dependabot-nuget 0.314.0 → 0.316.0

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Run/ApiModel/JobTests.cs

@@ -0,0 +1,405 @@
+using System.Collections.Immutable;
+
+using NuGet.Versioning;
+
+using NuGetUpdater.Core.Analyze;
+using NuGetUpdater.Core.Run.ApiModel;
+
+using Xunit;
+
+using DepType = NuGetUpdater.Core.Run.ApiModel.DependencyType;
+
+namespace NuGetUpdater.Core.Test.Run.ApiModel;
+
+public class JobTests
+{
+    [Theory]
+    [MemberData(nameof(IsUpdatePermittedTestData))]
+    public void IsUpdatePermitted(Job job, Dependency dependency, bool expectedResult)
+    {
+        var actualResult = job.IsUpdatePermitted(dependency);
+        Assert.Equal(expectedResult, actualResult);
+    }
+
+    public static IEnumerable<object?[]> IsUpdatePermittedTestData()
+    {
+        // with default allowed updates on a transitive dependency
+        yield return
+        [
+            CreateJob(
+                allowedUpdates: [
+                    new AllowedUpdate() { DependencyType = DepType.Direct, UpdateType = UpdateType.All }
+                ],
+                dependencies: [],
+                existingPrs: [],
+                securityAdvisories: [
+                    new Advisory() { DependencyName = "Some.Package", AffectedVersions = [], PatchedVersions = [Requirement.Parse(">= 1.11.0")], UnaffectedVersions = [] }
+                ],
+                securityUpdatesOnly: false,
+                updatingAPullRequest: false),
+            new Dependency("Some.Package", "1.8.0", DependencyType.PackageReference, IsTransitive: true),
+            // expectedResult
+            false,
+        ];
+
+        // when dealing with a security update
+        yield return
+        [
+            CreateJob(
+                allowedUpdates: [
+                    new AllowedUpdate() { DependencyType = DepType.Direct, UpdateType = UpdateType.All }
+                ],
+                dependencies: [],
+                existingPrs: [],
+                securityAdvisories: [
+                    new Advisory() { DependencyName = "Some.Package", AffectedVersions = [], PatchedVersions = [Requirement.Parse(">= 1.11.0")], UnaffectedVersions = [] }
+                ],
+                securityUpdatesOnly: true,
+                updatingAPullRequest: false),
+            new Dependency("Some.Package", "1.8.0", DependencyType.PackageReference, IsTransitive: true),
+            // expectedResult
+            true,
+        ];
+
+        // with a top-level dependency
+        yield return
+        [
+            CreateJob(
+            allowedUpdates: [
+                    new AllowedUpdate() { DependencyType = DepType.Direct, UpdateType = UpdateType.All },
+                    new AllowedUpdate() { DependencyType = DepType.Indirect, UpdateType = UpdateType.Security }
+                ],
+                dependencies: [],
+                existingPrs: [],
+                securityAdvisories: [],
+                securityUpdatesOnly: false,
+                updatingAPullRequest: false),
+            new Dependency("Some.Package", "1.8.0", DependencyType.PackageReference, IsTransitive: false),
+            // expectedResult
+            true,
+        ];
+
+        // with a sub-dependency
+        yield return
+        [
+            CreateJob(
+            allowedUpdates: [
+                    new AllowedUpdate() { DependencyType = DepType.Direct, UpdateType = UpdateType.All },
+                    new AllowedUpdate() { DependencyType = DepType.Indirect, UpdateType = UpdateType.Security }
+                ],
+                dependencies: [],
+                existingPrs: [],
+                securityAdvisories: [],
+                securityUpdatesOnly: false,
+                updatingAPullRequest: false),
+            new Dependency("Some.Package", "1.8.0", DependencyType.PackageReference, IsTransitive: true),
+            // expectedResult
+            false,
+        ];
+
+        // when insecure
+        yield return
+        [
+            CreateJob(
+            allowedUpdates: [
+                    new AllowedUpdate() { DependencyType = DepType.Direct, UpdateType = UpdateType.All },
+                    new AllowedUpdate() { DependencyType = DepType.Indirect, UpdateType = UpdateType.Security }
+                ],
+                dependencies: [],
+                existingPrs: [],
+                securityAdvisories: [
+                    new Advisory() { DependencyName = "Some.Package", AffectedVersions = [], PatchedVersions = [Requirement.Parse(">= 1.11.0")], UnaffectedVersions = [] }
+                ],
+                securityUpdatesOnly: false,
+                updatingAPullRequest: false),
+            new Dependency("Some.Package", "1.8.0", DependencyType.PackageReference, IsTransitive: true),
+            // expectedResult
+            true,
+        ];
+
+        // when only security fixes are allowed
+        yield return
+        [
+            CreateJob(
+            allowedUpdates: [
+                    new AllowedUpdate() { DependencyType = DepType.Direct, UpdateType = UpdateType.All },
+                    new AllowedUpdate() { DependencyType = DepType.Indirect, UpdateType = UpdateType.Security }
+                ],
+                dependencies: [],
+                existingPrs: [],
+                securityAdvisories: [],
+                securityUpdatesOnly: true,
+                updatingAPullRequest: false),
+            new Dependency("Some.Package", "1.8.0", DependencyType.PackageReference, IsTransitive: false),
+            // expectedResult
+            false,
+        ];
+
+        // when dealing with a security fix
+        yield return
+        [
+            CreateJob(
+            allowedUpdates: [
+                    new AllowedUpdate() { DependencyType = DepType.Direct, UpdateType = UpdateType.All },
+                    new AllowedUpdate() { DependencyType = DepType.Indirect, UpdateType = UpdateType.Security }
+                ],
+                dependencies: [],
+                existingPrs: [],
+                securityAdvisories: [
+                    new Advisory() { DependencyName = "Some.Package", AffectedVersions = [], PatchedVersions = [Requirement.Parse(">= 1.11.0")], UnaffectedVersions = [] }
+                ],
+                securityUpdatesOnly: true,
+                updatingAPullRequest: false),
+            new Dependency("Some.Package", "1.8.0", DependencyType.PackageReference, IsTransitive: false),
+            // expectedResult
+            true,
+        ];
+
+        // when dealing with a security fix that doesn't apply
+        yield return
+        [
+            CreateJob(
+            allowedUpdates: [
+                    new AllowedUpdate() { DependencyType = DepType.Direct, UpdateType = UpdateType.All },
+                    new AllowedUpdate() { DependencyType = DepType.Indirect, UpdateType = UpdateType.Security }
+                ],
+                dependencies: [],
+                existingPrs: [],
+                securityAdvisories: [
+                    new Advisory() { DependencyName = "Some.Package", AffectedVersions = [Requirement.Parse("> 1.8.0")], PatchedVersions = [], UnaffectedVersions = [] }
+                ],
+                securityUpdatesOnly: true,
+                updatingAPullRequest: false),
+            new Dependency("Some.Package", "1.8.0", DependencyType.PackageReference, IsTransitive: false),
+            // expectedResult
+            false,
+        ];
+
+        // when dealing with a security fix that doesn't apply to some versions
+        yield return
+        [
+            CreateJob(
+            allowedUpdates: [
+                    new AllowedUpdate() { DependencyType = DepType.Direct, UpdateType = UpdateType.All },
+                    new AllowedUpdate() { DependencyType = DepType.Indirect, UpdateType = UpdateType.Security }
+                ],
+                dependencies: [],
+                existingPrs: [],
+                securityAdvisories: [
+                    new Advisory() { DependencyName = "Some.Package", AffectedVersions = [Requirement.Parse("< 1.8.0"), Requirement.Parse("> 1.8.0")], PatchedVersions = [], UnaffectedVersions = [] }
+                ],
+                securityUpdatesOnly: true,
+                updatingAPullRequest: false),
+            new Dependency("Some.Package", "1.8.1", DependencyType.PackageReference, IsTransitive: false),
+            // expectedResult
+            true,
+        ];
+
+        // when a dependency allow list that includes the dependency
+        yield return
+        [
+            CreateJob(
+                allowedUpdates: [
+                    new AllowedUpdate() { DependencyName = "Some.Package" }
+                ],
+                dependencies: [],
+                existingPrs: [],
+                securityAdvisories: [],
+                securityUpdatesOnly: false,
+                updatingAPullRequest: false),
+            new Dependency("Some.Package", "1.8.0", DependencyType.PackageReference, IsTransitive: false),
+            // expectedResult
+            true,
+        ];
+
+        // with a dependency allow list that uses a wildcard
+        yield return
+        [
+            CreateJob(
+                allowedUpdates: [
+                    new AllowedUpdate() { DependencyName = "Some.*" }
+                ],
+                dependencies: [],
+                existingPrs: [],
+                securityAdvisories: [],
+                securityUpdatesOnly: false,
+                updatingAPullRequest: false),
+            new Dependency("Some.Package", "1.8.0", DependencyType.PackageReference, IsTransitive: false),
+            // expectedResult
+            true,
+        ];
+
+        // when dependency allow list that excludes the dependency
+        yield return
+        [
+            CreateJob(
+                allowedUpdates: [
+                    new AllowedUpdate() { DependencyName = "Unrelated.Package" }
+                ],
+                dependencies: [],
+                existingPrs: [],
+                securityAdvisories: [],
+                securityUpdatesOnly: false,
+                updatingAPullRequest: false),
+            new Dependency("Some.Package", "1.8.0", DependencyType.PackageReference, IsTransitive: false),
+            // expectedResult
+            false,
+        ];
+
+        // when matching with an incomplete dependency name
+        yield return
+        [
+            CreateJob(
+                allowedUpdates: [
+                    new AllowedUpdate() { DependencyName = "Some" }
+                ],
+                dependencies: [],
+                existingPrs: [],
+                securityAdvisories: [],
+                securityUpdatesOnly: false,
+                updatingAPullRequest: false),
+            new Dependency("Some.Package", "1.8.0", DependencyType.PackageReference, IsTransitive: false),
+            // expectedResult
+            false,
+        ];
+
+        // with a dependency allow list that uses a wildcard
+        yield return
+        [
+            CreateJob(
+                allowedUpdates: [
+                    new AllowedUpdate() { DependencyName = "Unrelated.*" }
+                ],
+                dependencies: [],
+                existingPrs: [],
+                securityAdvisories: [],
+                securityUpdatesOnly: false,
+                updatingAPullRequest: false),
+            new Dependency("Some.Package", "1.8.0", DependencyType.PackageReference, IsTransitive: false),
+            // expectedResult
+            false,
+        ];
+
+        // when security fixes are also allowed
+        yield return
+        [
+            CreateJob(
+                allowedUpdates: [
+                    new AllowedUpdate() { DependencyName = "Unrelated.Package" },
+                    new AllowedUpdate() { UpdateType = UpdateType.Security }
+                ],
+                dependencies: [],
+                existingPrs: [],
+                securityAdvisories: [],
+                securityUpdatesOnly: false,
+                updatingAPullRequest: false),
+            new Dependency("Some.Package", "1.8.0", DependencyType.PackageReference, IsTransitive: false),
+            // expectedResult
+            false,
+        ];
+
+        // when dealing with a security fix
+        yield return
+        [
+            CreateJob(
+                allowedUpdates: [
+                    new AllowedUpdate() { DependencyName = "Unrelated.Package"}, new AllowedUpdate(){ UpdateType = UpdateType.Security }
+                ],
+                dependencies: [],
+                existingPrs: [],
+                securityAdvisories: [
+                    new Advisory() { DependencyName = "Some.Package", AffectedVersions = [], PatchedVersions = [Requirement.Parse(">= 1.11.0")], UnaffectedVersions = [] }
+                ],
+                securityUpdatesOnly: false,
+                updatingAPullRequest: false),
+            new Dependency("Some.Package", "1.8.0", DependencyType.PackageReference, IsTransitive: false),
+            // expectedResult
+            true,
+        ];
+
+        // security job, not vulnerable => security update not needed
+        yield return
+        [
+            CreateJob(
+                allowedUpdates: [
+                    new AllowedUpdate() { UpdateType = UpdateType.Security }
+                ],
+                dependencies: [],
+                existingPrs: [],
+                securityAdvisories: [
+                    new Advisory() { DependencyName = "Some.Package", AffectedVersions = [Requirement.Parse("1.0.0")], PatchedVersions = [Requirement.Parse("1.1.0")] }
+                ],
+                securityUpdatesOnly: true,
+                updatingAPullRequest: false),
+            new Dependency("Some.Package", "1.1.0", DependencyType.PackageReference),
+            // expectedResult
+            false,
+        ];
+
+        // security job, not updating existing => pr already exists
+        yield return
+        [
+            CreateJob(
+                allowedUpdates: [
+                    new AllowedUpdate() { UpdateType = UpdateType.Security }
+                ],
+                dependencies: [],
+                existingPrs: [
+                    new PullRequest() { Dependencies = [new PullRequestDependency() { DependencyName = "Some.Package", DependencyVersion = NuGetVersion.Parse("1.2.0") }] }
+                ],
+                securityAdvisories: [
+                    new Advisory() { DependencyName = "Some.Package", AffectedVersions = [Requirement.Parse("1.1.0")] }
+                ],
+                securityUpdatesOnly: true,
+                updatingAPullRequest: false),
+            new Dependency("Some.Package", "1.1.0", DependencyType.PackageReference),
+            // expectedResult
+            false,
+        ];
+
+        // security job, updating existing => do update
+        yield return
+        [
+            CreateJob(
+                allowedUpdates: [
+                    new AllowedUpdate() { UpdateType = UpdateType.All, DependencyType = DepType.Direct }
+                ],
+                dependencies: ["Some.Package"],
+                existingPrs: [
+                    new PullRequest() { Dependencies = [new PullRequestDependency() { DependencyName = "Some.Package", DependencyVersion = NuGetVersion.Parse("1.1.0") }] }
+                ],
+                securityAdvisories: [
+                    new Advisory() { DependencyName = "Some.Package", AffectedVersions = [Requirement.Parse(">= 1.0.0, < 1.1.0")] }
+                ],
+                securityUpdatesOnly: true,
+                updatingAPullRequest: true),
+            new Dependency("Some.Package", "1.0.0", DependencyType.PackageReference),
+            // expectedResult
+            true,
+        ];
+    }
+
+    private static Job CreateJob(
+        ImmutableArray<AllowedUpdate> allowedUpdates,
+        ImmutableArray<string> dependencies,
+        ImmutableArray<PullRequest> existingPrs,
+        ImmutableArray<Advisory> securityAdvisories,
+        bool securityUpdatesOnly,
+        bool updatingAPullRequest)
+    {
+        return new Job()
+        {
+            AllowedUpdates = allowedUpdates,
+            Dependencies = dependencies,
+            ExistingPullRequests = existingPrs,
+            SecurityAdvisories = securityAdvisories,
+            SecurityUpdatesOnly = securityUpdatesOnly,
+            Source = new()
+            {
+                Provider = "nuget",
+                Repo = "test/repo",
+            },
+            UpdatingAPullRequest = updatingAPullRequest,
+        };
+    }
+}

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Run/EndToEndTests.cs

@@ -9,8 +9,10 @@ namespace NuGetUpdater.Core.Test.Run;
 
 public class EndToEndTests
 {
-    [Fact]
-    public async Task UpdatePackageWithDifferentVersionsInDifferentDirectories()
+    [Theory]
+    [InlineData(true)]
+    [InlineData(false)]
+    public async Task UpdatePackageWithDifferentVersionsInDifferentDirectories(bool useLegacyUpdateHandler)
     {
         // this test passes `null` for discovery, analyze, and update workers to fully test the desired behavior
 
@@ -18,8 +20,88 @@ public class EndToEndTests
         //   library1.csproj - top level dependency, already up to date
         //   library2.csproj - top level dependency, needs direct update
         //   library3.csproj - transitive dependency, needs pin
+        var base64DependencyFiles = useLegacyUpdateHandler
+            ? new[]
+            {
+                new DependencyFile()
+                    {
+                        Directory = "/",
+                        Name = "Directory.Build.props",
+                        Content = Convert.ToBase64String(Encoding.UTF8.GetBytes("<Project />")),
+                        ContentEncoding = "base64",
+                    },
+                    new DependencyFile()
+                    {
+                        Directory = "/",
+                        Name = "Directory.Build.targets",
+                        Content = Convert.ToBase64String(Encoding.UTF8.GetBytes("<Project />")),
+                        ContentEncoding = "base64",
+                    },
+                    new DependencyFile()
+                    {
+                        Directory = "/",
+                        Name = "Directory.Packages.props",
+                        Content = Convert.ToBase64String(Encoding.UTF8.GetBytes("""
+                            <Project>
+                              <PropertyGroup>
+                                <ManagePackageVersionsCentrally>false</ManagePackageVersionsCentrally>
+                              </PropertyGroup>
+                            </Project>
+                            """)),
+                        ContentEncoding = "base64",
+                    },
+                    new DependencyFile()
+                    {
+                        Directory = "/library1",
+                        Name = "library1.csproj",
+                        Content = Convert.ToBase64String(Encoding.UTF8.GetBytes("""
+                            <Project Sdk="Microsoft.NET.Sdk">
+                              <PropertyGroup>
+                                <TargetFramework>net8.0</TargetFramework>
+                              </PropertyGroup>
+                              <ItemGroup>
+                                <PackageReference Include="Some.Package" Version="2.0.0" />
+                              </ItemGroup>
+                            </Project>
+                            """)),
+                        ContentEncoding = "base64",
+                    },
+                    new DependencyFile()
+                    {
+                        Directory = "/library2",
+                        Name = "library2.csproj",
+                        Content = Convert.ToBase64String(Encoding.UTF8.GetBytes("""
+                            <Project Sdk="Microsoft.NET.Sdk">
+                              <PropertyGroup>
+                                <TargetFramework>net8.0</TargetFramework>
+                              </PropertyGroup>
+                              <ItemGroup>
+                                <PackageReference Include="Some.Package" Version="1.0.0" />
+                              </ItemGroup>
+                            </Project>
+                            """)),
+                        ContentEncoding = "base64",
+                    },
+                    new DependencyFile()
+                    {
+                        Directory = "/library3",
+                        Name = "library3.csproj",
+                        Content = Convert.ToBase64String(Encoding.UTF8.GetBytes("""
+                            <Project Sdk="Microsoft.NET.Sdk">
+                              <PropertyGroup>
+                                <TargetFramework>net8.0</TargetFramework>
+                              </PropertyGroup>
+                              <ItemGroup>
+                                <PackageReference Include="Package.With.Transitive.Dependency" Version="0.1.0" />
+                              </ItemGroup>
+                            </Project>
+                            """)),
+                        ContentEncoding = "base64",
+                    }
+            }
+            : [];
         await RunWorkerTests.RunAsync(
-            experimentsManager: new ExperimentsManager() { UseDirectDiscovery = true },
+            experimentsManager: new ExperimentsManager() { UseDirectDiscovery = true, UseLegacyUpdateHandler = useLegacyUpdateHandler },
             packages: [
                 MockNuGetPackage.CreateSimplePackage("Some.Package", "1.0.0", "net8.0"),
                 MockNuGetPackage.CreateSimplePackage("Some.Package", "2.0.0", "net8.0"),
@@ -28,6 +110,9 @@ public class EndToEndTests
             job: new Job()
             {
                 AllowedUpdates = [new() { UpdateType = UpdateType.Security }],
+                Dependencies = [
+                    "Some.Package"
+                ],
                 SecurityAdvisories =
                 [
                     new()
@@ -36,6 +121,7 @@ public class EndToEndTests
                         AffectedVersions = [Requirement.Parse("= 1.0.0")]
                     }
                 ],
+                SecurityUpdatesOnly = true,
                 Source = new()
                 {
                     Provider = "github",
@@ -98,84 +184,7 @@ public class EndToEndTests
             updaterWorker: null,
             expectedResult: new RunResult()
             {
-                Base64DependencyFiles =
-                [
-                    new DependencyFile()
-                    {
-                        Directory = "/",
-                        Name = "Directory.Build.props",
-                        Content = Convert.ToBase64String(Encoding.UTF8.GetBytes("<Project />")),
-                        ContentEncoding = "base64",
-                    },
-                    new DependencyFile()
-                    {
-                        Directory = "/",
-                        Name = "Directory.Build.targets",
-                        Content = Convert.ToBase64String(Encoding.UTF8.GetBytes("<Project />")),
-                        ContentEncoding = "base64",
-                    },
-                    new DependencyFile()
-                    {
-                        Directory = "/",
-                        Name = "Directory.Packages.props",
-                        Content = Convert.ToBase64String(Encoding.UTF8.GetBytes("""
-                            <Project>
-                              <PropertyGroup>
-                                <ManagePackageVersionsCentrally>false</ManagePackageVersionsCentrally>
-                              </PropertyGroup>
-                            </Project>
-                            """)),
-                        ContentEncoding = "base64",
-                    },
-                    new DependencyFile()
-                    {
-                        Directory = "/library1",
-                        Name = "library1.csproj",
-                        Content = Convert.ToBase64String(Encoding.UTF8.GetBytes("""
-                            <Project Sdk="Microsoft.NET.Sdk">
-                              <PropertyGroup>
-                                <TargetFramework>net8.0</TargetFramework>
-                              </PropertyGroup>
-                              <ItemGroup>
-                                <PackageReference Include="Some.Package" Version="2.0.0" />
-                              </ItemGroup>
-                            </Project>
-                            """)),
-                        ContentEncoding = "base64",
-                    },
-                    new DependencyFile()
-                    {
-                        Directory = "/library2",
-                        Name = "library2.csproj",
-                        Content = Convert.ToBase64String(Encoding.UTF8.GetBytes("""
-                            <Project Sdk="Microsoft.NET.Sdk">
-                              <PropertyGroup>
-                                <TargetFramework>net8.0</TargetFramework>
-                              </PropertyGroup>
-                              <ItemGroup>
-                                <PackageReference Include="Some.Package" Version="1.0.0" />
-                              </ItemGroup>
-                            </Project>
-                            """)),
-                        ContentEncoding = "base64",
-                    },
-                    new DependencyFile()
-                    {
-                        Directory = "/library3",
-                        Name = "library3.csproj",
-                        Content = Convert.ToBase64String(Encoding.UTF8.GetBytes("""
-                            <Project Sdk="Microsoft.NET.Sdk">
-                              <PropertyGroup>
-                                <TargetFramework>net8.0</TargetFramework>
-                              </PropertyGroup>
-                              <ItemGroup>
-                                <PackageReference Include="Package.With.Transitive.Dependency" Version="0.1.0" />
-                              </ItemGroup>
-                            </Project>
-                            """)),
-                        ContentEncoding = "base64",
-                    }
-                ],
+                Base64DependencyFiles = base64DependencyFiles,
                 BaseCommitSha = "TEST-COMMIT-SHA",
             },
             expectedApiMessages: [
@@ -346,7 +355,8 @@ public class EndToEndTests
                     BaseCommitSha = "TEST-COMMIT-SHA",
                     CommitMessage = RunWorkerTests.TestPullRequestCommitMessage,
                     PrTitle = RunWorkerTests.TestPullRequestTitle,
-                    PrBody = RunWorkerTests.TestPullRequestBody
+                    PrBody = RunWorkerTests.TestPullRequestBody,
+                    DependencyGroup = null,
                 },
                 new MarkAsProcessed("TEST-COMMIT-SHA")
             ]

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Run/HttpApiHandlerTests.cs

@@ -150,7 +150,12 @@ public class HttpApiHandlerTests
         yield return [new PrivateSourceAuthenticationFailure(["unused"]), "record_update_job_error"];
         yield return [new PrivateSourceBadResponse(["unused"]), "record_update_job_error"];
         yield return [new PullRequestExistsForLatestVersion("unused", "unused"), "record_update_job_error"];
+        yield return [new PullRequestExistsForSecurityUpdate([]), "record_update_job_error"];
+        yield return [new SecurityUpdateDependencyNotFound(), "record_update_job_error"];
+        yield return [new SecurityUpdateIgnored("unused"), "record_update_job_error"];
+        yield return [new SecurityUpdateNotFound("unused", "unused"), "record_update_job_error"];
         yield return [new SecurityUpdateNotNeeded("unused"), "record_update_job_error"];
+        yield return [new SecurityUpdateNotPossible("unused", "unused", "unused", []), "record_update_job_error"];
         yield return [new UnknownError(new Exception("unused"), "unused"), "record_update_job_error", "record_update_job_unknown_error", "increment_metric"];
         yield return [new UpdateNotPossible(["unused"]), "record_update_job_error"];
     }