dependabot-gradle 0.113.11 → 0.113.12

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e495ea01c31d6f96b4a91c897d176c1dd358e7bb72aed374374d12fb4edd9e1c
-  data.tar.gz: 3b09a534801ff6a1382a9f598c6c5599e9adef379cbc7612a5ec717f51d4c689
+  metadata.gz: b26a170f0a2743c89dc896cf9ce1e77e766383a536db342ed7b4a1a0e66f3a2d
+  data.tar.gz: 05c47a59ac27626efb4576ebb72782e9d2ab525211f712f7bbe621d4ae28bfd9
 SHA512:
-  metadata.gz: 67348d26a8b6b89a2e5331b16c06807e8f998779674e3379bad9bc12fb4b9ebbc6875aeaef3df2b3db40a85bceee46d41bc684da8ecf29ca01cae7394efc8359
-  data.tar.gz: 671301c680b7ca49b495bc0441aafa5e647844c189ccd5f6a5e721922a4d32773ae835676975693758d440e11868d7c4a90ffc0f8c77d8366fdff5e902efbcf4
+  metadata.gz: 46b491e2c767721b03c9fe57bae24583d652a2a51d99da318db4ce8d3a5adfd801c6fd60566d26db60a27c5709c82b5a7ae0db4c9b9d03b7442e1b4b058bf6cc
+  data.tar.gz: 9f56effdf5d02c715e42d9b9180ab0b3d3539fc44c0cdf51f5e84ba573d6ea39422cd9ef92072054d9384ae3c89156cf866193753e055c841dfcef86109132d7

data/lib/dependabot/gradle/file_parser.rb

@@ -168,6 +168,7 @@ module Dependabot
           fetch("value")
       end
 
+      # rubocop:disable Metrics/MethodLength
       def dependency_from(details_hash:, buildfile:, in_dependency_set: false)
         group   = evaluated_value(details_hash[:group], buildfile)
         name    = evaluated_value(details_hash[:name], buildfile)
@@ -181,6 +182,8 @@ module Dependabot
           if group == "plugins" then ["plugins"]
           else []
           end
+        source =
+          source_from(group, name, version)
 
         # If we can't evaluate a property they we won't be able to
         # update this dependency
@@ -193,13 +196,27 @@ module Dependabot
           requirements: [{
             requirement: version,
             file: buildfile.name,
-            source: nil,
+            source: source,
             groups: groups,
             metadata: dependency_metadata(details_hash, in_dependency_set)
           }],
           package_manager: "gradle"
         )
       end
+      # rubocop:enable Metrics/MethodLength
+
+      def source_from(group, name, version)
+        return nil unless group&.start_with?("com.github")
+
+        account = group.sub("com.github.", "")
+
+        {
+          type: "git",
+          url: "https://github.com/#{account}/#{name}",
+          branch: nil,
+          ref: version
+        }
+      end
 
       def dependency_metadata(details_hash, in_dependency_set)
         version_property_name =

data/lib/dependabot/gradle/update_checker.rb

@@ -12,6 +12,8 @@ module Dependabot
       require_relative "update_checker/multi_dependency_updater"
 
       def latest_version
+        return if git_dependency?
+
         latest_version_details&.fetch(:version)
       end
 
@@ -21,6 +23,7 @@ module Dependabot
         #
         # The above is hard. Currently we just return the latest version and
         # hope (hence this package manager is in beta!)
+        return if git_dependency?
         return nil if version_comes_from_multi_dependency_property?
         return nil if version_comes_from_dependency_set?
 
@@ -28,6 +31,7 @@ module Dependabot
       end
 
       def lowest_resolvable_security_fix_version
+        return if git_dependency?
         return nil if version_comes_from_multi_dependency_property?
         return nil if version_comes_from_dependency_set?
 
@@ -126,6 +130,18 @@ module Dependabot
           )
       end
 
+      def git_dependency?
+        git_commit_checker.git_dependency?
+      end
+
+      def git_commit_checker
+        @git_commit_checker ||=
+          GitCommitChecker.new(
+            dependency: dependency,
+            credentials: credentials
+          )
+      end
+
       def version_comes_from_multi_dependency_property?
         declarations_using_a_property.any? do |requirement|
           property_name = requirement.fetch(:metadata).fetch(:property_name)

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-gradle
 version: !ruby/object:Gem::Version
-  version: 0.113.11
+  version: 0.113.12
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-10-08 00:00:00.000000000 Z
+date: 2019-10-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.113.11
+        version: 0.113.12
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.113.11
+        version: 0.113.12
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement