dependabot-python 0.125.6 → 0.127.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e7961c9171af4382c7e680aae485124295f7cec0e7b49fa8d25028a65c092c6f
-  data.tar.gz: b84f1b200e407f41fadf21404107ce43adb4524381cca644eea380a5e9adef23
+  metadata.gz: 3588d18ba10f4fd3167a3628feacb61a99373e1e9672ccc19e56636d5f7abcd5
+  data.tar.gz: 2b019b8cca8dd3cc9591f0ed6a7aa1969c053094b47151b100382b26e460dd05
 SHA512:
-  metadata.gz: b811806ef5e299be4c9fffc2efbb247e5501b54b2f7486d6448c2ab858b38e7dda0922557e4c76973abfccedf2864f0a85142027556970541a6402c38faa20f4
-  data.tar.gz: 436d03634257d3da1440f1cc5b92b797c305e4e730e6ba3c469f4e8f0f0a48567fc7aea2aa3d77c74d5d929173082a4b7d10e06383c7469e2dc7def5bce85199
+  metadata.gz: 2b4f8ff91fcc256b3469e251de2da3325818ac03ce84748a415460dcf74174107c5b9103ac2a54c40f84cee1c2cad0d0ea8d0f4df1fa88c3b04ded4958a649e3
+  data.tar.gz: 8899592e97f4fdb858c92b5b858a22278ef58d81ee96af5d06ef85cf34b9023cfd2375cbebdaf343772044ce1d68d276630d7f546118a8f7cb3c7f9918959bda

data/helpers/requirements.txt

@@ -1,9 +1,10 @@
-pip==20.1.1
-pip-tools==5.3.1
+pip==20.3.1
+pip-tools==5.4.0
 hashin==0.15.0
 pipenv==2018.11.26
 pipfile==0.0.2
 poetry==1.1.4
+wheel==0.36.2
 
 # Some dependencies will only install if Cython is present
 Cython==0.29.21

data/lib/dependabot/python/requirement.rb

@@ -116,7 +116,7 @@ module Dependabot
       end
 
       def convert_wildcard(req_string)
-        # Note: This isn't perfect. It replaces the "!= 1.0.*" case with
+        # NOTE: This isn't perfect. It replaces the "!= 1.0.*" case with
         # "!= 1.0.0". There's no way to model this correctly in Ruby :'(
         quoted_ops = OPS.keys.sort_by(&:length).reverse.
                      map { |k| Regexp.quote(k) }.join("|")

data/lib/dependabot/python/update_checker/pip_compile_version_resolver.rb

@@ -27,8 +27,8 @@ module Dependabot
         GIT_DEPENDENCY_UNREACHABLE_REGEX =
           /git clone -q (?<url>[^\s]+).* /.freeze
         GIT_REFERENCE_NOT_FOUND_REGEX =
-          %r{git checkout -q (?<tag>[^\n"]+)\n?[^\n]*/(?<name>.*?)(\\n'\]|$)}m.
-          freeze
+          /egg=(?<name>\S+).*.*WARNING: Did not find branch or tag \'(?<tag>[^\n"]+)\'/m.freeze
+        NATIVE_COMPILATION_ERROR = "pip._internal.exceptions.InstallationError: Command errored out with exit status 1"
 
         attr_reader :dependency, :dependency_files, :credentials
 
@@ -36,6 +36,7 @@ module Dependabot
           @dependency               = dependency
           @dependency_files         = dependency_files
           @credentials              = credentials
+          @build_isolation = true
         end
 
         def latest_resolvable_version(requirement: nil)
@@ -72,7 +73,7 @@ module Dependabot
                   # Shell out to pip-compile.
                   # This is slow, as pip-compile needs to do installs.
                   run_pip_compile_command(
-                    "pyenv exec pip-compile --allow-unsafe "\
+                    "pyenv exec pip-compile --allow-unsafe -v "\
                      "#{pip_compile_options(filename)} -P #{dependency.name} "\
                      "#{filename}"
                   )
@@ -91,10 +92,22 @@ module Dependabot
                 parse_updated_files
               end
             rescue SharedHelpers::HelperSubprocessFailed => e
+              retry_count ||= 0
+              retry_count += 1
+
+              if compilation_error?(e) && retry_count <= 1
+                @build_isolation = false
+                retry
+              end
+
               handle_pip_compile_errors(e)
             end
         end
 
