dependabot-terraform 0.390.0 → 0.392.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6b961c5a78a81d4b3d75d0a9a6627140e8244377952fde7b237c3f5c743d4d05
-  data.tar.gz: 20b2ad33f1650d9437df55efc906c7dd8674f910334b01f54c15a7196f15c0c7
+  metadata.gz: 8967cf03e79ccf2048ee8899931fe7c5c84b61626ad1434821d4ea9c44116178
+  data.tar.gz: a0e6c8d998eebbc10c0041859cdb48e2006a9367dddafc270ade1aa0ce43dfed
 SHA512:
-  metadata.gz: 694f1d184f523c4c553922c22d2e2fb780246334a7a3d93630261c35971ef3a97a1f6586a0ed5ec62ab5f67b1f6c57e4c906e4a5aabf16296d0e7c0334b6e9bd
-  data.tar.gz: 3c5c5a40f09269b1f84d5ab19ba2092bfdf62ec63211950daee4cdd3dd13016df6955705e62aac5a6e06ecd83c8c131d66d5f6fd08e4b1f63a36ef155cb2ade6
+  metadata.gz: 781749e9fd5bc08e9292ac4eebb9e857149aab0cee47e7d63e4984ca249dfb32044ce5e372828f6c5949f8fa3704c3e49c4c2d174523fb82e26abee6b2301c81
+  data.tar.gz: 5bb5d99c9be118bb96bae5f66eb4329648b465259d2bf5b4ace83c645b4d9f5177c3ce6122531cb606b1b8b22ad9be6fce2604305dc67709cf6dd1639eeef91a

data/lib/dependabot/terraform/file_updater/provider_cli_config_builder.rb

@@ -75,12 +75,10 @@ module Dependabot
         def target_provider_source
           req = dependency.requirements.first
           return unless req
+          return unless req.source_string("type") == "provider"
 
-          source = req[:source]
-          return unless source && source[:type] == "provider"
-
-          hostname = source[:registry_hostname] || DEFAULT_REGISTRY
-          identifier = source[:module_identifier]
+          hostname = req.source_string("registry_hostname") || DEFAULT_REGISTRY
+          identifier = req.source_string("module_identifier")
           return unless identifier
 
           "#{hostname}/#{identifier}".downcase

data/lib/dependabot/terraform/file_updater.rb

@@ -1,10 +1,11 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"
 
 require "dependabot/file_updaters"
 require "dependabot/file_updaters/base"
+require "dependabot/dependency_requirement"
 require "dependabot/errors"
 require "dependabot/terraform/file_selector"
 require "dependabot/shared_helpers"
@@ -76,7 +77,7 @@ module Dependabot
           (dependency.requirements - T.must(dependency.previous_requirements)) |
           (T.must(dependency.previous_requirements) - dependency.requirements)
 
-        changed_requirements.any? { |f| f[:file] == file.name }
+        changed_requirements.any? { |requirement| requirement.file == file.name }
       end
 
       sig { params(file: Dependabot::DependencyFile).returns(String) }
@@ -88,17 +89,17 @@ module Dependabot
 
         # Loop through each changed requirement and update the files and lockfile
         reqs.each do |new_req, old_req|
-          raise "Bad req match" unless new_req[:file] == old_req&.fetch(:file)
-          next unless new_req.fetch(:file) == file.name
+          raise "Bad req match" unless new_req.file == old_req&.file
+          next unless new_req.file == file.name
 
-          case new_req[:source][:type]
+          source_type = T.must(new_req.source_string("type"))
+          case source_type
           when "git"
             update_git_declaration(new_req, old_req, content, file.name)
           when "registry", "provider"
             update_registry_declaration(new_req, old_req, content)
           else
-            raise "Don't know how to update a #{new_req[:source][:type]} " \
-                  "declaration!"
+            raise "Don't know how to update a #{source_type} declaration!"
           end
         end
 
@@ -107,50 +108,55 @@ module Dependabot
 
       sig do
         params(
-          new_req: T::Hash[Symbol, T.untyped],
-          old_req: T.nilable(T::Hash[Symbol, T.untyped]),
+          new_req: Dependabot::DependencyRequirement,
+          old_req: T.nilable(Dependabot::DependencyRequirement),
           updated_content: String,
           filename: String
         )
           .void
       end
       def update_git_declaration(new_req, old_req, updated_content, filename)
-        url = old_req&.dig(:source, :url)&.gsub(%r{^https://}, "")
-        tag = old_req&.dig(:source, :ref)
+        url = T.must(old_req&.source_string("url")).gsub(%r{^https://}, "")
+        old_ref = T.must(old_req&.source_string("ref"))
+        new_ref = T.must(new_req.source_string("ref"))
+        tag = old_ref
         url_regex = /#{Regexp.quote(url)}.*ref=#{Regexp.quote(tag)}/
 
         declaration_regex = git_declaration_regex(filename)
 
         updated_content.sub!(declaration_regex) do |regex_match|
           regex_match.sub(url_regex) do |url_match|
-            url_match.sub(old_req&.dig(:source, :ref), new_req[:source][:ref])
+            url_match.sub(old_ref, new_ref)
           end
         end
       end
 
       sig do
         params(
-          new_req: T::Hash[Symbol, T.untyped],
-          old_req: T.nilable(T::Hash[Symbol, T.untyped]),
+          new_req: Dependabot::DependencyRequirement,
+          old_req: T.nilable(Dependabot::DependencyRequirement),
           updated_content: String
         )
           .void
       end
       def update_registry_declaration(new_req, old_req, updated_content)
-        regex = if new_req[:source][:type] == "provider"
+        regex = if new_req.source_string("type") == "provider"
                   provider_declaration_regex(updated_content)
                 else
                   registry_declaration_regex
                 end
 
+        old_requirement = T.must(old_req&.requirement_string)
+        new_requirement = T.must(new_req.requirement_string)
+
         # Define and break down the version regex for better clarity
         version_key_pattern = /^\s*version\s*=\s*/
-        version_value_pattern = /["'].*#{Regexp.escape(old_req&.fetch(:requirement))}.*['"]/
+        version_value_pattern = /["'].*#{Regexp.escape(old_requirement)}.*['"]/
         version_regex = /#{version_key_pattern}#{version_value_pattern}/
 
         updated_content.gsub!(regex) do |regex_match|
           regex_match.sub(version_regex) do |req_line_match|
-            req_line_match.sub!(old_req&.fetch(:requirement), new_req[:requirement])
+            req_line_match.sub!(old_requirement, new_requirement)
           end
         end
       end
@@ -171,13 +177,15 @@ module Dependabot
 
       sig do
         params(
-          new_req: T::Hash[Symbol, T.untyped]
+          new_req: Dependabot::DependencyRequirement
         )
           .returns([String, String, Regexp])
       end
       def lockfile_details(new_req)
         content = T.must(lockfile).content.dup
-        provider_source = new_req[:source][:registry_hostname] + "/" + new_req[:source][:module_identifier]
+        registry_hostname = T.must(new_req.source_string("registry_hostname"))
+        module_identifier = T.must(new_req.source_string("module_identifier"))
+        provider_source = "#{registry_hostname}/#{module_identifier}"
         declaration_regex = lockfile_declaration_regex(provider_source)
 
         [T.must(content), provider_source, declaration_regex]
@@ -188,7 +196,7 @@ module Dependabot
         new_req = T.must(dependency.requirements.first)
 
         # NOTE: Only providers are included in the lockfile, modules are not
-        return unless new_req[:source][:type] == "provider"
+        return unless new_req.source_string("type") == "provider"
 
         architectures = []
         content, provider_source, declaration_regex = lockfile_details(new_req)
@@ -270,7 +278,7 @@ module Dependabot
 
         new_req = T.must(dependency.requirements.first)
         # NOTE: Only providers are included in the lockfile, modules are not
-        return unless new_req[:source][:type] == "provider"
+        return unless new_req.source_string("type") == "provider"
 
         content, provider_source, declaration_regex = lockfile_details(new_req)
         lockfile_dependency_removed = content.sub(declaration_regex, "")
@@ -353,7 +361,7 @@ module Dependabot
 
       sig { returns(T::Array[Dependabot::DependencyFile]) }
       def files_with_requirement
-        filenames = dependency.requirements.map { |r| r[:file] }
+        filenames = dependency.requirements.map(&:file)
         dependency_files.select { |file| filenames.include?(file.name) }
       end
 
@@ -425,8 +433,7 @@ module Dependabot
 
       sig { params(dependency: Dependabot::Dependency).returns(String) }
       def registry_host_for(dependency)
-        source = dependency.requirements.filter_map { |r| r[:source] }.first
-        source[:registry_hostname] || source["registry_hostname"] || "registry.terraform.io"
+        dependency.requirements.first&.source_string("registry_hostname") || "registry.terraform.io"
       end
 
       sig { params(provider_source: String).returns(Regexp) }

data/lib/dependabot/terraform/metadata_finder.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "excon"
@@ -32,16 +32,16 @@ module Dependabot
 
       sig { returns(T.nilable(Dependabot::Source)) }
       def find_source_from_git_url
-        info = dependency.requirements.filter_map { |r| r[:source] }.first
-
-        url = info[:url] || info.fetch("url")
+        url = T.must(dependency.source_string("url", allowed_types: ["git"]))
         Source.from_url(url)
       end
 
       sig { returns(T.nilable(Dependabot::Source)) }
       def find_source_from_registry_details
-        info = dependency.requirements.filter_map { |r| r[:source] }.first
-        hostname = info[:registry_hostname] || info["registry_hostname"]
+        hostname = dependency.source_string(
+          "registry_hostname",
+          allowed_types: %w(registry provider)
+        ) || RegistryClient::PUBLIC_HOSTNAME
 
         RegistryClient
           .new(hostname: hostname, credentials: credentials)

data/lib/dependabot/terraform/package/package_details_fetcher.rb

@@ -21,10 +21,7 @@ module Dependabot
         # https://registry.terraform.io/v2/providers/hashicorp/aws?include=provider-versions
         # https://registry.terraform.io/v2/modules/terraform-aws-modules/iam/aws?include=module-versions
 
-        ELIGIBLE_SOURCE_TYPES = T.let(
-          %w(git provider registry).freeze,
-          T::Array[String]
-        )
+        ELIGIBLE_SOURCE_TYPES = %w(git provider registry).freeze
 
         sig do
           params(

data/lib/dependabot/terraform/registry_client.rb

@@ -16,15 +16,9 @@ module Dependabot
 
       # Archive extensions supported by Terraform for HTTP URLs
       # https://developer.hashicorp.com/terraform/language/modules/sources#http-urls
-      ARCHIVE_EXTENSIONS = T.let(
-        %w(.zip .bz2 .tar.bz2 .tar.tbz2 .tbz2 .gz .tar.gz .tgz .xz .tar.xz .txz).freeze,
-        T::Array[String]
-      )
+      ARCHIVE_EXTENSIONS = %w(.zip .bz2 .tar.bz2 .tar.tbz2 .tbz2 .gz .tar.gz .tgz .xz .tar.xz .txz).freeze
       PUBLIC_HOSTNAME = "registry.terraform.io"
-      CERTIFICATE_ERROR_KEYWORDS = T.let(
-        %w(certificate SSL x509 verify).freeze,
-        T::Array[String]
-      )
+      CERTIFICATE_ERROR_KEYWORDS = %w(certificate SSL x509 verify).freeze
 
       sig { params(hostname: String, credentials: T::Array[Dependabot::Credential]).void }
       def initialize(hostname: PUBLIC_HOSTNAME, credentials: [])
@@ -117,7 +111,7 @@ module Dependabot
       # @return [nil, Dependabot::Source]
       sig { params(dependency: Dependabot::Dependency).returns(T.nilable(Dependabot::Source)) }
       def source(dependency:)
-        type = T.must(dependency.requirements.first)[:source][:type]
+        type = T.must(dependency.source_string("type"))
         base_url = service_url_for(service_key_for(type))
         case type
         # https://www.terraform.io/internals/module-registry-protocol#download-source-code-for-a-specific-module-version
@@ -255,7 +249,7 @@ module Dependabot
 
       sig { params(message: String).returns(T::Boolean) }
       def certificate_error?(message)
-        CERTIFICATE_ERROR_KEYWORDS.any? { |keyword| message.include?(keyword) }
+        CERTIFICATE_ERROR_KEYWORDS.any? { |keyword| message.index(keyword) }
       end
     end
   end

data/lib/dependabot/terraform/requirements_updater.rb

@@ -85,7 +85,7 @@ module Dependabot
         # requirement at index `i` to correspond to the previous requirement
         # at the same index.
         requirements.map do |req|
-          case req.dig(:source, :type)
+          case req.source_string("type")
           when "git" then update_git_requirement(req)
           when "registry", "provider" then update_registry_requirement(req)
           else req
@@ -106,25 +106,28 @@ module Dependabot
 
       sig { params(req: Dependabot::DependencyRequirement).returns(Dependabot::DependencyRequirement) }
       def update_git_requirement(req)
-        return req unless req.dig(:source, :ref)
+        return req unless req.source_string("ref")
         return req unless tag_for_latest_version
 
-        Dependabot::DependencyRequirement.create(req.merge(source: req[:source].merge(ref: tag_for_latest_version)))
+        source = updated_source(req, "ref" => tag_for_latest_version)
+        Dependabot::DependencyRequirement.create(req.merge(source: source))
       end
 
       sig { params(req: Dependabot::DependencyRequirement).returns(Dependabot::DependencyRequirement) }
       def update_registry_requirement(req)
-        return req if req.fetch(:requirement).nil?
+        string_req = req.requirement_string
+        return req if string_req.nil?
 
         latest = latest_version
         return req if latest.nil?
 
-        string_req = req.fetch(:requirement).strip
+        string_req = string_req.strip
         ruby_req = requirement_class.new(string_req)
         return req if ruby_req.satisfied_by?(latest)
 
         new_req =
-          if ruby_req.exact? then latest.to_s
+          if ruby_req.exact?
+            latest.to_s
           elsif string_req.start_with?("~>")
             update_twiddle_version(string_req).to_s
           else
@@ -134,6 +137,33 @@ module Dependabot
         Dependabot::DependencyRequirement.create(req.merge(requirement: new_req))
       end
 
+      sig do
+        params(
+          req: Dependabot::DependencyRequirement,
+          updates: T::Hash[String, String]
+        ).returns(Dependabot::DependencyRequirement::ObjectHash)
+      end
+      def updated_source(req, updates)
+        source = T.must(req.source_hash).dup
+        updates.each do |key, value|
+          source[source_key(source, key)] = value
+        end
+        source
+      end
+
+      sig do
+        params(
+          source: Dependabot::DependencyRequirement::ObjectHash,
+          key: String
+        ).returns(T.any(String, Symbol))
+      end
+      def source_key(source, key)
+        return key.to_sym if source.key?(key.to_sym)
+        return key if source.key?(key)
+
+        source.keys.any?(Symbol) ? key.to_sym : key
+      end
+
       # Updates the version in a "~>" constraint to allow the given version
       sig { params(req_string: String).returns(String) }
       def update_twiddle_version(req_string)

data/lib/dependabot/terraform/update_checker/latest_version_resolver.rb

@@ -26,10 +26,7 @@ module Dependabot
           @dependency = dependency
           @credentials = credentials
           @cooldown_options = cooldown_options
-          @git_commit_checker = T.let(
-            git_commit_checker,
-            Dependabot::GitCommitChecker
-          )
+          @git_commit_checker = git_commit_checker
         end
 
         sig { returns(Dependabot::Dependency) }

data/lib/dependabot/terraform/update_checker.rb

@@ -18,10 +18,7 @@ module Dependabot
 
       require_relative "update_checker/latest_version_resolver"
 
-      ELIGIBLE_SOURCE_TYPES = T.let(
-        %w(git provider registry).freeze,
-        T::Array[String]
-      )
+      ELIGIBLE_SOURCE_TYPES = %w(git provider registry).freeze
 
       sig { override.returns(T.nilable(T.any(String, Gem::Version))) }
       def latest_version
@@ -95,13 +92,13 @@ module Dependabot
 
       sig { returns(T::Array[Dependabot::Terraform::Version]) }
       def all_module_versions
-        identifier = dependency_source_details&.fetch(:module_identifier)
+        identifier = T.must(dependency.source_string("module_identifier", allowed_types: ELIGIBLE_SOURCE_TYPES))
         registry_client.all_module_versions(identifier: identifier)
       end
 
       sig { returns(T::Array[Dependabot::Terraform::Version]) }
       def all_provider_versions
-        identifier = dependency_source_details&.fetch(:module_identifier)
+        identifier = T.must(dependency.source_string("module_identifier", allowed_types: ELIGIBLE_SOURCE_TYPES))
         registry_client.all_provider_versions(identifier: identifier)
       end
 
@@ -118,7 +115,10 @@ module Dependabot
 
       sig { returns(String) }
       def registry_hostname
-        hostname = dependency_source_details&.fetch(:registry_hostname) || RegistryClient::PUBLIC_HOSTNAME
+        hostname = dependency.source_string(
+          "registry_hostname",
+          allowed_types: ELIGIBLE_SOURCE_TYPES
+        ) || RegistryClient::PUBLIC_HOSTNAME
         return hostname unless hostname == RegistryClient::PUBLIC_HOSTNAME
 
         base_registry = credentials.find do |cred|
@@ -158,7 +158,7 @@ module Dependabot
         end
 
         dependency.requirements.any? do |req|
-          req[:requirement]&.match?(/\d-[A-Za-z0-9]/)
+          req.requirement_string&.match?(/\d-[A-Za-z0-9]/)
         end
       end
 
@@ -201,28 +201,17 @@ module Dependabot
 
       sig { returns(T::Boolean) }
       def proxy_requirement?
-        dependency.requirements.any? do |req|
-          req.fetch(:source)&.fetch(:proxy_url, nil)
-        end
+        dependency.requirements.any? { |req| req.source_string("proxy_url") }
       end
 
       sig { returns(T::Boolean) }
       def registry_dependency?
-        return false if dependency_source_details.nil?
-
-        dependency_source_details&.fetch(:type) == "registry"
+        dependency.source_string("type", allowed_types: ELIGIBLE_SOURCE_TYPES) == "registry"
       end
 
       sig { returns(T::Boolean) }
       def provider_dependency?
-        return false if dependency_source_details.nil?
-
-        dependency_source_details&.fetch(:type) == "provider"
-      end
-
-      sig { returns(T.nilable(T::Hash[T.any(String, Symbol), T.untyped])) }
-      def dependency_source_details
-        dependency.source_details(allowed_types: ELIGIBLE_SOURCE_TYPES)
+        dependency.source_string("type", allowed_types: ELIGIBLE_SOURCE_TYPES) == "provider"
       end
 
       sig { returns(T::Boolean) }

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-terraform
 version: !ruby/object:Gem::Version
-  version: 0.390.0
+  version: 0.392.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.390.0
+        version: 0.392.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.390.0
+        version: 0.392.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -263,7 +263,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.390.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.392.0
 rdoc_options: []
 require_paths:
 - lib