dependabot-go_modules 0.328.0 → 0.330.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7ff25b76d1a24086264093362da726695c64660c39508c68eff0ab6ab75fdc32
-  data.tar.gz: 9668163f7dd4f2617a0e87679d3a525e850b1e1432de91b8ef4717f1aa31d79c
+  metadata.gz: fd1cb0ab981e8458d9be07a6da780e5a8c886ae7953cb0a06c8635a52d79d863
+  data.tar.gz: 87a6cc8857ad1c5e1c162a74c756bbce89eb9138704a90be4c16fa96f63af78b
 SHA512:
-  metadata.gz: 0c21b70471958985d3054b15e6a9ec925b46be323f4ec39f48e4006f5b7c0f042360f0bc7344c12a20c1e0ab290212bb2be9940f17fd811bc48348f7b4dacf41
-  data.tar.gz: 5f9776d873a1f64cc1978929f19671c85bd60489560be5f6f2f545b4eb66776d64f3b17337f1b1078dbd7852cf3ecf8d2692943f3385448bf9ea9a3b551aa67c
+  metadata.gz: e2b75696b1d7a08b027a0d26702c15101b32989ba706d4cd8aa50a7cf14e4bc1dd7d5786a7745fec67731f67ccc4412f890175f877779a8634ebc90f7e7dddee
+  data.tar.gz: 62309a608616a32808e65316afb7ae41719dac413808394cb8becfe0866470ebf5faa41249a768325f12109237d3db7a769fc5f6c2bc565e8c8474843bfed241

data/lib/dependabot/go_modules/file_fetcher.rb

@@ -41,6 +41,7 @@ module Dependabot
           fetched_files = go_mod ? [go_mod] : []
           # Fetch the (optional) go.sum
           fetched_files << T.must(go_sum) if go_sum
+          fetched_files << T.must(go_env) if go_env
           fetched_files
         end
       end
@@ -56,6 +57,14 @@ module Dependabot
       def go_sum
         @go_sum ||= T.let(fetch_file_if_present("go.sum"), T.nilable(Dependabot::DependencyFile))
       end
+
+      sig { returns(T.nilable(Dependabot::DependencyFile)) }
+      def go_env
+        return @go_env if defined?(@go_env)
+
+        @go_env = T.let(fetch_support_file("go.env"), T.nilable(Dependabot::DependencyFile))
+        @go_env
+      end
     end
   end
 end

data/lib/dependabot/go_modules/file_parser.rb

@@ -20,6 +20,18 @@ module Dependabot
     class FileParser < Dependabot::FileParsers::Base
       extend T::Sig
 
+      sig do
+        params(dependency_files: T::Array[Dependabot::DependencyFile], source: T.nilable(Dependabot::Source),
+               repo_contents_path: T.nilable(String), credentials: T::Array[Dependabot::Credential],
+               reject_external_code: T::Boolean, options: T::Hash[Symbol, T.untyped]).void
+      end
+      def initialize(dependency_files:, source: nil, repo_contents_path: nil,
+                     credentials: [], reject_external_code: false, options: {})
+        super
+
+        set_go_environment_variables
+      end
+
       sig { override.returns(T::Array[Dependabot::Dependency]) }
       def parse
         dependency_set = Dependabot::FileParsers::Base::DependencySet.new
@@ -50,6 +62,48 @@ module Dependabot
 
       private
 
+      sig { void }
+      def set_go_environment_variables
+        set_goenv_variable
+        set_goproxy_variable
+        set_goprivate_variable
+      end
+
+      sig { void }
+      def set_goenv_variable
+        return unless go_env
+
+        env_file = T.must(go_env)
+        File.write(env_file.name, env_file.content)
+        ENV["GOENV"] = Pathname.new(env_file.name).realpath.to_s
+      end
+
+      sig { void }
+      def set_goprivate_variable
+        return if go_env&.content&.include?("GOPRIVATE")
+        return if go_env&.content&.include?("GOPROXY")
+        return if goproxy_credentials.any?
+
+        goprivate = options.fetch(:goprivate, "*")
+        ENV["GOPRIVATE"] = goprivate if goprivate
+      end
+
+      sig { void }
+      def set_goproxy_variable
+        return if go_env&.content&.include?("GOPROXY")
+        return if goproxy_credentials.empty?
+
+        urls = goproxy_credentials.filter_map { |cred| cred["url"] }
+        ENV["GOPROXY"] = "#{urls.join(',')},direct"
+      end
+
+      sig { returns(T::Array[Dependabot::Credential]) }
+      def goproxy_credentials
+        @goproxy_credentials ||= T.let(credentials.select do |cred|
+          cred["type"] == "goproxy_server"
+        end, T.nilable(T::Array[Dependabot::Credential]))
+      end
+
       sig { returns(Ecosystem::VersionManager) }
       def package_manager
         @package_manager ||= T.let(
@@ -85,6 +139,11 @@ module Dependabot
         @go_mod ||= T.let(get_original_file("go.mod"), T.nilable(Dependabot::DependencyFile))
       end
 
+      sig { returns(T.nilable(Dependabot::DependencyFile)) }
+      def go_env
+        @go_env ||= T.let(get_original_file("go.env"), T.nilable(Dependabot::DependencyFile))
+      end
+
       sig { override.void }
       def check_required_files
         raise "No go.mod!" unless go_mod

data/lib/dependabot/go_modules/file_updater/go_mod_updater.rb

@@ -96,7 +96,6 @@ module Dependabot
           @directory = directory
           @tidy = T.let(options.fetch(:tidy, false), T::Boolean)
           @vendor = T.let(options.fetch(:vendor, false), T::Boolean)
-          @goprivate = T.let(options.fetch(:goprivate), T.nilable(String))
         end
 
         sig { returns(T.nilable(String)) }
@@ -188,7 +187,7 @@ module Dependabot
           # continue with an info log here. `go mod tidy` shouldn't block
           # updating versions because there are some edge cases where it's OK to fail
           # (such as generated files not available yet to us).
-          _, stderr, status = Open3.capture3(environment, command)
+          _, stderr, status = Open3.capture3(command)
           if status.success?
             Dependabot.logger.info "`go mod tidy` succeeded"
           else
@@ -201,7 +200,7 @@ module Dependabot
           return unless vendor?
 
           command = "go mod vendor"
-          _, stderr, status = Open3.capture3(environment, command)
+          _, stderr, status = Open3.capture3(command)
           handle_subprocess_error(stderr) unless status.success?
         end
 
@@ -225,7 +224,7 @@ module Dependabot
           end
           command = SharedHelpers.escape_command(command)
 
-          _, stderr, status = Open3.capture3(environment, command)
+          _, stderr, status = Open3.capture3(command)
           handle_subprocess_error(stderr) unless status.success?
         ensure
           FileUtils.rm_f(T.must(tmp_go_file))
@@ -234,7 +233,7 @@ module Dependabot
         sig { returns(T::Hash[String, T.untyped]) }
         def parse_manifest
           command = "go mod edit -json"
-          stdout, stderr, status = Open3.capture3(environment, command)
+          stdout, stderr, status = Open3.capture3(command)
           handle_subprocess_error(stderr) unless status.success?
 
           JSON.parse(stdout) || {}
@@ -305,7 +304,7 @@ module Dependabot
           end
 
           repo_error_regex = REPO_RESOLVABILITY_ERROR_REGEXES.find { |r| stderr =~ r }
-          ResolvabilityErrors.handle(stderr, goprivate: @goprivate) if repo_error_regex
+          ResolvabilityErrors.handle(stderr) if repo_error_regex
 
           path_regex = MODULE_PATH_MISMATCH_REGEXES.find { |r| stderr =~ r }
           if path_regex
@@ -366,11 +365,6 @@ module Dependabot
         def vendor?
           !!@vendor
         end
-
-        sig { returns(T::Hash[String, T.untyped]) }
-        def environment
-          { "GOPRIVATE" => @goprivate }
-        end
       end
     end
   end

data/lib/dependabot/go_modules/file_updater.rb

@@ -29,7 +29,6 @@ module Dependabot
       def initialize(dependencies:, dependency_files:, credentials:, repo_contents_path: nil, options: {})
         super
 
-        @goprivate = T.let(options.fetch(:goprivate, "*"), String)
         use_repo_contents_stub if repo_contents_path.nil?
       end
 
@@ -149,7 +148,7 @@ module Dependabot
             credentials: credentials,
             repo_contents_path: repo_contents_path,
             directory: T.must(directory),
-            options: { tidy: tidy?, vendor: vendor?, goprivate: @goprivate }
+            options: { tidy: tidy?, vendor: vendor? }
           ),
           T.nilable(Dependabot::GoModules::FileUpdater::GoModUpdater)
         )

data/lib/dependabot/go_modules/package/package_details_fetcher.rb

@@ -41,15 +41,13 @@ module Dependabot
           params(
             dependency: Dependabot::Dependency,
             dependency_files: T::Array[Dependabot::DependencyFile],
-            credentials: T::Array[Dependabot::Credential],
-            goprivate: String
+            credentials: T::Array[Dependabot::Credential]
           ).void
         end
-        def initialize(dependency:, dependency_files:, credentials:, goprivate:)
+        def initialize(dependency:, dependency_files:, credentials:)
           @dependency = dependency
           @dependency_files = dependency_files
           @credentials = credentials
-          @goprivate = T.let(goprivate, String)
 
           @source_type = T.let(nil, T.nilable(String))
         end
@@ -63,9 +61,6 @@ module Dependabot
         sig { returns(T::Array[T.untyped]) }
         attr_reader :credentials
 
-        sig { returns(String) }
-        attr_reader :goprivate
-
         # rubocop:disable Metrics/AbcSize,Metrics/PerceivedComplexity
         sig { returns(T::Array[Dependabot::Package::PackageRelease]) }
         def fetch_available_versions
@@ -82,12 +77,9 @@ module Dependabot
               end
 
               # Turn off the module proxy for private dependencies
-              env = { "GOPRIVATE" => @goprivate }
-
               versions_json = SharedHelpers.run_shell_command(
                 "go list -m -versions -json #{dependency.name}",
-                fingerprint: "go list -m -versions -json <dependency_name>",
-                env: env
+                fingerprint: "go list -m -versions -json <dependency_name>"
               )
               version_strings = JSON.parse(versions_json)["Versions"]
 
@@ -112,7 +104,7 @@ module Dependabot
           retry_count += 1
           retry if transitory_failure?(e) && retry_count < 2
 
-          ResolvabilityErrors.handle(e.message, goprivate: @goprivate)
+          ResolvabilityErrors.handle(e.message)
           [package_release(version: T.must(dependency.version))]
         end
         # rubocop:enable Metrics/AbcSize,Metrics/PerceivedComplexity

data/lib/dependabot/go_modules/resolvability_errors.rb

@@ -10,8 +10,8 @@ module Dependabot
 
       GITHUB_REPO_REGEX = %r{github.com/[^:@ ]*}
 
-      sig { params(message: String, goprivate: T.untyped).void }
-      def self.handle(message, goprivate:)
+      sig { params(message: String).void }
+      def self.handle(message)
         mod_path = message.scan(GITHUB_REPO_REGEX).last
         unless mod_path && message.include?("If this is a private repository")
           raise Dependabot::DependencyFileNotResolvable, message
@@ -30,8 +30,7 @@ module Dependabot
                         mod_path
                       end
 
-          env = { "GOPRIVATE" => goprivate }
-          _, _, status = Open3.capture3(env, SharedHelpers.escape_command("go list -m -versions #{repo_path}"))
+          _, _, status = Open3.capture3(SharedHelpers.escape_command("go list -m -versions #{repo_path}"))
           raise Dependabot::DependencyFileNotResolvable, message if status.success?
 
           raise Dependabot::GitDependenciesNotReachable, [repo_path]

data/lib/dependabot/go_modules/update_checker/latest_version_finder.rb

@@ -46,7 +46,6 @@ module Dependabot
             credentials: T::Array[Dependabot::Credential],
             ignored_versions: T::Array[String],
             security_advisories: T::Array[Dependabot::SecurityAdvisory],
-            goprivate: String,
             raise_on_ignored: T::Boolean,
             cooldown_options: T.nilable(Dependabot::Package::ReleaseCooldownOptions)
           )
@@ -58,7 +57,6 @@ module Dependabot
           credentials:,
           ignored_versions:,
           security_advisories:,
-          goprivate:,
           raise_on_ignored: false,
           cooldown_options: nil
         )
@@ -68,7 +66,6 @@ module Dependabot
           @ignored_versions    = ignored_versions
           @security_advisories = security_advisories
           @raise_on_ignored    = raise_on_ignored
-          @goprivate           = goprivate
           @cooldown_options    = cooldown_options
           super(
             dependency: dependency,
@@ -122,9 +119,6 @@ module Dependabot
         sig { returns(T::Array[Dependabot::SecurityAdvisory]) }
         attr_reader :security_advisories
 
-        sig { returns(String) }
-        attr_reader :goprivate
-
         sig { returns(T.nilable(Dependabot::Package::ReleaseCooldownOptions)) }
         attr_reader :cooldown_options
 
@@ -133,8 +127,7 @@ module Dependabot
           @available_versions_details ||= T.let(Package::PackageDetailsFetcher.new(
             dependency: dependency,
             dependency_files: dependency_files,
-            credentials: credentials,
-            goprivate: goprivate
+            credentials: credentials
           ).fetch_available_versions, T.nilable(T::Array[Dependabot::Package::PackageRelease]))
         end
 
@@ -197,13 +190,10 @@ module Dependabot
         # rubocop:disable Metrics/AbcSize
         sig { params(release: Dependabot::Package::PackageRelease).returns(T::Boolean) }
         def in_cooldown_period?(release)
-          env = { "GOPRIVATE" => @goprivate }
-
           begin
             release_info = SharedHelpers.run_shell_command(
               "go list -m -json #{dependency.name}@#{release.details.[]('version_string')}",
-              fingerprint: "go list -m -json <dependency_name>",
-              env: env
+              fingerprint: "go list -m -json <dependency_name>"
             )
           rescue Dependabot::SharedHelpers::HelperSubprocessFailed => e
             Dependabot.logger.info("Error while fetching release date info: #{e.message}")

data/lib/dependabot/go_modules/update_checker.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"
@@ -66,8 +66,7 @@ module Dependabot
             ignored_versions: ignored_versions,
             security_advisories: security_advisories,
             raise_on_ignored: raise_on_ignored,
-            cooldown_options: update_cooldown,
-            goprivate: options.fetch(:goprivate, "*")
+            cooldown_options: update_cooldown
           ),
           T.nilable(Dependabot::GoModules::UpdateChecker::LatestVersionFinder)
         )

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-go_modules
 version: !ruby/object:Gem::Version
-  version: 0.328.0
+  version: 0.330.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.328.0
+        version: 0.330.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.328.0
+        version: 0.330.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -271,7 +271,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.328.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.330.0
 rdoc_options: []
 require_paths:
 - lib