dependabot-go_modules 0.125.2 → 0.125.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 204052ad6212c6f372e3bb40d035eb5a200375ed75b305c7a463234ae7b33386
-  data.tar.gz: 819249afceeb8366a8d0072ca7f805db02cad601f3dc4fa799505bc3f37df9f6
+  metadata.gz: e6dda4cd88811bb7ec0f14ebbe79a3a81e79aeb3c1d838c16cae91efac49beea
+  data.tar.gz: 62198ba73d600dccb1fa1ce3fa55c70e182e4a25614830a5d2fda5fa7eaf653c
 SHA512:
-  metadata.gz: 2f783a5e157138a9447217e4068f87ecb33ddf6bb26a2f21cc6e2cc41c12c64873ddd29634e7b3bb012ffd2ddea7df72b88613bc7c6626c3f4ef6cac8d0f2124
-  data.tar.gz: 06dd80fc7e260995ea5ec44a15e3dcdc9f43de30b247713241409c64271f7d3a09c1183d962a915c8981ece52bdadc9e05952359aa85656626b3f3b730490ca9
+  metadata.gz: 7fb4d18080186d3a34d4ec8ff639a74084944567605849e0cee487aa9b285c2c1a732a6fd6f4f661659e190aefd0269bb7e6ffdef63ca9fa244d9205aa2a9de2
+  data.tar.gz: 0df0561ec6e2e86380f848a1e1e0fb0f52c68bbd54d847147e6ad1808ed1a0aba1e18965b7784c1b5b5d25c52ce6fb1c10b8119117e08c1a152dc4dd7fd121fc

data/helpers/build

@@ -24,3 +24,4 @@ os="$(uname -s | tr '[:upper:]' '[:lower:]')"
 echo "building $install_dir/bin/helper"
 
 GO111MODULE=on GOOS="$os" GOARCH=amd64 go build -o "$install_dir/bin/helper" .
+go clean -cache -modcache

data/lib/dependabot/go_modules/file_parser.rb

@@ -139,8 +139,9 @@ module Dependabot
       def handle_parser_error(path, stderr)
         case stderr
         when /go: .*: unknown revision/m
-          line = stderr.lines.grep(/unknown revision/).first
-          raise Dependabot::DependencyFileNotResolvable, line.strip
+          line = stderr.lines.grep(/unknown revision/).first.strip
+          handle_github_unknown_revision(line) if line.start_with?("go: github.com/")
+          raise Dependabot::DependencyFileNotResolvable, line
         when /go: .*: unrecognized import path/m
           line = stderr.lines.grep(/unrecognized import/).first
           raise Dependabot::DependencyFileNotResolvable, line.strip
@@ -156,6 +157,26 @@ module Dependabot
         end
       end
 
+      GITHUB_REPO_REGEX = %r{github.com/[^@]*}.freeze
+      def handle_github_unknown_revision(line)
+        repo_path = line.scan(GITHUB_REPO_REGEX).first
+        return unless repo_path
+
+        # Query for _any_ version of this module, to know if it doesn't exist (or is private)
+        # or we were just given a bad revision by this manifest
+        SharedHelpers.in_a_temporary_directory do
+          SharedHelpers.with_git_configured(credentials: credentials) do
+            File.write("go.mod", "module dummy\n")
+
+            env = { "GOPRIVATE" => "*" }
+            _, _, status = Open3.capture3(env, SharedHelpers.escape_command("go get #{repo_path}"))
+            raise Dependabot::DependencyFileNotResolvable, line if status.success?
+
+            raise Dependabot::GitDependenciesNotReachable, [repo_path]
+          end
+        end
+      end
+
       def rev_identifier?(dep)
         dep["Version"]&.match?(GIT_VERSION_REGEX)
       end

data/lib/dependabot/go_modules/requirement.rb

@@ -132,7 +132,7 @@ module Dependabot
         "~> #{parts.join('.')}"
       end
 
-      # Note: Dep's caret notation implementation doesn't distinguish between
+      # NOTE: Dep's caret notation implementation doesn't distinguish between
       # pre and post-1.0.0 requirements (unlike in JS)
       def convert_caret_req(req_string)
         version = req_string.gsub(/^\^?v?/, "")

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-go_modules
 version: !ruby/object:Gem::Version
-  version: 0.125.2
+  version: 0.125.7
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-11-11 00:00:00.000000000 Z
+date: 2020-11-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.125.2
+        version: 0.125.7
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.125.2
+        version: 0.125.7
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement
@@ -100,42 +100,42 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.93.0
+        version: 1.4.2
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.93.0
+        version: 1.4.2
 - !ruby/object:Gem::Dependency
   name: simplecov
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.19.0
+        version: 0.20.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.19.0
+        version: 0.20.0
 - !ruby/object:Gem::Dependency
   name: simplecov-console
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.7.2
+        version: 0.8.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.7.2
+        version: 0.8.0
 - !ruby/object:Gem::Dependency
   name: vcr
   requirement: !ruby/object:Gem::Requirement