dependabot-linguist 0.212.1 → 0.303.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (27) hide show
  1. checksums.yaml +4 -4
  2. data/.nvmrc +1 -0
  3. data/.rubocop.yml +137 -8
  4. data/.ruby-version +1 -0
  5. data/CONTRIBUTING.md +2 -0
  6. data/Gemfile.lock +266 -158
  7. data/Makefile +93 -19
  8. data/README.md +34 -5
  9. data/SECURITY.md +4 -2
  10. data/dependabot-linguist.gemspec +21 -11
  11. data/exe/dependabot-linguist +1 -1
  12. data/lib/dependabot/linguist/dependabot_file_validator.rb +3 -1
  13. data/lib/dependabot/linguist/dependabot_patch.rb +14 -2
  14. data/lib/dependabot/linguist/file_fetchers/bundler.rb +54 -0
  15. data/lib/dependabot/linguist/file_fetchers/git_submodules.rb +9 -7
  16. data/lib/dependabot/linguist/file_fetchers/go_modules.rb +2 -2
  17. data/lib/dependabot/linguist/language.rb +18 -14
  18. data/lib/dependabot/linguist/languages_to_ecosystems/contexts.rb +25 -21
  19. data/lib/dependabot/linguist/languages_to_ecosystems/contexts_applied.rb +1 -1
  20. data/lib/dependabot/linguist/languages_to_ecosystems/languages.yaml +841 -60
  21. data/lib/dependabot/linguist/languages_to_ecosystems/manager_ecosystem_maps.rb +33 -21
  22. data/lib/dependabot/linguist/languages_to_patch.txt +1 -0
  23. data/lib/dependabot/linguist/linguist_patch.rb +1 -1
  24. data/lib/dependabot/linguist/repository.rb +12 -3
  25. data/lib/dependabot/linguist/version.rb +1 -1
  26. metadata +67 -25
  27. data/lib/dependabot/linguist/file_fetchers/base.rb +0 -48
data/README.md CHANGED
@@ -2,10 +2,16 @@
2
2
  Use [linguist](https://github.com/github/linguist) to check the contents of a **local** repository, and then scan for [dependabot-core](https://github.com/dependabot/dependabot-core) ecosystems relevant to those languages! With the list of [ecosystems](https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#package-ecosystem) present in a repository, add a [dependabot.y[a]ml](https://docs.github.com/en/code-security/dependabot/dependabot-security-updates/configuring-dependabot-security-updates) ([configuration file](https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file)).
3
3
  ## Getting Started
4
4
  ### [Linguist dependencies](https://github.com/github/linguist#dependencies);
5
- Before installing this gem, which will install the [github-linguist gem](https://rubygems.org/gems/github-linguist), linguists dependencies should be installed. A number of these are enabling [rugged](https://rubygems.org/gems/rugged), so they can't be "ignored" like [dependabot's setup](https://github.com/dependabot/dependabot-core#setup), which _can_ be ignored for the purpose of **this** gem, which only intends to use the [file fetchers](https://github.com/dependabot/dependabot-core/blob/v0.212.0/common/lib/dependabot/file_fetchers/README.md).
5
+ Before installing this gem, which will install the [github-linguist gem](https://rubygems.org/gems/github-linguist), linguists dependencies should be installed. A number of these are enabling [rugged](https://rubygems.org/gems/rugged), so they can't be "ignored" like [dependabot's setup](https://github.com/dependabot/dependabot-core#setup), which _can_ be ignored for the purpose of **this** gem, which only intends to use the [file fetchers](https://github.com/dependabot/dependabot-core/blob/v0.303.0/common/lib/dependabot/file_fetchers/README.md).
6
6
  ```bash
7
7
  sudo apt-get install build-essential cmake pkg-config libicu-dev zlib1g-dev libcurl4-openssl-dev libssl-dev ruby-dev
8
8
  ```
9
+ ### Dependabot dependencies;
10
+ The `npm`/`yarn` module requires [`corepack`](https://www.npmjs.com/package/corepack), so it will be necessary to install, either with npm or yarn. Ensuring you have the _right version_ of `corepack` is important. Your best bet is to ensure you have the latest version.
11
+ ```bash
12
+ nvm install 22 && nvm use 22 && npm i -g corepack@latest
13
+ # you'll need to `nvm use 22` to load that node before running this gem
14
+ ```
9
15
  ### Install _this_
10
16
  [To install the latest from RubyGems](https://rubygems.org/gems/dependabot-linguist);
11
17
  ```sh
@@ -22,12 +28,12 @@ bundle add dependabot-linguist
22
28
  ```
23
29
  Or add the following line to your `Gemfile` manually
24
30
  ```ruby
25
- gem "dependabot-linguist", ">= 0.212.0
31
+ gem "dependabot-linguist", ">= 0.303.0
26
32
  ```
27
33
  [Add the GitHub hosted gem](https://github.com/Skenvy/dependabot-linguist/packages/1704407);
28
34
  ```ruby
29
35
  source "https://rubygems.pkg.github.com/skenvy" do
30
- gem "dependabot-linguist", ">= 0.212.0"
36
+ gem "dependabot-linguist", ">= 0.303.0"
31
37
  end
32
38
  ```
33
39
  ### Setup external CLIs
@@ -89,11 +95,34 @@ ignore:
89
95
  ```
90
96
  ## [RDoc generated docs](https://skenvy.github.io/dependabot-linguist/)
91
97
  ## Developing
98
+ ### Install Ruby
99
+ You will need to install [rvm](https://rvm.io/) and one of its [ruby binaries](https://rvm.io/binaries/).
100
+
101
+ You'll also need to set the `RVM_DIR` in your shell profile e.g. [like this](https://github.com/Skenvy/dotfiles/blob/1de61272c588a30b634a03a7d304ef51e40c72f1/.bash_login#L17). RVM will set some basic initialisation in your shell profile, but changing what it sets to instead use `RVM_DIR` like this allows you to install it somewhere other than the default.
