dependabot-terraform 0.212.0 → 0.214.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5c5297a1d328dc52c83ba5a78841009b5cb39925f98dc6b6ae382f561cea0ed5
-  data.tar.gz: 74db7a25d15ca90c1304cb2acf265a9d8d6d3281c74e8ed9074cba7bea400c58
+  metadata.gz: 4f71bc92463c650b0017996b239e934c11e142bf358346d933199809a421cdcc
+  data.tar.gz: 04cd2a28c3d5de1ba21e5b11d380e39245bba354cc5baaaa21f10469f56c7cf6
 SHA512:
-  metadata.gz: 80d983b46329b668eaa81022961329820768056a7fdbc175e614eb1e57c50d60fb56328b848bf02da7b324f61db847f8a30d5fa676f0e65e7213c58251d26145
-  data.tar.gz: cd3ea4534ab64ba1bd528a8cbc4a69c79e749ca6e359d2a56583168d4f4b5e42496c602a18b65b7b3c06c668747130fb5c89127473d4ddb32815b1b6c2620d20
+  metadata.gz: cf3a1762094ffe3a008ef7ed4780ddf246d84742df03aad54e94d5d9a8f200380dd8099aa7c64ce8f2db553d4066071828b4927eaad84af223d496bdee1bc07b
+  data.tar.gz: a63c4421a9c42b476ae9bfd9c21b72a096c95585875d105b880b7694ed50e2c3989a190918a0d53aecb99895ad9ec8a8b4ba7994ccf96378fb92ae3c56ab624b

data/lib/dependabot/terraform/file_fetcher.rb

@@ -10,7 +10,7 @@ module Dependabot
       include FileSelector
 
       # https://www.terraform.io/docs/language/modules/sources.html#local-paths
-      LOCAL_PATH_SOURCE = %r{source\s*=\s*['"](?<path>..?\/[^'"]+)}.freeze
+      LOCAL_PATH_SOURCE = %r{source\s*=\s*['"](?<path>..?\/[^'"]+)}
 
       def self.required_files_in?(filenames)
         filenames.any? { |f| f.end_with?(".tf", ".hcl") }

data/lib/dependabot/terraform/file_parser.rb

@@ -24,7 +24,7 @@ module Dependabot
       DEFAULT_REGISTRY = "registry.terraform.io"
       DEFAULT_NAMESPACE = "hashicorp"
       # https://www.terraform.io/docs/language/providers/requirements.html#source-addresses
-      PROVIDER_SOURCE_ADDRESS = %r{\A((?<hostname>.+)/)?(?<namespace>.+)/(?<name>.+)\z}.freeze
+      PROVIDER_SOURCE_ADDRESS = %r{\A((?<hostname>.+)/)?(?<namespace>.+)/(?<name>.+)\z}
 
       def parse
         dependency_set = DependencySet.new

data/lib/dependabot/terraform/file_updater.rb

@@ -11,9 +11,9 @@ module Dependabot
     class FileUpdater < Dependabot::FileUpdaters::Base
       include FileSelector
 
-      PRIVATE_MODULE_ERROR = /Could not download module.*code from\n.*\"(?<repo>\S+)\":/.freeze
-      MODULE_NOT_INSTALLED_ERROR =  /Module not installed.*module\s*\"(?<mod>\S+)\"/m.freeze
-      GIT_HTTPS_PREFIX = %r{^git::https://}.freeze
+      PRIVATE_MODULE_ERROR = /Could not download module.*code from\n.*\"(?<repo>\S+)\":/
+      MODULE_NOT_INSTALLED_ERROR =  /Module not installed.*module\s*\"(?<mod>\S+)\"/m
+      GIT_HTTPS_PREFIX = %r{^git::https://}
 
       def self.updated_files_regex
         [/\.tf$/, /\.hcl$/]
@@ -48,6 +48,30 @@ module Dependabot
 
       private
 
+      # Terraform allows to use a module from the same source multiple times
+      # To detect any changes in dependencies we need to overwrite an implementation from the base class
+      #
+      # Example (for simplicity other parameters are skipped):
+      # previous_requirements = [{requirement: "0.9.1"}, {requirement: "0.11.0"}]
+      # requirements = [{requirement: "0.11.0"}, {requirement: "0.11.0"}]
+      #
+      # Simple difference between arrays gives:
+      # requirements - previous_requirements
+      #  => []
+      # which loses an information that one of our requirements has changed.
+      #
+      # By using symmetric difference:
+      # (requirements - previous_requirements) | (previous_requirements - requirements)
+      #  => [{requirement: "0.9.1"}]
+      # we can detect that change.
+      def requirement_changed?(file, dependency)
+        changed_requirements =
+          (dependency.requirements - dependency.previous_requirements) |
+          (dependency.previous_requirements - dependency.requirements)
+
+        changed_requirements.any? { |f| f[:file] == file.name }
+      end
+
       def updated_terraform_file_content(file)
         content = file.content.dup
 
@@ -89,7 +113,7 @@ module Dependabot
 
       def update_registry_declaration(new_req, old_req, updated_content)
         regex = new_req[:source][:type] == "provider" ? provider_declaration_regex : registry_declaration_regex
-        updated_content.sub!(regex) do |regex_match|
+        updated_content.gsub!(regex) do |regex_match|
           regex_match.sub(/^\s*version\s*=.*/) do |req_line_match|
             req_line_match.sub(old_req[:requirement], new_req[:requirement])
           end

data/lib/dependabot/terraform/requirement.rb

@@ -12,7 +12,7 @@ module Dependabot
       # https://www.terraform.io/docs/registry/modules/publish.html#requirements
       OPERATORS = OPS.keys.map { |key| Regexp.quote(key) }.join("|").freeze
       PATTERN_RAW = "\\s*(#{OPERATORS})?\\s*v?(#{Gem::Version::VERSION_PATTERN})\\s*"
-      PATTERN = /\A#{PATTERN_RAW}\z/.freeze
+      PATTERN = /\A#{PATTERN_RAW}\z/
 
       def self.parse(obj)
         return ["=", Version.new(obj.to_s)] if obj.is_a?(Gem::Version)
@@ -27,7 +27,7 @@ module Dependabot
         [matches[1] || "=", Terraform::Version.new(matches[2])]
       end
 
-      # For consistency with other langauges, we define a requirements array.
+      # For consistency with other languages, we define a requirements array.
       # Terraform doesn't have an `OR` separator for requirements, so it
       # always contains a single element.
       def self.requirements_array(requirement_string)

data/lib/dependabot/terraform/update_checker.rb

@@ -45,14 +45,6 @@ module Dependabot
         !proxy_requirement?
       end
 
-      def requirement_class
-        Requirement
-      end
-
-      def version_class
-        Version
-      end
-
       private
 
       def latest_version_resolvable_with_full_unlock?
@@ -194,9 +186,7 @@ module Dependabot
             dependency: dependency,
             credentials: credentials,
             ignored_versions: ignored_versions,
-            raise_on_ignored: raise_on_ignored,
-            requirement_class: Requirement,
-            version_class: Version
+            raise_on_ignored: raise_on_ignored
           )
       end
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-terraform
 version: !ruby/object:Gem::Version
-  version: 0.212.0
+  version: 0.214.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-09-06 00:00:00.000000000 Z
+date: 2022-12-01 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,42 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.212.0
+        version: 0.214.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.212.0
-- !ruby/object:Gem::Dependency
-  name: debase
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - '='
-      - !ruby/object:Gem::Version
-        version: 0.2.3
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - '='
-      - !ruby/object:Gem::Version
-        version: 0.2.3
-- !ruby/object:Gem::Dependency
-  name: debase-ruby_core_source
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - '='
-      - !ruby/object:Gem::Version
-        version: 0.10.16
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - '='
-      - !ruby/object:Gem::Version
-        version: 0.10.16
+        version: 0.214.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -86,14 +58,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.12.0
+        version: 4.0.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.12.0
+        version: 4.0.0
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
@@ -142,42 +114,28 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.36.0
+        version: 1.39.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.36.0
+        version: 1.39.0
 - !ruby/object:Gem::Dependency
   name: rubocop-performance
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.14.2
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: 1.14.2
-- !ruby/object:Gem::Dependency
-  name: ruby-debug-ide
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: 0.7.3
+        version: 1.15.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.7.3
+        version: 1.15.0
 - !ruby/object:Gem::Dependency
   name: simplecov
   requirement: !ruby/object:Gem::Requirement
@@ -279,14 +237,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 2.7.0
+      version: 3.1.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 2.7.0
+      version: 3.1.0
 requirements: []
-rubygems_version: 3.1.6
+rubygems_version: 3.3.7
 signing_key: 
 specification_version: 4
 summary: Terraform support for dependabot