dependabot-opentofu 0.376.0 → 0.377.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4efddc6a36183aa2038f7d9b69ff1197bba38830508b3ae3e8bc2b52dab9893e
-  data.tar.gz: 685870d16a04ecdfb95897ab982dc57bcae637c93ecf9599d8492c76650ca02a
+  metadata.gz: 05e9a7f8a38fbe253d0b9003fd4edadefe1c63bce2c31aa2fcd0ff957f2b6383
+  data.tar.gz: eecdc5f549182a9c03df69d33e1adfd184397bcf5d0298955a4d9ef9b52edff3
 SHA512:
-  metadata.gz: 077ef5d07711b74029242b33aa691073dfa313e4dcd6282fb9220c9cffc80adcbf8835b5103de63d073e655aefb474894714b9e3c75121edb9c806906ca552e0
-  data.tar.gz: 3c40971c1554441412b9c371d9ee41b49d37d434887a2b5864f4c0d8f05baa3405111b048e0eff5baf035c89727ca4a38de6c5186fc80925d219a9a07d4f6935
+  metadata.gz: f5ba6edfb5b5655cb6b824e4000a9e296f9b88d38526149d74e89c9a8c52bc82455f515bb64b34d046d27a891274ae71f79d30ce29e89b07e50cd950cca223b4
+  data.tar.gz: c525464962777c2ab084a64abdd27d031f1a79e5868dcddb1e0d4aa99226db073d29aacdc76fd94935c00b0beaa00e4c2e058a1955791d3e0351d9a331d10747

data/lib/dependabot/opentofu/file_parser.rb

@@ -29,6 +29,7 @@ module Dependabot
       DEFAULT_NAMESPACE = "hashicorp"
       # https://opentofu.org/docs/language/providers/requirements/#source-addresses
       PROVIDER_SOURCE_ADDRESS = %r{\A((?<hostname>.+)/)?(?<namespace>.+)/(?<name>.+)\z}
+      LOCAL_REFERENCE_REGEX = /\A\$\{local\.(?<var_name>[^}]+)\}\z/
 
       # Namespaces reserved for providers bundled with the OpenTofu/Terraform
       # binary. Providers in these namespaces cannot be updated independently
@@ -68,6 +69,39 @@ module Dependabot
 
       private
 
+      sig { returns(T::Hash[String, T::Hash[Symbol, String]]) }
+      def locals_lookup
+        @locals_lookup ||= T.let(
+          begin
+            lookup = T.let({}, T::Hash[String, T::Hash[Symbol, String]])
+            opentofu_files.each do |file|
+              parsed_file(file).fetch("locals", []).each do |locals_block|
+                locals_block.each do |var_name, value|
+                  next unless value.is_a?(String)
+                  next if value.include?("${")
+
+                  lookup[var_name] = { value: value, file: file.name }
+                end
+              end
+            end
+            lookup
+          end,
+          T.nilable(T::Hash[String, T::Hash[Symbol, String]])
+        )
+      end
+
+      sig { params(version_string: String).returns(T.nilable(T::Hash[Symbol, String])) }
+      def resolve_local_reference(version_string)
+        match = version_string.match(LOCAL_REFERENCE_REGEX)
+        return nil unless match
+
+        var_name = T.must(match[:var_name])
+        local_entry = locals_lookup[var_name]
+        return nil unless local_entry
+
+        { value: T.must(local_entry[:value]), variable: var_name, file: T.must(local_entry[:file]) }
+      end
+
       sig { params(details: T.any(String, T::Hash[String, T.untyped])).returns(T::Boolean) }
       def builtin_provider?(details)
         return false unless details.is_a?(Hash)
@@ -163,6 +197,15 @@ module Dependabot
                    else name
                    end
         version_req = details["version"]&.strip
+
+        req_file = file.name
+        resolved = version_req ? resolve_local_reference(version_req) : nil
+        if resolved
+          version_req = resolved[:value]
+          req_file = T.must(resolved[:file])
+          source[:local_variable] = resolved[:variable]
+        end
+
         version =
           if source[:type] == "git" then version_from_ref(source[:ref])
           elsif source[:type] == "oci" then source[:version]
@@ -176,7 +219,7 @@ module Dependabot
           requirements: [
             { requirement: version_req,
               groups: [],
-              file: file.name,
+              file: req_file,
               source: source }
           ]
         )

data/lib/dependabot/opentofu/file_updater.rb

@@ -91,7 +91,11 @@ module Dependabot
           when "git"
             update_git_declaration(new_req, old_req, content, file.name)
           when "registry", "provider"
-            update_registry_declaration(new_req, old_req, content)
+            if new_req[:source][:local_variable]
+              update_local_variable_declaration(new_req, old_req, content)
+            else
+              update_registry_declaration(new_req, old_req, content)
+            end
           when "oci"
             update_oci_declaration(new_req, old_req, content)
           else
@@ -176,6 +180,31 @@ module Dependabot
         end
       end
 
+      sig do
+        params(
+          new_req: T::Hash[Symbol, T.untyped],
+          old_req: T.nilable(T::Hash[Symbol, T.untyped]),
+          updated_content: String
+        )
+          .void
+      end
+      def update_local_variable_declaration(new_req, old_req, updated_content)
+        var_name = new_req[:source][:local_variable]
+        old_version = old_req&.fetch(:requirement)
+        new_version = new_req[:requirement]
+        return if old_version.nil? || new_version.nil? || old_version == new_version
+
+        local_var_regex = /
+          (?<prefix>\b#{Regexp.escape(var_name)}\s*=\s*["'])
+          #{Regexp.escape(old_version)}
+          (?<suffix>["'])
+        /x
+
+        updated_content.sub!(local_var_regex) do
+          "#{Regexp.last_match(:prefix)}#{new_version}#{Regexp.last_match(:suffix)}"
+        end
+      end
+
       sig { params(content: String, declaration_regex: Regexp).returns(T::Array[String]) }
       def extract_provider_h1_hashes(content, declaration_regex)
         content.match(declaration_regex).to_s

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-opentofu
 version: !ruby/object:Gem::Version
-  version: 0.376.0
+  version: 0.377.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.376.0
+        version: 0.377.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.376.0
+        version: 0.377.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -262,7 +262,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.376.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.377.0
 rdoc_options: []
 require_paths:
 - lib