dependabot-rust_toolchain 0.321.2

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: a5830c9f4d86184e1c80384cae659ffaf4e70b7e45a1834f9737dda7c227411d
+  data.tar.gz: 1f9e76c27dd366c5bc3aaed7e0cae480bd9fe7e69c4f850659b51d6275becc4c
+SHA512:
+  metadata.gz: 9267d58423d657c68aebdbd98c3ecd012b13a780c8ec011c803625fe028a03016ac2edc94b2839378c86fef06070fe48dce65d4a3be07babbd48e3b6ab24f3e3
+  data.tar.gz: '0943acc3a484ec3fba4ddaa1ea5e9d67f80b4d709f52909112dd0d3cc3c1e5ec6d7d926dda2a0d3d16f75f2e3680b4a842e9ae4a20cbf72d4e717a54ea2b8798'

data/lib/dependabot/rust_toolchain/channel.rb

@@ -0,0 +1,115 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+
+require "dependabot/rust_toolchain/channel_type"
+
+module Dependabot
+  module RustToolchain
+    class Channel
+      extend T::Sig
+
+      include Comparable
+
+      sig { returns(T.nilable(String)) }
+      attr_reader :stability
+
+      sig { returns(T.nilable(String)) }
+      attr_reader :date
+
+      sig { returns(T.nilable(String)) }
+      attr_accessor :version
+
+      sig { params(stability: T.nilable(String), date: T.nilable(String), version: T.nilable(String)).void }
+      def initialize(stability: nil, date: nil, version: nil)
+        @stability = stability
+        @date = date
+        @version = version
+      end
+
+      # Factory method to create a Channel from parser output
+      sig { params(parsed_data: T::Hash[Symbol, T.nilable(String)]).returns(Channel) }
+      def self.from_parsed_data(parsed_data)
+        new(
+          stability: parsed_data[:stability],
+          date: parsed_data[:date],
+          version: parsed_data[:version]
+        )
+      end
+
+      # Returns the channel type for comparison purposes
+      sig { returns(Dependabot::RustToolchain::ChannelType) }
+      def channel_type
+        case [!!version, !!(stability && date), !!stability]
+        in [true, _, _] then ChannelType::Version
+        in [false, true, _] then ChannelType::DatedStability
+        in [false, false, true] then ChannelType::Stability
+        else ChannelType::Unknown
+        end
+      end
+
+      # Comparable implementation - only compare channels of the same type
+      sig { params(other: Object).returns(T.nilable(Integer)) }
+      def <=>(other)
+        return nil unless other.is_a?(Channel)
+        return nil unless channel_type == other.channel_type
+
+        case channel_type
+        in ChannelType::Version
+          compare_versions(T.must(version), T.must(other.version))
+        in ChannelType::DatedStability
+          # Channels must be of the same type to compare dates
+          # i.e. cannot compare "nightly-2023-10-01" with "beta-2023-10-01"
+          return nil unless stability == other.stability
+
+          compare_dates(T.must(date), T.must(other.date))
+        end
+      end
+
+      sig { params(other: Object).returns(T::Boolean) }
+      def ==(other)
+        return false unless other.is_a?(Channel)
+
+        stability == other.stability && date == other.date && version == other.version
+      end
+
+      sig { returns(String) }
+      def to_s
+        case [version, stability, date]
+        in [String => v, _, _] then v
+        in [nil, String => c, String => d] then "#{c}-#{d}"
+        in [nil, String => c, _] then c
+        else "unknown"
+        end
+      end
+
+      sig { returns(String) }
+      def inspect
+        "#<#{self.class.name} channel=#{stability.inspect} date=#{date.inspect} version=#{version.inspect}>"
+      end
+
+      private
+
+      # Compare semantic versions (e.g., "1.72.0" vs "1.73.1")
+      sig { params(version1: String, version2: String).returns(Integer) }
+      def compare_versions(version1, version2)
+        v1_parts = version1.split(".").map(&:to_i)
+        v2_parts = version2.split(".").map(&:to_i)
+
+        # Pad shorter version parts with zeros to ensure equal length
+        max_length = [v1_parts.size, v2_parts.size].max
+        v1_parts.fill(0, v1_parts.size...max_length) if v1_parts.size < max_length
+        v2_parts.fill(0, v2_parts.size...max_length) if v2_parts.size < max_length
+
+        v1_parts <=> v2_parts
+      end
+
+      # Compare dates in YYYY-MM-DD format
+      sig { params(date1: String, date2: String).returns(Integer) }
+      def compare_dates(date1, date2)
+        T.must(date1 <=> date2)
+      end
+    end
+  end
+end

data/lib/dependabot/rust_toolchain/channel_parser.rb

@@ -0,0 +1,58 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+
+require "dependabot/rust_toolchain"
+require "dependabot/rust_toolchain/channel"
+
+module Dependabot
+  module RustToolchain
+    class ChannelParser
+      extend T::Sig
+
+      sig { params(toolchain: String).void }
+      def initialize(toolchain)
+        @toolchain = toolchain
+      end
+
+      # Parse Rust toolchain and extract components (stability, date, version)
+      #
+      # This doesn't support the full range of Rust toolchain formats, but we cover
+      # those that Dependabot is likely to encounter.
+      #
+      # See https://rust-lang.github.io/rustup/concepts/toolchains.html
+      sig { returns(T.nilable(Dependabot::RustToolchain::Channel)) }
+      def parse
+        case toolchain
+        # Specific version like 1.72.0 or 1.72
+        when /^\d+\.\d+(\.\d+)?$/
+          Channel.new(
+            stability: nil,
+            date: nil,
+            version: toolchain
+          )
+        # With date: nightly-2025-01-0, beta-2025-01-0, stable-2025-01-0
+        when /^(nightly|beta|stable)-(\d{4}-\d{2}-\d{2})$/
+          Channel.new(
+            stability: ::Regexp.last_match(1),
+            date: ::Regexp.last_match(2),
+            version: nil
+          )
+        # Without date: stable, beta, nightly
+        when STABLE_CHANNEL, BETA_CHANNEL, NIGHTLY_CHANNEL
+          Channel.new(
+            stability: toolchain,
+            date: nil,
+            version: nil
+          )
+        end
+      end
+
+      private
+
+      sig { returns(String) }
+      attr_reader :toolchain
+    end
+  end
+end

data/lib/dependabot/rust_toolchain/channel_type.rb

@@ -0,0 +1,24 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+
+module Dependabot
+  module RustToolchain
+    class ChannelType < T::Enum
+      enums do
+        # Represents a version with a specific version number
+        Version = new("Version")
+
+        # Represents a channel with a date, e.g., "nightly-2023-10-01"
+        DatedStability = new("DatedStability")
+
+        # Represents a channel without a date, e.g., "stable" or "beta"
+        Stability = new("Stability")
+
+        # Represents an unknown or unsupported type
+        Unknown = new("Unknown")
+      end
+    end
+  end
+end

data/lib/dependabot/rust_toolchain/file_fetcher.rb

@@ -0,0 +1,52 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+
+require "dependabot/file_fetchers"
+require "dependabot/file_fetchers/base"
+
+require "dependabot/rust_toolchain"
+
+module Dependabot
+  module RustToolchain
+    class FileFetcher < Dependabot::FileFetchers::Base
+      extend T::Sig
+
+      sig { override.params(filenames: T::Array[String]).returns(T::Boolean) }
+      def self.required_files_in?(filenames)
+        filenames.any? do |filename|
+          basename = File.basename(filename)
+          basename == RUST_TOOLCHAIN_TOML_FILENAME || basename == RUST_TOOLCHAIN_FILENAME
+        end
+      end
+
+      sig { override.returns(String) }
+      def self.required_files_message
+        "Repo must contain a #{RUST_TOOLCHAIN_TOML_FILENAME} or #{RUST_TOOLCHAIN_FILENAME} file"
+      end
+
+      sig { override.returns(T::Array[Dependabot::DependencyFile]) }
+      def fetch_files
+        files = [rust_toolchain_toml_file, rust_toolchain_file].compact
+
+        return files unless files.empty?
+
+        raise Dependabot::DependencyFileNotFound.new(
+          nil,
+          self.class.required_files_message
+        )
+      end
+
+      private
+
+      sig { returns(T.nilable(Dependabot::DependencyFile)) }
+      def rust_toolchain_toml_file = fetch_file_if_present(RUST_TOOLCHAIN_TOML_FILENAME)
+
+      sig { returns(T.nilable(Dependabot::DependencyFile)) }
+      def rust_toolchain_file = fetch_file_if_present(RUST_TOOLCHAIN_FILENAME)
+    end
+  end
+end
+
+Dependabot::FileFetchers.register("rust_toolchain", Dependabot::RustToolchain::FileFetcher)

data/lib/dependabot/rust_toolchain/file_parser.rb

@@ -0,0 +1,109 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+require "toml-rb"
+
+require "dependabot/dependency"
+require "dependabot/errors"
+require "dependabot/file_parsers"
+require "dependabot/file_parsers/base"
+require "dependabot/file_parsers/base/dependency_set"
+
+require "dependabot/rust_toolchain/package_manager"
+
+module Dependabot
+  module RustToolchain
+    class FileParser < Dependabot::FileParsers::Base
+      extend T::Sig
+
+      sig { override.returns(T::Array[Dependabot::Dependency]) }
+      def parse
+        dependency_set = DependencySet.new
+
+        dependency_files.each do |dependency_file|
+          dependency = parse_dependency_file(dependency_file)
+          next unless dependency
+
+          dependency_set << dependency
+        end
+
+        dependency_set.dependencies
+      end
+
+      sig { returns(Dependabot::Ecosystem) }
+      def ecosystem
+        @ecosystem ||= T.let(
+          Dependabot::Ecosystem.new(
+            name: "rust_toolchain",
+            package_manager: package_manager
+          ),
+          T.nilable(Dependabot::Ecosystem)
+        )
+      end
+
+      private
+
+      sig { override.void }
+      def check_required_files
+        return if dependency_files.any?
+
+        raise "Could not find any dependency files to parse. " \
+              "Expected to find a file named 'rust-toolchain' or 'rust-toolchain.toml'."
+      end
+
+      sig { params(dependency_file: Dependabot::DependencyFile).returns(T.nilable(Dependabot::Dependency)) }
+      def parse_dependency_file(dependency_file)
+        content = T.must(dependency_file.content).strip
+
+        channel = case dependency_file.name
+                  when /\.toml$/
+                    parse_toml_toolchain(content)
+                  else
+                    parse_plaintext_toolchain(content)
+                  end
+
+        return if channel.empty?
+
+        Dependency.new(
+          name: "rust-toolchain",
+          version: channel,
+          requirements: [{
+            file: dependency_file.name,
+            requirement: channel,
+            groups: [],
+            source: nil
+          }],
+          package_manager: "rust_toolchain"
+        )
+      end
+
+      sig { params(content: String).returns(String) }
+      def parse_toml_toolchain(content)
+        parsed = TomlRB.parse(content)
+
+        channel = parsed.dig("toolchain", "channel")
+        return channel if channel
+
+        Dependabot.logger.warn("No toolchain section found in rust-toolchain.toml file.")
+        raise Dependabot::DependencyFileNotParseable, "rust-toolchain.toml"
+      rescue TomlRB::ParseError => e
+        Dependabot.logger.warn("Failed to parse rust-toolchain.toml file: #{e.message}")
+        raise Dependabot::DependencyFileNotParseable, "rust-toolchain.toml"
+      end
+
+      sig { params(content: String).returns(String) }
+      def parse_plaintext_toolchain(content) = content.strip
+
+      sig { returns(Dependabot::Ecosystem::VersionManager) }
+      def package_manager
+        @package_manager ||= T.let(
+          Dependabot::RustToolchain::RustToolchainPackageManager.new,
+          T.nilable(Dependabot::Ecosystem::VersionManager)
+        )
+      end
+    end
+  end
+end
+
+Dependabot::FileParsers.register("rust_toolchain", Dependabot::RustToolchain::FileParser)

data/lib/dependabot/rust_toolchain/file_updater.rb

@@ -0,0 +1,67 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+
+require "dependabot/file_updaters"
+require "dependabot/file_updaters/base"
+
+require "dependabot/rust_toolchain"
+
+module Dependabot
+  module RustToolchain
+    class FileUpdater < Dependabot::FileUpdaters::Base
+      extend T::Sig
+
+      sig { override.returns(T::Array[Regexp]) }
+      def self.updated_files_regex
+        [
+          /rust-toolchain$/,
+          /rust-toolchain\.toml$/
+        ]
+      end
+
+      sig { override.returns(T::Array[Dependabot::DependencyFile]) }
+      def updated_dependency_files
+        updated_files = []
+
+        rust_toolchain_files.each do |file|
+          next unless file_changed?(file)
+
+          updated_files << updated_file(file: file, content: update(T.must(file.content)))
+        end
+
+        updated_files
+      end
+
+      private
+
+      sig { returns(Dependabot::Dependency) }
+      def dependency
+        T.must(dependencies.first)
+      end
+
+      sig { override.void }
+      def check_required_files
+        return if dependency_files.any?
+
+        raise "Could not find any dependency files to update. " \
+              "Expected to find a file named 'rust-toolchain' or 'rust-toolchain.toml'."
+      end
+
+      sig { returns(T::Array[Dependabot::DependencyFile]) }
+      def rust_toolchain_files
+        dependency_files.select do |f|
+          f.name == RUST_TOOLCHAIN_FILENAME || f.name == RUST_TOOLCHAIN_TOML_FILENAME
+        end
+      end
+
+      sig { params(content: String).returns(String) }
+      def update(content)
+        content.gsub(T.must(dependency.previous_version), T.must(dependency.version))
+      end
+    end
+  end
+end
+
+Dependabot::FileUpdaters.register("rust_toolchain", Dependabot::RustToolchain::FileUpdater)

data/lib/dependabot/rust_toolchain/metadata_finder.rb

@@ -0,0 +1,28 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "nokogiri"
+require "sorbet-runtime"
+
+require "dependabot/metadata_finders"
+require "dependabot/metadata_finders/base"
+require "dependabot/registry_client"
+
+require "dependabot/rust_toolchain"
+
+module Dependabot
+  module RustToolchain
+    class MetadataFinder < Dependabot::MetadataFinders::Base
+      extend T::Sig
+
+      private
+
+      sig { override.returns(T.nilable(Dependabot::Source)) }
+      def look_up_source
+        Dependabot::Source.from_url(RUST_GITHUB_URL)
+      end
+    end
+  end
+end
+
+Dependabot::MetadataFinders.register("rust_toolchain", Dependabot::RustToolchain::MetadataFinder)

data/lib/dependabot/rust_toolchain/package/package_details_fetcher.rb

@@ -0,0 +1,97 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+require "uri"
+
+require "dependabot/package/package_details"
+require "dependabot/registry_client"
+require "dependabot/update_checkers/base"
+
+require "dependabot/rust_toolchain"
+require "dependabot/rust_toolchain/channel"
+require "dependabot/rust_toolchain/channel_parser"
+require "dependabot/rust_toolchain/version"
+
+module Dependabot
+  module RustToolchain
+    module Package
+      class PackageDetailsFetcher
+        extend T::Sig
+
+        MANIFESTS_URL = "https://static.rust-lang.org/manifests.txt"
+
+        sig do
+          params(
+            dependency: Dependabot::Dependency
+          ).void
+        end
+        def initialize(dependency:)
+          @dependency = dependency
+        end
+
+        sig { returns(Dependabot::Package::PackageDetails) }
+        def fetch
+          if all_versions.nil? || all_versions.empty?
+            raise Dependabot::DependencyFileNotResolvable, "No versions found in manifests.txt"
+          end
+
+          Dependabot::Package::PackageDetails.new(
+            dependency: dependency,
+            releases: all_versions.map { |v| Dependabot::Package::PackageRelease.new(version: v) },
+            dist_tags: nil
+          )
+        end
+
+        private
+
+        sig { returns(T::Array[Dependabot::RustToolchain::Version]) }
+        def all_versions
+          @all_versions ||= T.let(fetch_and_parse_manifests, T.nilable(T::Array[Dependabot::RustToolchain::Version]))
+        end
+
+        # Fetch the manifests.txt file and parse each line to extract version information
+        sig { returns(T::Array[Dependabot::RustToolchain::Version]) }
+        def fetch_and_parse_manifests
+          response = Dependabot::RegistryClient.get(url: MANIFESTS_URL)
+          manifests_content = response.body
+
+          channels = T.let([], T::Array[Dependabot::RustToolchain::Version])
+
+          manifests_content.each_line do |line|
+            line = line.strip
+            next if line.empty?
+
+            channel = parse_manifest_line(line)
+            channels << channel if channel
+          end
+
+          channels.uniq
+        end
+
+        sig { params(line: String).returns(T.nilable(Dependabot::RustToolchain::Version)) }
+        def parse_manifest_line(line)
+          match = line.match(%r{static\.rust-lang\.org/dist/(\d{4}-\d{2}-\d{2})/channel-rust-(.+)\.toml})
+          return nil unless match
+
+          date = match[1]
+          channel_part = match[2]
+
+          case channel_part
+          when STABLE_CHANNEL
+            Version.new("#{STABLE_CHANNEL}-#{date}")
+          when BETA_CHANNEL
+            Version.new("#{BETA_CHANNEL}-#{date}")
+          when NIGHTLY_CHANNEL
+            Version.new("#{NIGHTLY_CHANNEL}-#{date}")
+          when /^\d+\.\d+(\.\d+)?$/
+            Version.new(channel_part)
+          end
+        end
+
+        sig { returns(Dependabot::Dependency) }
+        attr_reader :dependency
+      end
+    end
+  end
+end

data/lib/dependabot/rust_toolchain/package_manager.rb

@@ -0,0 +1,46 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+
+require "dependabot/ecosystem"
+
+require "dependabot/rust_toolchain/requirement"
+require "dependabot/rust_toolchain/version"
+
+module Dependabot
+  module RustToolchain
+    class RustToolchainPackageManager < Dependabot::Ecosystem::VersionManager
+      extend T::Sig
+
+      # This is a placeholder version for the package manager.
+      VERSION = "1.0.0"
+
+      SUPPORTED_VERSIONS = T.let([].freeze, T::Array[Dependabot::Version])
+
+      DEPRECATED_VERSIONS = T.let([].freeze, T::Array[Dependabot::Version])
+
+      sig do
+        void
+      end
+      def initialize
+        super(
+          name: PACKAGE_MANAGER,
+          version: Version.new(VERSION),
+          deprecated_versions: DEPRECATED_VERSIONS,
+          supported_versions: SUPPORTED_VERSIONS
+       )
+      end
+
+      sig { override.returns(T::Boolean) }
+      def deprecated?
+        false
+      end
+
+      sig { override.returns(T::Boolean) }
+      def unsupported?
+        false
+      end
+    end
+  end
+end