102
+
103
+ The `make setup` in [first time setup](#the-first-time-setup) will install the intended development version for you, but it might not be a precompiled binary, depending on your OS and architecture ~ if it isn't precompiled, contributing your time in compiling to [publish the binary for rvm](https://github.com/rvm/rvm/issues/4921) is probably more worth your time than this lol.
104
+
105
+ RVM is locally how we manage proctoring the ruby environment. It is not on the [github runners](https://github.com/actions/runner-images), so the make invocations in the workflows set the RVM proctors empty. If you want to manage your own ruby installs you can set `_=''` on each `make ...`.
106
+
107
+ You should also read the requirements for the gems this uses, see [Linguist dependencies](#linguist-dependencies) and [Dependabot dependencies](#dependabot-dependencies). `Linguist`'s can be acquired with `make preinit` done once.
108
+ ### Install Corepack
109
+ [Dependabot dependencies](#dependabot-dependencies) are managed in this project via [`nvm`](https://github.com/nvm-sh/nvm), so `corepack` can be loaded into every subshell the `Makefile` spawns. If you don't want to install `nvm` but would rather manage your own `corepack` install, set `__=''` on each `make ...`.
110
+
111
+ For the currently targetted version of `dependabot` that this is using, the existing reference versions of `corepack` are;
112
+ * [bun/Dockerfile](https://github.com/dependabot/dependabot-core/blob/v0.303.0/bun/Dockerfile#L4)
113
+ * [npm_and_yarn/Dockerfile](https://github.com/dependabot/dependabot-core/blob/v0.303.0/npm_and_yarn/Dockerfile#L4)
114
+
115
+ Both currently (as of writing) set their `corepack` version to `0.31.0`. However, it's possible for the changes in versions in `corepack` to outstrip the rate of changes of this gem, so don't rely on _this_ to determine what the most suitable version of `corepack` is.
116
+
117
+ > [!CAUTION]
118
+ > `make setup` / `initialise` / `initialise_corepack` will install to your _global_ `node`. If you're using the recommended `nvm` then each `node` install can be treated eseentially ephemeral. If you aren't using `nvm`, this might hijack your global `corepack` install.
92
119
  ### The first time setup
120
+ If you have `rvm` and `nvm` installed and you have `apt`, you should be able to;
93
121
  ```sh
94
- git clone https://github.com/Skenvy/dependabot-linguist.git && cd dependabot-linguist && make setup
122
+ git clone https://github.com/Skenvy/dependabot-linguist.git && cd dependabot-linguist && make preinit && make setup
95
123
  ```
96
124
  ### Iterative development
97
125
  The majority of `make` recipes for this are just wrapping a `bundle` invocation of `rake`.
98
126
  * `make docs` will recreate the RDoc docs
99
- * `make test` will run both the RSpec tests and the RuboCop linter.
127
+ * `make test` will run the RSpec tests.
128
+ * `make lint` will run the RuboCop linter.
data/SECURITY.md CHANGED
@@ -1,9 +1,11 @@
1
1
  # Security Policy
2
2
  ## Supported Versions
3
3
  The `<major>.<minor>.*` versions of this are pinned to the **supported** `<major>.<minor>.*` versions of the gems that are published by the [dependabot-core](https://github.com/dependabot/dependabot-core) repository, centric to the [dependabot-common](https://rubygems.org/gems/dependabot-common) gem, with any required patches applied to each supported minor version.
4
- * Initially this will support version `0.212.0`, centric to [dependabot-common@0.212.0](https://rubygems.org/gems/dependabot-common/versions/0.212.0)
4
+ * Support version `0.212.0`, centric to [dependabot-common@0.212.0](https://rubygems.org/gems/dependabot-common/versions/0.212.0)
5
5
  * This is because this is the last version to support a Ruby version of `2.7.0`.
6
+ * Support version `0.217.0`, centric to [dependabot-common@0.217.0](https://rubygems.org/gems/dependabot-common/versions/0.217.0)
7
+ * Version `0.303.0` is a partial update to [dependabot-common@0.303.0](https://rubygems.org/gems/dependabot-common/versions/0.303.0)
6
8
 
7
- Bugs present in any supported pinned version may be patched and contribute to successive patch versions. If a bug exists in an older version and no longer exists in a newer version, it is suggested to update to the newer version.
9
+ Bugs present in only the most recent pinned minor version may be patched and contribute to successive patch versions. If a bug exists in an older version and no longer exists in a newer version, it is suggested to update to the newer version. As the underlying package this wraps, dependabot[-omnibus], is a live service, it makes sense for this to only roll forward.
8
10
  ## Reporting a Vulnerability
9
11
  Raise a [Security Vulnerability](https://github.com/Skenvy/dependabot-linguist/issues/new?assignees=&labels=security&template=security-vulnerability.yaml) issue.
data/dependabot-linguist.gemspec CHANGED
@@ -12,9 +12,12 @@ Gem::Specification.new do |spec|
12
12
  spec.description = "Use linguist to check the contents of a repository,
13
13
  and then scan for dependabot-core ecosystems relevant to those languages!"
14
14
  spec.homepage = "https://skenvy.github.io/dependabot-linguist"
15
- spec.required_ruby_version = ">= 2.7.0"
15
+ # https://github.com/dependabot/dependabot-core/blob/v0.303.0/common/dependabot-common.gemspec#L23-L24
16
+ spec.required_ruby_version = ">= 3.1.0"
17
+ spec.required_rubygems_version = ">= 3.3.7"
16
18
  spec.metadata["homepage_uri"] = spec.homepage
17
19
  spec.metadata["source_code_uri"] = "https://github.com/Skenvy/dependabot-linguist/tree/main/"
20
+ spec.metadata["github_repo"] = "https://github.com/Skenvy/dependabot-linguist"
18
21
 
19
22
  spec.require_paths = ["lib"]
20
23
  spec.files = Dir.chdir(__dir__) do
@@ -25,17 +28,24 @@ Gem::Specification.new do |spec|
25
28
  spec.bindir = "exe"
26
29
  spec.executables = spec.files.grep(%r{\Aexe/}) { |f| File.basename(f) }
27
30
 
28
- spec.add_dependency "rugged", "~> 1.5.0"
29
- spec.add_dependency "github-linguist", "7.23.0"
31
+ spec.add_dependency "rugged", "1.9.0"
32
+ spec.add_dependency "github-linguist", "9.0.0"
30
33
  # All ecosystem gems from https://rubygems.org/profiles/dependabot can be
31
- # required via https://rubygems.org/gems/dependabot-omnibus/versions/0.212.0
34
+ # required via https://rubygems.org/gems/dependabot-omnibus/versions/0.303.0
32
35
  # which will include all dependencies of omnibus (16 ecosystems and common).
33
- # https://github.com/dependabot/dependabot-core/blob/v0.212.0/omnibus/dependabot-omnibus.gemspec#L24-L40
34
- spec.add_dependency "dependabot-omnibus", "0.212.0"
36
+ # https://github.com/dependabot/dependabot-core/blob/v0.303.0/omnibus/dependabot-omnibus.gemspec#L29-L52
37
+ spec.add_dependency "dependabot-omnibus", "0.303.0"
38
+ # We can't update from this json version without getting some weird
39
+ # uninitialized constant Dependabot::FileFetchers::Base::OpenStruct
40
+ # ~= https://github.com/ruby/json/compare/v2.7.1...v2.7.2 but idk
41
+ # But also dependabot-* >= 0.238.0 introduce requiring json < 2.7
42
+ spec.add_dependency "json", "2.6.3"
43
+ # stringio (>= 0) leads to ambiguous spec so lock it too.
44
+ spec.add_dependency "stringio", "3.1.5"
35
45
 
36
- # spec.add_development_dependency "aruba", "~> 2.1" # TODO
37
- spec.add_development_dependency "rake", "~> 13.0"
38
- spec.add_development_dependency "rdoc", "~> 6.0"
39
- spec.add_development_dependency "rspec", "~> 3.12"
40
- spec.add_development_dependency "rubocop", "~> 1.37"
46
+ spec.add_development_dependency "aruba", "~> 2.3"
47
+ spec.add_development_dependency "rake", "~> 13.2"
48
+ spec.add_development_dependency "rdoc", "~> 6.12"
49
+ spec.add_development_dependency "rspec", "~> 3.13"
50
+ spec.add_development_dependency "rubocop", "~> 1.73"
41
51
  end
data/exe/dependabot-linguist CHANGED
@@ -12,7 +12,7 @@ require "yaml"
12
12
  $VERBOSE = previous_verbose
13
13
 
14
14
  VERSION = ::Dependabot::Linguist::VERSION
15
- BANNER = <<~BANNER
15
+ BANNER = <<~BANNER.freeze
16
16
  Dependabot Linguist v#{VERSION}
17
17
  Detect dependabot ecosystems present for a given git repository, based off using
18
18
  linguist to determine the files present, that could be relevant to an ecosystem,
data/lib/dependabot/linguist/dependabot_file_validator.rb CHANGED
@@ -202,7 +202,9 @@ module Dependabot
202
202
  end
203
203
 
204
204
  def write_new_config
205
- File.open("#{@repo.path.delete_suffix("/.git/")}/#{dependabot_file_path}", "w") { |file| file.write(new_config.to_yaml) } if new_config != existing_config
205
+ full_file_path = "#{@repo.path.delete_suffix("/.git/")}/#{dependabot_file_path}"
206
+ FileUtils.mkdir_p File.dirname(full_file_path)
207
+ File.open(full_file_path, "w") { |file| file.write(new_config.to_yaml) } if new_config != existing_config
206
208
  end
207
209
 
208
210
  # The expected environment to run this final step in should have 'git' AND
data/lib/dependabot/linguist/dependabot_patch.rb CHANGED
@@ -1,8 +1,20 @@
1
1
  # frozen_string_literal: true
2
2
 
3
+ #########################################################################################
4
+ # _____ _ _ _ _____ _ _ #
5
+ # | __ \ | | | | | | | __ \ | | | | #
6
+ # | | | | ___ _ __ ___ _ __ __| | __ _| |__ ___ | |_ | |__) |_ _| |_ ___| |__ #
7
+ # | | | |/ _ \ '_ \ / _ \ '_ \ / _` |/ _` | '_ \ / _ \| __| | ___/ _` | __/ __| '_ \ #
8
+ # | |__| | __/ |_) | __/ | | | (_| | (_| | |_) | (_) | |_ | | | (_| | || (__| | | | #
9
+ # |_____/ \___| .__/ \___|_| |_|\__,_|\__,_|_.__/ \___/ \__| |_| \__,_|\__\___|_| |_| #
10
+ # | | #
11
+ # |_| #
12
+ #########################################################################################
13
+
3
14
  # Direct the requiring of the files that patch dependabot via this.
4
- # https://github.com/dependabot/dependabot-core/tree/v0.212.0
15
+ # The current target version for dependabot is 0.303.0
16
+ # https://github.com/dependabot/dependabot-core/tree/v0.303.0
5
17
 
6
- require_relative "file_fetchers/base"
18
+ require_relative "file_fetchers/bundler"
7
19
  require_relative "file_fetchers/go_modules"
8
20
  require_relative "file_fetchers/git_submodules"
data/lib/dependabot/linguist/file_fetchers/bundler.rb ADDED
@@ -0,0 +1,54 @@
1
+ # frozen_string_literal: true
2
+
3
+ #########################################################################################
4
+ # _____ _ _ _ _____ _ _ #
5
+ # | __ \ | | | | | | | __ \ | | | | #
6
+ # | | | | ___ _ __ ___ _ __ __| | __ _| |__ ___ | |_ | |__) |_ _| |_ ___| |__ #
7
+ # | | | |/ _ \ '_ \ / _ \ '_ \ / _` |/ _` | '_ \ / _ \| __| | ___/ _` | __/ __| '_ \ #
8
+ # | |__| | __/ |_) | __/ | | | (_| | (_| | |_) | (_) | |_ | | | (_| | || (__| | | | #
9
+ # |_____/ \___| .__/ \___|_| |_|\__,_|\__,_|_.__/ \___/ \__| |_| \__,_|\__\___|_| |_| #
10
+ # | | #
11
+ # |_| #
12
+ #########################################################################################
13
+
14
+ # Patches Dependabot::GitSubmodules::FileFetcher.path_gemspec_paths
15
+
16
+ # To fix https://github.com/Skenvy/dependabot-linguist/issues/6 we need to patch
17
+ # ::Dependabot::Bundler::FileFetcher::fetch_path_gemspec_paths to stop it throwing
18
+ # a Bundler::GemfileNotFound error, thrown from assuming that ::Bundler::root will
19
+ # be run at the location the Gemfile.lock, and thus the Gemfile, exist. Currently
20
+ # ::Bundler::LockfileParser::initialize during fetch_path_gemspec_paths will go;
21
+ # ::Bundler::LockfileParser::parse_source, ::Bundler::Source::Rubygems::from_lock,
22
+ # ::Bundler::Source::Rubygems::initialize, ::Bundler::Source::Rubygems::cache_path,
23
+ # ::Bundler::app_cache, ::Bundler::root, ::Bundler::SharedHelpers::root, before
24
+ # landing at ::Bundler::SharedHelpers::find_gemfile where it can read from ENV
25
+ # `ENV["BUNDLE_GEMFILE"]`, or fail to locate an adjacent "Gemfile".
26
+
27
+ # See https://github.com/CloutKhan/dependabot-bundler error demo for more details.
28
+
29
+ # Instead of having the entire fetch_path_gemspec_paths in here, we can just wrap
30
+ # the only place it's used, inside path_gemspec_paths -- with setting the ENV.
31
+
32
+ require "dependabot/errors"
33
+ require "dependabot/bundler"
34
+
35
+ # rubocop:disable Style/Documentation
36
+
37
+ module Dependabot
38
+ module Bundler
39
+ class FileFetcher
40
+ # https://github.com/dependabot/dependabot-core/blob/v0.303.0/bundler/lib/dependabot/bundler/file_fetcher.rb#L162-L165
41
+ def path_gemspec_paths
42
+ swap_bundle_gemfile = ENV.fetch("BUNDLE_GEMFILE", nil)
43
+ repo_dir_gemfile = "#{@repo_contents_path}#{source.directory}/Gemfile"
44
+ ENV["BUNDLE_GEMFILE"] = repo_dir_gemfile
45
+ raise(Dependabot::DependencyFileNotFound, Pathname.new(File.join(directory, "Gemfile")).cleanpath.to_path) unless File.exist?(repo_dir_gemfile)
46
+ result = fetch_path_gemspec_paths.map { |path| Pathname.new(path) }
47
+ ENV["BUNDLE_GEMFILE"] = swap_bundle_gemfile
48
+ result
49
+ end
50
+ end
51
+ end
52
+ end
53
+
54
+ # rubocop:enable Style/Documentation
data/lib/dependabot/linguist/file_fetchers/git_submodules.rb CHANGED
@@ -12,8 +12,6 @@
12
12
  #########################################################################################
13
13
 
14
14
  # Patches Dependabot::GitSubmodules::FileFetcher.(fetch_files, gitmodules_file)
15
- # https://github.com/dependabot/dependabot-core/blob/v0.212.0/git_submodules/lib/dependabot/git_submodules/file_fetcher.rb#L21-L26
16
- # https://github.com/dependabot/dependabot-core/blob/v0.212.0/git_submodules/lib/dependabot/git_submodules/file_fetcher.rb#L28-L30
17
15
 
18
16
  # This patches out the network calls that might fail if you've used a private
19
17
  # repo as a submodule. It still validates the `.gitmodules` exists. If you ARE
@@ -21,9 +19,11 @@
21
19
  # "Allowing Dependabot to access private dependencies" at the below link
22
20
  # https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-dependabot-to-access-private-dependencies
23
21
 
24
- # required_files_in? only asserts the presence of a `.gitmodules` file if the
25
- # submodule referenced is private, then the network calls in `submodule_refs`
26
- # might break the runner. If Dependabot::FileFetchers::Base.load_cloned_file_if_present
22
+ # Dependabot::GitSubmodules::FileFetcher::required_files_in? only asserts the
23
+ # presence of a `.gitmodules` file if the submodule referenced is private, then
24
+ # the network calls in `submodule_refs` might break the runner.
25
+
26
+ # If Dependabot::FileFetchers::Base.load_cloned_file_if_present
27
27
  # can't see the file, it'll `raise Dependabot::DependencyFileNotFound`, which
28
28
  # will make Dependabot::FileFetchers::Base.fetch_file_if_present `return` which
29
29
  # will add nil to the list of fetched_files -- i.e.
@@ -36,9 +36,9 @@
36
36
  # So we need to be more cautious with this and check it first.
37
37
 
38
38
  # Dependabot::FileFetchers::Base.load_cloned_file_if_present
39
- # https://github.com/dependabot/dependabot-core/blob/v0.212.0/common/lib/dependabot/file_fetchers/base.rb#L117-L137
39
+ # https://github.com/dependabot/dependabot-core/blob/v0.303.0/common/lib/dependabot/file_fetchers/base.rb#L218-L240
40
40
  # Dependabot::FileFetchers::Base.fetch_file_if_present
41
- # https://github.com/dependabot/dependabot-core/blob/v0.212.0/common/lib/dependabot/file_fetchers/base.rb#L93-L115
41
+ # https://github.com/dependabot/dependabot-core/blob/v0.303.0/common/lib/dependabot/file_fetchers/base.rb#L194-L216
42
42
 
43
43
  require "dependabot/errors"
44
44
  require "dependabot/git_submodules"
@@ -48,11 +48,13 @@ require "dependabot/git_submodules"
48
48
  module Dependabot
49
49
  module GitSubmodules
50
50
  class FileFetcher
51
+ # https://github.com/dependabot/dependabot-core/blob/v0.303.0/git_submodules/lib/dependabot/git_submodules/file_fetcher.rb#L26-L32
51
52
  def fetch_files
52
53
  raise(Dependabot::DependencyFileNotFound, Pathname.new(File.join(directory, ".gitmodules")).cleanpath.to_path) if gitmodules_file.nil?
53
54
  [gitmodules_file]
54
55
  end
55
56
 
57
+ # https://github.com/dependabot/dependabot-core/blob/v0.303.0/git_submodules/lib/dependabot/git_submodules/file_fetcher.rb#L36-L43
56
58
  def gitmodules_file
57
59
  @gitmodules_file ||= fetch_file_if_present(".gitmodules")
58
60
  end
data/lib/dependabot/linguist/file_fetchers/go_modules.rb CHANGED
@@ -12,9 +12,8 @@
12
12
  #########################################################################################
13
13
 
14
14
  # Patches Dependabot::GoModules::FileFetcher.fetch_files
15
- # https://github.com/dependabot/dependabot-core/blob/v0.212.0/go_modules/lib/dependabot/go_modules/file_fetcher.rb#L19-L41
16
15
 
17
- # Patch to remove the online requirement for fetching go modules
16
+ # Patched to remove the online requirement for fetching go modules
18
17
 
19
18
  # See the git_submodule patch for a comment explaining the reorder pattern,
20
19
  # due to `go_mod` being acquired via `fetch_file_if_present` and hitting
@@ -28,6 +27,7 @@ require "dependabot/go_modules"
28
27
  module Dependabot
29
28
  module GoModules
30
29
  class FileFetcher
30
+ # https://github.com/dependabot/dependabot-core/blob/v0.303.0/go_modules/lib/dependabot/go_modules/file_fetcher.rb#L33-L46
31
31
  def fetch_files
32
32
  raise(Dependabot::DependencyFileNotFound, Pathname.new(File.join(directory, "go.mod")).cleanpath.to_path) if go_mod.nil?
33
33
  fetched_files = [go_mod]
data/lib/dependabot/linguist/language.rb CHANGED
@@ -11,26 +11,29 @@
11
11
  # |___/ #
12
12
  #####################################################################
13
13
 
14
- # Patches the class Linguist::Language to selectively "ungroup"
15
- # and change the type of "languages" to a detectable type.
16
- # https://github.com/github/linguist/blob/v7.23.0/lib/linguist/language.rb
17
-
18
- # Patch https://github.com/github/linguist/blob/v7.23.0/lib/linguist/blob_helper.rb#L220
19
- # Need to remove the "(^|/)\.gitmodules$" string (plus one of the adjacent "|") as we
20
- # can't rely on the gitmodules to be unvendored in a `.gitattributes` and patching
21
- # https://github.com/github/linguist/blob/v7.23.0/lib/linguist/lazy_blob.rb#L35-L38 or
22
- # https://github.com/github/linguist/blob/v7.23.0/lib/linguist/lazy_blob.rb#L56-L62
23
- # would be too cumbersome. It also seems easier than duplicating the vendor patterns
24
- # from https://github.com/github/linguist/blob/v7.23.0/lib/linguist/vendor.yml
25
- # See https://ruby-doc.org/core-2.7.0/Regexp.html
26
- # We also need to remove the "(^|/)\.github/" string (plus one of the adjacent "|"),
27
- # to capture yaml files under .github/workflows/*.yaml
14
+ # Patches the class Linguist::Language to selectively "ungroup" and
15
+ # change the type of "languages" to a detectable type. This patches
16
+ # the class with new functions, so there are no links to the "orig".
17
+
18
+ # Patch Linguist::BlobHelper::VendoredRegexp. Need to remove the
19
+ # "(^|/)\.gitmodules$" string (plus one of the adjacent "|") as we
20
+ # can't rely on the gitmodules to be unvendored in a `.gitattributes`.
21
+ # Need to remove the "(^|/)\.github/" string (plus the adjacent "|"),
22
+ # to capture yaml files under `.github/workflows/*.yaml`
23
+ # See https://ruby-doc.org/core-3.1.0/Regexp.html
24
+
25
+ # Patching either Linguist::LazyBlob::git_attributes or
26
+ # Linguist::LazyBlob::vendored? would be too cumbersome.
27
+ # It also seems easier than duplicating the vendor patterns from
28
+ # https://github.com/github/linguist/blob/v9.0.0/lib/linguist/vendor.yml
28
29
 
29
30
  require "linguist"
30
31
 
31
32
  # rubocop:disable Style/Documentation
32
33
 
33
34
  module Linguist
35
+ # https://github.com/github/linguist/blob/v9.0.0/lib/linguist/language.rb
36
+
34
37
  class Language
35
38
  def ungroup_language
36
39
  @group_name = self.name
@@ -55,6 +58,7 @@ module Linguist
55
58
  end
56
59
 
57
60
  module BlobHelper
61
+ # https://github.com/github/linguist/blob/v9.0.0/lib/linguist/blob_helper.rb#L220
58
62
  VendoredRegexp = Regexp.new(VendoredRegexp.source.gsub("(^|/)\\.gitmodules$|", "").gsub("|(^|/)\\.github/", ""))
59
63
  end
60
64
  end
data/lib/dependabot/linguist/languages_to_ecosystems/contexts.rb CHANGED
@@ -8,7 +8,7 @@
8
8
  # as it's source directory is not the directory it is valid to "fetch" from.
9
9
 
10
10
  # For a list of "linguist languages", see
11
- # https://github.com/github/linguist/blob/v7.23.0/lib/linguist/languages.yml
11
+ # https://github.com/github/linguist/blob/v9.0.0/lib/linguist/languages.yml
12
12
 
13
13
  require_relative "manager_ecosystem_maps"
14
14
 
@@ -23,6 +23,7 @@ module Dependabot
23
23
  # is derived from inspecting the rules the file fetcher class actually
24
24
  # uses itself to determine if it can "fetch files" for a directory.
25
25
  # Possibly also based on the `def self.required_files_message` message.
26
+ # Or alternatively the `def self.required_files_in?`, the actual check!
26
27
  FETCH_FILES = "def fetch_files"
27
28
  # PRIMARY_LANGUAGES implies that the language should be the main or only
28
29
  # languages that that package manager could be used for, and the presence
@@ -60,7 +61,7 @@ module Dependabot
60
61
 
61
62
  ##
62
63
  CONTEXT_RULES[PackageManagers::BUNDLER][ContextRule::FETCH_FILES] = [
63
- # https://github.com/dependabot/dependabot-core/blob/v0.212.0/bundler/lib/dependabot/bundler/file_fetcher.rb#L22-L24
64
+ # https://github.com/dependabot/dependabot-core/blob/v0.303.0/bundler/lib/dependabot/bundler/file_fetcher.rb#L22-L32
64
65
  "Gemfile.lock", # Gemfile.lock
65
66
  "Ruby" # Gemfile or .gemspec
66
67
  ]
@@ -69,7 +70,7 @@ module Dependabot
69
70
 
70
71
  ##
71
72
  CONTEXT_RULES[PackageManagers::CARGO][ContextRule::FETCH_FILES] = [
72
- # https://github.com/dependabot/dependabot-core/blob/v0.212.0/cargo/lib/dependabot/cargo/file_fetcher.rb#L19-L21
73
+ # https://github.com/dependabot/dependabot-core/blob/v0.303.0/cargo/lib/dependabot/cargo/file_fetcher.rb#L20-L26
73
74
  "TOML" # Cargo.toml and Cargo.lock
74
75
  ]
75
76
  CONTEXT_RULES[PackageManagers::CARGO][ContextRule::PRIMARY_LANGUAGES] = ["Rust"]
@@ -77,7 +78,8 @@ module Dependabot
77
78
 
78
79
  ##
79
80
  CONTEXT_RULES[PackageManagers::COMPOSER][ContextRule::FETCH_FILES] = [
80
- # https://github.com/dependabot/dependabot-core/blob/v0.212.0/composer/lib/dependabot/composer/file_fetcher.rb#L16-L18
81
+ # https://github.com/dependabot/dependabot-core/blob/v0.303.0/composer/lib/dependabot/composer/file_fetcher.rb#L18-L24
82
+ # https://github.com/dependabot/dependabot-core/blob/v0.303.0/composer/lib/dependabot/composer/package_manager.rb#L16
81
83
  "JSON" # composer.json and composer.lock
82
84
  ]
83
85
  CONTEXT_RULES[PackageManagers::COMPOSER][ContextRule::PRIMARY_LANGUAGES] = ["PHP"]
@@ -85,7 +87,7 @@ module Dependabot
85
87
 
86
88
  ##
87
89
  CONTEXT_RULES[PackageManagers::DOCKER][ContextRule::FETCH_FILES] = [
88
- # https://github.com/dependabot/dependabot-core/blob/v0.212.0/docker/lib/dependabot/docker/file_fetcher.rb#L17-L19
90
+ # https://github.com/dependabot/dependabot-core/blob/v0.303.0/docker/lib/dependabot/docker/file_fetcher.rb#L19-L28
89
91
  "Dockerfile", # Dockerfile
90
92
  "YAML" # .yaml, if kubernetes option is set
91
93
  ]
@@ -94,7 +96,7 @@ module Dependabot
94
96
 
95
97
  ##
96
98
  CONTEXT_RULES[PackageManagers::HEX][ContextRule::FETCH_FILES] = [
97
- # https://github.com/dependabot/dependabot-core/blob/v0.212.0/hex/lib/dependabot/hex/file_fetcher.rb#L20-L22
99
+ # https://github.com/dependabot/dependabot-core/blob/v0.303.0/hex/lib/dependabot/hex/file_fetcher.rb#L20-L28
98
100
  "Elixir" # mix.lock and mix.exs by extension
99
101
  ]
100
102
  CONTEXT_RULES[PackageManagers::HEX][ContextRule::PRIMARY_LANGUAGES] = ["Elixir"]
@@ -102,7 +104,8 @@ module Dependabot
102
104
 
103
105
  ##
104
106
  CONTEXT_RULES[PackageManagers::ELM_PACKAGE][ContextRule::FETCH_FILES] = [
105
- # https://github.com/dependabot/dependabot-core/blob/v0.212.0/elm/lib/dependabot/elm/file_fetcher.rb#L13-L15
107
+ # https://github.com/dependabot/dependabot-core/blob/v0.303.0/elm/lib/dependabot/elm/file_fetcher.rb#L14-L22
108
+ # https://github.com/dependabot/dependabot-core/blob/v0.303.0/elm/lib/dependabot/elm/package_manager.rb#L14
106
109
  "JSON" # elm-package.json or an elm.json, only seeks via .json extension though.
107
110
  ]
108
111
  CONTEXT_RULES[PackageManagers::ELM_PACKAGE][ContextRule::PRIMARY_LANGUAGES] = ["Elm"]
@@ -110,7 +113,7 @@ module Dependabot
110
113
 
111
114
  ##
112
115
  CONTEXT_RULES[PackageManagers::GIT_SUBMODULE][ContextRule::FETCH_FILES] = [
113
- # https://github.com/dependabot/dependabot-core/blob/v0.212.0/git_submodules/lib/dependabot/git_submodules/file_fetcher.rb#L15-L17
116
+ # https://github.com/dependabot/dependabot-core/blob/v0.303.0/git_submodules/lib/dependabot/git_submodules/file_fetcher.rb#L16-L24
114
117
  "Git Config" # ".gitmodules"
115
118
  ]
116
119
  CONTEXT_RULES[PackageManagers::GIT_SUBMODULE][ContextRule::PRIMARY_LANGUAGES] = []
@@ -118,7 +121,7 @@ module Dependabot
118
121
 
119
122
  ##
120
123
  CONTEXT_RULES[PackageManagers::GITHUB_ACTIONS][ContextRule::FETCH_FILES] = [
121
- # https://github.com/dependabot/dependabot-core/blob/v0.212.0/github_actions/lib/dependabot/github_actions/file_fetcher.rb#L15-L17
124
+ # https://github.com/dependabot/dependabot-core/blob/v0.303.0/github_actions/lib/dependabot/github_actions/file_fetcher.rb#L16-L24
122
125
  # "YAML", but this is handled without linguist
123
126
  ]
124
127
  CONTEXT_RULES[PackageManagers::GITHUB_ACTIONS][ContextRule::PRIMARY_LANGUAGES] = []
@@ -126,7 +129,7 @@ module Dependabot
126
129
 
127
130
  ##
128
131
  CONTEXT_RULES[PackageManagers::GO_MODULES][ContextRule::FETCH_FILES] = [
129
- # https://github.com/dependabot/dependabot-core/blob/v0.212.0/go_modules/lib/dependabot/go_modules/file_fetcher.rb#L13-L15
132
+ # https://github.com/dependabot/dependabot-core/blob/v0.303.0/go_modules/lib/dependabot/go_modules/file_fetcher.rb#L14-L22
130
133
  "Go Checksums", # go.sum
131
134
  "Go Module" # go.mod
132
135
  ]
@@ -134,7 +137,7 @@ module Dependabot
134
137
  CONTEXT_RULES[PackageManagers::GO_MODULES][ContextRule::RELEVANT_LANGUAGES] = []
135
138
 
136
139
  CONTEXT_RULES[PackageManagers::GRADLE][ContextRule::FETCH_FILES] = [
137
- # https://github.com/dependabot/dependabot-core/blob/v0.212.0/gradle/lib/dependabot/gradle/file_fetcher.rb#L23-L25
140
+ # https://github.com/dependabot/dependabot-core/blob/v0.303.0/gradle/lib/dependabot/gradle/file_fetcher.rb#L44-L54
138
141
  "Gradle", # for any `.gradle` file
139
142
  "Kotlin" # for any `.kts` file"
140
143
  ]
@@ -144,7 +147,7 @@ module Dependabot
144
147
  ]
145
148
 
146
149
  CONTEXT_RULES[PackageManagers::MAVEN][ContextRule::FETCH_FILES] = [
147
- # https://github.com/dependabot/dependabot-core/blob/v0.212.0/maven/lib/dependabot/maven/file_fetcher.rb#L17-L19
150
+ # https://github.com/dependabot/dependabot-core/blob/v0.303.0/maven/lib/dependabot/maven/file_fetcher.rb#L19-L27
148
151
  "Maven POM" # for `pom.xml` files
149
152
  ]
150
153
  CONTEXT_RULES[PackageManagers::MAVEN][ContextRule::PRIMARY_LANGUAGES] = []
@@ -154,7 +157,7 @@ module Dependabot
154
157
 
155
158
  ##
156
159
  CONTEXT_RULES[PackageManagers::NPM][ContextRule::FETCH_FILES] = [
157
- # https://github.com/dependabot/dependabot-core/blob/v0.212.0/npm_and_yarn/lib/dependabot/npm_and_yarn/file_fetcher.rb#L36-L51
160
+ # https://github.com/dependabot/dependabot-core/blob/v0.303.0/npm_and_yarn/lib/dependabot/npm_and_yarn/file_fetcher.rb#L35-L43
158
161
  "JSON", # "package.json" or "package-lock.json" or "npm-shrinkwrap.json" but only by extension
159
162
  "NPM Config" # ".npmrc"
160
163
  ]
@@ -163,7 +166,7 @@ module Dependabot
163
166
 
164
167
  ##
165
168
  CONTEXT_RULES[PackageManagers::NUGET][ContextRule::FETCH_FILES] = [
166
- # https://github.com/dependabot/dependabot-core/blob/v0.212.0/nuget/lib/dependabot/nuget/file_fetcher.rb#L20-L22
169
+ # https://github.com/dependabot/dependabot-core/blob/v0.303.0/nuget/lib/dependabot/nuget/file_fetcher.rb#L17-L25
167
170
  "XML" # .csproj, .vbproj and .fsproj
168
171
  # Nothing looks for a packages.config
169
172
  ]
@@ -172,8 +175,9 @@ module Dependabot
172
175
 
173
176
  ##
174
177
  CONTEXT_RULES[PackageManagers::PIP][ContextRule::FETCH_FILES] = [
175
- # https://github.com/dependabot/dependabot-core/blob/v0.212.0/python/lib/dependabot/python/file_fetcher.rb#L35-L38
178
+ # https://github.com/dependabot/dependabot-core/blob/v0.303.0/python/lib/dependabot/python/file_fetcher.rb#L26-L46
176
179
  # Besides the other pip related package managers, there is no language for `requirements` files. RIP.
180
+ "Pip Requirements", # Added in https://github.com/github-linguist/linguist/pull/6739 to specifically match what this pkg mngr is about
177
181
  "Text" # for `.txt`
178
182
  ]
179
183
  CONTEXT_RULES[PackageManagers::PIP][ContextRule::PRIMARY_LANGUAGES] = ["Python"]
@@ -181,7 +185,7 @@ module Dependabot
181
185
 
182
186
  ##
183
187
  CONTEXT_RULES[PackageManagers::PIPENV][ContextRule::FETCH_FILES] = [
184
- # https://github.com/dependabot/dependabot-core/blob/v0.212.0/python/lib/dependabot/python/file_fetcher.rb#L35-L38
188
+ # https://github.com/dependabot/dependabot-core/blob/v0.303.0/python/lib/dependabot/python/file_fetcher.rb#L26-L46
185
189
  "JSON", # Pipfile.lock
186
190
  "TOML" # Pipfile
187
191
  ]
@@ -190,7 +194,7 @@ module Dependabot
190
194
 
191
195
  ##
192
196
  CONTEXT_RULES[PackageManagers::PIP_COMPILE][ContextRule::FETCH_FILES] = [
193
- # https://github.com/dependabot/dependabot-core/blob/v0.212.0/python/lib/dependabot/python/file_fetcher.rb#L35-L38
197
+ # https://github.com/dependabot/dependabot-core/blob/v0.303.0/python/lib/dependabot/python/file_fetcher.rb#L26-L46
194
198
  # Already captured by the other pip related package manager paths
195
199
  ]
196
200
  CONTEXT_RULES[PackageManagers::PIP_COMPILE][ContextRule::PRIMARY_LANGUAGES] = ["Python"]
@@ -198,7 +202,7 @@ module Dependabot
198
202
 
199
203
  ##
200
204
  CONTEXT_RULES[PackageManagers::POETRY][ContextRule::FETCH_FILES] = [
201
- # https://github.com/dependabot/dependabot-core/blob/v0.212.0/python/lib/dependabot/python/file_fetcher.rb#L35-L38
205
+ # https://github.com/dependabot/dependabot-core/blob/v0.303.0/python/lib/dependabot/python/file_fetcher.rb#L26-L46
202
206
  # pyproject.lock has none and setup.py is vague.
203
207
  "TOML" # poetry.lock and pyproject.toml by extension
204
208
  ]
@@ -207,7 +211,7 @@ module Dependabot
207
211
 
208
212
  ##
209
213
  CONTEXT_RULES[PackageManagers::PUB][ContextRule::FETCH_FILES] = [
210
- # https://github.com/dependabot/dependabot-core/blob/v0.212.0/pub/lib/dependabot/pub/file_fetcher.rb#L15-L17
214
+ # https://github.com/dependabot/dependabot-core/blob/v0.303.0/pub/lib/dependabot/pub/file_fetcher.rb#L16-L24
211
215
  "YAML" # pubspec.yaml, but only by extension.
212
216
  ]
213
217
  CONTEXT_RULES[PackageManagers::PUB][ContextRule::PRIMARY_LANGUAGES] = ["Dart"]
@@ -215,7 +219,7 @@ module Dependabot
215
219
 
216
220
  ##
217
221
  CONTEXT_RULES[PackageManagers::TERRAFORM][ContextRule::FETCH_FILES] = [
218
- # https://github.com/dependabot/dependabot-core/blob/v0.212.0/terraform/lib/dependabot/terraform/file_fetcher.rb#L19-L21
222
+ # https://github.com/dependabot/dependabot-core/blob/v0.303.0/terraform/lib/dependabot/terraform/file_fetcher.rb#L21-L29
219
223
  "HCL" # .tf and .hcl
220
224
  ]
221
225
  CONTEXT_RULES[PackageManagers::TERRAFORM][ContextRule::PRIMARY_LANGUAGES] = []
@@ -223,7 +227,7 @@ module Dependabot
223
227
 
224
228
  ##
225
229
  CONTEXT_RULES[PackageManagers::YARN][ContextRule::FETCH_FILES] = [
226
- # https://github.com/dependabot/dependabot-core/blob/v0.212.0/npm_and_yarn/lib/dependabot/npm_and_yarn/file_fetcher.rb#L36-L51
230
+ # https://github.com/dependabot/dependabot-core/blob/v0.303.0/npm_and_yarn/lib/dependabot/npm_and_yarn/file_fetcher.rb#L35-L43
227
231
  "YAML" # yarn.lock
228
232
  ]
229
233
  CONTEXT_RULES[PackageManagers::YARN][ContextRule::PRIMARY_LANGUAGES] = ["JavaScript", "TypeScript"]
data/lib/dependabot/linguist/languages_to_ecosystems/contexts_applied.rb CHANGED
@@ -21,7 +21,7 @@ module Dependabot
21
21
  LANGUAGE_TO_PACKAGE_MANAGER = languages.to_h { |name, _| [name, nil] }.tap do |this|
22
22
  # Now apply the context rules to "this"
23
23
  CONTEXT_RULES.each do |package_manager, context_map|
24
- context_map.each do |_context_rule, linguist_languages|
24
+ context_map.each_value do |linguist_languages|
25
25
  linguist_languages.each do |linguist_language|
26
26
  if this[linguist_language].nil?
27
27
  this[linguist_language] = [package_manager]