dependabot-go_modules 0.401.0 → 0.403.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0b2b53bbb48b84ca1f7c5b2f62a63f38bc9fbd4862361827836b9f187c5a814a
-  data.tar.gz: 06066f37ca5940ee83ee6073e7a8215201577e9da520163eda7b6bf30a6f6a25
+  metadata.gz: 3ce2af6f74e26334e34e6f9f4adb5fc892d9dfc711b6fa964c2edb3199d1a060
+  data.tar.gz: 792d2865b21314188ad23c0e98bc215c6e89b87dff6f87669081dc125a10cc22
 SHA512:
-  metadata.gz: cd2e3b779771e3c92a07e7d609af95be7af592f47bd26c792735cb2d0685e1bb104586673103d6f07b861ece56994611dd1b43e362735f7413042480dcdbced8
-  data.tar.gz: 8c16abde1c7c011714160a0f6bb99540356704b7d79ff50321d92d8f280a3fc890ec951342de4748e8609b3638bd384b4c647ddc3777f32b0b0addde94c2f766
+  metadata.gz: 01db7a9b289ca3f3f1d2c443f0db181af398464a367ba03e157fefcafa6d9ae445705adf395c4dca32a50a2d2c71b8c33765132a8918e5358e6e3fc8055f57ce
+  data.tar.gz: b163437bba7deb781def5aa0a49eca690a36182be9ca07f8f3fb1ada68967c4174f68eaf11cb0a2af6f449bf640995ed6273a60912326ca79657216243681987

data/lib/dependabot/go_modules/file_updater/go_mod_updater.rb

@@ -114,6 +114,12 @@ module Dependabot
         GITHUB_403_REGEX =
           %r{https://github\.com/(?<repo>[^/'\s]+/[^/'\s]+)/?': The requested URL returned error: 403}
 
+        # An import that no module provides, as `go mod tidy` and `go get` report it. The package is often inside the
+        # repository's own module, and is generated code (protobuf, mocks) that is not committed.
+        MISSING_PACKAGE_ERROR = /^\s*(?<package>\S+): no matching versions for query "latest"/
+
+        GO_PROGRESS_LINE = /^go: (?:downloading|extracting) /
+
         GO_MOD_VERSION = /^go 1\.\d+(\.\d+)?$/
 
         sig do
@@ -252,6 +258,7 @@ module Dependabot
 
             run_go_work_sync
             run_workspace_tidy
+            run_go_list_modules
 
             collect_workspace_file_contents
           end
@@ -277,6 +284,20 @@ module Dependabot
           end
         end
 
+        # Go < 1.28 leaves go.work.sum without the checksums that `go list -m all` adds after `go work sync`
+        # (golang/go#63901). Loading the full module list last records them for the final workspace graph.
+        # Best-effort: sync and tidy have already succeeded, so a failure here must not fail the update.
+        sig { void }
+        def run_go_list_modules
+          return unless dependency_files.any? { |f| f.name == "go.work.sum" }
+
+          command = "go list -m all"
+          _, stderr, status = Open3.capture3(command)
+          return if status.success?
+
+          Dependabot.logger.info "Failed to `#{command}` in the workspace: #{stderr}"
+        end
+
         sig { returns(T::Array[String]) }
         def workspace_module_paths
           go_work_file = dependency_files.find { |f| f.name.end_with?("go.work") }
@@ -498,6 +519,8 @@ module Dependabot
             )
           end
 
+          raise_for_missing_package_error(stderr)
+
           # We don't know what happened so we raise a generic error
           msg = stderr.lines.last(10).join.strip
           raise Dependabot::DependabotError, msg
@@ -531,6 +554,18 @@ module Dependabot
           end
         end
 
+        sig { params(stderr: String).void }
+        def raise_for_missing_package_error(stderr)
+          packages = stderr.scan(MISSING_PACKAGE_ERROR).flatten.uniq
+          return if packages.empty?
+
+          raise Dependabot::DependencyFileNotResolvable,
+                "Go cannot find a module that provides #{packages.join(', ')}. If they are generated code " \
+                "(for example protobuf or mock output) that is not committed, Dependabot cannot generate it: " \
+                "commit the generated files, or check the import paths.\n\n" \
+                "#{stderr.lines.grep_v(GO_PROGRESS_LINE).join.strip}"
+        end
+
         sig { params(stderr: String).void }
         def raise_for_go_mod_parse_error(stderr)
           go_mod_parse_error_regex = GO_MOD_PARSE_ERROR_REGEXES.find { |r| stderr =~ r }

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-go_modules
 version: !ruby/object:Gem::Version
-  version: 0.401.0
+  version: 0.403.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.401.0
+        version: 0.403.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.401.0
+        version: 0.403.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -277,7 +277,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.401.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.403.0
 rdoc_options: []
 require_paths:
 - lib