dependabot-python 0.320.0 → 0.320.1

data/lib/dependabot/python/update_checker/pipenv_version_resolver.rb

@@ -1,6 +1,7 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
+require "sorbet-runtime"
 require "excon"
 require "open3"
 require "dependabot/dependency"
@@ -19,12 +20,14 @@ module Dependabot
   module Python
     class UpdateChecker
       class PipenvVersionResolver
+        extend T::Sig
+
         GIT_DEPENDENCY_UNREACHABLE_REGEX = /git clone --filter=blob:none --quiet (?<url>[^\s]+).*/
         GIT_REFERENCE_NOT_FOUND_REGEX = /git checkout -q (?<tag>[^\s]+).*/
         PIPENV_INSTALLATION_ERROR_NEW = "Getting requirements to build wheel exited with 1"
 
         # Can be removed when Python 3.11 support is dropped
-        PIPENV_INSTALLATION_ERROR_OLD = Regexp.quote("python setup.py egg_info exited with 1")
+        PIPENV_INSTALLATION_ERROR_OLD = T.let(Regexp.quote("python setup.py egg_info exited with 1"), String)
 
         PIPENV_INSTALLATION_ERROR = /#{PIPENV_INSTALLATION_ERROR_NEW}|#{PIPENV_INSTALLATION_ERROR_OLD}/
         PIPENV_INSTALLATION_ERROR_REGEX =
@@ -32,18 +35,34 @@ module Dependabot
 
         PIPENV_RANGE_WARNING = /Python version range specifier '(?<ver>.*)' is not supported/
 
+        sig { returns(Dependabot::Dependency) }
         attr_reader :dependency
+
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         attr_reader :dependency_files
+
+        sig { returns(T::Array[Dependabot::Credential]) }
         attr_reader :credentials
+
+        sig { returns(T.nilable(String)) }
         attr_reader :repo_contents_path
 
+        sig do
+          params(
+            dependency: Dependabot::Dependency,
+            dependency_files: T::Array[Dependabot::DependencyFile],
+            credentials: T::Array[Dependabot::Credential],
+            repo_contents_path: T.nilable(String)
+          ).void
+        end
         def initialize(dependency:, dependency_files:, credentials:, repo_contents_path:)
-          @dependency               = dependency
-          @dependency_files         = dependency_files
-          @credentials              = credentials
-          @repo_contents_path       = repo_contents_path
+          @dependency = T.let(dependency, Dependabot::Dependency)
+          @dependency_files = T.let(dependency_files, T::Array[Dependabot::DependencyFile])
+          @credentials = T.let(credentials, T::Array[Dependabot::Credential])
+          @repo_contents_path = T.let(repo_contents_path, T.nilable(String))
         end
 
+        sig { params(requirement: T.nilable(String)).returns(T.nilable(Dependabot::Python::Version)) }
         def latest_resolvable_version(requirement: nil)
           version_string =
             fetch_latest_resolvable_version_string(requirement: requirement)
@@ -51,17 +70,19 @@ module Dependabot
           version_string.nil? ? nil : Python::Version.new(version_string)
         end
 
+        sig { params(version: Gem::Version).returns(T::Boolean) }
         def resolvable?(version:)
-          @resolvable ||= {}
-          return @resolvable[version] if @resolvable.key?(version)
+          @resolvable ||= T.let({}, T.nilable(T::Hash[Gem::Version, T::Boolean]))
+          return T.must(@resolvable[version]) if @resolvable.key?(version)
 
           @resolvable[version] = !!fetch_latest_resolvable_version_string(requirement: "==#{version}")
         end
 
         private
 
+        sig { params(requirement: T.nilable(String)).returns(T.nilable(String)) }
         def fetch_latest_resolvable_version_string(requirement:)
-          @latest_resolvable_version_string ||= {}
+          @latest_resolvable_version_string ||= T.let({}, T.nilable(T::Hash[T.nilable(String), T.nilable(String)]))
           return @latest_resolvable_version_string[requirement] if @latest_resolvable_version_string.key?(requirement)
 
           @latest_resolvable_version_string[requirement] ||=
@@ -81,6 +102,7 @@ module Dependabot
         # rubocop:disable Metrics/PerceivedComplexity
         # rubocop:disable Metrics/AbcSize
         # rubocop:disable Metrics/MethodLength
+        sig { params(error: Dependabot::SharedHelpers::HelperSubprocessFailed).returns(T.nilable(String)) }
         def handle_pipenv_errors(error)
           if error.message.include?("no version found at all") ||
              error.message.include?("Invalid specifier:") ||
@@ -99,16 +121,17 @@ module Dependabot
           end
 
           if error.message.match?(GIT_REFERENCE_NOT_FOUND_REGEX)
-            tag = error.message.match(GIT_REFERENCE_NOT_FOUND_REGEX).named_captures.fetch("tag")
+            match_result = error.message.match(GIT_REFERENCE_NOT_FOUND_REGEX)
+            tag = T.must(match_result).named_captures.fetch("tag")
             # Unfortunately the error message doesn't include the package name.
             # TODO: Talk with pipenv maintainers about exposing the package name, it used to be part of the error output
             raise GitDependencyReferenceNotFound, "(unknown package at #{tag})"
           end
 
           if error.message.match?(GIT_DEPENDENCY_UNREACHABLE_REGEX)
-            url = error.message.match(GIT_DEPENDENCY_UNREACHABLE_REGEX)
-                       .named_captures.fetch("url")
-            raise GitDependenciesNotReachable, url
+            match_result = error.message.match(GIT_DEPENDENCY_UNREACHABLE_REGEX)
+            url = T.must(match_result).named_captures.fetch("url")
+            raise GitDependenciesNotReachable, T.must(url)
           end
 
           if error.message.include?("Could not find a version") || error.message.include?("ResolutionFailure")
@@ -151,6 +174,7 @@ module Dependabot
         # Note: We raise errors from this method, rather than returning a
         # boolean, so that all deps for this repo will raise identical
         # errors when failing to update
+        sig { returns(T::Boolean) }
         def check_original_requirements_resolvable
           SharedHelpers.in_a_temporary_repo_directory(base_directory, repo_contents_path) do
             write_temporary_dependency_files(update_pipfile: false)
@@ -160,13 +184,16 @@ module Dependabot
             true
           rescue SharedHelpers::HelperSubprocessFailed => e
             handle_pipenv_errors_resolving_original_reqs(e)
+            false
           end
         end
 
+        sig { returns(String) }
         def base_directory
-          dependency_files.first.directory
+          T.must(dependency_files.first).directory
         end
 
+        sig { params(error: Dependabot::SharedHelpers::HelperSubprocessFailed).void }
         def handle_pipenv_errors_resolving_original_reqs(error)
           if error.message.include?("Could not find a version") ||
              error.message.include?("package versions have conflicting dependencies")
@@ -193,6 +220,7 @@ module Dependabot
           raise
         end
 
+        sig { params(message: String).returns(String) }
         def clean_error_message(message)
           # Pipenv outputs a lot of things to STDERR, so we need to clean
           # up the error message
@@ -213,9 +241,11 @@ module Dependabot
           msg.gsub(/http.*?(?=\s)/, "<redacted>")
         end
 
+        sig { params(error_message: String).void }
         def handle_pipenv_installation_error(error_message)
           # Find the dependency that's causing resolution to fail
-          dependency_name = error_message.match(PIPENV_INSTALLATION_ERROR_REGEX).named_captures["name"]
+          match_result = error_message.match(PIPENV_INSTALLATION_ERROR_REGEX)
+          dependency_name = T.must(match_result).named_captures["name"]
           raise unless dependency_name
 
           msg = "Pipenv failed to install \"#{dependency_name}\". This could be caused by missing system " \
@@ -226,6 +256,7 @@ module Dependabot
           raise DependencyFileNotResolvable, msg
         end
 
+        sig { params(update_pipfile: T::Boolean).void }
         def write_temporary_dependency_files(update_pipfile: true)
           dependency_files.each do |file|
             path = file.name
@@ -256,6 +287,7 @@ module Dependabot
           )
         end
 
+        sig { void }
         def install_required_python
           # Initialize a git repo to appease pip-tools
           begin
@@ -267,7 +299,12 @@ module Dependabot
           language_version_manager.install_required_python
         end
 
+        sig { params(file: Dependabot::DependencyFile).returns(String) }
         def sanitized_setup_file_content(file)
+          @sanitized_setup_file_content = T.let(
+            @sanitized_setup_file_content,
+            T.nilable(T::Hash[String, String])
+          )
           @sanitized_setup_file_content ||= {}
           @sanitized_setup_file_content[file.name] ||=
             Python::FileUpdater::SetupFileSanitizer
@@ -275,77 +312,97 @@ module Dependabot
             .sanitized_content
         end
 
+        sig { params(file: Dependabot::DependencyFile).returns(T.nilable(Dependabot::DependencyFile)) }
         def setup_cfg(file)
           config_name = file.name.sub(/\.py$/, ".cfg")
           dependency_files.find { |f| f.name == config_name }
         end
 
+        sig { returns(String) }
         def pipfile_content
-          content = pipfile.content
+          pipfile_obj = T.must(pipfile)
+          content = T.must(pipfile_obj.content)
           content = add_private_sources(content)
           content = update_python_requirement(content)
-          content = update_ssl_requirement(content, pipfile.content)
+          content = update_ssl_requirement(content, T.must(pipfile_obj.content))
 
           content
         end
 
+        sig { params(pipfile_content: String).returns(String) }
         def update_python_requirement(pipfile_content)
           Python::FileUpdater::PipfilePreparer
             .new(pipfile_content: pipfile_content)
             .update_python_requirement(language_version_manager.python_major_minor)
         end
 
+        sig { params(pipfile_content: String, parsed_file: String).returns(String) }
         def update_ssl_requirement(pipfile_content, parsed_file)
           Python::FileUpdater::PipfilePreparer
             .new(pipfile_content: pipfile_content)
             .update_ssl_requirement(parsed_file)
         end
 
+        sig { params(pipfile_content: String).returns(String) }
         def add_private_sources(pipfile_content)
           Python::FileUpdater::PipfilePreparer
             .new(pipfile_content: pipfile_content)
             .replace_sources(credentials)
         end
 
+        sig { params(command: String).returns(String) }
         def run_command(command)
           SharedHelpers.run_shell_command(command, stderr_to_stdout: true)
         end
 
+        sig { returns(Dependabot::Python::FileParser::PythonRequirementParser) }
         def python_requirement_parser
-          @python_requirement_parser ||=
+          @python_requirement_parser ||= T.let(
             FileParser::PythonRequirementParser.new(
               dependency_files: dependency_files
-            )
+            ),
+            T.nilable(Dependabot::Python::FileParser::PythonRequirementParser)
+          )
         end
 
+        sig { returns(Dependabot::Python::LanguageVersionManager) }
         def language_version_manager
-          @language_version_manager ||=
+          @language_version_manager ||= T.let(
             LanguageVersionManager.new(
               python_requirement_parser: python_requirement_parser
-            )
+            ),
+            T.nilable(Dependabot::Python::LanguageVersionManager)
+          )
         end
 
+        sig { returns(Dependabot::Python::PipenvRunner) }
         def pipenv_runner
-          @pipenv_runner ||=
+          @pipenv_runner ||= T.let(
             PipenvRunner.new(
               dependency: dependency,
               lockfile: lockfile,
               language_version_manager: language_version_manager
-            )
+            ),
+            T.nilable(Dependabot::Python::PipenvRunner)
+          )
         end
 
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def pipfile
           dependency_files.find { |f| f.name == "Pipfile" }
         end
 
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def lockfile
           dependency_files.find { |f| f.name == "Pipfile.lock" }
         end
 
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         def setup_files
           dependency_files.select { |f| f.name.end_with?("setup.py") }
         end
 
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         def setup_cfg_files
           dependency_files.select { |f| f.name.end_with?("setup.cfg") }
         end

data/lib/dependabot/python/update_checker/poetry_version_resolver.rb

@@ -1,6 +1,7 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
+require "sorbet-runtime"
 require "excon"
 require "toml-rb"
 require "open3"
@@ -43,23 +44,50 @@ module Dependabot
 
         INCOMPATIBLE_CONSTRAINTS = /Incompatible constraints in requirements of (?<dep>.+?) ((?<ver>.+?)):/
 
+        PACKAGE_RESOLVER_ERRORS = T.let({
+          package_info_error: /Unable to determine package info/,
+          self_dep_error: /Package '(?<path>.*)' is listed as a dependency of itself./,
+          incompatible_constraints: /Incompatible constraints in requirements/
+        }.freeze, T::Hash[T.nilable(String), Regexp])
+
+        sig { returns(Dependabot::Dependency) }
         attr_reader :dependency
+
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         attr_reader :dependency_files
+
+        sig { returns(T::Array[Dependabot::Credential]) }
         attr_reader :credentials
+
+        sig { returns(T.nilable(String)) }
         attr_reader :repo_contents_path
 
         sig { returns(Dependabot::Python::PoetryErrorHandler) }
         attr_reader :error_handler
 
-        def initialize(dependency:, dependency_files:, credentials:, repo_contents_path:)
-          @dependency               = dependency
-          @dependency_files         = dependency_files
-          @credentials              = credentials
-          @repo_contents_path       = repo_contents_path
-          @error_handler = PoetryErrorHandler.new(dependencies: dependency,
-                                                  dependency_files: dependency_files)
+        sig do
+          params(
+            dependency: Dependabot::Dependency,
+            dependency_files: T::Array[Dependabot::DependencyFile],
+            credentials: T::Array[Dependabot::Credential],
+            repo_contents_path: T.nilable(String)
+          ).void
         end
-
+        def initialize(dependency:, dependency_files:, credentials:, repo_contents_path:)
+          @dependency               = T.let(dependency, Dependabot::Dependency)
+          @dependency_files         = T.let(dependency_files, T::Array[Dependabot::DependencyFile])
+          @credentials              = T.let(credentials, T::Array[Dependabot::Credential])
+          @repo_contents_path       = T.let(repo_contents_path, T.nilable(String))
+          @error_handler = T.let(PoetryErrorHandler.new(dependencies: dependency, dependency_files: dependency_files),
+                                 Dependabot::Python::PoetryErrorHandler)
+          @resolvable = T.let({}, T::Hash[Gem::Version, T::Boolean])
+          @latest_resolvable_version_string = T.let({}, T::Hash[T.nilable(String), T.nilable(String)])
+          @original_reqs_resolvable = T.let(nil, T.nilable(T::Boolean))
+          @python_requirement_parser = T.let(nil, T.nilable(FileParser::PythonRequirementParser))
+          @language_version_manager = T.let(nil, T.nilable(LanguageVersionManager))
+        end
+
+        sig { params(requirement: T.nilable(String)).returns(T.nilable(Dependabot::Python::Version)) }
         def latest_resolvable_version(requirement: nil)
           version_string =
             fetch_latest_resolvable_version_string(requirement: requirement)
@@ -67,9 +95,9 @@ module Dependabot
           version_string.nil? ? nil : Python::Version.new(version_string)
         end
 
+        sig { params(version: Gem::Version).returns(T::Boolean) }
         def resolvable?(version:)
-          @resolvable ||= {}
-          return @resolvable[version] if @resolvable.key?(version)
+          return T.must(@resolvable[version]) if @resolvable.key?(version)
 
