dependabot-terraform 0.147.0 → 0.148.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 21f0249523d3bd37b7c26bfcc7e76b0246cb83ef62c8e7aabd76d3cf207476c9
-  data.tar.gz: 791a20bc9878a4f7e5e1806824551bee1102dc9c9eb8b2dd58a0fbe1e880fd05
+  metadata.gz: 557281ba17818b79b7e7513d51032317191ea128bb2b70a9021967eb67e53394
+  data.tar.gz: 2f209922a5bdd9cfcd85f1746724eea11fa77709e7388aabd699d7dd192d5e83
 SHA512:
-  metadata.gz: b464c8b17eebf7f615824a79b85d660446e13e38741bfe60d195bf78643c0a983536c267719f3f775e78be1308d93b8cf1ba0c58ee7bddefa49404b2f1652fe9
-  data.tar.gz: 40b1ca7f782c0ed4d5309f293a72572d5f34be8963bbb4f7097d891a3545c7362d2331b029992776a4446ee5933bec22211d0848d9aff9df40d2b29839a50bf0
+  metadata.gz: f8dbf7cb6b636039b77c6b4834f0e24588c44836a73d28f6aab6ea1fe71dba615809185033cab51366629a3d69cb3c81e6ab4e1f782dc768620ddab0b91ec961
+  data.tar.gz: c5c1fbb0c5b9437a13023205dec1091a348d8ff99c8004f533352c97cdfd65b6070600ff40fcd7bd0fb5fb0bd1b202ce1c0d6b284fae97bd0aabf08a08810782

data/helpers/build

@@ -14,13 +14,6 @@ fi
 
 os="$(uname -s | tr '[:upper:]' '[:lower:]')"
 
-json2hcl_checksum="d124ed13f3538c465fcab19e6015d311d3cd56f7dc2db7609b6e72fec666482d"
-json2hcl_url="https://github.com/kvz/json2hcl/releases/download/v0.0.6/json2hcl_v0.0.6_${os}_amd64"
-json2hcl_path="$install_dir/bin/json2hcl"
-wget -O "$json2hcl_path"  "$json2hcl_url"
-echo "$json2hcl_checksum  $json2hcl_path" | sha256sum -c
-chmod +x "$install_dir/bin/json2hcl"
-
 hcl2json_checksum="24068f1e25a34d8f8ca763f34fce11527472891bfa834d1504f665855021d5d4"
 hcl2json_url="https://github.com/tmccombs/hcl2json/releases/download/v0.3.3/hcl2json_${os}_amd64"
 hcl2json_path="$install_dir/bin/hcl2json"

data/lib/dependabot/terraform/file_fetcher.rb

@@ -10,7 +10,7 @@ module Dependabot
       include FileSelector
 
       def self.required_files_in?(filenames)
-        filenames.any? { |f| f.end_with?(".tf", ".tfvars") }
+        filenames.any? { |f| f.end_with?(".tf", ".hcl") }
       end
 
       def self.required_files_message

data/lib/dependabot/terraform/file_parser.rb

@@ -27,15 +27,21 @@ module Dependabot
         terraform_files.each do |file|
           modules = parsed_file(file).fetch("module", {})
           modules.each do |name, details|
-            dependency_set << build_terraform_dependency(file, name, details)
+            dependency_set << build_terraform_dependency(file, name, details, false)
+          end
+
+          parsed_file(file).fetch("terraform", []).each do |terraform|
+            required_providers = terraform.fetch("required_providers", {})
+            required_providers.each do |provider|
+              provider.each do |name, details|
+                dependency_set << build_terraform_dependency(file, name, details, true)
+              end
+            end
           end
         end
 
         terragrunt_files.each do |file|
-          # legacy terragrunt (.tfvars) files have a top-level "terragrunt" key
-          # that has since been removed.
-          legacy_modules = (parsed_file(file).fetch("terragrunt", []).first || {}).fetch("terraform", [])
-          modules = parsed_file(file).fetch("terraform", []) + legacy_modules
+          modules = parsed_file(file).fetch("terraform", [])
           modules.each do |details|
             next unless details["source"]
 
@@ -48,12 +54,15 @@ module Dependabot
 
       private
 
-      def build_terraform_dependency(file, name, details)
-        details = details.first
+      def build_terraform_dependency(file, name, details, provider)
+        details = details.is_a?(Array) ? details.first : details
 
-        source = source_from(details)
-        dep_name =
-          source[:type] == "registry" ? source[:module_identifier] : name
+        source = source_from(details, provider)
+        dep_name = case source[:type]
+                   when "registry" then source[:module_identifier]
+                   when "provider" then details["source"]
+                   else name
+                   end
         version_req = details["version"]&.strip
         version =
           if source[:type] == "git" then version_from_ref(source[:ref])
@@ -74,7 +83,7 @@ module Dependabot
       end
 
       def build_terragrunt_dependency(file, details)
-        source = source_from(details)
+        source = source_from(details, false)
         dep_name =
           if Source.from_url(source[:url])
             Source.from_url(source[:url]).repo
@@ -98,7 +107,7 @@ module Dependabot
       end
 
       # Full docs at https://www.terraform.io/docs/modules/sources.html
-      def source_from(details_hash)
+      def source_from(details_hash, provider)
         raw_source = details_hash.fetch("source")
         bare_source = get_proxied_source(raw_source)
 
@@ -109,17 +118,23 @@ module Dependabot
           when :github, :bitbucket, :git
             git_source_details_from(bare_source)
           when :registry
-            registry_source_details_from(bare_source)
+            registry_source_details_from(bare_source, provider)
           end
 
         source_details[:proxy_url] = raw_source if raw_source != bare_source
         source_details
       end
 
-      def registry_source_details_from(source_string)
+      def registry_source_details_from(source_string, provider)
         parts = source_string.split("//").first.split("/")
 
-        if parts.count == 3
+        if provider && parts.count == 2
+          {
+            "type": "provider",
+            "registry_hostname": "registry.terraform.io",
+            "module_identifier": source_string
+          }
+        elsif parts.count == 3
           {
             type: "registry",
             registry_hostname: "registry.terraform.io",
@@ -215,56 +230,6 @@ module Dependabot
       end
       # rubocop:enable Metrics/PerceivedComplexity
 
-      def parsed_file_hcl2(file)
-        SharedHelpers.in_a_temporary_directory do
-          File.write("tmp.tf", file.content)
-
-          command = "#{terraform_hcl2_parser_path} < tmp.tf"
-          start = Time.now
-          stdout, stderr, process = Open3.capture3(command)
-          time_taken = Time.now - start
-
-          unless process.success?
-            raise SharedHelpers::HelperSubprocessFailed.new(
-              message: stderr,
-              error_context: {
-                command: command,
-                time_taken: time_taken,
-                process_exit_value: process.to_s
-              }
-            )
-          end
-
-          JSON.parse(stdout)
-        end
-      end
-
-      def parsed_file_hcl1(file)
-        SharedHelpers.in_a_temporary_directory do
-          File.write("tmp.tf", file.content)
-
-          command = "#{terraform_parser_path} -reverse < tmp.tf"
-          start = Time.now
-          stdout, stderr, process = Open3.capture3(command)
-          time_taken = Time.now - start
-
-          unless process.success?
-            raise SharedHelpers::HelperSubprocessFailed.new(
-              message: stderr,
-              error_context: {
-                command: command,
-                time_taken: time_taken,
-                process_exit_value: process.to_s
-              }
-            )
-          end
-
-          json = JSON.parse(stdout)
-          json["module"] = json.fetch("module", []).inject({}) { |memo, item| memo.merge(item) }
-          json
-        end
-      end
-
       # == Returns:
       # A Hash representing each module found in the specified file
       #
@@ -289,12 +254,27 @@ module Dependabot
       # }
       def parsed_file(file)
         @parsed_buildfile ||= {}
-        @parsed_buildfile[file.name] ||=
-          if options[:legacy_terraform]
-            parsed_file_hcl1(file)
-          else
-            parsed_file_hcl2(file)
+        @parsed_buildfile[file.name] ||= SharedHelpers.in_a_temporary_directory do
+          File.write("tmp.tf", file.content)
+
+          command = "#{terraform_hcl2_parser_path} < tmp.tf"
+          start = Time.now
+          stdout, stderr, process = Open3.capture3(command)
+          time_taken = Time.now - start
+
+          unless process.success?
+            raise SharedHelpers::HelperSubprocessFailed.new(
+              message: stderr,
+              error_context: {
+                command: command,
+                time_taken: time_taken,
+                process_exit_value: process.to_s
+              }
+            )
           end
+
+          JSON.parse(stdout)
+        end
       rescue SharedHelpers::HelperSubprocessFailed => e
         msg = e.message.strip
         raise Dependabot::DependencyFileNotParseable.new(file.path, msg)

data/lib/dependabot/terraform/file_selector.rb

@@ -12,7 +12,6 @@ module FileSelector
   end
 
   def terragrunt_file?(file_name)
-    file_name != ".terraform.lock.hcl" &&
-      (file_name.end_with?(".tfvars") || file_name.end_with?(".hcl"))
+    file_name != ".terraform.lock.hcl" && file_name.end_with?(".hcl")
   end
 end

data/lib/dependabot/terraform/file_updater.rb

@@ -11,7 +11,7 @@ module Dependabot
       include FileSelector
 
       def self.updated_files_regex
-        [/\.tf$/, /\.tfvars$/, /\.hcl$/]
+        [/\.tf$/, /\.hcl$/]
       end
 
       def updated_dependency_files
@@ -47,7 +47,7 @@ module Dependabot
           case new_req[:source][:type]
           when "git"
             update_git_declaration(new_req, old_req, content, file.name)
-          when "registry"
+          when "registry", "provider"
             update_registry_declaration(new_req, old_req, content)
           else
             raise "Don't know how to update a #{new_req[:source][:type]} "\

data/lib/dependabot/terraform/metadata_finder.rb

@@ -14,7 +14,7 @@ module Dependabot
       def look_up_source
         case new_source_type
         when "git" then find_source_from_git_url
-        when "registry" then find_source_from_registry_details
+        when "registry", "provider" then find_source_from_registry_details
         else raise "Unexpected source type: #{new_source_type}"
         end
       end
@@ -36,29 +36,11 @@ module Dependabot
         Source.from_url(url)
       end
 
-      # Registry API docs:
-      # https://www.terraform.io/docs/registry/api.html
       def find_source_from_registry_details
         info = dependency.requirements.map { |r| r[:source] }.compact.first
-
         hostname = info[:registry_hostname] || info["registry_hostname"]
 
-        # TODO: Implement service discovery for custom registries
-        return unless hostname == "registry.terraform.io"
-
-        url = "https://registry.terraform.io/v1/modules/"\
-              "#{dependency.name}/#{dependency.version}"
-
-        response = Excon.get(
-          url,
-          idempotent: true,
-          **SharedHelpers.excon_defaults
-        )
-
-        raise "Response from registry was #{response.status}" unless response.status == 200
-
-        source_url = JSON.parse(response.body).fetch("source")
-        Source.from_url(source_url) if source_url
+        RegistryClient.new(hostname: hostname).source(dependency: dependency)
       end
     end
   end

data/lib/dependabot/terraform/registry_client.rb

@@ -0,0 +1,104 @@
+# frozen_string_literal: true
+
+require "dependabot/dependency"
+require "dependabot/source"
+require "dependabot/terraform/version"
+
+module Dependabot
+  module Terraform
+    # Terraform::RegistryClient is a basic API client to interact with a
+    # terraform registry: https://www.terraform.io/docs/registry/api.html
+    class RegistryClient
+      PUBLIC_HOSTNAME = "registry.terraform.io"
+
+      def initialize(hostname:)
+        @hostname = hostname
+      end
+
+      # Fetch all the versions of a provider, and return a Version
+      # representation of them.
+      #
+      # @param identifier [String] the identifier for the dependency, i.e:
+      # "hashicorp/aws"
+      # @return [Array<Dependabot::Terraform::Version>]
+      # @raise [RuntimeError] when the versions cannot be retrieved
+      def all_provider_versions(identifier:)
+        # TODO: Implement service discovery for custom registries
+        return [] unless hostname == PUBLIC_HOSTNAME
+
+        response = get(endpoint: "providers/#{identifier}/versions")
+
+        JSON.parse(response).
+          fetch("versions").
+          map { |release| version_class.new(release.fetch("version")) }
+      end
+
+      # Fetch all the versions of a module, and return a Version
+      # representation of them.
+      #
+      # @param identifier [String] the identifier for the dependency, i.e:
+      # "hashicorp/consul/aws"
+      # @return [Array<Dependabot::Terraform::Version>]
+      # @raise [RuntimeError] when the versions cannot be retrieved
+      def all_module_versions(identifier:)
+        # TODO: Implement service discovery for custom registries
+        return [] unless hostname == PUBLIC_HOSTNAME
+
+        response = get(endpoint: "modules/#{identifier}/versions")
+
+        JSON.parse(response).
+          fetch("modules").first.fetch("versions").
+          map { |release| version_class.new(release.fetch("version")) }
+      end
+
+      # Fetch the "source" for a module or provider. We use the API to fetch
+      # the source for a dependency, this typically points to a source code
+      # repository, and then instantiate a Dependabot::Source object that we
+      # can use to fetch Metadata about a specific version of the dependency.
+      #
+      # @param dependency [Dependabot::Dependency] the dependency who's source
+      # we're attempting to find
+      # @return Dependabot::Source
+      # @raise [RuntimeError] when the source cannot be retrieved
+      def source(dependency:)
+        # TODO: Implement service discovery for custom registries
+        return unless hostname == PUBLIC_HOSTNAME
+
+        type = dependency.requirements.first[:source][:type]
+        endpoint = if type == "registry"
+                     "modules/#{dependency.name}/#{dependency.version}"
+                   elsif type == "provider"
+                     "providers/#{dependency.name}/#{dependency.version}"
+                   else
+                     raise "Invalid source type"
+                   end
+        response = get(endpoint: endpoint)
+
+        source_url = JSON.parse(response).fetch("source")
+        Source.from_url(source_url) if source_url
+      end
+
+      private
+
+      attr_reader :hostname
+
+      def get(endpoint:)
+        url = "https://#{hostname}/v1/#{endpoint}"
+
+        response = Excon.get(
+          url,
+          idempotent: true,
+          **SharedHelpers.excon_defaults
+        )
+
+        raise "Response from registry was #{response.status}" unless response.status == 200
+
+        response.body
+      end
+
+      def version_class
+        Version
+      end
+    end
+  end
+end

data/lib/dependabot/terraform/requirements_updater.rb

@@ -72,7 +72,7 @@ module Dependabot
         requirements.map do |req|
           case req.dig(:source, :type)
           when "git" then update_git_requirement(req)
-          when "registry" then update_registry_requirement(req)
+          when "registry", "provider" then update_registry_requirement(req)
           else req
           end
         end

data/lib/dependabot/terraform/update_checker.rb

@@ -6,6 +6,7 @@ require "dependabot/git_commit_checker"
 require "dependabot/terraform/requirements_updater"
 require "dependabot/terraform/requirement"
 require "dependabot/terraform/version"
+require "dependabot/terraform/registry_client"
 
 module Dependabot
   module Terraform
@@ -13,6 +14,7 @@ module Dependabot
       def latest_version
         return latest_version_for_git_dependency if git_dependency?
         return latest_version_for_registry_dependency if registry_dependency?
+        return latest_version_for_provider_dependency if provider_dependency?
         # Other sources (mercurial, path dependencies) just return `nil`
       end
 
@@ -65,34 +67,40 @@ module Dependabot
 
         return @latest_version_for_registry_dependency if @latest_version_for_registry_dependency
 
-        versions = all_registry_versions
+        versions = all_module_versions
         versions.reject!(&:prerelease?) unless wants_prerelease?
         versions.reject! { |v| ignore_requirements.any? { |r| r.satisfied_by?(v) } }
 
         @latest_version_for_registry_dependency = versions.max
       end
 
-      def all_registry_versions
-        hostname = dependency_source_details.fetch(:registry_hostname)
+      def all_module_versions
         identifier = dependency_source_details.fetch(:module_identifier)
+        registry_client.all_module_versions(identifier: identifier)
+      end
+
+      def all_provider_versions
+        identifier = dependency_source_details.fetch(:module_identifier)
+        registry_client.all_provider_versions(identifier: identifier)
+      end
 
-        # TODO: Implement service discovery for custom registries
-        return [] unless hostname == "registry.terraform.io"
+      def registry_client
+        @registry_client ||= begin
+          hostname = dependency_source_details.fetch(:registry_hostname)
+          RegistryClient.new(hostname: hostname)
+        end
+      end
 
-        url = "https://registry.terraform.io/v1/modules/"\
-              "#{identifier}/versions"
+      def latest_version_for_provider_dependency
+        return unless provider_dependency?
 
-        response = Excon.get(
-          url,
-          idempotent: true,
-          **SharedHelpers.excon_defaults
-        )
+        return @latest_version_for_provider_dependency if @latest_version_for_provider_dependency
 
-        raise "Response from registry was #{response.status}" unless response.status == 200
+        versions = all_provider_versions
+        versions.reject!(&:prerelease?) unless wants_prerelease?
+        versions.reject! { |v| ignore_requirements.any? { |r| r.satisfied_by?(v) } }
 
-        JSON.parse(response.body).
-          fetch("modules").first.fetch("versions").
-          map { |release| version_class.new(release.fetch("version")) }
+        @latest_version_for_provider_dependency = versions.max
       end
 
       def wants_prerelease?
@@ -160,6 +168,12 @@ module Dependabot
         dependency_source_details.fetch(:type) == "registry"
       end
 
+      def provider_dependency?
+        return false if dependency_source_details.nil?
+
+        dependency_source_details.fetch(:type) == "provider"
+      end
+
       def dependency_source_details
         sources =
           dependency.requirements.map { |r| r.fetch(:source) }.uniq.compact

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-terraform
 version: !ruby/object:Gem::Version
-  version: 0.147.0
+  version: 0.148.3
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-05-13 00:00:00.000000000 Z
+date: 2021-05-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.147.0
+        version: 0.148.3
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.147.0
+        version: 0.148.3
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement
@@ -100,14 +100,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.14.0
+        version: 1.15.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.14.0
+        version: 1.15.0
 - !ruby/object:Gem::Dependency
   name: simplecov
   requirement: !ruby/object:Gem::Requirement
@@ -192,6 +192,7 @@ files:
 - lib/dependabot/terraform/file_selector.rb
 - lib/dependabot/terraform/file_updater.rb
 - lib/dependabot/terraform/metadata_finder.rb
+- lib/dependabot/terraform/registry_client.rb
 - lib/dependabot/terraform/requirement.rb
 - lib/dependabot/terraform/requirements_updater.rb
 - lib/dependabot/terraform/update_checker.rb