dependabot-terraform 0.295.0 → 0.296.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: '09f8ec862f1e15a9c1d42ce70957de2f6416f982711b11dac0d6ad805eda5b3d'
-  data.tar.gz: 5f17aab0627b6d9efef8a8dece180b93860be06537ca160c0d319b84fc2aeb81
+  metadata.gz: 30eb2e7c99aefe9caa6a3e7b7fc64372b613ab51146eb17a701cd775116546f8
+  data.tar.gz: 6b197e83c13cd6a573524a1ce0cce325a78b5cf744792f95925a83d0dd68946e
 SHA512:
-  metadata.gz: adbed28b55677301eb334f9722a0c1ab57494238a442a94716edbef3e2e6854855ae992a986303ae37f15a67b53f3a5f2e6a20f147e1114e76ba1f905b210382
-  data.tar.gz: b0a3bca0733ee5165d45382c060272fa75d9d86fd2a550ae42b312f761c52ff164ed425110dcd6fd5151a86aff21bd336a24c11c1787e784fbf9d2d5133e3744
+  metadata.gz: ba1b5e22707cb62959165ebf7af175d50d3f7eea7c34f6058d7a91eca56ca50ab750b4fc13380627a34aefbcbcc518b2a184d5b9b197d8ce053d0f0e7a7deade
+  data.tar.gz: ab7527bec58714d60df2c9dc71a99906d1175f60a2a1ef85b9e45b1aa8461983d55b70faada0a25cf318cc3007a3500bd198870964f8b572cb4f34665d928b11

data/lib/dependabot/terraform/registry_client.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "dependabot/dependency"
@@ -12,35 +12,42 @@ module Dependabot
     # Terraform::RegistryClient is a basic API client to interact with a
     # terraform registry: https://www.terraform.io/docs/registry/api.html
     class RegistryClient
-      ARCHIVE_EXTENSIONS = %w(.zip .tbz2 .tgz .txz).freeze
+      extend T::Sig
+
+      ARCHIVE_EXTENSIONS = T.let(%w(.zip .tbz2 .tgz .txz).freeze, T::Array[String])
       PUBLIC_HOSTNAME = "registry.terraform.io"
 
+      sig { params(hostname: String, credentials: T::Array[Dependabot::Credential]).void }
       def initialize(hostname: PUBLIC_HOSTNAME, credentials: [])
         @hostname = hostname
-        @tokens = credentials.each_with_object({}) do |item, memo|
-          memo[item["host"]] = item["token"] if item["type"] == "terraform_registry"
-        end
+        @tokens = T.let(
+          credentials.each_with_object({}) do |item, memo|
+            memo[item["host"]] = item["token"] if item["type"] == "terraform_registry"
+          end,
+          T::Hash[String, String]
+        )
       end
 
       # rubocop:disable Metrics/PerceivedComplexity
-      # See https://www.terraform.io/docs/modules/sources.html#http-urls for
-      # details of how Terraform handle HTTP(S) sources for modules
       # rubocop:disable Metrics/AbcSize
       # rubocop:disable Metrics/CyclomaticComplexity
+      # See https://www.terraform.io/docs/modules/sources.html#http-urls for
+      # details of how Terraform handle HTTP(S) sources for modules
+      sig { params(raw_source: String).returns(String) }
       def self.get_proxied_source(raw_source)
         return raw_source unless raw_source.start_with?("http")
 
-        uri = URI.parse(raw_source.split(%r{(?<!:)//}).first)
+        uri = URI.parse(T.must(raw_source.split(%r{(?<!:)//}).first))
         return raw_source if ARCHIVE_EXTENSIONS.any? { |ext| uri.path&.end_with?(ext) }
         return raw_source if URI.parse(raw_source).query&.include?("archive=")
 
-        url = raw_source.split(%r{(?<!:)//}).first + "?terraform-get=1"
+        url = T.must(raw_source.split(%r{(?<!:)//}).first) + "?terraform-get=1"
         host = URI.parse(raw_source).host
 
         response = Dependabot::RegistryClient.get(url: url)
         raise PrivateSourceAuthenticationFailure, host if response.status == 401
 
-        return response.headers["X-Terraform-Get"] if response.headers["X-Terraform-Get"]
+        return T.must(response.headers["X-Terraform-Get"]) if response.headers["X-Terraform-Get"]
 
         doc = Nokogiri::XML(response.body)
         doc.css("meta").find do |tag|
@@ -62,6 +69,7 @@ module Dependabot
       # "hashicorp/aws"
       # @return [Array<Dependabot::Terraform::Version>]
       # @raise [Dependabot::DependabotError] when the versions cannot be retrieved
+      sig { params(identifier: String).returns(T::Array[Dependabot::Terraform::Version]) }
       def all_provider_versions(identifier:)
         base_url = service_url_for("providers.v1")
         response = http_get!(URI.join(base_url, "#{identifier}/versions"))
@@ -80,6 +88,7 @@ module Dependabot
       # "hashicorp/consul/aws"
       # @return [Array<Dependabot::Terraform::Version>]
       # @raise [Dependabot::DependabotError] when the versions cannot be retrieved
+      sig { params(identifier: String).returns(T::Array[Dependabot::Terraform::Version]) }
       def all_module_versions(identifier:)
         base_url = service_url_for("modules.v1")
         response = http_get!(URI.join(base_url, "#{identifier}/versions"))
@@ -97,8 +106,9 @@ module Dependabot
       # @param dependency [Dependabot::Dependency] the dependency who's source
       # we're attempting to find
       # @return [nil, Dependabot::Source]
+      sig { params(dependency: Dependabot::Dependency).returns(T.nilable(Dependabot::Source)) }
       def source(dependency:)
-        type = dependency.requirements.first[:source][:type]
+        type = T.must(dependency.requirements.first)[:source][:type]
         base_url = service_url_for(service_key_for(type))
         case type
         # https://www.terraform.io/internals/module-registry-protocol#download-source-code-for-a-specific-module-version
@@ -130,6 +140,7 @@ module Dependabot
       # @param service_key [String] the service type described in https://www.terraform.io/docs/internals/remote-service-discovery.html#supported-services
       # @param return String
       # @raise [Dependabot::PrivateSourceAuthenticationFailure] when the service is not available
+      sig { params(service_key: String).returns(String) }
       def service_url_for(service_key)
         url_for(services.fetch(service_key))
       rescue KeyError
@@ -138,26 +149,35 @@ module Dependabot
 
       private
 
+      sig { returns(String) }
       attr_reader :hostname
+
+      sig { returns(T::Hash[String, String]) }
       attr_reader :tokens
 
+      sig { returns(T.class_of(Dependabot::Terraform::Version)) }
       def version_class
         Version
       end
 
+      sig { params(hostname: String).returns(T::Hash[String, String]) }
       def headers_for(hostname)
         token = tokens[hostname]
         token ? { "Authorization" => "Bearer #{token}" } : {}
       end
 
+      sig { returns(T::Hash[String, String]) }
       def services
-        @services ||=
+        @services ||= T.let(
           begin
             response = http_get(url_for("/.well-known/terraform.json"))
             response.status == 200 ? JSON.parse(response.body) : {}
-          end
+          end,
+          T.nilable(T::Hash[String, String])
+        )
       end
 
+      sig { params(type: String).returns(String) }
       def service_key_for(type)
         case type
         when "module", "modules", "registry"
@@ -169,13 +189,17 @@ module Dependabot
         end
       end
 
+      sig { params(url: T.any(String, URI::Generic)).returns(Excon::Response) }
       def http_get(url)
         Dependabot::RegistryClient.get(
           url: url.to_s,
           headers: headers_for(hostname)
         )
+      rescue Excon::Error::Socket, Excon::Error::Timeout
+        raise PrivateSourceBadResponse, hostname
       end
 
+      sig { params(url: URI::Generic).returns(Excon::Response) }
       def http_get!(url)
         response = http_get(url)
 
@@ -185,6 +209,7 @@ module Dependabot
         response
       end
 
+      sig { params(path: String).returns(String) }
       def url_for(path)
         uri = URI.parse(path)
         return uri.to_s if uri.scheme == "https"
@@ -195,6 +220,7 @@ module Dependabot
         uri.to_s
       end
 
+      sig { params(message: String).returns(Dependabot::DependabotError) }
       def error(message)
         Dependabot::DependabotError.new(message)
       end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-terraform
 version: !ruby/object:Gem::Version
-  version: 0.295.0
+  version: 0.296.1
 platform: ruby
 authors:
 - Dependabot
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-01-30 00:00:00.000000000 Z
+date: 2025-02-11 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.295.0
+        version: 0.296.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.295.0
+        version: 0.296.1
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -261,7 +261,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.295.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.296.1
 post_install_message:
 rdoc_options: []
 require_paths: