dependabot-opentofu 0.385.0 → 0.387.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3bb80d0b504e093127b1fc9a74f482b8a8b73f99698c968bfd0e8b1c198dd026
-  data.tar.gz: fa2816fbf5b4108eb4bbe9e3acbe13efb6a7dee9aafc385af73ecb404233ed76
+  metadata.gz: 2bc33535e90295dc9a6701b45db149a1d6b91c5771a1c6905a76be6568324c7f
+  data.tar.gz: e9dbb471d8b1f931cc073167deef98a03edc4be1f12aebb71cbcec511fff895c
 SHA512:
-  metadata.gz: bb7b69e38138d4ea57b94df897078e63dbc9bab27ac79d8e6dd5c63528ddc4c1a890afeb18c97688e77d9bd4976304ba13b7cfffd4522c1c2c6b4b489f9a0b28
-  data.tar.gz: 8fa4575d341d81acbd5a242e800590f6b8326d84cb55c58bcf4b8d84a81c74d53c59425f7676ba2dd4a7c29dfbc7640ad99cbf9520a892b1ffbdf23940a76475
+  metadata.gz: 22cef6dcf34daa9849d66cd54fbf87c6fc1c046f58396ce0ec308515776ca5478c9c7b8066f69c10fcee428bebe17cff9d61a41fc9f16c090fa9bc564717619f
+  data.tar.gz: a2290ea710a8bf2fbbb0ed18ff55c7b4c9fc56adaea9a6e7f89485b8b16c7f598e1be4684ca8625b9a34faa58b3c2c58f6ba2199c1203f7b8ab9ec6a547066b0

data/lib/dependabot/opentofu/file_selector.rb

@@ -52,14 +52,14 @@ module Dependabot
 
       sig do
         params(
-          modules: T::Hash[String, T::Array[T::Hash[String, T.untyped]]],
+          modules: T::Hash[String, T::Array[T::Hash[String, Object]]],
           base_modules: T::Hash[String,
                                 T::Array[T::Hash[String,
-                                                 T.untyped]]]
+                                                 Object]]]
         )
           .returns(T::Hash[String,
                            T::Array[T::Hash[String,
-                                            T.untyped]]])
+                                            Object]]])
       end
       def merge_modules(modules, base_modules)
         merged_modules = base_modules.dup

data/lib/dependabot/opentofu/file_updater.rb

@@ -7,11 +7,12 @@ require "dependabot/file_updaters"
 require "dependabot/file_updaters/base"
 require "dependabot/errors"
 require "dependabot/opentofu/file_selector"
+require "dependabot/opentofu/registry_client"
 require "dependabot/shared_helpers"
 
 module Dependabot
   module Opentofu
-    class FileUpdater < Dependabot::FileUpdaters::Base
+    class FileUpdater < Dependabot::FileUpdaters::Base # rubocop:disable Metrics/ClassLength
       extend T::Sig
 
       include FileSelector
@@ -234,17 +235,52 @@ module Dependabot
       end
 
       sig { returns(T.nilable(T::Array[Symbol])) }
-      def lookup_hash_architecture # rubocop:disable Metrics/AbcSize, Metrics/MethodLength, Metrics/PerceivedComplexity
+      def lookup_hash_architecture
         new_req = T.must(dependency.requirements.first)
 
         # NOTE: Only providers are included in the lockfile, modules are not
         return unless new_req[:source][:type] == "provider"
 
+        result = lookup_hash_architecture_from_registry(new_req)
+        return result if result
+
+        lookup_hash_architecture_from_cli(new_req)
+      end
+
+      sig { params(new_req: T::Hash[Symbol, T.untyped]).returns(T.nilable(T::Array[Symbol])) }
+      def lookup_hash_architecture_from_registry(new_req) # rubocop:disable Metrics/PerceivedComplexity
+        content, _provider_source, declaration_regex = lockfile_details(new_req)
+        existing_h1 = extract_provider_h1_hashes(content, declaration_regex)
+        return nil if existing_h1.empty?
+
+        identifier = new_req[:source][:module_identifier]
+        old_version = dependency.previous_version
+        return nil unless old_version
+
+        hostname = new_req[:source][:registry_hostname] || RegistryClient::PUBLIC_HOSTNAME
+        client = RegistryClient.new(hostname: hostname, credentials: credentials)
+        packages = client.all_provider_package_hashes(identifier: identifier, version: old_version)
+        return nil unless packages
+
+        h1_to_platform = {}
+        packages.each do |platform, hashes|
+          hashes.each do |h|
+            h1_to_platform[h] = platform if h.start_with?("h1:")
+          end
+        end
+
+        architectures = existing_h1.filter_map { |h| h1_to_platform[h]&.to_sym }
+        architectures.empty? ? nil : architectures.uniq
+      rescue Dependabot::DependabotError
+        nil
+      end
+
+      sig { params(new_req: T::Hash[Symbol, T.untyped]).returns(T::Array[Symbol]) }
+      def lookup_hash_architecture_from_cli(new_req) # rubocop:disable Metrics/AbcSize, Metrics/MethodLength, Metrics/PerceivedComplexity
         architectures = []
         content, provider_source, declaration_regex = lockfile_details(new_req)
         hashes = extract_provider_h1_hashes(content, declaration_regex)
 
-        # These are ordered in assumed popularity
         possible_architectures = %w(
           linux_amd64
           darwin_amd64
@@ -256,15 +292,10 @@ module Dependabot
         base_dir = T.must(dependency_files.first).directory
         lockfile_hash_removed = remove_provider_h1_hashes(content, declaration_regex)
 
-        # This runs in the same directory as the actual lockfile update so
-        # the platform must be determined before the updated manifest files
-        # are written to disk
         SharedHelpers.in_a_temporary_repo_directory(base_dir, repo_contents_path) do
           possible_architectures.each do |arch|
-            # Exit early if we have detected all of the architectures present
             break if architectures.count == hashes.count
 
-            # OpenTofu will update the lockfile in place so we use a fresh lockfile for each lookup
             File.write(".terraform.lock.hcl", lockfile_hash_removed)
 
             SharedHelpers.run_shell_command(
@@ -276,7 +307,6 @@ module Dependabot
             updated_hashes = extract_provider_h1_hashes(updated_lockfile, declaration_regex)
             next if updated_hashes.nil?
 
-            # Check if the architecture is present in the original lockfile
             hashes.each do |hash|
               updated_hashes.select { |h| h.match?(/^h1:/) }.each do |updated_hash|
                 architectures.append(arch.to_sym) if hash == updated_hash
@@ -292,7 +322,6 @@ module Dependabot
           end
           raise if @retrying_lock || !e.message.include?("tofu init")
 
-          # NOTE: Modules need to be installed before OpenTofu can update the lockfile
           @retrying_lock = true
           run_opentofu_init
           retry
@@ -304,32 +333,117 @@ module Dependabot
       sig { returns(T::Array[Symbol]) }
       def architecture_type
         @architecture_type ||= T.let(
-          if lookup_hash_architecture.nil? || lookup_hash_architecture&.empty?
-            [:linux_amd64]
-          else
-            T.must(lookup_hash_architecture)
+          begin
+            detected = lookup_hash_architecture
+            detected.nil? || detected.empty? ? [:linux_amd64] : detected
           end,
           T.nilable(T::Array[Symbol])
         )
       end
 
       sig { params(updated_manifest_files: T::Array[Dependabot::DependencyFile]).returns(T.nilable(String)) }
-      def update_lockfile_declaration(updated_manifest_files) # rubocop:disable Metrics/AbcSize, Metrics/PerceivedComplexity
+      def update_lockfile_declaration(updated_manifest_files)
         return if lockfile.nil?
 
         new_req = T.must(dependency.requirements.first)
-        # NOTE: Only providers are included in the lockfile, modules are not
         return unless new_req[:source][:type] == "provider"
 
+        result = update_lockfile_from_registry(new_req)
+        return result if result
+
+        update_lockfile_from_cli(new_req, updated_manifest_files)
+      end
+
+      sig { params(new_req: T::Hash[Symbol, T.untyped]).returns(T.nilable(String)) }
+      def update_lockfile_from_registry(new_req) # rubocop:disable Metrics/AbcSize, Metrics/PerceivedComplexity
+        content, provider_source, declaration_regex = lockfile_details(new_req)
+        platforms = architecture_type
+        return nil if platforms.empty?
+
+        identifier = new_req[:source][:module_identifier]
+        new_version = dependency.version
+        return nil unless new_version
+
+        hostname = new_req[:source][:registry_hostname] || RegistryClient::PUBLIC_HOSTNAME
+        client = RegistryClient.new(hostname: hostname, credentials: credentials)
+        packages = client.all_provider_package_hashes(identifier: identifier, version: new_version)
+        return nil unless packages
+
+        platform_strings = platforms.map(&:to_s)
+        return nil unless platform_strings.all? { |p| packages.key?(p) }
+
+        h1_hashes = platform_strings.flat_map { |p| packages.fetch(p).select { |h| h.start_with?("h1:") } }.uniq.sort
+        zh_hashes = packages.values.flat_map { |hs| hs.select { |h| h.start_with?("zh:") } }.uniq.sort
+        all_hashes = h1_hashes + zh_hashes
+        return nil if all_hashes.empty?
+
+        new_declaration = build_lockfile_declaration(
+          provider_source: provider_source,
+          version: new_version,
+          constraints: extract_constraints(content, declaration_regex),
+          hashes: all_hashes
+        )
+
+        replace_lockfile_provider_block(content, declaration_regex, new_declaration)
+      rescue Dependabot::DependabotError
+        nil
+      end
+
+      sig do
+        params(
+          provider_source: String,
+          version: String,
+          constraints: T.nilable(String),
+          hashes: T::Array[String]
+        ).returns(String)
+      end
+      def build_lockfile_declaration(provider_source:, version:, constraints:, hashes:)
+        lines = []
+        lines << "provider \"#{provider_source}\" {"
+        if constraints
+          lines << "  version     = \"#{version}\""
+          lines << "  constraints = \"#{constraints}\""
+        else
+          lines << "  version = \"#{version}\""
+        end
+        lines << "  hashes = ["
+        hashes.each { |h| lines << "    \"#{h}\"," }
+        lines << "  ]"
+        lines << "}"
+        lines.join("\n")
+      end
+
+      sig { params(content: String, declaration_regex: Regexp, new_declaration: String).returns(String) }
+      def replace_lockfile_provider_block(content, declaration_regex, new_declaration)
+        provider_block_regex = /provider\s*["'][^"']+["']\s*\{[^}]*\}/m
+        content.sub(declaration_regex) do |match|
+          match.sub(provider_block_regex, new_declaration)
+        end
+      end
+
+      sig { params(content: String, declaration_regex: Regexp).returns(T.nilable(String)) }
+      def extract_constraints(content, declaration_regex)
+        match = content.match(declaration_regex)
+        return nil unless match
+
+        constraint_match = match.to_s.match(/^\s*constraints\s*=\s*"([^"]*)"/)
+        constraint_match ? constraint_match[1] : nil
+      end
+
+      sig do
+        params(
+          new_req: T::Hash[Symbol, T.untyped],
+          updated_manifest_files: T::Array[Dependabot::DependencyFile]
+        ).returns(T.nilable(String))
+      end
+      def update_lockfile_from_cli(new_req, updated_manifest_files) # rubocop:disable Metrics/AbcSize
         content, provider_source, declaration_regex = lockfile_details(new_req)
         lockfile_dependency_removed = content.sub(declaration_regex, "")
 
