dependabot-terraform 0.154.4 → 0.156.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2cee13c54e35bd3615badacd9cae09916740cfde9bf639b8550f0b2e5610c8b5
-  data.tar.gz: b3e73a9f422e93b525ac76bc5435f4ec967ff1fa43e8e458bf012228af4a9e6b
+  metadata.gz: f7b09b1f7e256b46726f3b97ff62cf24fda20edb289cede081329324af369ff3
+  data.tar.gz: 6f61d703546a1ec53cbf09d0af4c803a749152c54fa335bdf8eafe65c3c41702
 SHA512:
-  metadata.gz: f599ca85d635471619742068dc9c7c00c5d1eac3faa5faf607753c056a9e2e30d6645dcddc69d70e0836b16861d590aeb850cf086120c1bd65f086849cef0199
-  data.tar.gz: ef8807795513b2566d72bc61bc53cb2ad9cedeb60eca86127e7a51ed8f3d580b4b7f989d4416b0bc117e8199f8f239a7bdf4195e0700984355c272c59f794217
+  metadata.gz: 4cf7838fe33e476a71e463e45da2cdf54a0ce94cc58f1f2cbe35250e66dda59ac761aa0d2d5e8f02f7ef68a9e2d594d2f68493f890c2044aa31d7416994dfffb
+  data.tar.gz: 8ee3e8ac4ba04a7f3562fc47c66e1b9da083298378f2de24151404006073ae0eb91ca69ba7a30444d351092af82c2249c4bc339054003ba6cc6bc27f6ee8cb40

data/lib/dependabot/terraform.rb

@@ -17,3 +17,6 @@ Dependabot::PullRequestCreator::Labeler.
 require "dependabot/dependency"
 Dependabot::Dependency.
   register_production_check("terraform", ->(_) { true })
+
+require "dependabot/utils"
+Dependabot::Utils.register_always_clone("terraform")

data/lib/dependabot/terraform/file_updater.rb

@@ -11,6 +11,8 @@ module Dependabot
     class FileUpdater < Dependabot::FileUpdaters::Base
       include FileSelector
 
+      PRIVATE_MODULE_ERROR = /Could not download module.*code from\n.*\"(?<repo>\S+)\":/.freeze
+
       def self.updated_files_regex
         [/\.tf$/, /\.hcl$/]
       end
@@ -90,19 +92,20 @@ module Dependabot
         end
       end
 
-      def update_lockfile_declaration
+      def update_lockfile_declaration # rubocop:disable Metrics/AbcSize
         return if lock_file.nil?
 
         new_req = dependency.requirements.first
-        content = lock_file.content.dup
+        # NOTE: Only providers are inlcuded in the lockfile, modules are not
+        return unless new_req[:source][:type] == "provider"
 
+        content = lock_file.content.dup
         provider_source = new_req[:source][:registry_hostname] + "/" + new_req[:source][:module_identifier]
         declaration_regex = lockfile_declaration_regex(provider_source)
         lockfile_dependency_removed = content.sub(declaration_regex, "")
 
-        SharedHelpers.in_a_temporary_directory do
-          write_dependency_files
-
+        base_dir = dependency_files.first.directory
+        SharedHelpers.in_a_temporary_repo_directory(base_dir, repo_contents_path) do
           File.write(".terraform.lock.hcl", lockfile_dependency_removed)
           SharedHelpers.run_shell_command("terraform providers lock #{provider_source}")
 
@@ -115,20 +118,35 @@ module Dependabot
                  content.scan(declaration_regex).first.scan(/^\s*version\s*=.*/)
             content.sub!(declaration_regex, updated_dependency)
           end
+        rescue SharedHelpers::HelperSubprocessFailed => e
+          raise if @retrying_lock || !e.message.include?("terraform init")
+
+          # NOTE: Modules need to be installed before terraform can update the
+          # lockfile
+          @retrying_lock = true
+          run_terraform_init
+          retry
         end
 
         content
       end
 
-      def write_dependency_files
-        dependency_files.each do |file|
-          # Do not include the .terraform directory or .terraform.lock.hcl
-          next if file.name.include?(".terraform")
+      def run_terraform_init
+        SharedHelpers.with_git_configured(credentials: credentials) do
+          SharedHelpers.run_shell_command("terraform init")
+        rescue SharedHelpers::HelperSubprocessFailed => e
+          output = strip_terminal_colors(e.message)
 
-          File.write(file.name, file.content)
+          if output.match?(PRIVATE_MODULE_ERROR)
+            raise PrivateSourceAuthenticationFailure, output.match(PRIVATE_MODULE_ERROR).named_captures.fetch("repo")
+          end
         end
       end
 
+      def strip_terminal_colors(output)
+        output.gsub(/\e\[(\d+)m/, "")
+      end
+
       def dependency
         # Terraform updates will only ever be updating a single dependency
         dependencies.first

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-terraform
 version: !ruby/object:Gem::Version
-  version: 0.154.4
+  version: 0.156.1
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-06-22 00:00:00.000000000 Z
+date: 2021-06-24 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.154.4
+        version: 0.156.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.154.4
+        version: 0.156.1
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement
@@ -100,14 +100,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.16.0
+        version: 1.17.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.16.0
+        version: 1.17.0
 - !ruby/object:Gem::Dependency
   name: simplecov
   requirement: !ruby/object:Gem::Requirement