dependabot-go_modules 0.335.0 → 0.336.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0ba2ffbc3f930196b6230efea8a5d574e83b4be246dcdf3a7c9dcd6014aec870
-  data.tar.gz: fb9667f95fef7bf2f302f39032ddc57a74588d6b7f398c65112d27a839c50d9b
+  metadata.gz: 441237d8b344eb149a012809416b5ead853ad2ad04ada80b83c909eec215a3f8
+  data.tar.gz: af69934d9b47e3eeec459f021610dc591949a3e6b1073f9729e62531ffd29734
 SHA512:
-  metadata.gz: 6c89d1331a852edcfe8ce57885022a5971d088b964e400e87ccb5bf4273e0978881ba76a9a52706b806dc5ae298cb168c090c937ee4b77c07acb3883932ae8fc
-  data.tar.gz: 61fe3e6273a93c9f529f2475ed6eaf5e8480a477a1a20ddf45b5788b88537a559ce5857e0bf1ee7b07db07ff6925cf1c34b49f33dc8d58d18a90fa1c4c22261e
+  metadata.gz: 1b0a329ebb51fa5cebefa6c7236538b561771f2ca1500082b68e3c036dd3f58fc99e87254a35750c58feac75fb3073c52fad2031d7e934d9aebf5aba05cd016c
+  data.tar.gz: 4c0a6ff2f636a900f137fdf5bba5ab8b4832b8e8f4d97d86ef92e3647dd9d2264cf76201ba6c3c3ae61eb69d1681f5fb82e28b40a4ea37e73271c79c28fbae3e

data/lib/dependabot/go_modules/dependency_grapher.rb

@@ -11,6 +11,8 @@ module Dependabot
     class DependencyGrapher < Dependabot::DependencyGraphers::Base
       sig { override.returns(Dependabot::DependencyFile) }
       def relevant_dependency_file
+        # This cannot realistically happen as the parser will throw a runtime error on init without a go_mod file,
+        # but this will avoid surprises if anything changes.
         raise DependabotError, "No go.mod present in dependency files." unless go_mod
 
         T.must(go_mod)
@@ -32,7 +34,7 @@ module Dependabot
         return @go_mod if defined?(@go_mod)
 
         @go_mod = T.let(
-          @dependency_files.find { |f| f.name = "go.mod" },
+          dependency_files.find { |f| f.name = "go.mod" },
           T.nilable(Dependabot::DependencyFile)
         )
       end

data/lib/dependabot/go_modules/file_updater/go_mod_updater.rb

@@ -58,7 +58,9 @@ module Dependabot
             # Package pointing to a proxy that 404s
             /go(?: get)?: .*: unrecognized import path/m,
             # Package not being referenced correctly
-            /go:.*imports.*package.+is not in std/m
+            /go:.*imports.*package.+is not in std/m,
+            # Invalid version due to missing go.mod files at specified revision
+            /go: .*: invalid version: missing .*go\.mod.* at revision/m
           ].freeze,
           T::Array[Regexp]
         )
@@ -81,6 +83,17 @@ module Dependabot
           T::Array[Regexp]
         )
 
+        GO_MOD_PARSE_ERROR_REGEXES = T.let(
+          [
+            # go.mod file parsing errors
+            /go: error loading go\.mod:/,
+            /go\.mod:\d+: .*unknown.*/,
+            /go\.mod:\d+: .*syntax error.*/,
+            /go\.mod:\d+: .*invalid.*/
+          ].freeze,
+          T::Array[Regexp]
+        )
+
         GO_LANG = "Go"
 
         AMBIGUOUS_ERROR_MESSAGE = /ambiguous import: found package (?<package>.*) in multiple modules/
@@ -310,9 +323,15 @@ module Dependabot
         # rubocop:disable Metrics/AbcSize
         # rubocop:disable Metrics/PerceivedComplexity
         sig { params(stderr: String).returns(T.noreturn) }
-        def handle_subprocess_error(stderr) # rubocop:disable Metrics/AbcSize
+        def handle_subprocess_error(stderr) # rubocop:disable Metrics/AbcSize,Metrics/MethodLength
           stderr = stderr.gsub(Dir.getwd, "")
 
+          go_mod_parse_error_regex = GO_MOD_PARSE_ERROR_REGEXES.find { |r| stderr =~ r }
+          if go_mod_parse_error_regex
+            error_message = filter_error_message(message: stderr, regex: go_mod_parse_error_regex)
+            raise Dependabot::DependencyFileNotParseable.new(go_mod_path, error_message)
+          end
+
           # Package version doesn't match the module major version
           error_regex = RESOLVABILITY_ERROR_REGEXES.find { |r| stderr =~ r }
           if error_regex

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-go_modules
 version: !ruby/object:Gem::Version
-  version: 0.335.0
+  version: 0.336.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.335.0
+        version: 0.336.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.335.0
+        version: 0.336.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -272,7 +272,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.335.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.336.0
 rdoc_options: []
 require_paths:
 - lib