dependabot-go_modules 0.129.1 → 0.129.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 66a84b6b47ca0b0c2123cbb74dc9289edf5a3456e47e243b9f5f7e3e811a6e83
-  data.tar.gz: c818cafc810e2d768e1048c30b9c28b06b2f74d0c15fe4fecb38ccc3341b4746
+  metadata.gz: 9a5732b46b502a7660d58467755acc033f3eddd7ac90d457401479dc21985504
+  data.tar.gz: 70b7dc19d8f80346f8300ce48995e68e425e79e4a33ff6b33f80d3cf09c34321
 SHA512:
-  metadata.gz: 6fafe82fab2b405593f8a7c8a431ff71804189922a9f7d3d920ee6b4295417294e904c4b123fb4f3cdea32e8044ad69f5a130e342418f36d0e819e934be1980b
-  data.tar.gz: 1456d1903e1b9b1b832de978aad3f2ba579d9dc30ef5179f97ef3d9f62963c01e8586967729e44e1da015166fa7e96ba4496d76309311ff79d3414d8b42726fc
+  metadata.gz: 8b21e2f1b812745f68fe053aaa3e20735e56c5f50d060a896db9484087ffd1ee091ae22039e4d384ac9aefdc66561c657cda30aad5dab53a62a6f833a1305dbc
+  data.tar.gz: d75ca92c24e867137de528fb58db6a100333fb6089e487c5511e4438087f9b71abc8c8a4e5249eed543cc0548ffafa6703ddd8db193f3a7402a80e85487767c3

data/lib/dependabot/go_modules/file_parser.rb

@@ -16,17 +16,8 @@ module Dependabot
       def parse
         dependency_set = Dependabot::FileParsers::Base::DependencySet.new
 
-        i = 0
-        chunks = module_info.lines.
-                 group_by { |line| line == "{\n" ? i += 1 : i }
-        deps = chunks.values.map { |chunk| JSON.parse(chunk.join) }
-
-        deps.each do |dep|
-          # The project itself appears in this list as "Main"
-          next if dep["Main"]
-
-          dependency = dependency_from_details(dep)
-          dependency_set << dependency if dependency
+        required_packages.each do |dep|
+          dependency_set << dependency_from_details(dep) unless dep["Indirect"]
         end
 
         dependency_set.dependencies
@@ -65,39 +56,36 @@ module Dependabot
         )
       end
 
-      def module_info
-        @module_info ||=
+      def required_packages
+        @required_packages ||=
           SharedHelpers.in_a_temporary_directory do |path|
-            SharedHelpers.with_git_configured(credentials: credentials) do
-              # Create a fake empty module for each local module so that
-              # `go list` works, even if some modules have been `replace`d with
-              # a local module that we don't have access to.
-              local_replacements.each do |_, stub_path|
-                Dir.mkdir(stub_path) unless Dir.exist?(stub_path)
-                FileUtils.touch(File.join(stub_path, "go.mod"))
-              end
-
-              File.write("go.mod", go_mod_content)
-
-              command = "go mod edit -print > /dev/null"
-              command += " && go list -m -json all"
-
-              # Turn off the module proxy for now, as it's causing issues with
-              # private git dependencies
-              env = { "GOPRIVATE" => "*" }
-
-              stdout, stderr, status = Open3.capture3(env, command)
-              handle_parser_error(path, stderr) unless status.success?
-              stdout
-            rescue Dependabot::DependencyFileNotResolvable
-              # We sometimes see this error if a host times out.
-              # In such cases, retrying (a maximum of 3 times) may fix it.
-              retry_count ||= 0
-              raise if retry_count >= 3
-
-              retry_count += 1
-              retry
+            # Create a fake empty module for each local module so that
+            # `go mod edit` works, even if some modules have been `replace`d with
+            # a local module that we don't have access to.
+            local_replacements.each do |_, stub_path|
+              Dir.mkdir(stub_path) unless Dir.exist?(stub_path)
+              FileUtils.touch(File.join(stub_path, "go.mod"))
             end
+
+            File.write("go.mod", go_mod_content)
+
+            command = "go mod edit -json"
+
+            # Turn off the module proxy for now, as it's causing issues with
+            # private git dependencies
+            env = { "GOPRIVATE" => "*" }
+
+            stdout, stderr, status = Open3.capture3(env, command)
+            handle_parser_error(path, stderr) unless status.success?
+            JSON.parse(stdout)["Require"]
+          rescue Dependabot::DependencyFileNotResolvable
+            # We sometimes see this error if a host times out.
+            # In such cases, retrying (a maximum of 3 times) may fix it.
+            retry_count ||= 0
+            raise if retry_count >= 3
+
+            retry_count += 1
+            retry
           end
       end
 
@@ -135,52 +123,9 @@ module Dependabot
         end
       end
 
-      GIT_ERROR_REGEX = /go: .*: git fetch .*: exit status 128/m.freeze
       def handle_parser_error(path, stderr)
-        case stderr
-        when /go: .*: unknown revision/m
-          line = stderr.lines.grep(/unknown revision/).first.strip
-          handle_github_unknown_revision(line) if line.start_with?("go: github.com/")
-          raise Dependabot::DependencyFileNotResolvable, line
-        when /go: .*: unrecognized import path/m
-          line = stderr.lines.grep(/unrecognized import/).first
-          raise Dependabot::DependencyFileNotResolvable, line.strip
-        when /go: errors parsing go.mod/m
-          msg = stderr.gsub(path.to_s, "").strip
-          raise Dependabot::DependencyFileNotParseable.new(go_mod.path, msg)
-        when GIT_ERROR_REGEX
-          lines = stderr.lines.drop_while { |l| GIT_ERROR_REGEX !~ l }
-          raise Dependabot::DependencyFileNotResolvable.new, lines.join
-        else
-          msg = stderr.gsub(path.to_s, "").strip
-          raise Dependabot::DependencyFileNotParseable.new(go_mod.path, msg)
-        end
-      end
-
-      GITHUB_REPO_REGEX = %r{github.com/[^@]*}.freeze
-      def handle_github_unknown_revision(line)
-        mod_path = line.scan(GITHUB_REPO_REGEX).first
-        return unless mod_path
-
-        # Query for _any_ version of this module, to know if it doesn't exist (or is private)
-        # or we were just given a bad revision by this manifest
-        SharedHelpers.in_a_temporary_directory do
-          SharedHelpers.with_git_configured(credentials: credentials) do
-            File.write("go.mod", "module dummy\n")
-
-            env = { "GOPRIVATE" => "*" }
-            _, _, status = Open3.capture3(env, SharedHelpers.escape_command("go get #{mod_path}"))
-            raise Dependabot::DependencyFileNotResolvable, line if status.success?
-
-            mod_split = mod_path.split("/")
-            repo_path = if mod_split.size > 3
-                          mod_split[0..2].join("/")
-                        else
-                          mod_path
-                        end
-            raise Dependabot::GitDependenciesNotReachable, [repo_path]
-          end
-        end
+        msg = stderr.gsub(path.to_s, "").strip
+        raise Dependabot::DependencyFileNotParseable.new(go_mod.path, msg)
       end
 
       def rev_identifier?(dep)

data/lib/dependabot/go_modules/file_updater/go_mod_updater.rb

@@ -40,6 +40,8 @@ module Dependabot
           /no space left on device/.freeze
         ].freeze
 
+        GO_MOD_VERSION = /^go 1\.[\d]+$/.freeze
+
         def initialize(dependencies:, credentials:, repo_contents_path:,
                        directory:, options:)
           @dependencies = dependencies
@@ -67,10 +69,9 @@ module Dependabot
           @updated_files ||= update_files
         end
 
-        def update_files # rubocop:disable Metrics/AbcSize
+        def update_files # rubocop:disable Metrics/AbcSize, Metrics/PerceivedComplexity
           in_repo_path do
             # Map paths in local replace directives to path hashes
-
             original_go_mod = File.read("go.mod")
             original_manifest = parse_manifest
             original_go_sum = File.read("go.sum") if File.exist?("go.sum")
@@ -87,35 +88,36 @@ module Dependabot
             # Then run `go get` to pick up other changes to the file caused by
             # the upgrade
             run_go_get
-            run_go_vendor
-            run_go_mod_tidy
-
-            # At this point, the go.mod returned from run_go_get contains the
-            # correct set of modules, but running `go get` can change the file
-            # in undesirable ways (such as injecting the current Go version),
-            # so we need to update the original go.mod with the updated set of
-            # requirements rather than using the regenerated file directly
-            original_reqs = original_manifest["Require"] || []
-            updated_reqs = parse_manifest["Require"] || []
-
-            original_paths = original_reqs.map { |r| r["Path"] }
-            updated_paths = updated_reqs.map { |r| r["Path"] }
-            req_paths_to_remove = original_paths - updated_paths
-
-            # Put back the original content before we replace just the updated
-            # dependencies.
-            write_go_mod(original_go_mod)
 
-            remove_requirements(req_paths_to_remove)
-            deps = updated_reqs.map { |r| requirement_to_dependency_obj(r) }
-            update_go_mod(deps)
-
-            # put the old replace directives back again
-            substitute_all(substitutions.invert)
+            # If we stubbed modules, don't run `go mod {tidy,vendor}` as
+            # dependencies are incomplete
+            if substitutions.empty?
+              run_go_mod_tidy
+              run_go_vendor
+            else
+              substitute_all(substitutions.invert)
+            end
 
             updated_go_sum = original_go_sum ? File.read("go.sum") : nil
             updated_go_mod = File.read("go.mod")
 
+            # running "go get" may inject the current go version, remove it
+            original_go_version = original_go_mod.match(GO_MOD_VERSION)&.to_a&.first
+            updated_go_version = updated_go_mod.match(GO_MOD_VERSION)&.to_a&.first
+            if original_go_version != updated_go_version
+              go_mod_lines = updated_go_mod.lines
+              go_mod_lines.each_with_index do |line, i|
+                next unless line&.match?(GO_MOD_VERSION)
+
+                # replace with the original version
+                go_mod_lines[i] = original_go_version
+                # avoid a stranded newline if there was no version originally
+                go_mod_lines[i + 1] = nil if original_go_version.nil?
+              end
+
+              updated_go_mod = go_mod_lines.compact.join
+            end
+
             { go_mod: updated_go_mod, go_sum: updated_go_sum }
           end
         end
@@ -184,24 +186,6 @@ module Dependabot
           JSON.parse(stdout) || {}
         end
 
-        def remove_requirements(requirement_paths)
-          requirement_paths.each do |path|
-            escaped_path = Shellwords.escape(path)
-            command = "go mod edit -droprequire #{escaped_path}"
-            _, stderr, status = Open3.capture3(ENVIRONMENT, command)
-            handle_subprocess_error(stderr) unless status.success?
-          end
-        end
-
-        def add_requirements(requirements)
-          requirements.each do |r|
-            escaped_req = Shellwords.escape("#{r['Path']}@#{r['Version']}")
-            command = "go mod edit -require #{escaped_req}"
-            _, stderr, status = Open3.capture3(ENVIRONMENT, command)
-            handle_subprocess_error(stderr) unless status.success?
-          end
-        end
-
         def in_repo_path(&block)
           SharedHelpers.
             in_a_temporary_repo_directory(directory, repo_contents_path) do
@@ -268,7 +252,7 @@ module Dependabot
         end
 
         def module_pathname
-          @module_pathname ||= Pathname.new(repo_contents_path).join(directory)
+          @module_pathname ||= Pathname.new(repo_contents_path).join(directory.sub(%r{^/}, ""))
         end
 
         def substitute_all(substitutions)
@@ -312,24 +296,6 @@ module Dependabot
           File.join(directory, "go.mod")
         end
 
-        def requirement_to_dependency_obj(req)
-          # This is an approximation - we're not correctly populating `source`
-          # for instance, but it's only to plug the requirement into the
-          # `update_go_mod` method so this mapping doesn't need to be perfect
-          dep_req = {
-            file: "go.mod",
-            requirement: req["Version"],
-            groups: [],
-            source: nil
-          }
-          Dependency.new(
-            name: req["Path"],
-            version: req["Version"],
-            requirements: req["Indirect"] ? [] : [dep_req],
-            package_manager: "go_modules"
-          )
-        end
-
         def write_go_mod(body)
           File.write("go.mod", body)
         end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-go_modules
 version: !ruby/object:Gem::Version
-  version: 0.129.1
+  version: 0.129.2
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-12-21 00:00:00.000000000 Z
+date: 2021-01-04 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.129.1
+        version: 0.129.2
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.129.1
+        version: 0.129.2
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement
@@ -100,28 +100,28 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.6.0
+        version: 1.7.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.6.0
+        version: 1.7.0
 - !ruby/object:Gem::Dependency
   name: simplecov
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.20.0
+        version: 0.21.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.20.0
+        version: 0.21.0
 - !ruby/object:Gem::Dependency
   name: simplecov-console
   requirement: !ruby/object:Gem::Requirement