the parser picked up) of the tag name.
-        if dependency.version&.match?(/^[0-9a-f]{40}$/)
-          return tag&.fetch(:commit_sha)
-        end
+        return tag&.fetch(:commit_sha) if dependency.version&.match?(/^[0-9a-f]{40}$/)
 
         tag&.fetch(:tag)
       end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-go_modules
 version: !ruby/object:Gem::Version
-  version: 0.125.0
+  version: 0.125.5
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-11-05 00:00:00.000000000 Z
+date: 2020-11-25 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.125.0
+        version: 0.125.5
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.125.0
+        version: 0.125.5
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement
@@ -128,14 +128,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.7.2
+        version: 0.8.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.7.2
+        version: 0.8.0
 - !ruby/object:Gem::Dependency
   name: vcr
   requirement: !ruby/object:Gem::Requirement