dependabot-python 0.86.3 → 0.86.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ec5bbb936cbd185f711b8bc31a04558a345f9c3b536ffc55fb70861b3a76827d
-  data.tar.gz: 112f0d76dc9192896ab4de0bf7e53f4d2e65a3eb88387c43978fe21a21f1a70c
+  metadata.gz: ac640bf9a47275ef209943942948251fe5e46566f1f4a05836079adee09b03c4
+  data.tar.gz: ebd52009a78d217b5a7f502060256f8e4450c7987fa1be732d963c2e9233c526
 SHA512:
-  metadata.gz: be281d7c4d85e1f02c24fab46377432d6aa6afe804372c17367c89aa79e1ac046108616a11a787f3f24c5d15be342cdddc3982144bd098a299b034049d00c71e
-  data.tar.gz: 8d10489a806ca3a18ba0859accbd9b067e3909646f6605ead9aa89def9a1f25c5dc114d0c2ef16eaedf081a9579fb88fdccbf1fe17f7d4873ecda45e9134bfb9
+  metadata.gz: 8b8bee1cf37744d2ae01989f4b7e982f1db7fd69969c25363f587cce79a24dcaf620ce7a3271c50f5697dc02df66275c19899672dec202f89177c94457f74423
+  data.tar.gz: bca5ad20b033135a0cd5c50b4effc438a7002da5ca9350c919952dcbac7b91b0fb613b751c96e8f2f2800b78ef5f9a349cf92f9906714b1a4ac64f776f484e36

data/lib/dependabot/python/update_checker/latest_version_finder.rb

@@ -9,6 +9,8 @@ module Dependabot
   module Python
     class UpdateChecker
       class LatestVersionFinder
+        ENVIRONMENT_VARIABLE_REGEX = /\$\{.+\}/.freeze
+
         def initialize(dependency:, dependency_files:, credentials:,
                        ignored_versions:)
           @dependency       = dependency
@@ -95,29 +97,32 @@ module Dependabot
         end
 
         def index_urls
-          main_index_url =
-            config_variable_index_urls[:main] ||
-            pipfile_index_urls[:main] ||
-            requirement_file_index_urls[:main] ||
-            pip_conf_index_urls[:main] ||
-            "https://pypi.python.org/simple/"
-
-          if main_index_url
-            main_index_url = main_index_url.strip.gsub(%r{/*$}, "") + "/"
-          end
-
           extra_index_urls =
             config_variable_index_urls[:extra] +
             pipfile_index_urls[:extra] +
             requirement_file_index_urls[:extra] +
             pip_conf_index_urls[:extra]
 
-          extra_index_urls =
-            extra_index_urls.map { |url| url.strip.gsub(%r{/*$}, "") + "/" }
+          extra_index_urls = extra_index_urls.map do |url|
+            clean_check_and_remove_environment_variables(url)
+          end
 
           [main_index_url, *extra_index_urls].uniq
         end
 
+        def main_index_url
+          url =
+            config_variable_index_urls[:main] ||
+            pipfile_index_urls[:main] ||
+            requirement_file_index_urls[:main] ||
+            pip_conf_index_urls[:main] ||
+            "https://pypi.python.org/simple/"
+
+          return unless url
+
+          clean_check_and_remove_environment_variables(url)
+        end
+
         def registry_response_for_dependency(index_url)
           Excon.get(
             index_url + normalised_name + "/",
@@ -201,6 +206,27 @@ module Dependabot
           urls
         end
 
+        def clean_check_and_remove_environment_variables(url)
+          url = url.strip.gsub(%r{/*$}, "") + "/"
+          return url unless url.match?(ENVIRONMENT_VARIABLE_REGEX)
+
+          config_variable_urls =
+            [
+              config_variable_index_urls[:main],
+              *config_variable_index_urls[:extra]
+            ].
+            compact.
+            map { |u| u.strip.gsub(%r{/*$}, "") + "/" }
+
+          regexp = url.split(ENVIRONMENT_VARIABLE_REGEX).
+                   map { |part| Regexp.quote(part) }.
+                   join(".+")
+          authed_url = config_variable_urls.find { |u| u.match?(regexp) }
+          return authed_url if authed_url
+
+          raise PrivateSourceAuthenticationFailure, url
+        end
+
         def ignore_reqs
           ignored_versions.map { |req| requirement_class.new(req.split(",")) }
         end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-python
 version: !ruby/object:Gem::Version
-  version: 0.86.3
+  version: 0.86.4
 platform: ruby
 authors:
 - Dependabot
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.86.3
+        version: 0.86.4
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.86.3
+        version: 0.86.4
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement