dependabot-go_modules 0.126.1 → 0.128.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d4186139c2bb3f62bd4f9446eb2a9e00742d0059c02c3c230aa74a738f6c2ae6
-  data.tar.gz: 3635f9c4276e27e34fd1c3b0694bb821e1c9fdaac745f486cfdb0d9457de727a
+  metadata.gz: 829d0ac68d17ff0e98eb1cea23df08e6d0dda6f28b9f9f7315b99b7ed2a6a355
+  data.tar.gz: f90a05b616834eea6573db46d5e327ffc2fc233fc9018562746205f88972a2c0
 SHA512:
-  metadata.gz: 75a0df4e2bdd441cbf2acc8ea963fa64388eac99567494efe1e4fe9afc551642fbac4807f769244a3e10e586124fd1adbba93d409fbe473d43ba101c36f4f20f
-  data.tar.gz: 442e099ca2a89a721dcbd09b202413a69b9d479aa94d7498b0dd5c88ff8eebdde29de94835c9a6409768512325b5e83127879cbfda9cc12de11ea8f0efb48141
+  metadata.gz: 1fe6f621f9af602d6c4f8245e17376f6fb3ea010d97b0ccd31d832f1a91d119133ca9cc2a6c386595320770214a08891bf9c3260035476985417242a59d495a6
+  data.tar.gz: 73f66e0d0165db078aee5ea0ddbe088306955eb7be220e43118bc5d46ae06c302836472d6565d19a9ec04e4285695ed0b8e4f53576b972c7f1d2dd6e0a1e1ef3

data/lib/dependabot/go_modules/file_updater/go_mod_updater.rb

@@ -35,6 +35,11 @@ module Dependabot
           /go: ([^@\s]+)(?:@[^\s]+)?: .* declares its path as: ([\S]*)/m
         ].freeze
 
+        OUT_OF_DISK_REGEXES = [
+          %r{input/output error}.freeze,
+          /no space left on device/.freeze
+        ].freeze
+
         def initialize(dependencies:, credentials:, repo_contents_path:,
                        directory:, options:)
           @dependencies = dependencies
@@ -235,12 +240,37 @@ module Dependabot
               (manifest["Replace"] || []).
                 map { |r| r["New"]["Path"] }.
                 compact.
-                select { |p| p.start_with?(".") || p.start_with?("/") }.
+                select { |p| stub_replace_path?(p) }.
                 map { |p| [p, "./" + Digest::SHA2.hexdigest(p)] }.
                 to_h
             end
         end
 
+        # returns true if the provided path should be replaced with a stub
+        def stub_replace_path?(path)
+          return true if absolute_path?(path)
+          return false unless relative_replacement_path?(path)
+
+          resolved_path = module_pathname.join(path).realpath
+          inside_repo_contents_path = resolved_path.to_s.start_with?(repo_contents_path.to_s)
+          !inside_repo_contents_path
+        rescue Errno::ENOENT
+          true
+        end
+
+        def absolute_path?(path)
+          path.start_with?("/")
+        end
+
+        def relative_replacement_path?(path)
+          # https://golang.org/ref/mod#go-mod-file-replace
+          path.start_with?("./") || path.start_with?("../")
+        end
+
+        def module_pathname
+          @module_pathname ||= Pathname.new(repo_contents_path).join(directory)
+        end
+
         def substitute_all(substitutions)
           body = substitutions.reduce(File.read("go.mod")) do |text, (a, b)|
             text.sub(a, b)
@@ -265,6 +295,12 @@ module Dependabot
               new(go_mod_path, match[1], match[2])
           end
 
+          out_of_disk_regex = OUT_OF_DISK_REGEXES.find { |r| stderr =~ r }
+          if out_of_disk_regex
+            lines = stderr.lines.select { |l| out_of_disk_regex =~ l }
+            raise Dependabot::OutOfDisk.new, lines.join
+          end
+
           # We don't know what happened so we raise a generic error
           msg = stderr.lines.last(10).join.strip
           raise Dependabot::DependabotError, msg

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-go_modules
 version: !ruby/object:Gem::Version
-  version: 0.126.1
+  version: 0.128.2
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-12-10 00:00:00.000000000 Z
+date: 2020-12-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.126.1
+        version: 0.128.2
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.126.1
+        version: 0.128.2
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement