dependabot-gradle 0.376.0 → 0.377.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 927977ff944f07aab10b9338ca71c9540520dc07a97f3db8cf2aa9b27d325d9f
-  data.tar.gz: b618b2c6aaeb01de38041a829a0b1f650604df9791889323fe8066388b3e3aeb
+  metadata.gz: fc9ccb07b414741f2b8839cd0fb9515a004b20df4dfb5b008347af097a93128a
+  data.tar.gz: d974e7d7f85518016c86c19366421127781be99f2d014b16891d6483d9196e76
 SHA512:
-  metadata.gz: 648c6a0d23f8ae1f8026a10d19e66766a14c29be9e4fe3b46cc6386b0b24e82328e357b9504b40b61612322cddff3ab4ad786beca3a1d5d70dc9e42b321aebaf
-  data.tar.gz: 289b073da8a00a76bf0f2b636e8429d76a4472eba85057e4d4630b981b30554a674cbdd23879f3446a78f2a874903089ac00dfdd1f4de44072393245c7ec82e1
+  metadata.gz: b9c4b0b21c8b0dd3625b464491a723e63bfb5d12c6524e503f0edae004a65cfa7194c86638c2a8eb609652b79e3625dbbfdebbbe41f620ce889679a1e2aacddf
+  data.tar.gz: 20b4d157bf6a305cafe771152a638ef3f4290d935cb7b2d221c62338c33e8b18de2bb6b55586d0808118993b34f37d7b62392eb02c9324f0f010a465fa4eed8c

data/lib/dependabot/gradle/metadata_finder.rb

@@ -1,25 +1,19 @@
 # typed: strict
 # frozen_string_literal: true
 
-require "nokogiri"
 require "sorbet-runtime"
 
-require "dependabot/file_fetchers/base"
 require "dependabot/gradle/distributions"
 require "dependabot/gradle/file_fetcher"
 require "dependabot/gradle/file_parser/repositories_finder"
-require "dependabot/maven/utils/auth_headers_finder"
+require "dependabot/maven/shared/shared_metadata_finder"
 require "dependabot/metadata_finders"
-require "dependabot/metadata_finders/base"
-require "dependabot/registry_client"
 
 module Dependabot
   module Gradle
-    class MetadataFinder < Dependabot::MetadataFinders::Base
+    class MetadataFinder < Dependabot::Maven::Shared::SharedMetadataFinder
       extend T::Sig
 
-      DOT_SEPARATOR_REGEX = %r{\.(?!\d+([.\/_\-]|$)+)}
-      PROPERTY_REGEX      = /\$\{(?<property>.*?)\}/
       KOTLIN_PLUGIN_REPO_PREFIX = "org.jetbrains.kotlin"
 
       private
@@ -28,18 +22,7 @@ module Dependabot
       def look_up_source
         return distributions_source if Distributions.distribution_requirements?(dependency.requirements)
 
-        tmp_source = look_up_source_in_pom(dependency_pom_file)
-        return tmp_source if tmp_source
-
-        return unless (parent = parent_pom_file(dependency_pom_file))
-
-        tmp_source = look_up_source_in_pom(parent)
-        return unless tmp_source
-
-        artifact = dependency.name.split(":").last
-        return tmp_source if tmp_source.repo.end_with?(T.must(artifact))
-
-        tmp_source if repo_has_subdir_for_dep?(tmp_source)
+        super
       end
 
       # The Gradle Wrapper does not have its own release notes.
@@ -53,120 +36,35 @@ module Dependabot
         )
       end
 
-      sig { params(tmp_source: Dependabot::Source).returns(T::Boolean) }
-      def repo_has_subdir_for_dep?(tmp_source)
-        @repo_has_subdir_for_dep ||= T.let({}, T.nilable(T::Hash[Dependabot::Source, T::Boolean]))
-        return T.must(@repo_has_subdir_for_dep[tmp_source]) if @repo_has_subdir_for_dep.key?(tmp_source)
-
-        artifact = dependency.name.split(":").last
-        fetcher =
-          Dependabot::Gradle::FileFetcher.new(source: tmp_source, credentials: credentials)
-
-        @repo_has_subdir_for_dep[tmp_source] =
-          fetcher.send(:repo_contents, raise_errors: false)
-                 .select { |f| f.type == "dir" }
-                 .any? { |f| artifact&.end_with?(f.name) }
-      rescue Dependabot::BranchNotFound
-        tmp_source.branch = nil
-        retry
-      rescue Dependabot::RepoNotFound
-        T.must(@repo_has_subdir_for_dep)[tmp_source] = false
-      end
-
-      sig { params(pom: Nokogiri::XML::Document).returns(T.nilable(Dependabot::Source)) }
-      def look_up_source_in_pom(pom)
-        potential_source_urls = [
-          pom.at_css("project > url")&.content,
-          pom.at_css("project > scm > url")&.content,
-          pom.at_css("project > issueManagement > url")&.content
-        ].compact
-
-        source_url = potential_source_urls.find { |url| Source.from_url(url) }
-        source_url ||= source_from_anywhere_in_pom(pom)
-        source_url = substitute_property_in_source_url(source_url, pom)
-
-        Source.from_url(source_url)
-      end
-
-      sig { params(source_url: T.nilable(String), pom: Nokogiri::XML::Document).returns(T.nilable(String)) }
-      def substitute_property_in_source_url(source_url, pom)
-        return unless source_url
-        return source_url unless source_url.include?("${")
-
-        regex = PROPERTY_REGEX
-        property_name = T.must(source_url.match(regex)).named_captures["property"]
-        doc = pom.dup
-        doc.remove_namespaces!
-        nm = T.must(property_name).sub(/^pom\./, "").sub(/^project\./, "")
-        property_value =
-          loop do
-            candidate_node =
-              doc.at_xpath("/project/#{nm}") ||
-              doc.at_xpath("/project/properties/#{nm}") ||
-              doc.at_xpath("/project/profiles/profile/properties/#{nm}")
-            break(candidate_node.content) if candidate_node
-            break unless nm.match?(DOT_SEPARATOR_REGEX)
-
-            nm = nm.sub(DOT_SEPARATOR_REGEX, "/")
-          end
-
-        source_url.gsub("${#{property_name}}", property_value)
+      sig { override.returns(T.class_of(Dependabot::FileFetchers::Base)) }
+      def file_fetcher_class
+        Dependabot::Gradle::FileFetcher
       end
 
-      sig { params(pom: T.any(String, Nokogiri::XML::Document)).returns(T.nilable(String)) }
-      def source_from_anywhere_in_pom(pom)
-        github_urls = []
-        pom.to_s.scan(Source::SOURCE_REGEX) do
-          github_urls << Regexp.last_match.to_s
-        end
-
-        github_urls.find do |url|
-          repo = T.must(Source.from_url(url)).repo
-          repo.end_with?(T.must(dependency.name.split(":").last))
+      sig { override.returns(T.nilable(String)) }
+      def dependency_artifact_id
+        if kotlin_plugin? then "#{KOTLIN_PLUGIN_REPO_PREFIX}.#{dependency.name}.gradle.plugin"
+        elsif plugin? then "#{dependency.name}.gradle.plugin"
+        else
+          dependency.name.split(":").last
         end
       end
 
-      sig { returns(Nokogiri::XML::Document) }
-      def dependency_pom_file
-        return @dependency_pom_file unless @dependency_pom_file.nil?
-
-        artifact_id =
-          if kotlin_plugin? then "#{KOTLIN_PLUGIN_REPO_PREFIX}.#{dependency.name}.gradle.plugin"
-          elsif plugin? then "#{dependency.name}.gradle.plugin"
+      sig { override.returns(String) }
+      def maven_repo_dependency_url
+        group_id, artifact_id =
+          if kotlin_plugin?
+            ["#{KOTLIN_PLUGIN_REPO_PREFIX}.#{dependency.name}",
+             "#{KOTLIN_PLUGIN_REPO_PREFIX}.#{dependency.name}.gradle.plugin"]
+          elsif plugin? then [dependency.name, "#{dependency.name}.gradle.plugin"]
           else
-            dependency.name.split(":").last
+            dependency.name.split(":")
           end
 
-        response = Dependabot::RegistryClient.get(
-          url: "#{maven_repo_dependency_url}/#{dependency.version}/#{artifact_id}-#{dependency.version}.pom",
-          headers: auth_headers
-        )
-
-        @dependency_pom_file = T.let(Nokogiri::XML(response.body), T.nilable(Nokogiri::XML::Document))
-      rescue Excon::Error::Timeout
-        @dependency_pom_file ||= T.let(Nokogiri::XML(""), T.nilable(Nokogiri::XML::Document))
-      end
-
-      sig { params(pom: Nokogiri::XML::Document).returns(T.nilable(Nokogiri::XML::Document)) }
-      def parent_pom_file(pom)
-        doc = pom.dup
-        doc.remove_namespaces!
-        group_id = doc.at_xpath("/project/parent/groupId")&.content&.strip
-        artifact_id =
-          doc.at_xpath("/project/parent/artifactId")&.content&.strip
-        version = doc.at_xpath("/project/parent/version")&.content&.strip
-
-        return unless artifact_id && group_id && version
-
-        response = Dependabot::RegistryClient.get(
-          url: "#{maven_repo_url}/#{group_id.tr('.', '/')}/#{artifact_id}/#{version}/#{artifact_id}-#{version}.pom",
-          headers: auth_headers
-        )
-
-        Nokogiri::XML(response.body)
+        "#{maven_repo_url}/#{group_id&.tr('.', '/')}/#{artifact_id}"
       end
 
-      sig { returns(String) }
+      sig { override.returns(String) }
       def maven_repo_url
         source = dependency.requirements
                            .find { |r| r.fetch(:source) }&.fetch(:source)
@@ -176,18 +74,9 @@ module Dependabot
           Gradle::FileParser::RepositoriesFinder::CENTRAL_REPO_URL
       end
 
-      sig { returns(String) }
-      def maven_repo_dependency_url
-        group_id, artifact_id =
-          if kotlin_plugin?
-            ["#{KOTLIN_PLUGIN_REPO_PREFIX}.#{dependency.name}",
-             "#{KOTLIN_PLUGIN_REPO_PREFIX}.#{dependency.name}.gradle.plugin"]
-          elsif plugin? then [dependency.name, "#{dependency.name}.gradle.plugin"]
-          else
-            dependency.name.split(":")
-          end
-
-        "#{maven_repo_url}/#{group_id&.tr('.', '/')}/#{artifact_id}"
+      sig { override.returns(String) }
+      def central_repo_url
+        Gradle::FileParser::RepositoriesFinder::CENTRAL_REPO_URL
       end
 
       sig { returns(T::Boolean) }
@@ -199,14 +88,6 @@ module Dependabot
       def kotlin_plugin?
         plugin? && dependency.requirements.any? { |r| r.fetch(:groups).include? "kotlin" }
       end
-
-      sig { returns(T::Hash[String, String]) }
-      def auth_headers
-        @auth_headers ||= T.let(
-          Dependabot::Maven::Utils::AuthHeadersFinder.new(credentials).auth_headers(maven_repo_url),
-          T.nilable(T::Hash[String, String])
-        )
-      end
     end
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-gradle
 version: !ruby/object:Gem::Version
-  version: 0.376.0
+  version: 0.377.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,28 +15,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.376.0
+        version: 0.377.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.376.0
+        version: 0.377.0
 - !ruby/object:Gem::Dependency
   name: dependabot-maven
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.376.0
+        version: 0.377.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.376.0
+        version: 0.377.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -285,7 +285,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.376.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.377.0
 rdoc_options: []
 require_paths:
 - lib