dependabot-nuget 0.180.5 → 0.181.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 61b27d5d875584d04aaa2ca331041d3098476e77b6b0d9e8d7af63202cb4d723
-  data.tar.gz: 7b0663ef7dc545f61e300f48d60a8a2b5716edd01a6a4eba85016ca7b3d8cab3
+  metadata.gz: 00d509aec39eb1ed4536e8338f908e36ffcecc44c8a6dd1ccfa81259b2cb2407
+  data.tar.gz: 29b633cea66136163bbf267dd275419e626ebc53e0031b1d2a2c091afbc912f0
 SHA512:
-  metadata.gz: aaa0aa35b9dc44ba56e4022f7a0ce28bb2e197d28a334937ddd212ed85069b8254cf6fff67252f06adc25cc1dc27ed09f28b7b054b3ee24724571a40d94c2a0c
-  data.tar.gz: 4ee7083532a4f7b3ae074db7a0499e9422cec1334d62f184cbca886e5ebc25483f637b37051d2f673d060067402aee1539245d15a753d731096c0c9f82755274
+  metadata.gz: d286c00d9ed1c703c971db213ad0feec6530508f69f73ca9c7bdd39589ced2eea7d8f0d9ac22ca2a5e5b722382f736b295d4b70d99c83a2a9c3a7db198a5d2cc
+  data.tar.gz: 9e68f5838a99fba274c7576b4b72676d6afc28200defafb265df25324304ca34daa2c1d83c7cfafe1aa70db00eeadabbeb02a18893ead7ab078e4d2948ad8a8c

data/lib/dependabot/nuget/metadata_finder.rb

@@ -12,7 +12,62 @@ module Dependabot
       def look_up_source
         return Source.from_url(dependency_source_url) if dependency_source_url
 
-        look_up_source_in_nuspec(dependency_nuspec_file)
+        src_repo = look_up_source_in_nuspec(dependency_nuspec_file)
+        return src_repo if src_repo
+
+        # Fallback to getting source from the search result's projectUrl or licenseUrl.
+        # GitHub Packages doesn't support getting the `.nuspec`, switch to getting
+        # that instead once it is supported.
+        src_repo_from_project
+      end
+
+      def src_repo_from_project
+        source = dependency.requirements.find { |r| r&.fetch(:source) }&.fetch(:source)
+        return unless source
+
+        # Query the service index e.g. https://nuget.pkg.github.com/ORG/index.json
+        response = Excon.get(
+          source.fetch(:url),
+          idempotent: true,
+          **SharedHelpers.excon_defaults(headers: auth_header)
+        )
+        return unless response.status == 200
+
+        # Extract the query url e.g. https://nuget.pkg.github.com/ORG/query
+        search_base = extract_search_url(response.body)
+        return unless search_base
+
+        response = Excon.get(
+          search_base + "?q=#{dependency.name.downcase}&prerelease=true&semVerLevel=2.0.0",
+          idempotent: true,
+          **SharedHelpers.excon_defaults(headers: auth_header)
+        )
+        return unless response.status == 200
+
+        # Find a projectUrl or licenseUrl that look like a source URL
+        extract_source_repo(response.body)
+      end
+
+      def extract_search_url(body)
+        JSON.parse(body).
+          fetch("resources", []).
+          find { |r| r.fetch("@type") == "SearchQueryService" }&.
+          fetch("@id")
+      end
+
+      def extract_source_repo(body)
+        JSON.parse(body).fetch("data", []).each do |search_result|
+          next unless search_result["id"].downcase == dependency.name.downcase
+
+          if search_result.fetch("projectUrl")
+            source = Source.from_url(search_result.fetch("projectUrl"))
+            return source unless source.repo.nil?
+          end
+          if search_result.fetch("licenseUrl")
+            source = Source.from_url(search_result.fetch("licenseUrl"))
+            return source unless source.repo.nil?
+          end
+        end
       end
 
       def look_up_source_in_nuspec(nuspec)

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-nuget
 version: !ruby/object:Gem::Version
-  version: 0.180.5
+  version: 0.181.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-04-07 00:00:00.000000000 Z
+date: 2022-04-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.180.5
+        version: 0.181.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.180.5
+        version: 0.181.0
+- !ruby/object:Gem::Dependency
+  name: debase
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 0.2.4.1
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 0.2.4.1
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -100,14 +114,28 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.26.0
+        version: 1.27.0
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 1.27.0
+- !ruby/object:Gem::Dependency
+  name: ruby-debug-ide
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 0.7.3
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.26.0
+        version: 0.7.3
 - !ruby/object:Gem::Dependency
   name: simplecov
   requirement: !ruby/object:Gem::Requirement