dependabot-gradle 0.372.0 → 0.374.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 282dba0bd89561268db5e6224039aeb147e5746d4aeaf39263bd21631ebdb07b
-  data.tar.gz: 348487ae71fdb12ddb94a46c7bd77b9c7e5aa07d1b30fd9447ca7167fc8aa892
+  metadata.gz: 24a6bbe139e4af0217ef4ea1ddeb88c0e41d0a45ed31bd88196c093b6f2944a0
+  data.tar.gz: f8cbaad6702c242862bb448f3274429755077556390e323162b9feba2e18279f
 SHA512:
-  metadata.gz: 855e22b2158eaa6889a7c550c27ce119efbcbd9939911cdd11fa5d4d054156960f6784a2bf524c63503df73c1cf4537c8bbeae8152173ecf94de67cee69f8077
-  data.tar.gz: bffb2f8e7c355ad87c1886c34947cfbb974f9801be2c41c3edde11d9985175f28fb95cda84dcf3144e0af4ac239e6a4dd43e34f79044e3b3e621f50e1729b41b
+  metadata.gz: a28b958fbb58d4028203ed53eb02fb96843ae8aee4805f0b54798ec64abf7a968df7176c8ab680b7dbb7c7cb1200f3dace01b49bf528ab617ba9120aac6a80c7
+  data.tar.gz: adfdf9461dcdf3b6cd6f6a050714abe53409eae513d78168b8aee9d2bcb326b72b5423399ef88b0bcd1243b6ad8bdc652b2bc334ab16a972886394e10e7e3c3f

data/lib/dependabot/gradle/file_parser/repositories_finder.rb

@@ -32,11 +32,13 @@ module Dependabot
         sig do
           params(
             dependency_files: T::Array[Dependabot::DependencyFile],
-            target_dependency_file: T.nilable(Dependabot::DependencyFile)
+            target_dependency_file: T.nilable(Dependabot::DependencyFile),
+            credentials: T::Array[Dependabot::Credential]
           ).void
         end
-        def initialize(dependency_files:, target_dependency_file:)
+        def initialize(dependency_files:, target_dependency_file:, credentials: [])
           @dependency_files = T.let(dependency_files, T::Array[Dependabot::DependencyFile])
+          @credentials = T.let(credentials, T::Array[Dependabot::Credential])
           raise "No target file!" unless target_dependency_file
 
           @target_dependency_file = T.let(target_dependency_file, Dependabot::DependencyFile)
@@ -57,7 +59,7 @@ module Dependabot
 
           return repository_urls unless repository_urls.empty?
 
-          [CENTRAL_REPO_URL]
+          [central_repo_url]
         end
 
         private
@@ -65,6 +67,9 @@ module Dependabot
         sig { returns(T::Array[Dependabot::DependencyFile]) }
         attr_reader :dependency_files
 
+        sig { returns(T::Array[Dependabot::Credential]) }
+        attr_reader :credentials
+
         sig { returns(Dependabot::DependencyFile) }
         attr_reader :target_dependency_file
 
@@ -143,7 +148,7 @@ module Dependabot
           repository_blocks.each do |block|
             repository_urls << GOOGLE_MAVEN_REPO if block.match?(/\sgoogle\(/)
 
-            repository_urls << CENTRAL_REPO_URL if block.match?(/\smavenCentral\(/)
+            repository_urls << central_repo_url if block.match?(/\smavenCentral\(/)
 
             repository_urls << "https://jcenter.bintray.com/" if block.match?(/\sjcenter\(/)
 
@@ -160,6 +165,24 @@ module Dependabot
             .uniq
         end
 
+        sig { returns(String) }
+        def central_repo_url
+          base_credential = credentials.find do |cred|
+            cred["type"] == "maven_repository" && replaces_base?(cred) && cred["url"]
+          end
+
+          base_credential ? T.must(base_credential["url"]).gsub(%r{/+$}, "") : CENTRAL_REPO_URL
+        end
+
+        sig { params(credential: T.untyped).returns(T::Boolean) }
+        def replaces_base?(credential)
+          if credential.respond_to?(:replaces_base?)
+            credential.replaces_base?
+          else
+            credential["replaces-base"] == true
+          end
+        end
+
         sig { params(string: String).returns(Integer) }
         def closing_bracket_index(string)
           closes_required = 1

data/lib/dependabot/gradle/package/package_details_fetcher.rb

@@ -265,10 +265,11 @@ module Dependabot
             requirement_files.flat_map do |target_file|
               Gradle::FileParser::RepositoriesFinder.new(
                 dependency_files: dependency_files,
-                target_dependency_file: target_file
+                target_dependency_file: target_file,
+                credentials: credentials
               ).repository_urls
                                                     .map do |url|
-                { "url" => url, "auth_headers" => {} }
+                { "url" => url, "auth_headers" => auth_headers(url) }
               end
             end.uniq
         end

data/lib/dependabot/gradle/requirement.rb

@@ -5,12 +5,12 @@ require "sorbet-runtime"
 
 require "dependabot/requirement"
 require "dependabot/utils"
-require "dependabot/maven/requirement"
+require "dependabot/maven/shared/shared_requirement"
 require "dependabot/gradle/version"
 
 module Dependabot
   module Gradle
-    class Requirement < Dependabot::Requirement
+    class Requirement < Dependabot::Maven::Shared::SharedRequirement
       extend T::Sig
 
       quoted = OPS.keys.map { |k| Regexp.quote k }.join("|")
@@ -19,6 +19,16 @@ module Dependabot
       # Like PATTERN, but the leading operator is required
       RUBY_STYLE_PATTERN = /\A\s*(#{quoted})\s*(#{Gradle::Version::VERSION_PATTERN})\s*\z/
 
+      sig { override.returns(Regexp) }
+      def self.pattern
+        PATTERN
+      end
+
+      sig { override.returns(Regexp) }
+      def self.ruby_style_pattern
+        RUBY_STYLE_PATTERN
+      end
+
       sig { override.params(obj: T.any(Gem::Version, String)).returns([String, Gem::Version]) }
       def self.parse(obj)
         return ["=", Gradle::Version.new(obj.to_s)] if obj.is_a?(Gem::Version)
@@ -40,96 +50,11 @@ module Dependabot
         end
       end
 
-      sig { params(requirements: T.any(T.nilable(String), T::Array[T.nilable(String)])).void }
-      def initialize(*requirements)
-        requirements = requirements.flatten.flat_map do |req_string|
-          convert_java_constraint_to_ruby_constraint(req_string)
-        end
-
-        super(requirements)
-      end
-
       sig { override.params(version: Gem::Version).returns(T::Boolean) }
       def satisfied_by?(version)
         version = Gradle::Version.new(version.to_s)
         super
       end
-
-      private
-
-      sig { params(req_string: T.nilable(String)).returns(T::Array[T.nilable(String)]) }
-      def self.split_java_requirement(req_string)
-        return [req_string] unless req_string&.match?(Maven::Requirement::OR_SYNTAX)
-
-        req_string.split(Maven::Requirement::OR_SYNTAX).flat_map do |str|
-          next str if str.start_with?("(", "[")
-
-          exacts, *rest = str.split(/,(?=\[|\()/)
-          [*T.must(exacts).split(","), *rest]
-        end
-      end
-      private_class_method :split_java_requirement
-
-      sig { params(req_string: T.nilable(String)).returns(T.nilable(T::Array[String])) }
-      def convert_java_constraint_to_ruby_constraint(req_string)
-        return unless req_string
-
-        if self.class.send(:split_java_requirement, req_string).count > 1
-          raise "Can't convert multiple Java reqs to a single Ruby one"
-        end
-
-        version_reqs = req_string.split(",").map(&:strip)
-        if version_reqs.length > 1 && !version_reqs.all? { |s| PATTERN.match?(s) }
-          return convert_java_range_to_ruby_range(req_string)
-        end
-
-        version_reqs.map do |r|
-          # if an operator is already provided, use it
-          next r if r.match?(RUBY_STYLE_PATTERN)
-
-          convert_java_equals_req_to_ruby(r)
-        end
-      end
-
-      sig { params(req_string: String).returns(T::Array[String]) }
-      def convert_java_range_to_ruby_range(req_string)
-        lower_b, upper_b = req_string.split(",").map(&:strip)
-
-        lower_b =
-          if ["(", "["].include?(lower_b) then nil
-          elsif T.must(lower_b).start_with?("(") then "> #{T.must(lower_b).sub(/\(\s*/, '')}"
-          else
-            ">= #{T.must(lower_b).sub(/\[\s*/, '').strip}"
-          end
-
-        upper_b =
-          if [")", "]"].include?(upper_b) then nil
-          elsif T.must(upper_b).end_with?(")") then "< #{T.must(upper_b).sub(/\s*\)/, '')}"
-          else
-            "<= #{T.must(upper_b).sub(/\s*\]/, '').strip}"
-          end
-
-        [lower_b, upper_b].compact
-      end
-
-      sig { params(req_string: String).returns(String) }
-      def convert_java_equals_req_to_ruby(req_string)
-        return convert_wildcard_req(req_string) if req_string.include?("+")
-
-        # If a soft requirement is being used, treat it as an equality matcher
-        return req_string unless req_string.start_with?("[")
-
-        req_string.gsub(/[\[\]\(\)]/, "")
-      end
-
-      sig { params(req_string: String).returns(String) }
-      def convert_wildcard_req(req_string)
-        version = req_string.split("+").first
-        return ">= 0" if version.nil? || version.empty?
-
-        version += "0" if version.end_with?(".")
-        "~> #{version}"
-      end
     end
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-gradle
 version: !ruby/object:Gem::Version
-  version: 0.372.0
+  version: 0.374.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,28 +15,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.372.0
+        version: 0.374.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.372.0
+        version: 0.374.0
 - !ruby/object:Gem::Dependency
   name: dependabot-maven
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.372.0
+        version: 0.374.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.372.0
+        version: 0.374.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -285,7 +285,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.372.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.374.0
 rdoc_options: []
 require_paths:
 - lib