           @resolvable[version] = if fetch_latest_resolvable_version_string(requirement: "==#{version}")
                                    true
@@ -84,8 +112,8 @@ module Dependabot
 
         private
 
+        sig { params(requirement: T.nilable(String)).returns(T.nilable(String)) }
         def fetch_latest_resolvable_version_string(requirement:)
-          @latest_resolvable_version_string ||= {}
           return @latest_resolvable_version_string[requirement] if @latest_resolvable_version_string.key?(requirement)
 
           @latest_resolvable_version_string[requirement] ||=
@@ -112,6 +140,7 @@ module Dependabot
             end
         end
 
+        sig { params(updated_lockfile: T::Hash[String, T.untyped]).returns(T.nilable(String)) }
         def fetch_version_from_parsed_lockfile(updated_lockfile)
           version =
             updated_lockfile.fetch("package", [])
@@ -124,25 +153,26 @@ module Dependabot
         end
 
         # rubocop:disable Metrics/AbcSize
+        sig { params(error: StandardError).returns(T.nilable(String)) }
         def handle_poetry_errors(error)
           error_handler.handle_poetry_error(error)
 
           if error.message.gsub(/\s/, "").match?(GIT_REFERENCE_NOT_FOUND_REGEX)
             message = error.message.gsub(/\s/, "")
             match = message.match(GIT_REFERENCE_NOT_FOUND_REGEX)
-            name = if (url = match.named_captures.fetch("url"))
+            name = if (url = T.must(match).named_captures.fetch("url"))
                      File.basename(T.must(URI.parse(url).path))
                    else
-                     message.match(GIT_REFERENCE_NOT_FOUND_REGEX)
-                            .named_captures.fetch("name")
+                     T.must(message.match(GIT_REFERENCE_NOT_FOUND_REGEX))
+                      .named_captures.fetch("name")
                    end
-            raise GitDependencyReferenceNotFound, name
+            raise GitDependencyReferenceNotFound, T.must(name)
           end
 
           if error.message.match?(GIT_DEPENDENCY_UNREACHABLE_REGEX)
-            url = error.message.match(GIT_DEPENDENCY_UNREACHABLE_REGEX)
-                       .named_captures.fetch("url")
-            raise GitDependenciesNotReachable, url
+            url = T.must(error.message.match(GIT_DEPENDENCY_UNREACHABLE_REGEX))
+                   .named_captures.fetch("url")
+            raise GitDependenciesNotReachable, T.must(url)
           end
 
           raise unless error.message.include?("SolverProblemError") ||
@@ -163,6 +193,7 @@ module Dependabot
 
         # Using `--lock` avoids doing an install.
         # Using `--no-interaction` avoids asking for passwords.
+        sig { void }
         def run_poetry_update_command
           run_poetry_command(
             "pyenv exec poetry update #{dependency.name} --lock --no-interaction",
@@ -170,6 +201,7 @@ module Dependabot
           )
         end
 
+        sig { returns(T::Boolean) }
         def check_original_requirements_resolvable
           return @original_reqs_resolvable if @original_reqs_resolvable
 
@@ -189,11 +221,18 @@ module Dependabot
           end
         end
 
+        sig { params(message: String).returns(String) }
         def clean_error_message(message)
           # Redact any URLs, as they may include credentials
           message.gsub(/http.*?(?=\s)/, "<redacted>")
         end
 
+        sig do
+          params(
+            updated_req: T.nilable(String),
+            update_pyproject: T::Boolean
+          ).void
+        end
         def write_temporary_dependency_files(updated_req: nil,
                                              update_pyproject: true)
           dependency_files.each do |file|
@@ -216,14 +255,16 @@ module Dependabot
           end
         end
 
+        sig { void }
         def add_auth_env_vars
           Python::FileUpdater::PyprojectPreparer
-            .new(pyproject_content: pyproject.content)
+            .new(pyproject_content: T.must(T.must(pyproject).content))
             .add_auth_env_vars(credentials)
         end
 
+        sig { params(updated_requirement: T.nilable(String)).returns(String) }
         def updated_pyproject_content(updated_requirement:)
-          content = pyproject.content
+          content = T.must(T.must(pyproject).content)
           content = sanitize_pyproject_content(content)
           content = update_python_requirement(content)
           content = freeze_other_dependencies(content)
@@ -231,31 +272,36 @@ module Dependabot
           content
         end
 
+        sig { returns(String) }
         def sanitized_pyproject_content
-          content = pyproject.content
+          content = T.must(T.must(pyproject).content)
           content = sanitize_pyproject_content(content)
           content = update_python_requirement(content)
           content
         end
 
+        sig { params(pyproject_content: String).returns(String) }
         def sanitize_pyproject_content(pyproject_content)
           Python::FileUpdater::PyprojectPreparer
             .new(pyproject_content: pyproject_content)
             .sanitize
         end
 
+        sig { params(pyproject_content: String).returns(String) }
         def update_python_requirement(pyproject_content)
           Python::FileUpdater::PyprojectPreparer
             .new(pyproject_content: pyproject_content)
             .update_python_requirement(language_version_manager.python_version)
         end
 
+        sig { params(pyproject_content: String).returns(String) }
         def freeze_other_dependencies(pyproject_content)
           Python::FileUpdater::PyprojectPreparer
             .new(pyproject_content: pyproject_content, lockfile: lockfile)
             .freeze_top_level_dependencies_except([dependency])
         end
 
+        sig { params(pyproject_content: String, updated_requirement: T.nilable(String)).returns(String) }
         def set_target_dependency_req(pyproject_content, updated_requirement)
           return pyproject_content unless updated_requirement
 
@@ -275,7 +321,7 @@ module Dependabot
           end
 
           # If this is a sub-dependency, add the new requirement
-          unless dependency.requirements.find { |r| r[:file] == pyproject.name }
+          unless dependency.requirements.find { |r| r[:file] == T.must(pyproject).name }
             poetry_object[subdep_type] ||= {}
             poetry_object[subdep_type][dependency.name] = updated_requirement
           end
@@ -283,6 +329,7 @@ module Dependabot
           TomlRB.dump(pyproject_object)
         end
 
+        sig { params(toml_node: T::Hash[String, T.untyped], requirement: String).void }
         def update_dependency_requirement(toml_node, requirement)
           names = toml_node.keys
           pkg_name = names.find { |nm| normalise(nm) == dependency.name }
@@ -295,10 +342,12 @@ module Dependabot
           end
         end
 
+        sig { returns(String) }
         def subdep_type
           dependency.production? ? "dependencies" : "dev-dependencies"
         end
 
+        sig { returns(FileParser::PythonRequirementParser) }
         def python_requirement_parser
           @python_requirement_parser ||=
             FileParser::PythonRequirementParser.new(
@@ -306,6 +355,7 @@ module Dependabot
             )
         end
 
+        sig { returns(LanguageVersionManager) }
         def language_version_manager
           @language_version_manager ||=
             LanguageVersionManager.new(
@@ -313,22 +363,27 @@ module Dependabot
             )
         end
 
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def pyproject
           dependency_files.find { |f| f.name == "pyproject.toml" }
         end
 
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def poetry_lock
           dependency_files.find { |f| f.name == "poetry.lock" }
         end
 
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def lockfile
           poetry_lock
         end
 
+        sig { params(command: String, fingerprint: T.nilable(String)).returns(String) }
         def run_poetry_command(command, fingerprint: nil)
           SharedHelpers.run_shell_command(command, fingerprint: fingerprint)
         end
 
+        sig { params(name: String).returns(String) }
         def normalise(name)
           NameNormaliser.normalise(name)
         end
@@ -395,8 +450,8 @@ module Dependabot
         ).void
       end
       def initialize(dependencies:, dependency_files:)
-        @dependencies = dependencies
-        @dependency_files = dependency_files
+        @dependencies = T.let(dependencies, Dependabot::Dependency)
+        @dependency_files = T.let(dependency_files, T::Array[Dependabot::DependencyFile])
       end
 
       private