dependabot-python 0.288.0 → 0.289.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2a48e0851bec2770472370c41f5bc8c2f51252f14d0df9895b354eb0ed0cd26b
-  data.tar.gz: f105f8d5deffbb70dc2c0a3cfb9e00a4b591c01e6ededcacec376f52ae926738
+  metadata.gz: 53fcf514cdb25a0a0ce7ee91ee7c7a709bed7a0b0b12e96c1b75ee0670c9a776
+  data.tar.gz: ad1d6c5111311f7c22da1b9632747a03a419d329a2047f147fc93aba580aedd1
 SHA512:
-  metadata.gz: 0d407719216601023ff1d397072e158e3a4ab2fcf0113702655d83176accdfbdb3fb532a72e71fdaab76c07985203dbf12de20b69be78ed93d5bd37241b99db1
-  data.tar.gz: 75ad08b140727494fbb29ea3a564680b2366c9104f19e08d16896483cb594a3fc66c1bf51836c8ab063fedc64d4448bbaa1777868efb883e13587e63cfe70c95
+  metadata.gz: ada2669aa9b1e58cc9ed8e8f3001d7d47b9ecaf496666753247a8e4b9e00db288aecae9a30061dfe4880bfe5569eeab7faf873187d93d132330097104fd1b5a3
+  data.tar.gz: 04c164ca91f954361f394fba2a2f4fe3ee4685b392526d6e8ad8d14148da95ea9f1ca4d104c84d8af626d6462cb545b73d7e60f52ead0f8fe228596a82322093

data/lib/dependabot/python/file_parser.rb

@@ -8,9 +8,12 @@ require "dependabot/file_parsers/base/dependency_set"
 require "dependabot/shared_helpers"
 require "dependabot/python/requirement"
 require "dependabot/errors"
+require "dependabot/python/language"
 require "dependabot/python/native_helpers"
 require "dependabot/python/name_normaliser"
 require "dependabot/python/pip_compile_file_matcher"
+require "dependabot/python/language_version_manager"
+require "dependabot/python/package_manager"
 
 module Dependabot
   module Python
@@ -34,6 +37,11 @@ module Dependabot
         InvalidRequirement ValueError RecursionError
       ).freeze
 
+      # we use this placeholder version in case we are not able to detect any
+      # PIP version from shell, we are ensuring that the actual update is not blocked
+      # in any way if any metric collection exception start happening
+      UNDETECTED_PACKAGE_MANAGER_VERSION = "0.0"
+
       def parse
         # TODO: setup.py from external dependencies is evaluated. Provide guards before removing this.
         raise Dependabot::UnexpectedExternalCode if @reject_external_code
@@ -48,8 +56,172 @@ module Dependabot
         dependency_set.dependencies
       end
 
+      sig { returns(Ecosystem) }
+      def ecosystem
+        @ecosystem ||= T.let(
+          Ecosystem.new(
+            name: ECOSYSTEM,
+            package_manager: package_manager,
+            language: language
+          ),
+          T.nilable(Ecosystem)
+        )
+      end
+
       private
 
+      def language_version_manager
+        @language_version_manager ||=
+          LanguageVersionManager.new(
+            python_requirement_parser: python_requirement_parser
+          )
+      end
+
+      def python_requirement_parser
+        @python_requirement_parser ||=
+          FileParser::PythonRequirementParser.new(
+            dependency_files: dependency_files
+          )
+      end
+
+      sig { returns(Ecosystem::VersionManager) }
+      def package_manager
+        if Dependabot::Experiments.enabled?(:enable_file_parser_python_local)
+          Dependabot.logger.info("Detected package manager : #{detected_package_manager.name}")
+        end
+
+        @package_manager ||= detected_package_manager
+      end
+
+      sig { returns(Ecosystem::VersionManager) }
+      def detected_package_manager
+        setup_python_environment if Dependabot::Experiments.enabled?(:enable_file_parser_python_local)
+
+        return PipenvPackageManager.new(T.must(detect_pipenv_version)) if detect_pipenv_version
+
+        return PoetryPackageManager.new(T.must(detect_poetry_version)) if detect_poetry_version
+
+        return PipCompilePackageManager.new(T.must(detect_pipcompile_version)) if detect_pipcompile_version
+
+        PipPackageManager.new(detect_pip_version)
+      end
+
+      # Detects the version of poetry. If the version cannot be detected, it returns nil
+      sig { returns(T.nilable(String)) }
+      def detect_poetry_version
+        if poetry_files
+          package_manager = PoetryPackageManager::NAME
+
+          version = package_manager_version(package_manager)
+                    .to_s.split("version ").last&.split(")")&.first
+
+          log_if_version_malformed(package_manager, version)
+
+          # makes sure we have correct version format returned
+          version if version&.match?(/^\d+(?:\.\d+)*$/)
+        end
+      rescue StandardError
+        nil
+      end
+
+      # Detects the version of pip-compile. If the version cannot be detected, it returns nil
+      sig { returns(T.nilable(String)) }
+      def detect_pipcompile_version
+        if pipcompile_in_file
+          package_manager = PipCompilePackageManager::NAME
+
+          version = package_manager_version(package_manager)
+                    .to_s.split("version ").last&.split(")")&.first
+
+          log_if_version_malformed(package_manager, version)
+
+          # makes sure we have correct version format returned
+          version if version&.match?(/^\d+(?:\.\d+)*$/)
+        end
+      rescue StandardError
+        nil
+      end
+
+      # Detects the version of pipenv. If the version cannot be detected, it returns nil
+      sig { returns(T.nilable(String)) }
+      def detect_pipenv_version
+        if pipenv_files
+          package_manager = PipenvPackageManager::NAME
+
+          version = package_manager_version(package_manager)
+                    .to_s.split("version ").last&.strip
+
+          log_if_version_malformed(package_manager, version)
+
+          # makes sure we have correct version format returned
+          version if version&.match?(/^\d+(?:\.\d+)*$/)
+        end
+      rescue StandardError
+        nil
+      end
+
+      # Detects the version of pip. If the version cannot be detected, it returns 0.0
+      sig { returns(String) }
+      def detect_pip_version
+        package_manager = PipPackageManager::NAME
+
+        version = package_manager_version(package_manager)
+                  .split("from").first&.split("pip")&.last&.strip
+
+        log_if_version_malformed(package_manager, version)
+
+        version&.match?(/^\d+(?:\.\d+)*$/) ? version : UNDETECTED_PACKAGE_MANAGER_VERSION
+      rescue StandardError
+        nil
+      end
+
+      sig { params(package_manager: String).returns(T.any(String, T.untyped)) }
+      def package_manager_version(package_manager)
+        version_info = SharedHelpers.run_shell_command("pyenv exec #{package_manager} --version")
+        Dependabot.logger.info("Package manager #{package_manager}, Info : #{version_info}")
+
+        version_info
+      rescue StandardError => e
+        Dependabot.logger.error(e.message)
+        nil
+      end
+
+      # setup python local setup on file parser stage
+      sig { void }
+      def setup_python_environment
+        language_version_manager.install_required_python
+
+        SharedHelpers.run_shell_command("pyenv local #{language_version_manager.python_major_minor}")
+      rescue StandardError => e
+        Dependabot.logger.error(e.message)
+        nil
+      end
+
+      sig { params(package_manager: String, version: String).void }
+      def log_if_version_malformed(package_manager, version)
+        # logs warning if malformed version is found
+        return true if version.match?(/^\d+(?:\.\d+)*$/)
+
+        Dependabot.logger.warn(
+          "Detected #{package_manager} with malformed version #{version}"
+        )
+      end
+
+      sig { returns(String) }
+      def python_raw_version
+        if Dependabot::Experiments.enabled?(:enable_file_parser_python_local)
+          Dependabot.logger.info("Detected python version: #{language_version_manager.python_version}")
+          Dependabot.logger.info("Detected python major minor version: #{language_version_manager.python_major_minor}")
+        end
+
+        language_version_manager.python_version
+      end
+
+      sig { returns(T.nilable(Ecosystem::VersionManager)) }
+      def language
+        Language.new(python_raw_version)
+      end
+
       def requirement_files
         dependency_files.select { |f| f.name.end_with?(".txt", ".in") }
       end
@@ -164,6 +336,18 @@ module Dependabot
         end
       end
 