         base_dir = T.must(dependency_files.first).directory
         SharedHelpers.in_a_temporary_repo_directory(base_dir, repo_contents_path) do
-          # Determine the provider using the original manifest files
           platforms = architecture_type.map { |arch| "-platform=#{arch}" }.join(" ")
 
-          # Update the provider requirements in case the previous requirement doesn't allow the new version
           updated_manifest_files.each { |f| File.write(f.name, f.content) }
 
           File.write(".terraform.lock.hcl", lockfile_dependency_removed)
@@ -342,8 +456,6 @@ module Dependabot
           updated_lockfile = File.read(".terraform.lock.hcl")
           updated_dependency = T.cast(updated_lockfile.scan(declaration_regex).first, String)
 
-          # OpenTofu will occasionally update h1 hashes without updating the version of the dependency
-          # Here we make sure the dependency's version actually changes in the lockfile
           unless T.cast(updated_dependency.scan(declaration_regex).first, String).scan(/^\s*version\s*=.*/) ==
                  T.cast(content.scan(declaration_regex).first, String).scan(/^\s*version\s*=.*/)
             content.sub!(declaration_regex, updated_dependency)
@@ -358,7 +470,6 @@ module Dependabot
           end
           raise if @retrying_lock || !e.message.include?("tofu init")
 
-          # NOTE: Modules need to be installed before OpenTofu can update the lockfile
           @retrying_lock = T.let(true, T.nilable(T::Boolean))
           run_opentofu_init
           retry

data/lib/dependabot/opentofu/registry_client.rb

@@ -130,6 +130,39 @@ module Dependabot
         raise Dependabot::PrivateSourceBadResponse, host
       end
 
+      # Fetch the package hashes for every platform of a given provider version.
+      # Returns a Hash mapping "<os>_<arch>" strings to arrays of hash strings
+      # (e.g. {"linux_amd64" => ["h1:...", "zh:..."], "darwin_arm64" => [...]}).
+      # Returns nil when the registry does not include the `packages` field
+      # (e.g. the Terraform registry).
+      sig do
+        params(identifier: String, version: String)
+          .returns(T.nilable(T::Hash[String, T::Array[String]]))
+      end
+      def all_provider_package_hashes(identifier:, version:)
+        base_url = service_url_for_registry("providers.v1")
+        response = http_get!(URI.join(base_url, "#{identifier}/#{version}/download/linux/amd64"))
+        body = JSON.parse(response.body)
+
+        packages = body["packages"]
+        return nil unless packages.is_a?(Hash)
+
+        packages.each_with_object({}) do |(platform, info), result|
+          next unless info.is_a?(Hash)
+
+          hashes = Array(info["hashes"])
+          if hashes.empty?
+            Dependabot.logger.debug(
+              "No package hashes for #{identifier} v#{version} on platform #{platform}; " \
+              "registry returned hashes=#{info['hashes'].inspect}"
+            )
+          end
+          result[platform] = hashes
+        end
+      rescue Excon::Error, JSON::ParserError
+        raise error("Could not fetch provider package hashes for #{identifier} v#{version}")
+      end
+
       # Fetch all the versions of a provider, and return a Version
       # representation of them.
       #

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-opentofu
 version: !ruby/object:Gem::Version
-  version: 0.385.0
+  version: 0.387.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.385.0
+        version: 0.387.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.385.0
+        version: 0.387.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -262,7 +262,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.385.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.387.0
 rdoc_options: []
 require_paths:
 - lib