dependabot-python 0.125.7 → 0.128.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d14f99e97125c12346de48675d036e82e71ff41432cece781115f493af6ff701
-  data.tar.gz: dc94655cd1f089d22c57a1bf01f8945e8ecd7906bc667e63e77ae5089900b373
+  metadata.gz: cf6f64b4656464c1e02e73d553bcea937088074440b8b389aebfd0dffaff7e9f
+  data.tar.gz: 3af9328f0ef10bbcce3037a58c38cf0574805956ab8e94de1e1fa0fdb3936566
 SHA512:
-  metadata.gz: a7c1f9e17e3846e35296a20a5eb9b92f947c0d87f398ec377a77937abea74a9dcc829a6b5df10279fe7ba5fcff1489e55ff5c7840d9e77e6bf0b0b5dbea57b1a
-  data.tar.gz: f95df4327723a4c086f27c43c88059101d5080d4ab3d912dac3a8aaabb032c0c98d42811375ececd8690012753f6ff227f83587e18e40b8296409642ffd09b2b
+  metadata.gz: 84b362df67759d62bb506e8ca373cf487f790424a824610ebd18bed15e191580d0406aa66605c4b657adad8bba7a560acf72f4a6f86b8fe1d95c5f17b3c38456
+  data.tar.gz: 92047e230d53909532adf04e1945450ef8466d7d9bd8d6b925d9841314f6a97c6370691678801db81b7fbcf2e524729b59f614dc237230bbe91fbb92d5837c50

data/helpers/requirements.txt

@@ -1,9 +1,10 @@
-pip==20.1.1
+pip==20.3.1
 pip-tools==5.4.0
 hashin==0.15.0
 pipenv==2018.11.26
 pipfile==0.0.2
 poetry==1.1.4
+wheel==0.36.2
 
 # Some dependencies will only install if Cython is present
 Cython==0.29.21

data/lib/dependabot/python/update_checker/pip_compile_version_resolver.rb

@@ -27,8 +27,8 @@ module Dependabot
         GIT_DEPENDENCY_UNREACHABLE_REGEX =
           /git clone -q (?<url>[^\s]+).* /.freeze
         GIT_REFERENCE_NOT_FOUND_REGEX =
-          %r{git checkout -q (?<tag>[^\n"]+)\n?[^\n]*/(?<name>.*?)(\\n'\]|$)}m.
-          freeze
+          /egg=(?<name>\S+).*.*WARNING: Did not find branch or tag \'(?<tag>[^\n"]+)\'/m.freeze
+        NATIVE_COMPILATION_ERROR = "pip._internal.exceptions.InstallationError: Command errored out with exit status 1"
 
         attr_reader :dependency, :dependency_files, :credentials
 
@@ -36,6 +36,7 @@ module Dependabot
           @dependency               = dependency
           @dependency_files         = dependency_files
           @credentials              = credentials
+          @build_isolation = true
         end
 
         def latest_resolvable_version(requirement: nil)
@@ -72,7 +73,7 @@ module Dependabot
                   # Shell out to pip-compile.
                   # This is slow, as pip-compile needs to do installs.
                   run_pip_compile_command(
-                    "pyenv exec pip-compile --allow-unsafe "\
+                    "pyenv exec pip-compile --allow-unsafe -v "\
                      "#{pip_compile_options(filename)} -P #{dependency.name} "\
                      "#{filename}"
                   )
@@ -91,10 +92,22 @@ module Dependabot
                 parse_updated_files
               end
             rescue SharedHelpers::HelperSubprocessFailed => e
+              retry_count ||= 0
+              retry_count += 1
+
+              if compilation_error?(e) && retry_count <= 1
+                @build_isolation = false
+                retry
+              end
+
               handle_pip_compile_errors(e)
             end
         end
 
+        def compilation_error?(error)
+          error.message.include?(NATIVE_COMPILATION_ERROR)
+        end
+
         # rubocop:disable Metrics/AbcSize
         def handle_pip_compile_errors(error)
           if error.message.include?("Could not find a version")
@@ -195,7 +208,7 @@ module Dependabot
         end
 
         def pip_compile_options(filename)
-          options = ["--build-isolation"]
+          options = @build_isolation ? ["--build-isolation"] : ["--no-build-isolation"]
           options += pip_compile_index_options
 
           if (requirements_file = compiled_file_for_filename(filename))
@@ -366,11 +379,21 @@ module Dependabot
           NameNormaliser.normalise(name)
         end
 
