dependabot-terraform 0.180.5 → 0.182.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fb7822e5b9456b0cde7d02354605daea8953091a2def4fb4ea61f880a014a78f
-  data.tar.gz: 1cd422f2ce97f5f77304a381dea33cc3917c8137f573bc1ed50b87376455a045
+  metadata.gz: 4989a37bcdf893186bfbdc4a5e64272b37b144674ed9497744cc333d763cd4f3
+  data.tar.gz: 9f12c1d8b5987a956100f158856d7c6de58ad3b27ab42c6d78a496fc9e26ae59
 SHA512:
-  metadata.gz: f387e1d2d7b147dcc95831171cc892c4d7c024aa9e64af0bf92103e6432aa7dc39735863ee35c722bd9239232cd4bc936b0b3e04d5f411275094d712aabd7007
-  data.tar.gz: f7e76bc9a66926c1c8a755c757014d60ea5591ae7c1ff7bf0b4f7b1fd07dd48503b955843a40921fb8087beebb032738de4ece8f33e72278b3b67e0fe1b16270
+  metadata.gz: 74acecc88f4997f9498ba6df54b8ad9d90b5d14ba583139f4d1a195953763a67a46483a0393db2bd994365e6a6e5dbbef5efce82a7dad12ca663d03765c937bb
+  data.tar.gz: e2fb99a17a9807830978d7b0cb570b556c00c815b8338c4b83675bcc3825235da870b946d84015e2bea6d335b903f5b7972dbd92cfb758ce0aeccce53fe0c072

data/lib/dependabot/terraform/file_updater.rb

@@ -94,25 +94,110 @@ module Dependabot
         end
       end
 
-      def update_lockfile_declaration(updated_manifest_files) # rubocop:disable Metrics/AbcSize
+      def extract_provider_h1_hashes(content, declaration_regex)
+        content.match(declaration_regex).to_s.
+          match(hashes_object_regex).to_s.
+          split("\n").map { |hash| hash.match(hashes_string_regex).to_s }.
+          select { |h| h&.match?(/^h1:/) }
+      end
+
+      def lockfile_details(new_req)
+        content = lock_file.content.dup
+        provider_source = new_req[:source][:registry_hostname] + "/" + new_req[:source][:module_identifier]
+        declaration_regex = lockfile_declaration_regex(provider_source)
+
+        [content, provider_source, declaration_regex]
+      end
+
+      def lookup_hash_architecture # rubocop:disable Metrics/AbcSize, Metrics/MethodLength, Metrics/PerceivedComplexity
+        new_req = dependency.requirements.first
+
+        # NOTE: Only providers are inlcuded in the lockfile, modules are not
+        return unless new_req[:source][:type] == "provider"
+
+        architectures = []
+        content, provider_source, declaration_regex = lockfile_details(new_req)
+        hashes = extract_provider_h1_hashes(content, declaration_regex)
+
+        # These are ordered in assumed popularity
+        possible_architectures = %w(
+          linux_amd64
+          darwin_amd64
+          windows_amd64
+          darwin_arm64
+          linux_arm64
+        )
+
+        base_dir = dependency_files.first.directory
+        lockfile_hash_removed = content.sub(hashes_object_regex, "")
+
+        # This runs in the same directory as the actual lockfile update so
+        # the platform must be determined before the updated manifest files
+        # are written to disk
+        SharedHelpers.in_a_temporary_repo_directory(base_dir, repo_contents_path) do
+          possible_architectures.each do |arch|
+            # Exit early if we have detected all of the architectures present
+            break if architectures.count == hashes.count
+
+            # Terraform will update the lockfile in place so we use a fresh lockfile for each lookup
+            File.write(".terraform.lock.hcl", lockfile_hash_removed)
+
+            SharedHelpers.run_shell_command("terraform providers lock -platform=#{arch} #{provider_source} -no-color")
+
+            updated_lockfile = File.read(".terraform.lock.hcl")
+            updated_hashes = extract_provider_h1_hashes(updated_lockfile, declaration_regex)
+            next if updated_hashes.nil?
+
+            # Check if the architecture is present in the original lockfile
+            hashes.each do |hash|
+              updated_hashes.select { |h| h.match?(/^h1:/) }.each do |updated_hash|
+                architectures.append(arch.to_sym) if hash == updated_hash
+              end
+            end
+
+            File.delete(".terraform.lock.hcl")
+          end
+        rescue SharedHelpers::HelperSubprocessFailed => e
+          if @retrying_lock && e.message.match?(MODULE_NOT_INSTALLED_ERROR)
+            mod = e.message.match(MODULE_NOT_INSTALLED_ERROR).named_captures.fetch("mod")
+            raise Dependabot::DependencyFileNotResolvable, "Attempt to install module #{mod} failed"
+          end
+          raise if @retrying_lock || !e.message.include?("terraform init")
+
+          # NOTE: Modules need to be installed before terraform can update the lockfile
+          @retrying_lock = true
+          run_terraform_init
+          retry
+        end
+
+        architectures.to_a
+      end
+
+      def architecture_type
+        @architecture_type ||= lookup_hash_architecture.empty? ? [:linux_amd64] : lookup_hash_architecture
+      end
+
+      def update_lockfile_declaration(updated_manifest_files) # rubocop:disable Metrics/AbcSize, Metrics/PerceivedComplexity
         return if lock_file.nil?
 
