dependabot-go_modules 0.340.0 → 0.341.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1b695c0ab28ab17c59d2343007d70d9122ec0355b16e2b780e0660c616bdb90f
-  data.tar.gz: af69934d9b47e3eeec459f021610dc591949a3e6b1073f9729e62531ffd29734
+  metadata.gz: a9ca492d6b9d56a7be03e19e38be007bc307d7ea23ec4d0a5d88f371029a73da
+  data.tar.gz: db692934cb7d258f6f2ae10b325840e08877561573ca5603b2fc8c230bb703f6
 SHA512:
-  metadata.gz: eba6fc0b774efcf9ad9ec96e93e47cc235ab31a5008d5a7ab5d43bedb9293f85369099b68e182e6c63568ab09041071dcc7ee643b975f3ccdd223ef1b379e9a7
-  data.tar.gz: 4c0a6ff2f636a900f137fdf5bba5ab8b4832b8e8f4d97d86ef92e3647dd9d2264cf76201ba6c3c3ae61eb69d1681f5fb82e28b40a4ea37e73271c79c28fbae3e
+  metadata.gz: cfb88ba08e3122dbdadbf85b188d0360ac3331f2c674793a11305f583d2c9f4b9f8637b36aa7e75f4d340f397543add55a6f662971cfc4748ceedffa59d942e4
+  data.tar.gz: a3e94ce7e338c7cf6f13c8da2f272f63fb69f8a9923fffde63e947bb4e831f1eebef9a28a2f0e25d81a35aac923a16a5e87120e02a88757cba079984f0c25c2a

data/lib/dependabot/go_modules/dependency_grapher.rb

@@ -9,6 +9,17 @@ require "dependabot/dependency_graphers/base"
 module Dependabot
   module GoModules
     class DependencyGrapher < Dependabot::DependencyGraphers::Base
+      # Used to capture output from `go mod graph`
+      #
+      # The parent and child are space-separated and we process one line at a time.
+      #
+      # Example output:
+      #   github.com/dependabot/core-test rsc.io/sampler@v1.3.0
+      #   rsc.io/sampler@v1.3.0 golang.org/x/text@v0.0.0-20170915032832-14c0d48ead0c
+      #   <---parent--->        <----child------>
+      #
+      GO_MOD_GRAPH_LINE_REGEX = /^(?<parent>[^@\s]+)@?[^\s]*\s(?<child>[^@\s]+)/
+
       sig { override.returns(Dependabot::DependencyFile) }
       def relevant_dependency_file
         # This cannot realistically happen as the parser will throw a runtime error on init without a go_mod file,
@@ -26,7 +37,7 @@ module Dependabot
       # doing this in the parser shouldn't add a huge overhead.
       sig { override.params(dependency: Dependabot::Dependency).returns(T::Array[String]) }
       def fetch_subdependencies(dependency)
-        dependency.metadata.fetch(:depends_on, [])
+        package_relationships.fetch(dependency.name, [])
       end
 
       sig { returns(T.nilable(Dependabot::DependencyFile)) }
@@ -52,6 +63,31 @@ module Dependabot
       def purl_pkg_for(_dependency)
         "golang"
       end
+
+      sig { returns(T::Hash[String, T.untyped]) }
+      def package_relationships
+        @package_relationships ||= T.let(
+          fetch_package_relationships,
+          T.nilable(T::Hash[String, T.untyped])
+        )
+      end
+
+      sig { returns(T::Hash[String, T.untyped]) }
+      def fetch_package_relationships
+        T.cast(
+          file_parser,
+          Dependabot::GoModules::FileParser
+        ).run_in_parsed_context("go mod graph").lines.each_with_object({}) do |line, rels|
+          match = line.match(GO_MOD_GRAPH_LINE_REGEX)
+          unless match
+            Dependabot.logger.warn("Unexpected output from 'go mod graph': 'line'")
+            next
+          end
+
+          rels[match[:parent]] ||= []
+          rels[match[:parent]] << match[:child]
+        end
+      end
     end
   end
 end

data/lib/dependabot/go_modules/file_parser.rb

@@ -72,6 +72,26 @@ module Dependabot
         )
       end
 
+      # Utility method to allow collaborators to check other go commands inside the parsed project's context
+      sig { params(command: String).returns(String) }
+      def run_in_parsed_context(command)
+        SharedHelpers.in_a_temporary_directory do |path|
+          # Create a fake empty module for each local module so that
+          # `go mod edit` works, even if some modules have been `replace`d with
+          # a local module that we don't have access to.
+          local_replacements.each do |_, stub_path|
+            FileUtils.mkdir_p(stub_path)
+            FileUtils.touch(File.join(stub_path, "go.mod"))
+          end
+
+          File.write("go.mod", go_mod_content)
+          stdout, stderr, status = Open3.capture3(command)
+          handle_parser_error(path, stderr) unless status.success?
+
+          stdout
+        end
+      end
+
       private
 
       sig { void }
@@ -194,23 +214,7 @@ module Dependabot
       def required_packages
         @required_packages ||=
           T.let(
-            SharedHelpers.in_a_temporary_directory do |path|
-              # Create a fake empty module for each local module so that
-              # `go mod edit` works, even if some modules have been `replace`d with
-              # a local module that we don't have access to.
-              local_replacements.each do |_, stub_path|
-                FileUtils.mkdir_p(stub_path)
-                FileUtils.touch(File.join(stub_path, "go.mod"))
-              end
-
-              File.write("go.mod", go_mod_content)
-
-              command = "go mod edit -json"
-
-              stdout, stderr, status = Open3.capture3(command)
-              handle_parser_error(path, stderr) unless status.success?
-              JSON.parse(stdout)["Require"] || []
-            end,
+            JSON.parse(run_in_parsed_context("go mod edit -json"))["Require"] || [],
             T.nilable(T::Array[T::Hash[String, T.untyped]])
           )
       end

data/lib/dependabot/go_modules/file_updater.rb

@@ -32,15 +32,6 @@ module Dependabot
         use_repo_contents_stub if repo_contents_path.nil?
       end
 
-      sig { override.returns(T::Array[Regexp]) }
-      def self.updated_files_regex
-        [
-          /^go\.mod$/,
-          /^go\.sum$/,
-          %r{^vendor/.*}
-        ]
-      end
-
       sig { override.returns(T::Array[Dependabot::DependencyFile]) }
       def updated_dependency_files
         updated_files = []

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-go_modules
 version: !ruby/object:Gem::Version
-  version: 0.340.0
+  version: 0.341.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.340.0
+        version: 0.341.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.340.0
+        version: 0.341.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -272,7 +272,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.340.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.341.0
 rdoc_options: []
 require_paths:
 - lib