+        VERBOSE_ERROR_OUTPUT_LINES = [
+          "Traceback",
+          "Using indexes:",
+          "Current constraints:",
+          "Finding the best candidates:",
+          "Finding secondary dependencies:",
+          "\n",
+          "  "
+        ].freeze
+
         def clean_error_message(message)
           msg_lines = message.lines
           msg = msg_lines.
                 take_while { |l| !l.start_with?("During handling of") }.
-                drop_while { |l| l.start_with?("Traceback", "  ") }.
+                drop_while { |l| l.start_with?(*VERBOSE_ERROR_OUTPUT_LINES) }.
                 join.strip
 
           # Redact any URLs, as they may include credentials

data/lib/dependabot/python/update_checker/pipenv_version_resolver.rb

@@ -39,6 +39,12 @@ module Dependabot
         UNSUPPORTED_DEP_REGEX =
           /"python setup\.py egg_info".*(?:#{UNSUPPORTED_DEPS.join("|")})/.
           freeze
+        PIPENV_INSTALLATION_ERROR = "pipenv.patched.notpip._internal."\
+                                    "exceptions.InstallationError: "\
+                                    "Command \"python setup.py egg_info\" "\
+                                    "failed with error code 1 in"
+        PIPENV_INSTALLATION_ERROR_REGEX =
+          %r{#{Regexp.quote(PIPENV_INSTALLATION_ERROR)}.+/(?<name>.+)/$}.freeze
 
         attr_reader :dependency, :dependency_files, :credentials
 
@@ -169,7 +175,6 @@ module Dependabot
             return if error.message.match?(/#{Regexp.quote(dependency.name)}/i)
           end
 
-          puts error.message
           if error.message.match?(GIT_DEPENDENCY_UNREACHABLE_REGEX)
             url = error.message.match(GIT_DEPENDENCY_UNREACHABLE_REGEX).
                   named_captures.fetch("url")
@@ -232,6 +237,10 @@ module Dependabot
             raise DependencyFileNotResolvable, msg
           end
 
+          # NOTE: Pipenv masks the actualy error, see this issue for updates:
+          # https://github.com/pypa/pipenv/issues/2791
+          handle_pipenv_installation_error(error.message) if error.message.match?(PIPENV_INSTALLATION_ERROR_REGEX)
+
           # Raise an unhandled error, as this could be a problem with
           # Dependabot's infrastructure, rather than the Pipfile
           raise
@@ -257,6 +266,19 @@ module Dependabot
           msg.gsub(/http.*?(?=\s)/, "<redacted>")
         end
 
+        def handle_pipenv_installation_error(error_message)
+          # Find the dependency that's causing resolution to fail
+          dependency_name = error_message.match(PIPENV_INSTALLATION_ERROR_REGEX).named_captures["name"]
+          raise unless dependency_name
+
+          msg = "Pipenv failed to install \"#{dependency_name}\". This could be caused by missing system "\
+                "dependencies that can't be installed by Dependabot or required installation flags.\n\n"\
+                "Error output from running \"pipenv lock\":\n"\
+                "#{clean_error_message(error_message)}"
+
+          raise DependencyFileNotResolvable, msg
+        end
+
         def write_temporary_dependency_files(updated_req: nil,
                                              update_pipfile: true)
           dependency_files.each do |file|

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-python
 version: !ruby/object:Gem::Version
-  version: 0.125.7
+  version: 0.128.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-11-30 00:00:00.000000000 Z
+date: 2020-12-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.125.7
+        version: 0.128.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.125.7
+        version: 0.128.0
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement
@@ -100,14 +100,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.4.2
+        version: 1.6.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.4.2
+        version: 1.6.0
 - !ruby/object:Gem::Dependency
   name: simplecov
   requirement: !ruby/object:Gem::Requirement