dependabot-terraform 0.279.0 → 0.281.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5aaff31ec9c254d6546d349bf160dd50f0dc038f00d3fb4deb1521d26b4c621b
-  data.tar.gz: '08fb4b1a107d25ded631a2f6ac3f392f0b808930c7c3fc1b064191b6acb4999a'
+  metadata.gz: d37ae246539b7134c6d776e782b70ef1125acc9e230600f03836ab8d363de079
+  data.tar.gz: 1256f419f1e57ac20446b3cd5d677f481cc075b685bae54ee5def7bba5e6ec03
 SHA512:
-  metadata.gz: b4e2435cd36a64fd1984fa489c9048d57f363585c8fb07eb210b8345d5956d44e952e05a759ce87d06bf2ba38f562825d8660e1fd39d78496382891b59f35840
-  data.tar.gz: b1ef7bf7f8dc3c836aea734f48af7a446261320e9a249c47149a507cca99147844be0efccad2c678345d3df97e00e0bf83345aaf2a876037bfd3846b7bde4a97
+  metadata.gz: f26e6943c4c843fa2d37c14393ffaa6046a976a6b4929baa69936a8f2a4afb7bf8c6e9615a7b228aa4371c488c59a7c9d5fbb8fad88c88c233860d0e50a784c5
+  data.tar.gz: 5555620a9d25d7ee7383ba013e04b9b4a4ce7566378e9af17954afc0c7991d51d3854b60bde0ac51a518c295cf67859aaf471987e8e6c64ad68905b8b5b0dcad

data/lib/dependabot/terraform/file_parser.rb

@@ -269,7 +269,7 @@ module Dependabot
           if git_url.include?("git@")
             T.must(git_url.split("git@").last).sub(":", "/")
           else
-            git_url.sub(%r{.*?://}, "")
+            git_url.sub(%r{(?:\w{3,5})?://}, "")
           end
 
         querystr = URI.parse("https://" + bare_uri).query
@@ -292,6 +292,7 @@ module Dependabot
       end
 
       # rubocop:disable Metrics/PerceivedComplexity
+      # rubocop:disable Metrics/CyclomaticComplexity
       sig { params(source_string: String).returns(Symbol) }
       def source_type(source_string)
         return :interpolation if source_string.include?("${")
@@ -308,11 +309,12 @@ module Dependabot
 
         path_uri = URI.parse(T.must(source_string.split(%r{(?<!:)//}).first))
         query_uri = URI.parse(source_string)
-        return :http_archive if path_uri.path.end_with?(*RegistryClient::ARCHIVE_EXTENSIONS)
+        return :http_archive if RegistryClient::ARCHIVE_EXTENSIONS.any? { |ext| path_uri.path&.end_with?(ext) }
         return :http_archive if query_uri.query&.include?("archive=")
 
         raise "HTTP source, but not an archive!"
       end
+      # rubocop:enable Metrics/CyclomaticComplexity
       # rubocop:enable Metrics/PerceivedComplexity
 
       # == Returns:

data/lib/dependabot/terraform/file_updater.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "sorbet-runtime"
@@ -20,10 +20,12 @@ module Dependabot
       MODULE_NOT_INSTALLED_ERROR =  /Module not installed.*module\s*\"(?<mod>\S+)\"/m
       GIT_HTTPS_PREFIX = %r{^git::https://}
 
+      sig { override.returns(T::Array[Regexp]) }
       def self.updated_files_regex
         [/\.tf$/, /\.hcl$/]
       end
 
+      sig { override.returns(T::Array[Dependabot::DependencyFile]) }
       def updated_dependency_files
         updated_files = []
 
@@ -69,23 +71,25 @@ module Dependabot
       # (requirements - previous_requirements) | (previous_requirements - requirements)
       #  => [{requirement: "0.9.1"}]
       # we can detect that change.
+      sig { params(file: Dependabot::DependencyFile, dependency: Dependabot::Dependency).returns(T::Boolean) }
       def requirement_changed?(file, dependency)
         changed_requirements =
-          (dependency.requirements - dependency.previous_requirements) |
-          (dependency.previous_requirements - dependency.requirements)
+          (dependency.requirements - T.must(dependency.previous_requirements)) |
+          (T.must(dependency.previous_requirements) - dependency.requirements)
 
         changed_requirements.any? { |f| f[:file] == file.name }
       end
 
+      sig { params(file: Dependabot::DependencyFile).returns(String) }
       def updated_terraform_file_content(file)
-        content = file.content.dup
+        content = T.must(file.content.dup)
 
-        reqs = dependency.requirements.zip(dependency.previous_requirements)
+        reqs = dependency.requirements.zip(T.must(dependency.previous_requirements))
                          .reject { |new_req, old_req| new_req == old_req }
 
         # Loop through each changed requirement and update the files and lockfile
         reqs.each do |new_req, old_req|
-          raise "Bad req match" unless new_req[:file] == old_req[:file]
+          raise "Bad req match" unless new_req[:file] == old_req&.fetch(:file)
           next unless new_req.fetch(:file) == file.name
 
           case new_req[:source][:type]
@@ -102,20 +106,37 @@ module Dependabot
         content
       end
 
+      sig do
+        params(
+          new_req: T::Hash[Symbol, T.untyped],
+          old_req: T.nilable(T::Hash[Symbol, T.untyped]),
+          updated_content: String,
+          filename: String
+        )
+          .void
+      end
       def update_git_declaration(new_req, old_req, updated_content, filename)
-        url = old_req.fetch(:source)[:url].gsub(%r{^https://}, "")
-        tag = old_req.fetch(:source)[:ref]
+        url = old_req&.dig(:source, :url)&.gsub(%r{^https://}, "")
+        tag = old_req&.dig(:source, :ref)
         url_regex = /#{Regexp.quote(url)}.*ref=#{Regexp.quote(tag)}/
 
         declaration_regex = git_declaration_regex(filename)
 
         updated_content.sub!(declaration_regex) do |regex_match|
           regex_match.sub(url_regex) do |url_match|
-            url_match.sub(old_req[:source][:ref], new_req[:source][:ref])
+            url_match.sub(old_req&.dig(:source, :ref), new_req[:source][:ref])
           end
         end
       end
 
+      sig do
+        params(
+          new_req: T::Hash[Symbol, T.untyped],
+          old_req: T.nilable(T::Hash[Symbol, T.untyped]),
+          updated_content: String
+        )
+          .void
+      end
       def update_registry_declaration(new_req, old_req, updated_content)
         regex = if new_req[:source][:type] == "provider"
                   provider_declaration_regex(updated_content)
@@ -124,18 +145,20 @@ module Dependabot
                 end
         updated_content.gsub!(regex) do |regex_match|
           regex_match.sub(/^\s*version\s*=.*/) do |req_line_match|
-            req_line_match.sub(old_req[:requirement], new_req[:requirement])
+            req_line_match.sub(old_req&.fetch(:requirement), new_req[:requirement])
           end
         end
       end
 
+      sig { params(content: String, declaration_regex: Regexp).returns(T::Array[String]) }
       def extract_provider_h1_hashes(content, declaration_regex)
         content.match(declaration_regex).to_s
                .match(hashes_object_regex).to_s
                .split("\n").map { |hash| hash.match(hashes_string_regex).to_s }
-               .select { |h| h&.match?(/^h1:/) }
+               .select { |h| h.match?(/^h1:/) }
       end
 
+      sig { params(content: String, declaration_regex: Regexp).returns(String) }
       def remove_provider_h1_hashes(content, declaration_regex)
         content.match(declaration_regex).to_s
                .sub(hashes_object_regex, "")
@@ -155,8 +178,9 @@ module Dependabot
         [T.must(content), provider_source, declaration_regex]
       end
 
+      sig { returns(T.nilable(T::Array[Symbol])) }
       def lookup_hash_architecture # rubocop:disable Metrics/AbcSize, Metrics/MethodLength, Metrics/PerceivedComplexity
-        new_req = dependency.requirements.first
+        new_req = T.must(dependency.requirements.first)
 
         # NOTE: Only providers are included in the lockfile, modules are not
         return unless new_req[:source][:type] == "provider"
@@ -222,14 +246,23 @@ module Dependabot
         architectures.to_a
       end
 
+      sig { returns(T::Array[Symbol]) }
       def architecture_type
-        @architecture_type ||= lookup_hash_architecture.empty? ? [:linux_amd64] : lookup_hash_architecture
+        @architecture_type ||= T.let(
+          if lookup_hash_architecture.nil? || lookup_hash_architecture&.empty?
+            [:linux_amd64]
+          else
+            T.must(lookup_hash_architecture)
+          end,
+          T.nilable(T::Array[Symbol])
+        )
       end
 
+      sig { params(updated_manifest_files: T::Array[Dependabot::DependencyFile]).returns(T.nilable(String)) }
       def update_lockfile_declaration(updated_manifest_files) # rubocop:disable Metrics/AbcSize, Metrics/PerceivedComplexity
         return if lockfile.nil?
 
-        new_req = dependency.requirements.first
+        new_req = T.must(dependency.requirements.first)
         # NOTE: Only providers are included in the lockfile, modules are not
         return unless new_req[:source][:type] == "provider"
 
@@ -268,7 +301,7 @@ module Dependabot
           raise if @retrying_lock || !e.message.include?("terraform init")
 
           # NOTE: Modules need to be installed before terraform can update the lockfile
-          @retrying_lock = true
+          @retrying_lock = T.let(true, T.nilable(T::Boolean))
           run_terraform_init
           retry
         end
@@ -276,6 +309,7 @@ module Dependabot
         content
       end
 
+      sig { void }
       def run_terraform_init
         SharedHelpers.with_git_configured(credentials: credentials) do
           # -backend=false option used to ignore any backend configuration, as these won't be accessible
@@ -298,30 +332,36 @@ module Dependabot
         end
       end
 
+      sig { returns(Dependabot::Dependency) }
       def dependency
         # Terraform updates will only ever be updating a single dependency
-        dependencies.first
+        T.must(dependencies.first)
       end
 
+      sig { returns(T::Array[Dependabot::DependencyFile]) }
       def files_with_requirement
         filenames = dependency.requirements.map { |r| r[:file] }
         dependency_files.select { |file| filenames.include?(file.name) }
       end
 
+      sig { override.void }
       def check_required_files
         return if [*terraform_files, *terragrunt_files].any?
 
         raise "No Terraform configuration file!"
       end
 
+      sig { returns(Regexp) }
       def hashes_object_regex
         /hashes\s*=\s*[^\]]*\]/m
       end
 
+      sig { returns(Regexp) }
       def hashes_string_regex
         /(?<=\").*(?=\")/
       end
 
+      sig { params(updated_content: String).returns(Regexp) }
       def provider_declaration_regex(updated_content)
         name = Regexp.escape(dependency.name)
         registry_host = Regexp.escape(registry_host_for(dependency))
@@ -341,6 +381,7 @@ module Dependabot
         end
       end
 
+      sig { returns(Regexp) }
       def registry_declaration_regex
         %r{
           (?<=\{)
@@ -354,6 +395,7 @@ module Dependabot
         }mx
       end
 
+      sig { params(filename: String).returns(Regexp) }
       def git_declaration_regex(filename)
         # For terragrunt dependencies there's not a lot we can base the
         # regex on. Just look for declarations within a `terraform` block
@@ -361,13 +403,14 @@ module Dependabot
 
         # For modules we can do better - filter for module blocks that use the
         # name of the module
-        module_name = dependency.name.split("::").first
+        module_name = T.must(dependency.name.split("::").first)
         /
          module\s+["']#{Regexp.escape(module_name)}["']\s*\{
          (?:(?!^\}).)*
         /mx
       end
 
+      sig { params(dependency: Dependabot::Dependency).returns(String) }
       def registry_host_for(dependency)
         source = dependency.requirements.filter_map { |r| r[:source] }.first
         source[:registry_hostname] || source["registry_hostname"] || "registry.terraform.io"

data/lib/dependabot/terraform/registry_client.rb

@@ -25,11 +25,13 @@ module Dependabot
       # rubocop:disable Metrics/PerceivedComplexity
       # See https://www.terraform.io/docs/modules/sources.html#http-urls for
       # details of how Terraform handle HTTP(S) sources for modules
-      def self.get_proxied_source(raw_source) # rubocop:disable Metrics/AbcSize
+      # rubocop:disable Metrics/AbcSize
+      # rubocop:disable Metrics/CyclomaticComplexity
+      def self.get_proxied_source(raw_source)
         return raw_source unless raw_source.start_with?("http")
 
         uri = URI.parse(raw_source.split(%r{(?<!:)//}).first)
-        return raw_source if uri.path.end_with?(*ARCHIVE_EXTENSIONS)
+        return raw_source if ARCHIVE_EXTENSIONS.any? { |ext| uri.path&.end_with?(ext) }
         return raw_source if URI.parse(raw_source).query&.include?("archive=")
 
         url = raw_source.split(%r{(?<!:)//}).first + "?terraform-get=1"
@@ -49,6 +51,8 @@ module Dependabot
 
         raw_source
       end
+      # rubocop:enable Metrics/CyclomaticComplexity
+      # rubocop:enable Metrics/AbcSize
       # rubocop:enable Metrics/PerceivedComplexity
 
       # Fetch all the versions of a provider, and return a Version

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-terraform
 version: !ruby/object:Gem::Version
-  version: 0.279.0
+  version: 0.281.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-10-03 00:00:00.000000000 Z
+date: 2024-10-17 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.279.0
+        version: 0.281.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.279.0
+        version: 0.281.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -156,14 +156,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.8.1
+        version: 0.8.5
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.8.1
+        version: 0.8.5
 - !ruby/object:Gem::Dependency
   name: simplecov
   requirement: !ruby/object:Gem::Requirement
@@ -260,7 +260,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.279.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.281.0
 post_install_message: 
 rdoc_options: []
 require_paths: