dependabot-gradle 0.113.11 → 0.113.16

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e495ea01c31d6f96b4a91c897d176c1dd358e7bb72aed374374d12fb4edd9e1c
-  data.tar.gz: 3b09a534801ff6a1382a9f598c6c5599e9adef379cbc7612a5ec717f51d4c689
+  metadata.gz: 0e54dd4f3f02afae8e029e2ff40cc6977d7a3b15ef9075f51c1b7fe747e5073d
+  data.tar.gz: 1e4c12fc18d67fde3294aa9f40e52933410bc0ff35e314f1c9115c8bd940221b
 SHA512:
-  metadata.gz: 67348d26a8b6b89a2e5331b16c06807e8f998779674e3379bad9bc12fb4b9ebbc6875aeaef3df2b3db40a85bceee46d41bc684da8ecf29ca01cae7394efc8359
-  data.tar.gz: 671301c680b7ca49b495bc0441aafa5e647844c189ccd5f6a5e721922a4d32773ae835676975693758d440e11868d7c4a90ffc0f8c77d8366fdff5e902efbcf4
+  metadata.gz: 28bd859ad91dad9d74d26f118416c1f2bd699908318104db5b472d201343285bd6813182f7958de04284d3d680a0f0dcf88bab545afb9da6dfdcff046354e5d2
+  data.tar.gz: fd6bbc5ee0710d54dc0af836b83ee56ba01ca49c587a3bbc000f3276287ac4fcf0646778e46049cb92143e0d0b8779f0f9361569f962fbccf6259cbb4719f39f

data/lib/dependabot/gradle/file_parser.rb

@@ -168,6 +168,7 @@ module Dependabot
           fetch("value")
       end
 
+      # rubocop:disable Metrics/MethodLength
       def dependency_from(details_hash:, buildfile:, in_dependency_set: false)
         group   = evaluated_value(details_hash[:group], buildfile)
         name    = evaluated_value(details_hash[:name], buildfile)
@@ -181,6 +182,8 @@ module Dependabot
           if group == "plugins" then ["plugins"]
           else []
           end
+        source =
+          source_from(group, name, version)
 
         # If we can't evaluate a property they we won't be able to
         # update this dependency
@@ -193,13 +196,27 @@ module Dependabot
           requirements: [{
             requirement: version,
             file: buildfile.name,
-            source: nil,
+            source: source,
             groups: groups,
             metadata: dependency_metadata(details_hash, in_dependency_set)
           }],
           package_manager: "gradle"
         )
       end
+      # rubocop:enable Metrics/MethodLength
+
+      def source_from(group, name, version)
+        return nil unless group&.start_with?("com.github")
+
+        account = group.sub("com.github.", "")
+
+        {
+          type: "git",
+          url: "https://github.com/#{account}/#{name}",
+          branch: nil,
+          ref: version
+        }
+      end
 
       def dependency_metadata(details_hash, in_dependency_set)
         version_property_name =

data/lib/dependabot/gradle/update_checker.rb

@@ -12,6 +12,8 @@ module Dependabot
       require_relative "update_checker/multi_dependency_updater"
 
       def latest_version
+        return if git_dependency?
+
         latest_version_details&.fetch(:version)
       end
 
@@ -21,6 +23,7 @@ module Dependabot
         #
         # The above is hard. Currently we just return the latest version and
         # hope (hence this package manager is in beta!)
+        return if git_dependency?
         return nil if version_comes_from_multi_dependency_property?
         return nil if version_comes_from_dependency_set?
 
@@ -28,6 +31,7 @@ module Dependabot
       end
 
       def lowest_resolvable_security_fix_version
+        return if git_dependency?
         return nil if version_comes_from_multi_dependency_property?
         return nil if version_comes_from_dependency_set?
 
@@ -126,6 +130,18 @@ module Dependabot
           )
       end
 
+      def git_dependency?
+        git_commit_checker.git_dependency?
+      end
+
+      def git_commit_checker
+        @git_commit_checker ||=
+          GitCommitChecker.new(
+            dependency: dependency,
+            credentials: credentials
+          )
+      end
+
       def version_comes_from_multi_dependency_property?
         declarations_using_a_property.any? do |requirement|
           property_name = requirement.fetch(:metadata).fetch(:property_name)

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-gradle
 version: !ruby/object:Gem::Version
-  version: 0.113.11
+  version: 0.113.16
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-10-08 00:00:00.000000000 Z
+date: 2019-10-28 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.113.11
+        version: 0.113.16
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.113.11
+        version: 0.113.16
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement