dependabot-maven 0.393.0 → 0.394.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fff231d12e4c6ebdbdbf645bcc82c18a7b895ecc870ddb6aba549e4296f0ead6
-  data.tar.gz: a0c24d6534e7bd9c48e7256bd6f03176713f75173f523ac75a8f389b022cc7ff
+  metadata.gz: '009515ba93dc3e414380b797fe7b3aa17a388d024e5406e74291c901600f1a0c'
+  data.tar.gz: b511053c1259a770b1f7a2d649cf357bec4abcab55ad3aacb34b96ec40482893
 SHA512:
-  metadata.gz: 96a5bc8b3c845098794cec76a15763afde0d7b1d31caec84daf558d031a560fbd954d068b115dc9c0ba3a43806619d1d104f68b2d07ecd98c161c1d6bf3e99d1
-  data.tar.gz: fa5d05a001407b8dcfc41c530caacb1b547c60a42831ca9bfdb6aa6ec6983c1d63178c5d4429a8450aaedbac1f51ad48c747d3f4c4e498054b2564842fe55f93
+  metadata.gz: 36c134e6d66d0d445df02dca60b7ae8afe60dd585e7475e8c4668656b22bc6ca3b8917251110772709075112142cc7ffd109564573f5231fcb130adba9aaa2cf
+  data.tar.gz: dd730e81dec85d5abb73e201c832087ac4e0f75a5a09284046b87d203a208415f0588e3f9b04c58a588ecf1a55e7c70673551b20a43fd59a3b27bf1a48ea5d7f

data/lib/dependabot/maven/native_helpers.rb

@@ -6,6 +6,7 @@ require "open3"
 require "uri"
 require "sorbet-runtime"
 require "nokogiri"
+require "dependabot/errors"
 require "dependabot/shared_helpers"
 
 module Dependabot
@@ -13,6 +14,25 @@ module Dependabot
     module NativeHelpers
       extend T::Sig
 
+      # Matches Maven's "Could not transfer artifact" failures, capturing the
+      # repository URL and HTTP status so we can classify auth vs. other errors.
+      TRANSFER_FAILURE_REGEX =
+        %r{Could not transfer artifact (?<artifact>[^ ]+) from/to (?<repository_name>[^ ]+) \((?<repository_url>[^ ]+)\): status code: (?<status_code>[0-9]+)} # rubocop:disable Layout/LineLength
+
+      # Matches Maven's "Plugin ... could not be resolved" failures, used to
+      # detect when the wrapper plugin itself is unavailable behind the proxy.
+      WRAPPER_PLUGIN_UNRESOLVED_REGEX =
+        /Plugin org\.apache\.maven\.plugins:maven-wrapper-plugin[^ ]* .*could not be resolved/
+
+      # Upper bound on the length of the Maven error summary included in raised errors,
+      # to avoid oversized error payloads while retaining the relevant failure detail.
+      MAX_ERROR_SUMMARY_LENGTH = 2_000
+
+      # Matches ANSI/VT100 control sequences. Maven can be configured to emit colored
+      # output (e.g. `-Dstyle.color=always`), wrapping markers like `[ERROR]` in escape
+      # codes; we strip these so classification and the surfaced summary see plain text.
+      ANSI_ESCAPE_REGEX = %r{\e\[[0-9;?]*[ -/]*[@-~]}
+
       pom_path = File.join(__dir__, "pom.xml")
 
       version = File.open(pom_path) do |f|
@@ -43,9 +63,8 @@ module Dependabot
 
       sig { params(output: String).void }
       def self.handle_tool_error(output)
-        if (match = output.match(
-          %r{Could not transfer artifact (?<artifact>[^ ]+) from/to (?<repository_name>[^ ]+) \((?<repository_url>[^ ]+)\): status code: (?<status_code>[0-9]+)} # rubocop:disable Layout/LineLength
-        )) && (match[:status_code] == "403" || match[:status_code] == "401")
+        if (match = output.match(TRANSFER_FAILURE_REGEX)) &&
+           (match[:status_code] == "403" || match[:status_code] == "401")
           raise Dependabot::PrivateSourceAuthenticationFailure, match[:repository_url]
         end
 
@@ -91,7 +110,63 @@ module Dependabot
         # to parse. An argument vector is executed without an intermediate shell.
         cmd = ["mvn"] + standard_args
         run_cwd = cwd && cwd != "." ? cwd : nil
-        SharedHelpers.run_shell_command(cmd, env: env, cwd: run_cwd)
+
+        output = SharedHelpers.run_shell_command(cmd, env: env, cwd: run_cwd)
+        Dependabot.logger.info("mvn wrapper output: STDOUT:#{output}")
+        output
+      rescue SharedHelpers::HelperSubprocessFailed => e
+        # `run_shell_command` raises HelperSubprocessFailed on a non-zero exit, and the
+        # updater sanitizes that into an opaque `SubprocessFailed` that only reports the
+        # command and hides the real Maven output. Log the full output and re-raise a
+        # classified Dependabot error so operators get an actionable message, mirroring
+        # the `run_mvn_dependency_tree_plugin` path.
+        Dependabot.logger.warn("mvn wrapper command failed:\n#{e.message}")
+        handle_wrapper_error(e)
+      end
+
+      # Classifies a failed Maven Wrapper invocation into an actionable Dependabot
+      # error. Known auth and plugin-resolution failures are mapped to their specific
+      # error types, and genuine Maven diagnostics are surfaced via MisconfiguredTooling.
+      # `run_shell_command` also reports inactivity timeouts and a missing `mvn`
+      # executable as HelperSubprocessFailed; those carry no Maven `[ERROR]` markers, so
+      # we re-raise the original error and let it follow normal unknown-error routing
+      # instead of mislabelling infrastructure/runtime failures as tooling misconfigurations.
+      sig { params(error: SharedHelpers::HelperSubprocessFailed).returns(T.noreturn) }
+      def self.handle_wrapper_error(error)
+        # Strip ANSI color codes up front so classification and the surfaced summary see
+        # plain text even when Maven is configured to emit colored output.
+        output = error.message.gsub(ANSI_ESCAPE_REGEX, "")
+
+        if (match = output.match(TRANSFER_FAILURE_REGEX)) &&
+           (match[:status_code] == "403" || match[:status_code] == "401")
+          raise Dependabot::PrivateSourceAuthenticationFailure, match[:repository_url]
+        end
+
+        if output.match?(WRAPPER_PLUGIN_UNRESOLVED_REGEX)
+          raise Dependabot::DependencyFileNotResolvable, "Could not resolve the Maven Wrapper plugin."
+        end
+
+        # Only reclassify when Maven emitted its own `[ERROR]` diagnostics. Otherwise the
+        # failure is not a Maven misconfiguration (e.g. timeout or missing executable), so
+        # re-raise the original error; its full output is already in the job log.
+        summary = mvn_error_summary(output)
+        raise error unless summary
+
+        raise Dependabot::MisconfiguredTooling.new("Maven Wrapper", summary)
+      end
+
+      # Extracts Maven's own `[ERROR]` lines from the combined tool output so that raised
+      # errors surface the relevant failure reason without leaking unrelated build noise or
+      # arbitrary subprocess output (which may contain sensitive file contents or paths) into
+      # the reported error. Returns nil when Maven produced no `[ERROR]` diagnostics, and caps
+      # the length to keep error payloads reasonable.
+      sig { params(output: String).returns(T.nilable(String)) }
+      def self.mvn_error_summary(output)
+        error_lines = output.lines.map(&:chomp).select { |line| line.include?("[ERROR]") }
+        return nil if error_lines.empty?
+
+        summary = error_lines.join("\n")
+        summary.length > MAX_ERROR_SUMMARY_LENGTH ? "#{summary[0, MAX_ERROR_SUMMARY_LENGTH]}..." : summary
       end
     end
   end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-maven
 version: !ruby/object:Gem::Version
-  version: 0.393.0
+  version: 0.394.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.393.0
+        version: 0.394.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.393.0
+        version: 0.394.0
 - !ruby/object:Gem::Dependency
   name: rexml
   requirement: !ruby/object:Gem::Requirement
@@ -183,14 +183,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.22'
+        version: '1.1'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.22'
+        version: '1.1'
 - !ruby/object:Gem::Dependency
   name: turbo_tests
   requirement: !ruby/object:Gem::Requirement
@@ -296,7 +296,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.393.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.394.0
 rdoc_options: []
 require_paths:
 - lib