dependabot-go_modules 0.126.0 → 0.128.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7dbc4274560d04bbf09b09689428c79d743257f4ac0b21a64b2e5227ba29b56a
-  data.tar.gz: 7a3b3fc2b78ae5869d5acd13211c3401d316444e160fd71a23e8a6d7f9afc944
+  metadata.gz: 29da29921bc4394c205fb629cb0789c925786644cb959b46f9b2f298db09cfaf
+  data.tar.gz: 7a4d3430eedaabe4042c9ffe8e6217b012c79ede1baeeca957da44baaa507ee0
 SHA512:
-  metadata.gz: 9f8d205f48240fbb46f6ef08af769c4c33dcb5ea4d4c6514d808de9334e8c191cf38ef844acb0a7e68a1f77d402ede0959ea7fdfae4f09930051fa9e373e2dda
-  data.tar.gz: 243ebe6509585802e61692d90bc3649b1fe8e2808a6c3c33c073aa7adba82a1b4364e991896981300a5a6b9e1e263483787645081ebc8d8e57dc7f692eff5dd0
+  metadata.gz: ff7112a43b6836338ff04931727b1b7868963e5adb342df5168690afb4817ff2cdc15e86d9f745e389a5c36ced024f47dc3b02666865a0f29454c9b86a1732cc
+  data.tar.gz: ade4e284555898deb7a757149be26461ebf75b4e94e1b226165cfa2bcea2a1464580e83e503528674f29436bfe47ae9e7c048af071cf3c80f789cebc1f635ccc

data/lib/dependabot/go_modules/file_updater/go_mod_updater.rb

@@ -35,6 +35,11 @@ module Dependabot
           /go: ([^@\s]+)(?:@[^\s]+)?: .* declares its path as: ([\S]*)/m
         ].freeze
 
+        OUT_OF_DISK_REGEXES = [
+          %r{input/output error}.freeze,
+          /no space left on device/.freeze
+        ].freeze
+
         def initialize(dependencies:, credentials:, repo_contents_path:,
                        directory:, options:)
           @dependencies = dependencies
@@ -118,9 +123,15 @@ module Dependabot
         def run_go_mod_tidy
           return unless tidy?
 
+          # NOTE(arslan): use `go mod tidy -e` once Go 1.16 is out:
+          # https://github.com/golang/go/commit/3aa09489ab3aa13a3ac78b1ff012b148ffffe367
           command = "go mod tidy"
-          _, stderr, status = Open3.capture3(ENVIRONMENT, command)
-          handle_subprocess_error(stderr) unless status.success?
+
+          # we explicitly don't raise an error for 'go mod tidy' and silently
+          # continue here. `go mod tidy` shouldn't block updating versions
+          # because there are some edge cases where it's OK to fail (such as
+          # generated files not available yet to us).
+          Open3.capture3(ENVIRONMENT, command)
         end
 
         def run_go_vendor
@@ -229,12 +240,37 @@ module Dependabot
               (manifest["Replace"] || []).
                 map { |r| r["New"]["Path"] }.
                 compact.
-                select { |p| p.start_with?(".") || p.start_with?("/") }.
+                select { |p| stub_replace_path?(p) }.
                 map { |p| [p, "./" + Digest::SHA2.hexdigest(p)] }.
                 to_h
             end
         end
 
+        # returns true if the provided path should be replaced with a stub
+        def stub_replace_path?(path)
+          return true if absolute_path?(path)
+          return false unless relative_replacement_path?(path)
+
+          resolved_path = module_pathname.join(path).realpath
+          inside_repo_contents_path = resolved_path.to_s.start_with?(repo_contents_path.to_s)
+          !inside_repo_contents_path
+        rescue Errno::ENOENT
+          true
+        end
+
+        def absolute_path?(path)
+          path.start_with?("/")
+        end
+
+        def relative_replacement_path?(path)
+          # https://golang.org/ref/mod#go-mod-file-replace
+          path.start_with?("./") || path.start_with?("../")
+        end
+
+        def module_pathname
+          @module_pathname ||= repo_contents_path.join(directory)
+        end
+
         def substitute_all(substitutions)
           body = substitutions.reduce(File.read("go.mod")) do |text, (a, b)|
             text.sub(a, b)
@@ -259,6 +295,12 @@ module Dependabot
               new(go_mod_path, match[1], match[2])
           end
 
+          out_of_disk_regex = OUT_OF_DISK_REGEXES.find { |r| stderr =~ r }
+          if out_of_disk_regex
+            lines = stderr.lines.select { |l| out_of_disk_regex =~ l }
+            raise Dependabot::OutOfDisk.new, lines.join
+          end
+
           # We don't know what happened so we raise a generic error
           msg = stderr.lines.last(10).join.strip
           raise Dependabot::DependabotError, msg

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-go_modules
 version: !ruby/object:Gem::Version
-  version: 0.126.0
+  version: 0.128.1
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-12-08 00:00:00.000000000 Z
+date: 2020-12-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.126.0
+        version: 0.128.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.126.0
+        version: 0.128.1
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement
@@ -100,14 +100,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.5.0
+        version: 1.6.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.5.0
+        version: 1.6.0
 - !ruby/object:Gem::Dependency
   name: simplecov
   requirement: !ruby/object:Gem::Requirement