+        def compilation_error?(error)
+          error.message.include?(NATIVE_COMPILATION_ERROR)
+        end
+
         # rubocop:disable Metrics/AbcSize
         def handle_pip_compile_errors(error)
           if error.message.include?("Could not find a version")
@@ -195,7 +208,7 @@ module Dependabot
         end
 
         def pip_compile_options(filename)
-          options = ["--build-isolation"]
+          options = @build_isolation ? ["--build-isolation"] : ["--no-build-isolation"]
           options += pip_compile_index_options
 
           if (requirements_file = compiled_file_for_filename(filename))
@@ -366,11 +379,21 @@ module Dependabot
           NameNormaliser.normalise(name)
         end
 
+        VERBOSE_ERROR_OUTPUT_LINES = [
+          "Traceback",
+          "Using indexes:",
+          "Current constraints:",
+          "Finding the best candidates:",
+          "Finding secondary dependencies:",
+          "\n",
+          "  "
+        ].freeze
+
         def clean_error_message(message)
           msg_lines = message.lines
           msg = msg_lines.
                 take_while { |l| !l.start_with?("During handling of") }.
-                drop_while { |l| l.start_with?("Traceback", "  ") }.
+                drop_while { |l| l.start_with?(*VERBOSE_ERROR_OUTPUT_LINES) }.
                 join.strip
 
           # Redact any URLs, as they may include credentials

data/lib/dependabot/python/update_checker/pipenv_version_resolver.rb

@@ -39,6 +39,12 @@ module Dependabot
         UNSUPPORTED_DEP_REGEX =
           /"python setup\.py egg_info".*(?:#{UNSUPPORTED_DEPS.join("|")})/.
           freeze
+        PIPENV_INSTALLATION_ERROR = "pipenv.patched.notpip._internal."\
+                                    "exceptions.InstallationError: "\
+                                    "Command \"python setup.py egg_info\" "\
+                                    "failed with error code 1 in"
+        PIPENV_INSTALLATION_ERROR_REGEX =
+          %r{#{Regexp.quote(PIPENV_INSTALLATION_ERROR)}.+/(?<name>.+)/$}.freeze
 
         attr_reader :dependency, :dependency_files, :credentials
 
@@ -169,7 +175,6 @@ module Dependabot
             return if error.message.match?(/#{Regexp.quote(dependency.name)}/i)
           end
 
-          puts error.message
           if error.message.match?(GIT_DEPENDENCY_UNREACHABLE_REGEX)
             url = error.message.match(GIT_DEPENDENCY_UNREACHABLE_REGEX).
                   named_captures.fetch("url")
@@ -232,6 +237,10 @@ module Dependabot
             raise DependencyFileNotResolvable, msg
           end
 
+          # NOTE: Pipenv masks the actualy error, see this issue for updates:
+          # https://github.com/pypa/pipenv/issues/2791
+          handle_pipenv_installation_error(error.message) if error.message.match?(PIPENV_INSTALLATION_ERROR_REGEX)
+
           # Raise an unhandled error, as this could be a problem with
           # Dependabot's infrastructure, rather than the Pipfile
           raise
@@ -257,6 +266,19 @@ module Dependabot
           msg.gsub(/http.*?(?=\s)/, "<redacted>")
         end
 
+        def handle_pipenv_installation_error(error_message)
+          # Find the dependency that's causing resolution to fail
+          dependency_name = error_message.match(PIPENV_INSTALLATION_ERROR_REGEX).named_captures["name"]
+          raise unless dependency_name
+
+          msg = "Pipenv failed to install \"#{dependency_name}\". This could be caused by missing system "\
+                "dependencies that can't be installed by Dependabot or required installation flags.\n\n"\
+                "Error output from running \"pipenv lock\":\n"\
+                "#{clean_error_message(error_message)}"
+
+          raise DependencyFileNotResolvable, msg
+        end
+
         def write_temporary_dependency_files(updated_req: nil,
                                              update_pipfile: true)
           dependency_files.each do |file|

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-python
 version: !ruby/object:Gem::Version
-  version: 0.125.6
+  version: 0.127.1
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-11-27 00:00:00.000000000 Z
+date: 2020-12-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.125.6
+        version: 0.127.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.125.6
+        version: 0.127.1
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement
@@ -100,28 +100,28 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.93.0
+        version: 1.6.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.93.0
+        version: 1.6.0
 - !ruby/object:Gem::Dependency
   name: simplecov
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.19.0
+        version: 0.20.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.19.0
+        version: 0.20.0
 - !ruby/object:Gem::Dependency
   name: simplecov-console
   requirement: !ruby/object:Gem::Requirement