dependabot-nuget 0.289.0 → 0.291.0

data/lib/dependabot/nuget/file_parser.rb

@@ -4,9 +4,11 @@
 require "dependabot/dependency"
 require "dependabot/file_parsers"
 require "dependabot/file_parsers/base"
-require "dependabot/nuget/native_discovery/native_discovery_json_reader"
+require "dependabot/nuget/discovery/discovery_json_reader"
 require "dependabot/nuget/native_helpers"
 require "sorbet-runtime"
+require "dependabot/nuget/package_manager"
+require "dependabot/nuget/language"
 
 # For details on how dotnet handles version constraints, see:
 # https://docs.microsoft.com/en-us/nuget/reference/package-versioning
@@ -22,14 +24,42 @@ module Dependabot
         dependencies
       end
 
+      sig { returns(Ecosystem) }
+      def ecosystem
+        @ecosystem ||= T.let(
+          Ecosystem.new(
+            name: ECOSYSTEM,
+            package_manager: package_manager,
+            language: language
+          ),
+          T.nilable(Ecosystem)
+        )
+      end
+
       private
 
+      sig { returns(T.nilable(T::Array[String])) }
+      def content_json
+        @content_json ||= T.let(begin
+          directory = source&.directory || "/"
+          discovery_json_reader = DiscoveryJsonReader.run_discovery_in_directory(
+            repo_contents_path: T.must(repo_contents_path),
+            directory: directory,
+            credentials: credentials
+          )
+
+          discovery_json_reader.workspace_discovery&.projects&.map do |framework|
+            T.let(framework.instance_variable_get(:@target_frameworks), T::Array[String]).compact.join(",")
+          end
+        end, T.nilable(T::Array[String]))
+      end
+
       sig { returns(T::Array[Dependabot::Dependency]) }
       def dependencies
         @dependencies ||= T.let(begin
-          NativeDiscoveryJsonReader.debug_report_discovery_files(error_if_missing: true)
+          NativeHelpers.install_dotnet_sdks
           directory = source&.directory || "/"
-          discovery_json_reader = NativeDiscoveryJsonReader.run_discovery_in_directory(
+          discovery_json_reader = DiscoveryJsonReader.run_discovery_in_directory(
             repo_contents_path: T.must(repo_contents_path),
             directory: directory,
             credentials: credentials
@@ -54,6 +84,65 @@ module Dependabot
           "No project file."
         )
       end
+
+      sig { returns(T.nilable(Ecosystem::VersionManager)) }
+      def language
+        # Historically new version of language is released with incremental update of
+        # .Net version, so we tie the language with framework version for metric collection
+
+        nomenclature = "#{language_type} #{framework_version&.join(',')}".strip.tr(" ", "-")
+
+        Dependabot.logger.info("Detected language and framework #{nomenclature}")
+
+        case language_type
+
+        when CSharpLanguage::TYPE
+          CSharpLanguage.new(nomenclature)
+
+        when VBLanguage::TYPE
+          VBLanguage.new(nomenclature)
+
+        when FSharpLanguage::TYPE
+          FSharpLanguage.new(nomenclature)
+
+        when DotNet::TYPE
+          DotNet.new(nomenclature)
+
+        end
+      end
+
+      sig { returns(T.nilable(T::Array[String])) }
+      def framework_version
+        content_json
+      rescue StandardError
+        nil
+      end
+
+      sig { returns(T.nilable(String)) }
+      def language_type
+        requirement_files = dependencies.flat_map do |dep|
+          dep.requirements.map { |r| T.let(r.fetch(:file), String) }
+        end.uniq
+
+        return "cs" if requirement_files.any? { |f| File.basename(f).match?(/\.csproj$/) }
+        return "vb" if requirement_files.any? { |f| File.basename(f).match?(/\.vbproj$/) }
+        return "fs" if requirement_files.any? { |f| File.basename(f).match?(/\.fsproj$/) }
+
+        # return a fallback to avoid falling to exception
+        "dotnet"
+      end
+
+      sig { returns(Ecosystem::VersionManager) }
+      def package_manager
+        NugetPackageManager.new(T.must(nuget_version))
+      end
+
+      sig { returns(T.nilable(String)) }
+      def nuget_version
+        SharedHelpers.run_shell_command("dotnet nuget --version").split("Command Line").last&.strip
+      rescue StandardError
+        nil
+      end
     end
   end
 end

data/lib/dependabot/nuget/file_updater.rb

@@ -4,9 +4,9 @@
 require "dependabot/dependency_file"
 require "dependabot/file_updaters"
 require "dependabot/file_updaters/base"
-require "dependabot/nuget/native_discovery/native_dependency_details"
-require "dependabot/nuget/native_discovery/native_discovery_json_reader"
-require "dependabot/nuget/native_discovery/native_workspace_discovery"
+require "dependabot/nuget/discovery/dependency_details"
+require "dependabot/nuget/discovery/discovery_json_reader"
+require "dependabot/nuget/discovery/workspace_discovery"
 require "dependabot/nuget/native_helpers"
 require "dependabot/shared_helpers"
 require "sorbet-runtime"
@@ -57,7 +57,7 @@ module Dependabot
             try_update_projects(dependency) || try_update_json(dependency)
           end
           updated_files = dependency_files.filter_map do |f|
-            dependency_file_path = NativeDiscoveryJsonReader.dependency_file_path(
+            dependency_file_path = DiscoveryJsonReader.dependency_file_path(
               repo_contents_path: T.must(repo_contents_path),
               dependency_file: f
             )
@@ -97,7 +97,7 @@ module Dependabot
         # run update for each project file
         project_files.each do |project_file|
           project_dependencies = project_dependencies(project_file)
-          dependency_file_path = NativeDiscoveryJsonReader.dependency_file_path(
+          dependency_file_path = DiscoveryJsonReader.dependency_file_path(
             repo_contents_path: T.must(repo_contents_path),
             dependency_file: project_file
           )
@@ -128,7 +128,7 @@ module Dependabot
 
           # We just need to feed the updater a project file, grab the first
           project_file = T.must(project_files.first)
-          dependency_file_path = NativeDiscoveryJsonReader.dependency_file_path(
+          dependency_file_path = DiscoveryJsonReader.dependency_file_path(
             repo_contents_path: T.must(repo_contents_path),
             dependency_file: project_file
           )
@@ -168,13 +168,13 @@ module Dependabot
         @update_tooling_calls
       end
 
-      sig { returns(T.nilable(NativeWorkspaceDiscovery)) }
+      sig { returns(T.nilable(WorkspaceDiscovery)) }
       def workspace
         dependency_file_paths = dependency_files.map do |f|
-          NativeDiscoveryJsonReader.dependency_file_path(repo_contents_path: T.must(repo_contents_path),
-                                                         dependency_file: f)
+          DiscoveryJsonReader.dependency_file_path(repo_contents_path: T.must(repo_contents_path),
+                                                   dependency_file: f)
         end
-        NativeDiscoveryJsonReader.load_discovery_for_dependency_file_paths(dependency_file_paths).workspace_discovery
+        DiscoveryJsonReader.load_discovery_for_dependency_file_paths(dependency_file_paths).workspace_discovery
       end
 
       sig { params(project_file: Dependabot::DependencyFile).returns(T::Array[String]) }
@@ -182,7 +182,7 @@ module Dependabot
         workspace&.projects&.find { |p| p.file_path == project_file.name }&.referenced_project_paths || []
       end
 
-      sig { params(project_file: Dependabot::DependencyFile).returns(T::Array[NativeDependencyDetails]) }
+      sig { params(project_file: Dependabot::DependencyFile).returns(T::Array[DependencyDetails]) }
       def project_dependencies(project_file)
         workspace&.projects&.find do |p|
           full_project_file_path = File.join(project_file.directory, project_file.name)
@@ -190,12 +190,12 @@ module Dependabot
         end&.dependencies || []
       end
 
-      sig { returns(T::Array[NativeDependencyDetails]) }
+      sig { returns(T::Array[DependencyDetails]) }
       def global_json_dependencies
         workspace&.global_json&.dependencies || []
       end
 
-      sig { returns(T::Array[NativeDependencyDetails]) }
+      sig { returns(T::Array[DependencyDetails]) }
       def dotnet_tools_json_dependencies
         workspace&.dotnet_tools_json&.dependencies || []
       end

data/lib/dependabot/nuget/language.rb

@@ -0,0 +1,82 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+require "dependabot/nuget/version"
+require "dependabot/ecosystem"
+
+module Dependabot
+  module Nuget
+    class Language < Dependabot::Ecosystem::VersionManager
+      extend T::Sig
+
+      sig { params(language: String, raw_version: String, requirement: T.nilable(Requirement)).void }
+      def initialize(language, raw_version, requirement = nil)
+        super(language, Version.new(raw_version), [], [], requirement)
+      end
+    end
+
+    class CSharpLanguage < Dependabot::Ecosystem::VersionManager
+      extend T::Sig
+
+      LANGUAGE = "CSharp"
+      TYPE = "cs"
+
+      SUPPORTED_VERSIONS = T.let([].freeze, T::Array[Dependabot::Version])
+
+      DEPRECATED_VERSIONS = T.let([].freeze, T::Array[Dependabot::Version])
+
+      sig { params(language: String, requirement: T.nilable(Requirement)).void }
+      def initialize(language, requirement = nil)
+        super(language, Version.new(nil), [], [], requirement)
+      end
+    end
+
+    class VBLanguage < Dependabot::Ecosystem::VersionManager
+      extend T::Sig
+
+      LANGUAGE = "VB"
+      TYPE = "vb"
+
+      SUPPORTED_VERSIONS = T.let([].freeze, T::Array[Dependabot::Version])
+
+      DEPRECATED_VERSIONS = T.let([].freeze, T::Array[Dependabot::Version])
+
+      sig { params(language: String, requirement: T.nilable(Requirement)).void }
+      def initialize(language, requirement = nil)
+        super(language, Version.new(nil), [], [], requirement)
+      end
+    end
+
+    class FSharpLanguage < Dependabot::Ecosystem::VersionManager
+      extend T::Sig
+
+      LANGUAGE = "FSharp"
+      TYPE = "fs"
+
+      SUPPORTED_VERSIONS = T.let([].freeze, T::Array[Dependabot::Version])
+
+      DEPRECATED_VERSIONS = T.let([].freeze, T::Array[Dependabot::Version])
+
+      sig { params(language: String, requirement: T.nilable(Requirement)).void }
+      def initialize(language, requirement = nil)
+        super(language, Version.new(nil), [], [], requirement)
+      end
+    end
+
+    class DotNet < Dependabot::Ecosystem::VersionManager
+      extend T::Sig
+
+      TYPE = "dotnet"
+
+      SUPPORTED_VERSIONS = T.let([].freeze, T::Array[Dependabot::Version])
+
+      DEPRECATED_VERSIONS = T.let([].freeze, T::Array[Dependabot::Version])
+
+      sig { params(language: String, requirement: T.nilable(Requirement)).void }
+      def initialize(language, requirement = nil)
+        super(language, Version.new(nil), [], [], requirement)
+      end
+    end
+  end
+end

data/lib/dependabot/nuget/native_helpers.rb

@@ -81,6 +81,8 @@ module Dependabot
         fingerprint = [
           exe_path,
           "discover",
+          "--job-path",
+          "<job-path>",
           "--repo-root",
           "<repo-root>",
           "--workspace",
@@ -116,15 +118,17 @@ module Dependabot
       end
 
       sig do
-        params(repo_root: String, discovery_file_path: String, dependency_file_path: String,
+        params(job_path: String, repo_root: String, discovery_file_path: String, dependency_file_path: String,
                analysis_folder_path: String).returns([String, String])
       end
-      def self.get_nuget_analyze_tool_command(repo_root:, discovery_file_path:, dependency_file_path:,
+      def self.get_nuget_analyze_tool_command(job_path:, repo_root:, discovery_file_path:, dependency_file_path:,
                                               analysis_folder_path:)
         exe_path = File.join(native_helpers_root, "NuGetUpdater", "NuGetUpdater.Cli")
         command_parts = [
           exe_path,
           "analyze",
+          "--job-path",
+          job_path,
           "--repo-root",
           repo_root,
           "--discovery-file-path",
@@ -140,6 +144,8 @@ module Dependabot
         fingerprint = [
           exe_path,
           "analyze",
+          "--job-path",
+          "<job-path>",
           "--discovery-file-path",
           "<discovery-file-path>",
           "--dependency-file-path",
@@ -153,13 +159,14 @@ module Dependabot
 
       sig do
         params(
-          repo_root: String, discovery_file_path: String, dependency_file_path: String,
+          job_path: String, repo_root: String, discovery_file_path: String, dependency_file_path: String,
           analysis_folder_path: String, credentials: T::Array[Dependabot::Credential]
         ).void
       end
-      def self.run_nuget_analyze_tool(repo_root:, discovery_file_path:, dependency_file_path:,
+      def self.run_nuget_analyze_tool(job_path:, repo_root:, discovery_file_path:, dependency_file_path:,
                                       analysis_folder_path:, credentials:)
-        (command, fingerprint) = get_nuget_analyze_tool_command(repo_root: repo_root,
+        (command, fingerprint) = get_nuget_analyze_tool_command(job_path: job_path,
+                                                                repo_root: repo_root,
                                                                 discovery_file_path: discovery_file_path,
                                                                 dependency_file_path: dependency_file_path,
                                                                 analysis_folder_path: analysis_folder_path)
@@ -205,6 +212,8 @@ module Dependabot
         fingerprint = [
           exe_path,
           "update",
+          "--job-path",
+          "<job-path>",
           "--repo-root",
           "<repo-root>",
           "--solution-or-project",
@@ -260,6 +269,27 @@ module Dependabot
         end
       end
 
+      sig { void }
+      def self.install_dotnet_sdks
+        return unless Dependabot::Experiments.enabled?(:nuget_install_dotnet_sdks)
+
+        # environment variables are required and the following will generate an actionable error message if they're not
+        _dependabot_job_path = ENV.fetch("DEPENDABOT_JOB_PATH")
+        _dependabot_repo_contents_path = ENV.fetch("DEPENDABOT_REPO_CONTENTS_PATH")
+        _dotnet_install_script_path = ENV.fetch("DOTNET_INSTALL_SCRIPT_PATH")
+        _dotnet_install_dir = ENV.fetch("DOTNET_INSTALL_DIR")
+
+        # this environment variable is directly used
+        dependabot_home = ENV.fetch("DEPENDABOT_HOME")
+
+        command = [
+          "pwsh",
+          "#{dependabot_home}/dependabot-updater/bin/install-sdks.ps1"
+        ].join(" ")
+        output = SharedHelpers.run_shell_command(command)
+        puts output
+      end
+
       sig { params(json: T::Hash[String, T.untyped]).void }
       def self.ensure_no_errors(json)
         error_type = T.let(json.fetch("ErrorType", nil), T.nilable(String))
@@ -267,6 +297,8 @@ module Dependabot
         case error_type
         when "None", nil
           # no issue
+        when "DependencyFileNotParseable"
+          raise DependencyFileNotParseable, T.must(T.let(error_details, T.nilable(String)))
         when "AuthenticationFailure"
           raise PrivateSourceAuthenticationFailure, T.let(error_details, T.nilable(String))
         when "MissingFile"

data/lib/dependabot/nuget/package_manager.rb

@@ -0,0 +1,51 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+require "dependabot/nuget/version"
+require "dependabot/ecosystem"
+require "dependabot/nuget/requirement"
+
+module Dependabot
+  module Nuget
+    ECOSYSTEM = "dotnet"
+
+    SUPPORTED_VERSIONS = T.let([].freeze, T::Array[Dependabot::Version])
+
+    DEPRECATED_VERSIONS = T.let([].freeze, T::Array[Dependabot::Version])
+
+    class NugetPackageManager < Dependabot::Ecosystem::VersionManager
+      extend T::Sig
+
+      NAME = "nuget"
+
+      SUPPORTED_VERSIONS = T.let([].freeze, T::Array[Dependabot::Version])
+
+      DEPRECATED_VERSIONS = T.let([].freeze, T::Array[Dependabot::Version])
+
+      sig do
+        params(
+          raw_version: T.nilable(String)
+        ).void
+      end
+      def initialize(raw_version)
+        super(
+          NAME,
+          Version.new(raw_version),
+          SUPPORTED_VERSIONS,
+          DEPRECATED_VERSIONS
+       )
+      end
+
+      sig { override.returns(T::Boolean) }
+      def deprecated?
+        false
+      end
+
+      sig { override.returns(T::Boolean) }
+      def unsupported?
+        false
+      end
+    end
+  end
+end