         new_req = dependency.requirements.first
         # NOTE: Only providers are inlcuded in the lockfile, modules are not
         return unless new_req[:source][:type] == "provider"
 
-        content = lock_file.content.dup
-        provider_source = new_req[:source][:registry_hostname] + "/" + new_req[:source][:module_identifier]
-        declaration_regex = lockfile_declaration_regex(provider_source)
+        content, provider_source, declaration_regex = lockfile_details(new_req)
         lockfile_dependency_removed = content.sub(declaration_regex, "")
 
         base_dir = dependency_files.first.directory
         SharedHelpers.in_a_temporary_repo_directory(base_dir, repo_contents_path) do
+          # Determine the provider using the original manifest files
+          platforms = architecture_type.map { |arch| "-platform=#{arch}" }.join(" ")
+
           # Update the provider requirements in case the previous requirement doesn't allow the new version
           updated_manifest_files.each { |f| File.write(f.name, f.content) }
 
           File.write(".terraform.lock.hcl", lockfile_dependency_removed)
-          SharedHelpers.run_shell_command("terraform providers lock #{provider_source} -no-color")
+
+          SharedHelpers.run_shell_command("terraform providers lock #{platforms} #{provider_source}")
 
           updated_lockfile = File.read(".terraform.lock.hcl")
           updated_dependency = updated_lockfile.scan(declaration_regex).first
@@ -130,8 +215,7 @@ module Dependabot
           end
           raise if @retrying_lock || !e.message.include?("terraform init")
 
-          # NOTE: Modules need to be installed before terraform can update the
-          # lockfile
+          # NOTE: Modules need to be installed before terraform can update the lockfile
           @retrying_lock = true
           run_terraform_init
           retry
@@ -178,6 +262,14 @@ module Dependabot
         raise "No Terraform configuration file!"
       end
 
+      def hashes_object_regex
+        /hashes\s*=\s*.*\]/m
+      end
+
+      def hashes_string_regex
+        /(?<=\").*(?=\")/
+      end
+
       def provider_declaration_regex
         name = Regexp.escape(dependency.name)
         %r{

data/lib/dependabot/terraform/requirements_updater.rb

@@ -117,10 +117,11 @@ module Dependabot
 
       def update_range(req_string)
         requirement_class.new(req_string).requirements.flat_map do |r|
-          next r if r.satisfied_by?(latest_version)
+          ruby_req = requirement_class.new(r.join(" "))
+          next ruby_req if ruby_req.satisfied_by?(latest_version)
 
-          case op = r.requirements.first.first
-          when "<", "<=" then [update_greatest_version(r, latest_version)]
+          case op = ruby_req.requirements.first.first
+          when "<", "<=" then [update_greatest_version(ruby_req, latest_version)]
           when "!=" then []
           else raise "Unexpected operation for unsatisfied req: #{op}"
           end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-terraform
 version: !ruby/object:Gem::Version
-  version: 0.180.5
+  version: 0.182.1
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-04-07 00:00:00.000000000 Z
+date: 2022-04-25 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.180.5
+        version: 0.182.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.180.5
+        version: 0.182.1
+- !ruby/object:Gem::Dependency
+  name: debase
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 0.2.4.1
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 0.2.4.1
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -100,14 +114,28 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.26.0
+        version: 1.27.0
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 1.27.0
+- !ruby/object:Gem::Dependency
+  name: ruby-debug-ide
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 0.7.3
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.26.0
+        version: 0.7.3
 - !ruby/object:Gem::Dependency
   name: simplecov
   requirement: !ruby/object:Gem::Requirement