dependabot-go_modules 0.402.0 → 0.403.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1c052f4f5db8b010cd76d3626359a37799e1da3e6a2e8a95909764f4254918ba
-  data.tar.gz: e04068d807a4ad8f3febb620e8c3c18769ea553e47dd44258bd21e895e2c2aa8
+  metadata.gz: 3ce2af6f74e26334e34e6f9f4adb5fc892d9dfc711b6fa964c2edb3199d1a060
+  data.tar.gz: 792d2865b21314188ad23c0e98bc215c6e89b87dff6f87669081dc125a10cc22
 SHA512:
-  metadata.gz: afc71ddb4ebee49031e1755946e69809ffc884d4301931f0920c8d7a3b75d43c29dc23ba0b2a831c2ce33f33de55e523f55532b329cc981979046d76a902251e
-  data.tar.gz: d971f9e7489aecf9a7129d11d8d5c31d5c8af794139c7967186d39cf71ae412c31487e9ef2308b4630ec69146005f29422cba4474be9e09d6df3dc08c448a499
+  metadata.gz: 01db7a9b289ca3f3f1d2c443f0db181af398464a367ba03e157fefcafa6d9ae445705adf395c4dca32a50a2d2c71b8c33765132a8918e5358e6e3fc8055f57ce
+  data.tar.gz: b163437bba7deb781def5aa0a49eca690a36182be9ca07f8f3fb1ada68967c4174f68eaf11cb0a2af6f449bf640995ed6273a60912326ca79657216243681987

data/lib/dependabot/go_modules/file_updater/go_mod_updater.rb

@@ -114,6 +114,12 @@ module Dependabot
         GITHUB_403_REGEX =
           %r{https://github\.com/(?<repo>[^/'\s]+/[^/'\s]+)/?': The requested URL returned error: 403}
 
+        # An import that no module provides, as `go mod tidy` and `go get` report it. The package is often inside the
+        # repository's own module, and is generated code (protobuf, mocks) that is not committed.
+        MISSING_PACKAGE_ERROR = /^\s*(?<package>\S+): no matching versions for query "latest"/
+
+        GO_PROGRESS_LINE = /^go: (?:downloading|extracting) /
+
         GO_MOD_VERSION = /^go 1\.\d+(\.\d+)?$/
 
         sig do
@@ -513,6 +519,8 @@ module Dependabot
             )
           end
 
+          raise_for_missing_package_error(stderr)
+
           # We don't know what happened so we raise a generic error
           msg = stderr.lines.last(10).join.strip
           raise Dependabot::DependabotError, msg
@@ -546,6 +554,18 @@ module Dependabot
           end
         end
 
+        sig { params(stderr: String).void }
+        def raise_for_missing_package_error(stderr)
+          packages = stderr.scan(MISSING_PACKAGE_ERROR).flatten.uniq
+          return if packages.empty?
+
+          raise Dependabot::DependencyFileNotResolvable,
+                "Go cannot find a module that provides #{packages.join(', ')}. If they are generated code " \
+                "(for example protobuf or mock output) that is not committed, Dependabot cannot generate it: " \
+                "commit the generated files, or check the import paths.\n\n" \
+                "#{stderr.lines.grep_v(GO_PROGRESS_LINE).join.strip}"
+        end
+
         sig { params(stderr: String).void }
         def raise_for_go_mod_parse_error(stderr)
           go_mod_parse_error_regex = GO_MOD_PARSE_ERROR_REGEXES.find { |r| stderr =~ r }

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-go_modules
 version: !ruby/object:Gem::Version
-  version: 0.402.0
+  version: 0.403.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.402.0
+        version: 0.403.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.402.0
+        version: 0.403.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -277,7 +277,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.402.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.403.0
 rdoc_options: []
 require_paths:
 - lib