data/lib/dependabot/nuget/update_checker/requirements_updater.rb

@@ -9,6 +9,7 @@
 require "sorbet-runtime"
 
 require "dependabot/update_checkers/base"
+require "dependabot/nuget/discovery/dependency_details"
 require "dependabot/nuget/version"
 
 module Dependabot
@@ -20,22 +21,18 @@ module Dependabot
         sig do
           params(
             requirements: T::Array[T::Hash[Symbol, T.untyped]],
-            latest_version: T.nilable(T.any(String, Dependabot::Nuget::Version)),
-            source_details: T.nilable(T::Hash[Symbol, T.untyped])
+            dependency_details: T.nilable(Dependabot::Nuget::DependencyDetails)
           )
             .void
         end
-        def initialize(requirements:, latest_version:, source_details:)
+        def initialize(requirements:, dependency_details:)
           @requirements = requirements
-          @source_details = source_details
-          return unless latest_version
-
-          @latest_version = T.let(version_class.new(latest_version), Dependabot::Nuget::Version)
+          @dependency_details = dependency_details
         end
 
         sig { returns(T::Array[T::Hash[Symbol, T.untyped]]) }
         def updated_requirements
-          return requirements unless latest_version
+          return requirements unless clean_version
 
           # NOTE: Order is important here. The FileUpdater needs the updated
           # requirement at index `i` to correspond to the previous requirement
@@ -53,13 +50,21 @@ module Dependabot
                 # version
                 req[:requirement].sub(
                   /#{Nuget::Version::VERSION_PATTERN}/o,
-                  latest_version.to_s
+                  clean_version.to_s
                 )
               end
 
             next req if new_req == req.fetch(:requirement)
 
-            req.merge(requirement: new_req, source: updated_source)
+            new_source = req[:source]&.dup
+            unless @dependency_details.nil?
+              new_source = {
+                type: "nuget_repo",
+                source_url: @dependency_details.info_url
+              }
+            end
+
+            req.merge({ requirement: new_req, source: new_source })
           end
         end
 
@@ -68,17 +73,18 @@ module Dependabot
         sig { returns(T::Array[T::Hash[Symbol, T.untyped]]) }
         attr_reader :requirements
 
-        sig { returns(T.nilable(Dependabot::Nuget::Version)) }
-        attr_reader :latest_version
-
-        sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
-        attr_reader :source_details
-
         sig { returns(T.class_of(Dependabot::Nuget::Version)) }
         def version_class
           Dependabot::Nuget::Version
         end
 
+        sig { returns(T.nilable(Dependabot::Nuget::Version)) }
+        def clean_version
+          return unless @dependency_details&.version
+
+          version_class.new(@dependency_details.version)
+        end
+
         sig { params(req_string: String).returns(String) }
         def update_wildcard_requirement(req_string)
           return req_string if req_string == "*-*"
@@ -88,21 +94,11 @@ module Dependabot
           precision = T.must(req_string.split("*").first).split(/\.|\-/).count
           wildcard_section = req_string.partition(/(?=[.\-]\*)/).last
 
-          version_parts = T.must(latest_version).segments.first(precision)
+          version_parts = T.must(clean_version).segments.first(precision)
           version = version_parts.join(".")
 
           version + wildcard_section
         end
-
-        sig { returns(T::Hash[Symbol, T.untyped]) }
-        def updated_source
-          {
-            type: "nuget_repo",
-            url: source_details&.fetch(:repo_url),
-            nuspec_url: source_details&.fetch(:nuspec_url),
-            source_url: source_details&.fetch(:source_url)
-          }
-        end
       end
     end
   end