+      def pipcompile_in_file
+        requirement_files.any? { |f| f.end_with?(".in") }
+      end
+
+      def pipenv_files
+        dependency_files.any? { |f| f.name == PipenvPackageManager::LOCKFILE_FILENAME }
+      end
+
+      def poetry_files
+        true if get_original_file(PoetryPackageManager::LOCKFILE_NAME)
+      end
+
       def write_temporary_dependency_files
         dependency_files
           .reject { |f| f.name == ".python-version" }

data/lib/dependabot/python/language.rb

@@ -0,0 +1,21 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+require "dependabot/python/version"
+require "dependabot/ecosystem"
+
+module Dependabot
+  module Python
+    LANGUAGE = "python"
+
+    class Language < Dependabot::Ecosystem::VersionManager
+      extend T::Sig
+
+      sig { params(raw_version: String, requirement: T.nilable(Requirement)).void }
+      def initialize(raw_version, requirement = nil)
+        super(LANGUAGE, Version.new(raw_version), [], [], requirement)
+      end
+    end
+  end
+end

data/lib/dependabot/python/package_manager.rb

@@ -0,0 +1,166 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+require "dependabot/python/version"
+require "dependabot/ecosystem"
+require "dependabot/python/requirement"
+
+module Dependabot
+  module Python
+    ECOSYSTEM = "Python"
+
+    SUPPORTED_PYTHON_VERSIONS = T.let([].freeze, T::Array[Dependabot::Version])
+
+    DEPRECATED_PYTHON_VERSIONS = T.let([].freeze, T::Array[Dependabot::Version])
+
+    class PipPackageManager < Dependabot::Ecosystem::VersionManager
+      extend T::Sig
+
+      NAME = "pip"
+
+      SUPPORTED_VERSIONS = T.let([].freeze, T::Array[Dependabot::Version])
+
+      DEPRECATED_VERSIONS = T.let([].freeze, T::Array[Dependabot::Version])
+
+      sig do
+        params(
+          raw_version: String,
+          requirement: T.nilable(Requirement)
+        ).void
+      end
+      def initialize(raw_version, requirement = nil)
+        super(
+          NAME,
+          Version.new(raw_version),
+          SUPPORTED_VERSIONS,
+          DEPRECATED_VERSIONS,
+          requirement,
+       )
+      end
+
+      sig { override.returns(T::Boolean) }
+      def deprecated?
+        false
+      end
+
+      sig { override.returns(T::Boolean) }
+      def unsupported?
+        false
+      end
+    end
+
+    class PoetryPackageManager < Dependabot::Ecosystem::VersionManager
+      extend T::Sig
+
+      NAME = "poetry"
+
+      LOCKFILE_NAME = "poetry.lock"
+
+      SUPPORTED_VERSIONS = T.let([].freeze, T::Array[Dependabot::Version])
+
+      DEPRECATED_VERSIONS = T.let([].freeze, T::Array[Dependabot::Version])
+
+      sig do
+        params(
+          raw_version: String,
+          requirement: T.nilable(Requirement)
+        ).void
+      end
+      def initialize(raw_version, requirement = nil)
+        super(
+          NAME,
+          Version.new(raw_version),
+          SUPPORTED_VERSIONS,
+          DEPRECATED_VERSIONS,
+          requirement,
+       )
+      end
+
+      sig { override.returns(T::Boolean) }
+      def deprecated?
+        false
+      end
+
+      sig { override.returns(T::Boolean) }
+      def unsupported?
+        false
+      end
+    end
+
+    class PipCompilePackageManager < Dependabot::Ecosystem::VersionManager
+      extend T::Sig
+
+      NAME = "pip-compile"
+
+      SUPPORTED_VERSIONS = T.let([].freeze, T::Array[Dependabot::Version])
+
+      DEPRECATED_VERSIONS = T.let([].freeze, T::Array[Dependabot::Version])
+
+      sig do
+        params(
+          raw_version: String,
+          requirement: T.nilable(Requirement)
+        ).void
+      end
+      def initialize(raw_version, requirement = nil)
+        super(
+          NAME,
+          Version.new(raw_version),
+          SUPPORTED_VERSIONS,
+          DEPRECATED_VERSIONS,
+          requirement,
+       )
+      end
+
+      sig { override.returns(T::Boolean) }
+      def deprecated?
+        false
+      end
+
+      sig { override.returns(T::Boolean) }
+      def unsupported?
+        false
+      end
+    end
+
+    class PipenvPackageManager < Dependabot::Ecosystem::VersionManager
+      extend T::Sig
+
+      NAME = "pipenv"
+
+      MANIFEST_FILENAME = "Pipfile"
+      LOCKFILE_FILENAME = "Pipfile.lock"
+
+      SUPPORTED_VERSIONS = T.let([].freeze, T::Array[Dependabot::Version])
+
+      DEPRECATED_VERSIONS = T.let([].freeze, T::Array[Dependabot::Version])
+
+      sig do
+        params(
+          raw_version: String,
+          requirement: T.nilable(Requirement)
+        ).void
+      end
+      def initialize(raw_version, requirement = nil)
+        super(
+          NAME,
+          Version.new(raw_version),
+          SUPPORTED_VERSIONS,
+          DEPRECATED_VERSIONS,
+          requirement,
+       )
+      end
+
+      sig { override.returns(T::Boolean) }
+      def deprecated?
+        false
+      end
+
+      sig { override.returns(T::Boolean) }
+      def unsupported?
+        false
+      end
+    end
+  end
+end

data/lib/dependabot/python/update_checker.rb

@@ -113,6 +113,10 @@ module Dependabot
       end
 
       def resolver
+        if Dependabot::Experiments.enabled?(:enable_file_parser_python_local)
+          Dependabot.logger.info("Python package resolver : #{resolver_type}")
+        end
+
         case resolver_type
         when :pip_compile then pip_compile_version_resolver
         when :pipenv then pipenv_version_resolver

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-python
 version: !ruby/object:Gem::Version
-  version: 0.288.0
+  version: 0.289.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-11-21 00:00:00.000000000 Z
+date: 2024-12-05 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.288.0
+        version: 0.289.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.288.0
+        version: 0.289.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -266,10 +266,12 @@ files:
 - lib/dependabot/python/file_updater/requirement_file_updater.rb
 - lib/dependabot/python/file_updater/requirement_replacer.rb
 - lib/dependabot/python/file_updater/setup_file_sanitizer.rb
+- lib/dependabot/python/language.rb
 - lib/dependabot/python/language_version_manager.rb
 - lib/dependabot/python/metadata_finder.rb
 - lib/dependabot/python/name_normaliser.rb
 - lib/dependabot/python/native_helpers.rb
+- lib/dependabot/python/package_manager.rb
 - lib/dependabot/python/pip_compile_file_matcher.rb
 - lib/dependabot/python/pipenv_runner.rb
 - lib/dependabot/python/requirement.rb
@@ -288,7 +290,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.288.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.289.0
 post_install_message: 
 rdoc_options: []
 require_paths: