dependabot-nuget 0.182.4 → 0.185.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fd112f60d5684ef24177b5c8142288d71c8244c7c91bc108c538954d17aab8be
-  data.tar.gz: ca17802fb58a0e5b97eb6b49c08f373196ce128104e34aabef20e693b1117489
+  metadata.gz: 371e6d47e0d0c264bbc29fd3763bdf8d292b8d1b7b8e01924b7d1c39e8500841
+  data.tar.gz: 604bedfec7fd7187cbaeca4568a773bf03eb2859077202bffcb316d5e203c75c
 SHA512:
-  metadata.gz: 9794bb694a3a33a524d6d99a7695cc8d3202fb708cf5fca9a37bb4788ed214c0eed16c36c4b6f4ea84eacf057ce9b4ae4111f9d6ddebc181962b45b023206bf7
-  data.tar.gz: 282c8208c99282d83c74e330994d5c478c25e39f963bd50b9aa3998e699b31525450ff177d4bf7cf5a1233d74f942222f0429005a30283a892bfaa8c776b3c98
+  metadata.gz: 534a9efa904bf97bf0fd2615103f3e98ce14c29efb65e2d92b4bf523a35e14b768a059af0cd74727444c1ffb2a7cfbaa58181d13dc2e5561087652e816a0b8ec
+  data.tar.gz: c21499f7e83e3bf9eea738e4373ab752473294a119bd335a67c34655a4329ae014df748b0ef15aa6957fb2715a20d6544cea0e1aa737ccb1dafdbbb0b28b99d6

data/lib/dependabot/nuget/metadata_finder.rb

@@ -12,7 +12,71 @@ module Dependabot
       def look_up_source
         return Source.from_url(dependency_source_url) if dependency_source_url
 
-        look_up_source_in_nuspec(dependency_nuspec_file)
+        src_repo = look_up_source_in_nuspec(dependency_nuspec_file)
+        return src_repo if src_repo
+
+        # Fallback to getting source from the search result's projectUrl or licenseUrl.
+        # GitHub Packages doesn't support getting the `.nuspec`, switch to getting
+        # that instead once it is supported.
+        src_repo_from_project
+      rescue StandardError
+        # At this point in the process the PR is ready to be posted, we tried to gather commit
+        # and release notes, but have encountered an exception. So let's eat it since it's
+        # better to have a PR with no info than error out.
+        nil
+      end
+
+      def src_repo_from_project
+        source = dependency.requirements.find { |r| r&.fetch(:source) }&.fetch(:source)
+        return unless source
+
+        # Query the service index e.g. https://nuget.pkg.github.com/ORG/index.json
+        response = Excon.get(
+          source.fetch(:url),
+          idempotent: true,
+          **SharedHelpers.excon_defaults(headers: { **auth_header, "Accept" => "application/json" })
+        )
+        return unless response.status == 200
+
+        # Extract the query url e.g. https://nuget.pkg.github.com/ORG/query
+        search_base = extract_search_url(response.body)
+        return unless search_base
+
+        response = Excon.get(
+          search_base + "?q=#{dependency.name.downcase}&prerelease=true&semVerLevel=2.0.0",
+          idempotent: true,
+          **SharedHelpers.excon_defaults(headers: { **auth_header, "Accept" => "application/json" })
+        )
+        return unless response.status == 200
+
+        # Find a projectUrl or licenseUrl that look like a source URL
+        extract_source_repo(response.body)
+      rescue JSON::ParserError
+        # Ignored, this is expected for some registries that don't handle these request.
+      end
+
+      def extract_search_url(body)
+        JSON.parse(body).
+          fetch("resources", []).
+          find { |r| r.fetch("@type") == "SearchQueryService" }&.
+          fetch("@id")
+      end
+
+      def extract_source_repo(body)
+        JSON.parse(body).fetch("data", []).each do |search_result|
+          next unless search_result["id"].downcase == dependency.name.downcase
+
+          if search_result.key?("projectUrl")
+            source = Source.from_url(search_result.fetch("projectUrl"))
+            return source if source
+          end
+          if search_result.key?("licenseUrl")
+            source = Source.from_url(search_result.fetch("licenseUrl"))
+            return source if source
+          end
+        end
+        # failed to find a source URL
+        nil
       end
 
       def look_up_source_in_nuspec(nuspec)

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-nuget
 version: !ruby/object:Gem::Version
-  version: 0.182.4
+  version: 0.185.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-04-26 00:00:00.000000000 Z
+date: 2022-05-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,28 +16,42 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.182.4
+        version: 0.185.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.182.4
+        version: 0.185.0
 - !ruby/object:Gem::Dependency
   name: debase
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - '='
       - !ruby/object:Gem::Version
-        version: 0.2.4.1
+        version: 0.2.3
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 0.2.3
+- !ruby/object:Gem::Dependency
+  name: debase-ruby_core_source
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 0.10.14
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
       - !ruby/object:Gem::Version
-        version: 0.2.4.1
+        version: 0.10.14
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -114,14 +128,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.27.0
+        version: 1.28.2
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.27.0
+        version: 1.28.2
 - !ruby/object:Gem::Dependency
   name: ruby-debug-ide
   requirement: !ruby/object:Gem::Requirement
@@ -253,7 +267,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: 2.7.0
 requirements: []
-rubygems_version: 3.2.32
+rubygems_version: 3.3.7
 signing_key: 
 specification_version: 4
 summary: ".NET (NuGet) support for dependabot"