dependabot-npm_and_yarn 0.285.0 → 0.287.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bf3271285f39bf1e7f91fad3995676126cf0b580184e741e1fe10b5d295a5f4e
-  data.tar.gz: 91d70c4bb5a9454ffb50e38fdcb92957649a8211a1a27349b023d9a2a104ac26
+  metadata.gz: a81729237750f9d53bf9197345ac3f563f267d9683ac202ebca543413bd912ef
+  data.tar.gz: 5caefb54429a28a52aeff8b50ba8f80554f67baa70eaf6e5bef7040d52d7ebaa
 SHA512:
-  metadata.gz: c3f3efeb4f22bfaad116b86ec6dcede6dfd378c2e669e9293f521ff9d285b54b7a072ce888c2eb0d44ef64605f144d9deb5f5ce9b723ee44c00366147f065474
-  data.tar.gz: 9426fe3a37b2b6af1c86dc79e7f596406a59329a0bc0429065387d7fe3a6cff987b69865f49c21df3bf90c8e46687dd291fc2a1a12f65fe8621487c7e8e56433
+  metadata.gz: 2d4fca7ae33a0540e6940de6946420c08e06be84daf21b37c9efe7234af43050de4efe74191254ace8b12e7e977c74d66557067e9a9bdc07eaf5964bc1996060
+  data.tar.gz: ab4bd3efd5fe75244c87ec30fb31e1585ce26ac586d42a4b9b8ea84fe86a4015d54dbdc515afe228fb319520fdedc1b1aaa1ab89f71f38bd5cf76683c4c780a9

data/lib/dependabot/npm_and_yarn/helpers.rb

@@ -145,7 +145,7 @@ module Dependabot
         false
       end
 
-      sig { returns(Integer) }
+      sig { returns(T.any(Integer, T.noreturn)) }
       def self.yarn_major_version
         retries = 0
         output = run_single_yarn_command("--version")
@@ -171,6 +171,7 @@ module Dependabot
         handle_subprocess_failure(e)
       end
 
+      sig { params(error: StandardError).returns(T.noreturn) }
       def self.handle_subprocess_failure(error)
         message = error.message
         if YARN_PATH_NOT_FOUND.match?(message)
@@ -224,6 +225,7 @@ module Dependabot
         yarn_major_version >= 4
       end
 
+      sig { returns(T.nilable(String)) }
       def self.setup_yarn_berry
         # Always disable immutable installs so yarn's CI detection doesn't prevent updates.
         run_single_yarn_command("config set enableImmutableInstalls false")
@@ -260,24 +262,92 @@ module Dependabot
       # NOTE: Needs to be explicitly run through corepack to respect the
       # `packageManager` setting in `package.json`, because corepack does not
       # add shims for NPM.
+      sig { params(command: String, fingerprint: T.nilable(String)).returns(String) }
       def self.run_npm_command(command, fingerprint: command)
-        SharedHelpers.run_shell_command("corepack npm #{command}", fingerprint: "corepack npm #{fingerprint}")
+        if Dependabot::Experiments.enabled?(:enable_corepack_for_npm_and_yarn)
+          package_manager_run_command(NpmPackageManager::NAME, command, fingerprint: fingerprint)
+        else
+          SharedHelpers.run_shell_command("corepack npm #{command}", fingerprint: "corepack npm #{fingerprint}")
+        end
       end
 
       # Setup yarn and run a single yarn command returning stdout/stderr
+      sig { params(command: String, fingerprint: T.nilable(String)).returns(String) }
       def self.run_yarn_command(command, fingerprint: nil)
         setup_yarn_berry
         run_single_yarn_command(command, fingerprint: fingerprint)
       end
 
       # Run single pnpm command returning stdout/stderr
+      sig { params(command: String, fingerprint: T.nilable(String)).returns(String) }
       def self.run_pnpm_command(command, fingerprint: nil)
-        SharedHelpers.run_shell_command("pnpm #{command}", fingerprint: "pnpm #{fingerprint || command}")
+        if Dependabot::Experiments.enabled?(:enable_corepack_for_npm_and_yarn)
+          package_manager_run_command(PNPMPackageManager::NAME, command, fingerprint: fingerprint)
+        else
+          SharedHelpers.run_shell_command("pnpm #{command}", fingerprint: "pnpm #{fingerprint || command}")
+        end
       end
 
       # Run single yarn command returning stdout/stderr
+      sig { params(command: String, fingerprint: T.nilable(String)).returns(String) }
       def self.run_single_yarn_command(command, fingerprint: nil)
-        SharedHelpers.run_shell_command("yarn #{command}", fingerprint: "yarn #{fingerprint || command}")
+        if Dependabot::Experiments.enabled?(:enable_corepack_for_npm_and_yarn)
+          package_manager_run_command(YarnPackageManager::NAME, command, fingerprint: fingerprint)
+        else
+          SharedHelpers.run_shell_command("yarn #{command}", fingerprint: "yarn #{fingerprint || command}")
+        end
+      end
+
+      # Install the package manager for specified version by using corepack
+      # and prepare it for use by using corepack
+      sig { params(name: String, version: String).void }
+      def self.install(name, version)
+        Dependabot.logger.info("Installing \"#{name}@#{version}\"")
+
+        package_manager_install(name, version)
+        package_manager_activate(name, version)
+        installed_version = package_manager_version(name)
+
+        Dependabot.logger.info("Installed version of #{name}: #{installed_version}")
+      end
+
+      # Install the package manager for specified version by using corepack
+      sig { params(name: String, version: String).void }
+      def self.package_manager_install(name, version)
+        SharedHelpers.run_shell_command(
+          "corepack install #{name}@#{version} --global --cache-only",
+          fingerprint: "corepack install <name>@<version> --global --cache-only"
+        )
+      end
+
+      # Prepare the package manager for use by using corepack
+      sig { params(name: String, version: String).void }
+      def self.package_manager_activate(name, version)
+        SharedHelpers.run_shell_command(
+          "corepack prepare #{name}@#{version} --activate",
+          fingerprint: "corepack prepare --activate"
+        )
+      end
+
+      # Get the version of the package manager by using corepack
+      sig { params(name: String).returns(String) }
+      def self.package_manager_version(name)
+        package_manager_run_command(name, "-v")
+      end
+
+      # Run single command on package manager returning stdout/stderr
+      sig do
+        params(
+          name: String,
+          command: String,
+          fingerprint: T.nilable(String)
+        ).returns(String)
+      end
+      def self.package_manager_run_command(name, command, fingerprint: nil)
+        SharedHelpers.run_shell_command(
+          "corepack #{name} #{command}",
+          fingerprint: "corepack #{name} #{fingerprint || command}"
+        )
       end
       private_class_method :run_single_yarn_command
 

data/lib/dependabot/npm_and_yarn/package_manager.rb

@@ -172,18 +172,15 @@ module Dependabot
 
       sig { returns(T.nilable(String)) }
       def name_from_lockfiles
-        PACKAGE_MANAGER_CLASSES.each_key do |manager_name| # iterates keys in order as defined in the hash
-          return manager_name.to_s if @lockfiles[manager_name.to_sym]
-        end
-        nil
+        PACKAGE_MANAGER_CLASSES.keys.map(&:to_s).find { |manager_name| @lockfiles[manager_name.to_sym] }
       end
 
       sig { returns(T.nilable(String)) }
       def name_from_package_manager_attr
         return unless @manifest_package_manager
 
-        PACKAGE_MANAGER_CLASSES.each_key do |manager_name| # iterates keys in order as defined in the hash
-          return manager_name.to_s if @manifest_package_manager.start_with?("#{manager_name}@")
+        PACKAGE_MANAGER_CLASSES.keys.map(&:to_s).find do |manager_name|
+          @manifest_package_manager.start_with?("#{manager_name}@")
         end
       end
 
@@ -255,22 +252,30 @@ module Dependabot
           )
         end
 
-        version ||= requested_version(name)
+        if Dependabot::Experiments.enabled?(:enable_corepack_for_npm_and_yarn)
+          version ||= requested_version(name) || guessed_version(name)
 
-        if version
-          raise_if_unsupported!(name, version)
-
-          install(name, version)
+          if version
+            raise_if_unsupported!(name, version.to_s)
+            install(name, version)
+          end
         else
-          version = guessed_version(name)
+          version ||= requested_version(name)
 
           if version
-            raise_if_unsupported!(name, version.to_s)
+            raise_if_unsupported!(name, version)
 
-            install(name, version) if name == PNPMPackageManager::NAME
+            install(name, version)
+          else
+            version = guessed_version(name)
+
+            if version
+              raise_if_unsupported!(name, version.to_s)
+
+              install(name, version) if name == PNPMPackageManager::NAME
+            end
           end
         end
-
         version
       end
       # rubocop:enable Metrics/CyclomaticComplexity
@@ -278,8 +283,10 @@ module Dependabot
 
       private
 
-      sig { params(name: String).returns(Ecosystem::VersionManager) }
+      sig { params(name: T.nilable(String)).returns(Ecosystem::VersionManager) }
       def package_manager_by_name(name)
+        name = DEFAULT_PACKAGE_MANAGER if name.nil? || PACKAGE_MANAGER_CLASSES[name].nil?
+
         package_manager_class = PACKAGE_MANAGER_CLASSES[name]
 
         package_manager_class ||= PACKAGE_MANAGER_CLASSES[DEFAULT_PACKAGE_MANAGER]
@@ -297,6 +304,10 @@ module Dependabot
       end
 
       def install(name, version)
+        if Dependabot::Experiments.enabled?(:enable_corepack_for_npm_and_yarn)
+          return Helpers.install(name, version.to_s)
+        end
+
         Dependabot.logger.info("Installing \"#{name}@#{version}\"")
 
         SharedHelpers.run_shell_command(

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-npm_and_yarn
 version: !ruby/object:Gem::Version
-  version: 0.285.0
+  version: 0.287.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-11-07 00:00:00.000000000 Z
+date: 2024-11-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.285.0
+        version: 0.287.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.285.0
+        version: 0.287.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -346,7 +346,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.285.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.287.0
 post_install_message: 
 rdoc_options: []
 require_paths: