dependabot-terraform 0.145.3 → 0.147.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 31c573e2007e5e402b99a716654cde3f86a92ba93bfba9c5001fd6a64f22708b
-  data.tar.gz: 1b6036b61190e1f215d21397941baf800bc459308730b1720d7c026f89cfa7a2
+  metadata.gz: 1513bb43b2a242c080012555ab17869d6c062e941912c36dcc5ea76476be03b9
+  data.tar.gz: 731c9a7cd5658b622f7a24e87ea9a48909094af9cba08deb9850cb55a7f19bd9
 SHA512:
-  metadata.gz: 588cb4a84609aa084258e4a2dae5cb92c1515eb3fe3a0c63cbc0f4f5827a16fa940ee51876dd189103d96973b6bd8af28cdeadf836f55d8a874cc18a71a658d0
-  data.tar.gz: 429a5d3666109a065eab96047ecee80df76ad13ea91a097262dde0aec05735984ddb6f542cc29f3c3ea1ab51e9a6ebeb55eef0632942f8e26bcea7f4b3376fe6
+  metadata.gz: 3ea9a436607ccb4b54b21743d6952d41b4a86bd344724372facdb6368b1fd6b1d24b7327ae569738280b8bd4187ae78f9fad0b458ac8832665a0741ca380eb33
+  data.tar.gz: b438039b06970eaf03a187567432a785e4f7eb2e9f61b18dffbdec99aa39080e2c322467d40b830af9b83356355a1d4702f61bbe84c9bdac50187309e7709a4d

data/helpers/build

@@ -13,7 +13,10 @@ if [ ! -d "$install_dir/bin" ]; then
 fi
 
 os="$(uname -s | tr '[:upper:]' '[:lower:]')"
-github_url="https://github.com/kvz/json2hcl"
-url="${github_url}/releases/download/v0.0.6/json2hcl_v0.0.6_${os}_amd64"
-wget -O "$install_dir/bin/json2hcl" "$url"
-chmod +x "$install_dir/bin/json2hcl"
+
+hcl2json_checksum="24068f1e25a34d8f8ca763f34fce11527472891bfa834d1504f665855021d5d4"
+hcl2json_url="https://github.com/tmccombs/hcl2json/releases/download/v0.3.3/hcl2json_${os}_amd64"
+hcl2json_path="$install_dir/bin/hcl2json"
+wget -O "$hcl2json_path" "$hcl2json_url"
+echo "$hcl2json_checksum  $hcl2json_path" | sha256sum -c
+chmod +x "$install_dir/bin/hcl2json"

data/lib/dependabot/terraform/file_fetcher.rb

@@ -2,12 +2,15 @@
 
 require "dependabot/file_fetchers"
 require "dependabot/file_fetchers/base"
+require "dependabot/terraform/file_selector"
 
 module Dependabot
   module Terraform
     class FileFetcher < Dependabot::FileFetchers::Base
+      include FileSelector
+
       def self.required_files_in?(filenames)
-        filenames.any? { |f| f.end_with?(".tf", ".tfvars") }
+        filenames.any? { |f| f.end_with?(".tf", ".hcl") }
       end
 
       def self.required_files_message
@@ -39,7 +42,7 @@ module Dependabot
       def terragrunt_files
         @terragrunt_files ||=
           repo_contents(raise_errors: false).
-          select { |f| f.type == "file" && f.name.end_with?(".tfvars") }.
+          select { |f| f.type == "file" && terragrunt_file?(f.name) }.
           map { |f| fetch_file_from_host(f.name) }
       end
     end

data/lib/dependabot/terraform/file_parser.rb

@@ -10,27 +10,29 @@ require "dependabot/file_parsers/base"
 require "dependabot/git_commit_checker"
 require "dependabot/shared_helpers"
 require "dependabot/errors"
+require "dependabot/terraform/file_selector"
 
 module Dependabot
   module Terraform
     class FileParser < Dependabot::FileParsers::Base
       require "dependabot/file_parsers/base/dependency_set"
 
+      include FileSelector
+
       ARCHIVE_EXTENSIONS = %w(.zip .tbz2 .tgz .txz).freeze
 
       def parse
         dependency_set = DependencySet.new
 
         terraform_files.each do |file|
-          modules = parsed_file(file).fetch("module", []).map(&:first)
+          modules = parsed_file(file).fetch("module", {})
           modules.each do |name, details|
             dependency_set << build_terraform_dependency(file, name, details)
           end
         end
 
         terragrunt_files.each do |file|
-          modules = parsed_file(file).fetch("terragrunt", []).first || {}
-          modules = modules.fetch("terraform", [])
+          modules = parsed_file(file).fetch("terraform", [])
           modules.each do |details|
             next unless details["source"]
 
@@ -38,7 +40,7 @@ module Dependabot
           end
         end
 
-        dependency_set.dependencies
+        dependency_set.dependencies.sort_by(&:name)
       end
 
       private
@@ -210,30 +212,51 @@ module Dependabot
       end
       # rubocop:enable Metrics/PerceivedComplexity
 
+      # == Returns:
+      # A Hash representing each module found in the specified file
+      #
+      # E.g.
+      # {
+      #   "module" => {
+      #     {
+      #       "consul" => [
+      #         {
+      #           "source"=>"consul/aws",
+      #           "version"=>"0.1.0"
+      #         }
+      #       ]
+      #     }
+      #   },
+      #   "terragrunt"=>[
+      #     {
+      #       "include"=>[{ "path"=>"${find_in_parent_folders()}" }],
+      #       "terraform"=>[{ "source" => "git::git@github.com:gruntwork-io/modules-example.git//consul?ref=v0.0.2" }]
+      #     }
+      #   ],
+      # }
       def parsed_file(file)
         @parsed_buildfile ||= {}
-        @parsed_buildfile[file.name] ||=
-          SharedHelpers.in_a_temporary_directory do
-            File.write("tmp.tf", file.content)
-
-            command = "#{terraform_parser_path} -reverse < tmp.tf"
-            start = Time.now
-            stdout, stderr, process = Open3.capture3(command)
-            time_taken = Time.now - start
-
-            unless process.success?
-              raise SharedHelpers::HelperSubprocessFailed.new(
-                message: stderr,
-                error_context: {
-                  command: command,
-                  time_taken: time_taken,
-                  process_exit_value: process.to_s
-                }
-              )
-            end
-
-            JSON.parse(stdout)
+        @parsed_buildfile[file.name] ||= SharedHelpers.in_a_temporary_directory do
+          File.write("tmp.tf", file.content)
+
+          command = "#{terraform_hcl2_parser_path} < tmp.tf"
+          start = Time.now
+          stdout, stderr, process = Open3.capture3(command)
+          time_taken = Time.now - start
+
+          unless process.success?
+            raise SharedHelpers::HelperSubprocessFailed.new(
+              message: stderr,
+              error_context: {
+                command: command,
+                time_taken: time_taken,
+                process_exit_value: process.to_s
+              }
+            )
           end
+
+          JSON.parse(stdout)
+        end
       rescue SharedHelpers::HelperSubprocessFailed => e
         msg = e.message.strip
         raise Dependabot::DependencyFileNotParseable.new(file.path, msg)
@@ -244,19 +267,16 @@ module Dependabot
         Pathname.new(File.join(helper_bin_dir, "json2hcl")).cleanpath.to_path
       end
 
+      def terraform_hcl2_parser_path
+        helper_bin_dir = File.join(native_helpers_root, "terraform/bin")
+        Pathname.new(File.join(helper_bin_dir, "hcl2json")).cleanpath.to_path
+      end
+
       def native_helpers_root
         default_path = File.join(__dir__, "../../../helpers/install-dir")
         ENV.fetch("DEPENDABOT_NATIVE_HELPERS_PATH", default_path)
       end
 
-      def terraform_files
-        dependency_files.select { |f| f.name.end_with?(".tf") }
-      end
-
-      def terragrunt_files
-        dependency_files.select { |f| f.name.end_with?(".tfvars") }
-      end
-
       def check_required_files
         return if [*terraform_files, *terragrunt_files].any?
 

data/lib/dependabot/terraform/file_selector.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+module FileSelector
+  private
+
+  def terraform_files
+    dependency_files.select { |f| f.name.end_with?(".tf") }
+  end
+
+  def terragrunt_files
+    dependency_files.select { |f| terragrunt_file?(f.name) }
+  end
+
+  def terragrunt_file?(file_name)
+    file_name != ".terraform.lock.hcl" && file_name.end_with?(".hcl")
+  end
+end

data/lib/dependabot/terraform/file_updater.rb

@@ -3,12 +3,15 @@
 require "dependabot/file_updaters"
 require "dependabot/file_updaters/base"
 require "dependabot/errors"
+require "dependabot/terraform/file_selector"
 
 module Dependabot
   module Terraform
     class FileUpdater < Dependabot::FileUpdaters::Base
+      include FileSelector
+
       def self.updated_files_regex
-        [/\.tf$/, /\.tfvars$/]
+        [/\.tf$/, /\.hcl$/]
       end
 
       def updated_dependency_files
@@ -87,14 +90,6 @@ module Dependabot
         dependency_files.select { |file| filenames.include?(file.name) }
       end
 
-      def terraform_files
-        dependency_files.select { |f| f.name.end_with?(".tf") }
-      end
-
-      def terragrunt_files
-        dependency_files.select { |f| f.name.end_with?(".tfvars") }
-      end
-
       def check_required_files
         return if [*terraform_files, *terragrunt_files].any?
 
@@ -113,7 +108,7 @@ module Dependabot
       def git_declaration_regex(filename)
         # For terragrunt dependencies there's not a lot we can base the
         # regex on. Just look for declarations within a `terraform` block
-        return /terraform\s*\{(?:(?!^\}).)*/m if filename.end_with?(".tfvars")
+        return /terraform\s*\{(?:(?!^\}).)*/m if terragrunt_file?(filename)
 
         # For modules we can do better - filter for module blocks that use the
         # name of the dependency

data/lib/dependabot/terraform/requirements_updater.rb

@@ -10,9 +10,45 @@ require "dependabot/terraform/requirement"
 
 module Dependabot
   module Terraform
+    # Takes an array of `requirements` hashes for a dependency at the old
+    # version and a new version, and generates a set of new `requirements`
+    # hashes at the new version.
+    #
+    # A requirements hash is a basic description of a dependency at a certain
+    # version constraint, and it includes the data that is needed to update the
+    # manifest (i.e. the `.tf` file) with the new version.
+    #
+    # A requirements hash looks like this for a registry hosted requirement:
+    # ```ruby
+    # {
+    #   requirement: "~> 0.2.1",
+    #   groups: [],
+    #   file: "main.tf",
+    #   source: {
+    #     type: "registry",
+    #     registry_hostname: "registry.terraform.io",
+    #     module_identifier: "hashicorp/consul/aws"
+    #   }
+    # }
+    #
+    # And like this for a git requirement:
+    # ```ruby
+    # {
+    #   requirement: nil,
+    #   groups: [],
+    #   file: "main.tf",
+    #   source: {
+    #     type: "git",
+    #     url: "https://github.com/cloudposse/terraform-null-label.git",
+    #     branch: nil,
+    #     ref: nil
+    #   }
+    # }
     class RequirementsUpdater
-      def initialize(requirements:, latest_version:,
-                     tag_for_latest_version:)
+      # @param requirements [Hash{Symbol => String, Array, Hash}]
+      # @param latest_version [Dependabot::Terraform::Version]
+      # @param tag_for_latest_version [String, NilClass]
+      def initialize(requirements:, latest_version:, tag_for_latest_version:)
         @requirements = requirements
         @tag_for_latest_version = tag_for_latest_version
 
@@ -22,6 +58,11 @@ module Dependabot
         @latest_version = version_class.new(latest_version)
       end
 
+      # @return requirements [Hash{Symbol => String, Array, Hash}]
+      #   * requirement [String, NilClass] the updated version constraint
+      #   * groups [Array] no-op for terraform
+      #   * file [String] the file that specified this dependency
+      #   * source [Hash{Symbol => String}] The updated git or registry source details
       def updated_requirements
         return requirements unless latest_version
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-terraform
 version: !ruby/object:Gem::Version
-  version: 0.145.3
+  version: 0.147.1
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-05-07 00:00:00.000000000 Z
+date: 2021-05-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.145.3
+        version: 0.147.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.145.3
+        version: 0.147.1
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement
@@ -100,14 +100,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.14.0
+        version: 1.15.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.14.0
+        version: 1.15.0
 - !ruby/object:Gem::Dependency
   name: simplecov
   requirement: !ruby/object:Gem::Requirement
@@ -189,6 +189,7 @@ files:
 - lib/dependabot/terraform.rb
 - lib/dependabot/terraform/file_fetcher.rb
 - lib/dependabot/terraform/file_parser.rb
+- lib/dependabot/terraform/file_selector.rb
 - lib/dependabot/terraform/file_updater.rb
 - lib/dependabot/terraform/metadata_finder.rb
 - lib/dependabot/terraform/requirement.rb