dependabot-go_modules 0.108.5 → 0.108.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b40e73489de1680eba2f39e21a02e66a1ae741f8df455f2ae78fb7f307403654
-  data.tar.gz: af72b097af408e66b30885e8f61e9a2f7eb4d379fb13c2a6983cc9223a70dd36
+  metadata.gz: ce6f5dc536a60ddf4cd51d4ccce3faf0ceb5de3f24da316263d812fe409727f3
+  data.tar.gz: f96dd76188542d28ad13d511eda0bc38e86fb34e75273d590aaf398bb1903362
 SHA512:
-  metadata.gz: c62811a5de266908eea3cef1e4c519a5febd8541e6413d32bb28b4cde768dce98daee9b7d781ae60149d1d5c79544e97364c6cc8758fca56fb14a1dc211a5fde
-  data.tar.gz: 0afef8107f8992e2b9c6f5fc2d996605444ad1ae4facda23029fb3f021229b12d2f29ad0afe6e1f9abc703cc2b04a68c50b2a136b53b6a90bbb760fd61f677b8
+  metadata.gz: fd77729970e9cea2f739ad73d5adf52b2e7ef60bfa135e7fdfadef9b60e2002ae8353a48310cc467bbe28a0e6c5e4d86ba8119f0f862badcd59d7679a010053c
+  data.tar.gz: 6db938d4567033e8997889739ea6aaa487ac83d0c090db787fa8818a968d5eb11eb9c87effeb1bf87ded6309d03c4500c4a229ebcdf6330c9e25cbbe40b540a9

data/lib/dependabot/go_modules/file_parser.rb

@@ -17,7 +17,7 @@ module Dependabot
         dependency_set = Dependabot::FileParsers::Base::DependencySet.new
 
         i = 0
-        chunks = module_info(go_mod).lines.
+        chunks = module_info.lines.
                  group_by { |line| line == "{\n" ? i += 1 : i }
         deps = chunks.values.map { |chunk| JSON.parse(chunk.join) }
 
@@ -65,11 +65,19 @@ module Dependabot
         )
       end
 
-      def module_info(go_mod)
+      def module_info
         @module_info ||=
           SharedHelpers.in_a_temporary_directory do |path|
             SharedHelpers.with_git_configured(credentials: credentials) do
-              File.write("go.mod", go_mod.content)
+              # Create a fake empty module for each local module so that
+              # `go list` works, even if some modules have been `replace`d with
+              # a local module that we don't have access to.
+              local_replacements.each do |_, stub_path|
+                Dir.mkdir(stub_path) unless Dir.exist?(stub_path)
+                FileUtils.touch(File.join(stub_path, "go.mod"))
+              end
+
+              File.write("go.mod", go_mod_content)
 
               command = "go mod edit -print > /dev/null"
               command += " && go list -m -json all"
@@ -89,6 +97,36 @@ module Dependabot
           end
       end
 
+      def local_replacements
+        @local_replacements ||=
+          SharedHelpers.in_a_temporary_directory do |path|
+            File.write("go.mod", go_mod.content)
+
+            # Parse the go.mod to get a JSON representation of the replace
+            # directives
+            command = "go mod edit -json"
+            env = { "GO111MODULE" => "on" }
+            stdout, stderr, status = Open3.capture3(env, command)
+            handle_parser_error(path, stderr) unless status.success?
+
+            # Find all the local replacements, and return them with a stub path
+            # we can use in their place. Using generated paths is safer as it
+            # means we don't need to worry about references to parent
+            # directories, etc.
+            (JSON.parse(stdout)["Replace"] || []).
+              map { |r| r["New"]["Path"] }.
+              compact.
+              select { |p| p.start_with?(".") || p.start_with?("/") }.
+              map { |p| [p, "./" + Digest::SHA2.hexdigest(p)] }
+          end
+      end
+
+      def go_mod_content
+        local_replacements.reduce(go_mod.content) do |body, (path, stub_path)|
+          body.sub(path, stub_path)
+        end
+      end
+
       GIT_ERROR_REGEX = /go: .*: git fetch .*: exit status 128/.freeze
 
       # rubocop:disable Metrics/AbcSize

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-go_modules
 version: !ruby/object:Gem::Version
-  version: 0.108.5
+  version: 0.108.6
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-06-06 00:00:00.000000000 Z
+date: 2019-06-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.108.5
+        version: 0.108.6
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.108.5
+        version: 0.108.6
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement