dependabot-go_modules 0.125.1 → 0.125.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 938fbd55ae7e15ed375af08ff52f4e880542b7dd3ef877cf555926f96db5c562
-  data.tar.gz: 383e4b76b2014d5ad3837c6f0153730e7ac6aa81ca70a0a276963726cdb060dc
+  metadata.gz: d40caace6b8a70902b6e28726c0e8b632d4f20d49db3c8214b4e5c4949d6e353
+  data.tar.gz: fc64b5fe38212dd886938f6a31a7a6a91c81a6eb5853730f1bec418adacc2abe
 SHA512:
-  metadata.gz: 9c0e2bb0834d17d6f9e16bca2d5fb29130a545fbb89526bb27582c055382bebc82cfb4fbb943db30a943de4261afd307017447d407e32977d8c5a656ebf2ee27
-  data.tar.gz: 324459b3127a4663edb326b8e4209530e99a6f35e0d5bb6cf5e0cb2107b4fcc30958cf44e87beac881045696f8a924301eaf5b82fc124f0528735bda47a3e431
+  metadata.gz: 554927206ebc005ad4aa5d70319439cd5b3f9784a6926c106745668ed529eaf1326cf4f3b3f8d89786147153971625092ece781767766cfcb97bd2e65faf5f8e
+  data.tar.gz: 5369595d043f895993fa8834801cad952fc749dff568f468f6af69a3049524718f42cefa5ab6e802d1e8e70ba83b7042c818f083c7318d0dde2bd54be9516b4e

data/helpers/build

@@ -24,3 +24,4 @@ os="$(uname -s | tr '[:upper:]' '[:lower:]')"
 echo "building $install_dir/bin/helper"
 
 GO111MODULE=on GOOS="$os" GOARCH=amd64 go build -o "$install_dir/bin/helper" .
+go clean -cache -modcache

data/lib/dependabot/go_modules/file_parser.rb

@@ -139,8 +139,9 @@ module Dependabot
       def handle_parser_error(path, stderr)
         case stderr
         when /go: .*: unknown revision/m
-          line = stderr.lines.grep(/unknown revision/).first
-          raise Dependabot::DependencyFileNotResolvable, line.strip
+          line = stderr.lines.grep(/unknown revision/).first.strip
+          handle_github_unknown_revision(line) if line.start_with?("go: github.com/")
+          raise Dependabot::DependencyFileNotResolvable, line
         when /go: .*: unrecognized import path/m
           line = stderr.lines.grep(/unrecognized import/).first
           raise Dependabot::DependencyFileNotResolvable, line.strip
@@ -156,6 +157,26 @@ module Dependabot
         end
       end
 
+      GITHUB_REPO_REGEX = %r{github.com/[^@]*}.freeze
+      def handle_github_unknown_revision(line)
+        repo_path = line.scan(GITHUB_REPO_REGEX).first
+        return unless repo_path
+
+        # Query for _any_ version of this module, to know if it doesn't exist (or is private)
+        # or we were just given a bad revision by this manifest
+        SharedHelpers.in_a_temporary_directory do
+          SharedHelpers.with_git_configured(credentials: credentials) do
+            File.write("go.mod", "module dummy\n")
+
+            env = { "GOPRIVATE" => "*" }
+            _, _, status = Open3.capture3(env, SharedHelpers.escape_command("go get #{repo_path}"))
+            raise Dependabot::DependencyFileNotResolvable, line if status.success?
+
+            raise Dependabot::GitDependenciesNotReachable, [repo_path]
+          end
+        end
+      end
+
       def rev_identifier?(dep)
         dep["Version"]&.match?(GIT_VERSION_REGEX)
       end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-go_modules
 version: !ruby/object:Gem::Version
-  version: 0.125.1
+  version: 0.125.6
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-11-05 00:00:00.000000000 Z
+date: 2020-11-27 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.125.1
+        version: 0.125.6
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.125.1
+        version: 0.125.6
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement
@@ -128,14 +128,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.7.2
+        version: 0.8.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.7.2
+        version: 0.8.0
 - !ruby/object:Gem::Dependency
   name: vcr
   requirement: !ruby/object:Gem::Requirement