dependabot-go_modules 0.108.11 → 0.108.12

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: eff351d40f49552ffa906fa77fbc3899c6eb3671975dd643499e3e3e539e456a
-  data.tar.gz: 667347d4f9bcde04d16e7a4b3499657b942926352828ca166280dabd850b7d2b
+  metadata.gz: ca7e5018cdc7a4ab5c37614e3cfdc55caed507148115ca6755e39c295cbc7b7e
+  data.tar.gz: e885fdfc8540135deb192e5d444c1cc1e894211eb17054d2f8b5e9c0670f3a1b
 SHA512:
-  metadata.gz: 7e61822fb69b8cc2bd6165423b65aa510cc0a38244f932b43d40e9c55c85138ffaf99dc45441a9fdeec7f0859807c39c67de88931591a6a6f17afb427b40a685
-  data.tar.gz: c1ffea94264f108f6512abe5a97b3ec15a6ee8c07f6dc364adb3e6879fbd5ba241944f50b9c89aaea4e58ef77e9ddf0bc1ed5ed78dd25088f3061b7cf79a318b
+  metadata.gz: '09da58eaaf9d9fc93666b1ef8efda1273298cf0c1713d964333378eeb94c8dd91979c7fbac9252c30396ad508c1800220388175e96cb190341253ac458c57971'
+  data.tar.gz: 908aca3630a2cd043d8b206a8702c45f306c86b19185bdffd9ac0b89c06df3e92f396381a6f07fe3e9171d907f1f80ad3768e77aa5ae7c8609d1586ab4b83643

data/lib/dependabot/go_modules/file_updater/go_mod_updater.rb

@@ -44,12 +44,20 @@ module Dependabot
           return nil unless go_sum
 
           # This needs to be run separately so we don't nest subprocess calls
-          updated_go_mod_content
+          prepared_go_mod_content
 
           @updated_go_sum_content ||=
             SharedHelpers.in_a_temporary_directory do
               SharedHelpers.with_git_configured(credentials: credentials) do
-                File.write("go.mod", updated_go_mod_content)
+                # Create a fake empty module for each local module so that
+                # `go get -d` works, even if some modules have been `replace`d
+                # with a local module that we don't have access to.
+                local_replacements.each do |_, stub_path|
+                  Dir.mkdir(stub_path) unless Dir.exist?(stub_path)
+                  FileUtils.touch(File.join(stub_path, "go.mod"))
+                end
+
+                File.write("go.mod", prepared_go_mod_content)
                 File.write("go.sum", go_sum.content)
                 File.write("main.go", dummy_main_go)
 
@@ -76,6 +84,37 @@ module Dependabot
           /go: ([^@\s]+)(?:@[^\s]+)?: .* unexpected module path "(.*)"/
         ].freeze
 
+        def local_replacements
+          @local_replacements ||=
+            SharedHelpers.in_a_temporary_directory do |path|
+              File.write("go.mod", go_mod.content)
+
+              # Parse the go.mod to get a JSON representation of the replace
+              # directives
+              command = "go mod edit -json"
+              env = { "GO111MODULE" => "on" }
+              stdout, stderr, status = Open3.capture3(env, command)
+              handle_parser_error(path, stderr) unless status.success?
+
+              # Find all the local replacements, and return them with a stub
+              # path we can use in their place. Using generated paths is safer
+              # as it means we don't need to worry about references to parent
+              # directories, etc.
+              (JSON.parse(stdout)["Replace"] || []).
+                map { |r| r["New"]["Path"] }.
+                compact.
+                select { |p| p.start_with?(".") || p.start_with?("/") }.
+                map { |p| [p, "./" + Digest::SHA2.hexdigest(p)] }
+            end
+        end
+
+        def prepared_go_mod_content
+          content = updated_go_mod_content
+          local_replacements.reduce(content) do |body, (path, stub_path)|
+            body.sub(path, stub_path)
+          end
+        end
+
         def handle_subprocess_error(path, stderr)
           error_regex = RESOLVABILITY_ERROR_REGEXES.find { |r| stderr =~ r }
           if error_regex

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-go_modules
 version: !ruby/object:Gem::Version
-  version: 0.108.11
+  version: 0.108.12
 platform: ruby
 authors:
 - Dependabot
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.108.11
+        version: 0.108.12
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.108.11
+        version: 0.108.12
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement