dependabot-terraform 0.146.0 → 0.146.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4e420475dee8741febcbdbb02fbffc509cf328bc767ba0f3126dc384403cf8d3
-  data.tar.gz: 728d0bcf47d8891d39ea7de8c6e4794f2866492aae8328cce43f1d72156abd7e
+  metadata.gz: 0e0e4b2c49852d13b19402f2fdd23baa832ca40a285b1875407b4316f5a1be35
+  data.tar.gz: 5ae48fd942a0614878c439998b153bd82038b3b759206cc1b639ff4616e1fe3e
 SHA512:
-  metadata.gz: b9ae9da9838932d029c73c2d9ede6cf13f0405440f590bb74ad2e7bcaf37394e2ce2c4ba8d8d8746699f8fe238f0c06c4756f5d3a919817b91132ee3e816efcd
-  data.tar.gz: a530a3b1fba4dae111238e23d67e89f3794fb812ebf658f3a357cf7b588bcb9637c582f55619aee83f87f75fca4b7302efc172363008cf6833154d848be575f4
+  metadata.gz: a21225eb63d2ba7e7c2a973f92fa0f923ed8beb43c6f143e5bd3373eee249e95a7131384363285d523521846fcf7477f3cae059d6b9bd5ff2a88491dc84aa72e
+  data.tar.gz: bfef2a31dccd5e6f4c18e7591f08462888ebf4d2d3bbb30802e9a2b3e74a570cde408f7478ee32939eb8aed36c442c06c553258c9c62b247657d0934a7a01b42

data/helpers/build

@@ -13,7 +13,17 @@ if [ ! -d "$install_dir/bin" ]; then
 fi
 
 os="$(uname -s | tr '[:upper:]' '[:lower:]')"
-github_url="https://github.com/kvz/json2hcl"
-url="${github_url}/releases/download/v0.0.6/json2hcl_v0.0.6_${os}_amd64"
-wget -O "$install_dir/bin/json2hcl" "$url"
+
+json2hcl_checksum="d124ed13f3538c465fcab19e6015d311d3cd56f7dc2db7609b6e72fec666482d"
+json2hcl_url="https://github.com/kvz/json2hcl/releases/download/v0.0.6/json2hcl_v0.0.6_${os}_amd64"
+json2hcl_path="$install_dir/bin/json2hcl"
+wget -O "$json2hcl_path"  "$json2hcl_url"
+echo "$json2hcl_checksum  $json2hcl_path" | sha256sum -c
 chmod +x "$install_dir/bin/json2hcl"
+
+hcl2json_checksum="24068f1e25a34d8f8ca763f34fce11527472891bfa834d1504f665855021d5d4"
+hcl2json_url="https://github.com/tmccombs/hcl2json/releases/download/v0.3.3/hcl2json_${os}_amd64"
+hcl2json_path="$install_dir/bin/hcl2json"
+wget -O "$hcl2json_path" "$hcl2json_url"
+echo "$hcl2json_checksum  $hcl2json_path" | sha256sum -c
+chmod +x "$install_dir/bin/hcl2json"

data/lib/dependabot/terraform/file_fetcher.rb

@@ -2,10 +2,13 @@
 
 require "dependabot/file_fetchers"
 require "dependabot/file_fetchers/base"
+require "dependabot/terraform/file_selector"
 
 module Dependabot
   module Terraform
     class FileFetcher < Dependabot::FileFetchers::Base
+      include FileSelector
+
       def self.required_files_in?(filenames)
         filenames.any? { |f| f.end_with?(".tf", ".tfvars") }
       end
@@ -39,7 +42,7 @@ module Dependabot
       def terragrunt_files
         @terragrunt_files ||=
           repo_contents(raise_errors: false).
-          select { |f| f.type == "file" && f.name.end_with?(".tfvars") }.
+          select { |f| f.type == "file" && terragrunt_file?(f.name) }.
           map { |f| fetch_file_from_host(f.name) }
       end
     end

data/lib/dependabot/terraform/file_parser.rb

@@ -10,27 +10,32 @@ require "dependabot/file_parsers/base"
 require "dependabot/git_commit_checker"
 require "dependabot/shared_helpers"
 require "dependabot/errors"
+require "dependabot/terraform/file_selector"
 
 module Dependabot
   module Terraform
     class FileParser < Dependabot::FileParsers::Base
       require "dependabot/file_parsers/base/dependency_set"
 
+      include FileSelector
+
       ARCHIVE_EXTENSIONS = %w(.zip .tbz2 .tgz .txz).freeze
 
       def parse
         dependency_set = DependencySet.new
 
         terraform_files.each do |file|
-          modules = parsed_file(file).fetch("module", []).map(&:first)
+          modules = parsed_file(file).fetch("module", {})
           modules.each do |name, details|
             dependency_set << build_terraform_dependency(file, name, details)
           end
         end
 
         terragrunt_files.each do |file|
-          modules = parsed_file(file).fetch("terragrunt", []).first || {}
-          modules = modules.fetch("terraform", [])
+          # legacy terragrunt (.tfvars) files have a top-level "terragrunt" key
+          # that has since been removed.
+          legacy_modules = (parsed_file(file).fetch("terragrunt", []).first || {}).fetch("terraform", [])
+          modules = parsed_file(file).fetch("terraform", []) + legacy_modules
           modules.each do |details|
             next unless details["source"]
 
@@ -38,7 +43,7 @@ module Dependabot
           end
         end
 
-        dependency_set.dependencies
+        dependency_set.dependencies.sort_by(&:name)
       end
 
       private
@@ -210,29 +215,85 @@ module Dependabot
       end
       # rubocop:enable Metrics/PerceivedComplexity
 
+      def parsed_file_hcl2(file)
+        SharedHelpers.in_a_temporary_directory do
+          File.write("tmp.tf", file.content)
+
+          command = "#{terraform_hcl2_parser_path} < tmp.tf"
+          start = Time.now
+          stdout, stderr, process = Open3.capture3(command)
+          time_taken = Time.now - start
+
+          unless process.success?
+            raise SharedHelpers::HelperSubprocessFailed.new(
+              message: stderr,
+              error_context: {
+                command: command,
+                time_taken: time_taken,
+                process_exit_value: process.to_s
+              }
+            )
+          end
+
+          JSON.parse(stdout)
+        end
+      end
+
+      def parsed_file_hcl1(file)
+        SharedHelpers.in_a_temporary_directory do
+          File.write("tmp.tf", file.content)
+
+          command = "#{terraform_parser_path} -reverse < tmp.tf"
+          start = Time.now
+          stdout, stderr, process = Open3.capture3(command)
+          time_taken = Time.now - start
+
+          unless process.success?
+            raise SharedHelpers::HelperSubprocessFailed.new(
+              message: stderr,
+              error_context: {
+                command: command,
+                time_taken: time_taken,
+                process_exit_value: process.to_s
+              }
+            )
+          end
+
+          json = JSON.parse(stdout)
+          json["module"] = json.fetch("module", []).inject({}) { |memo, item| memo.merge(item) }
+          json
+        end
+      end
+
+      # == Returns:
+      # A Hash representing each module found in the specified file
+      #
+      # E.g.
+      # {
+      #   "module" => {
+      #     {
+      #       "consul" => [
+      #         {
+      #           "source"=>"consul/aws",
+      #           "version"=>"0.1.0"
+      #         }
+      #       ]
+      #     }
+      #   },
+      #   "terragrunt"=>[
+      #     {
+      #       "include"=>[{ "path"=>"${find_in_parent_folders()}" }],
+      #       "terraform"=>[{ "source" => "git::git@github.com:gruntwork-io/modules-example.git//consul?ref=v0.0.2" }]
+      #     }
+      #   ],
+      # }
       def parsed_file(file)
         @parsed_buildfile ||= {}
         @parsed_buildfile[file.name] ||=
-          SharedHelpers.in_a_temporary_directory do
-            File.write("tmp.tf", file.content)
-
-            command = "#{terraform_parser_path} -reverse < tmp.tf"
-            start = Time.now
-            stdout, stderr, process = Open3.capture3(command)
-            time_taken = Time.now - start
-
-            unless process.success?
-              raise SharedHelpers::HelperSubprocessFailed.new(
-                message: stderr,
-                error_context: {
-                  command: command,
-                  time_taken: time_taken,
-                  process_exit_value: process.to_s
-                }
-              )
-            end
-
-            JSON.parse(stdout)
+          if options[:terraform_hcl2]
+            parsed_file_hcl2(file)
+          else
+            parsed_file_hcl1(file)
           end
       rescue SharedHelpers::HelperSubprocessFailed => e
         msg = e.message.strip
@@ -244,19 +305,16 @@ module Dependabot
         Pathname.new(File.join(helper_bin_dir, "json2hcl")).cleanpath.to_path
       end
 
+      def terraform_hcl2_parser_path
+        helper_bin_dir = File.join(native_helpers_root, "terraform/bin")
+        Pathname.new(File.join(helper_bin_dir, "hcl2json")).cleanpath.to_path
+      end
+
       def native_helpers_root
         default_path = File.join(__dir__, "../../../helpers/install-dir")
         ENV.fetch("DEPENDABOT_NATIVE_HELPERS_PATH", default_path)
       end
 
-      def terraform_files
-        dependency_files.select { |f| f.name.end_with?(".tf") }
-      end
-
-      def terragrunt_files
-        dependency_files.select { |f| f.name.end_with?(".tfvars") }
-      end
-
       def check_required_files
         return if [*terraform_files, *terragrunt_files].any?
 

data/lib/dependabot/terraform/file_selector.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+module FileSelector
+  private
+
+  def terraform_files
+    dependency_files.select { |f| f.name.end_with?(".tf") }
+  end
+
+  def terragrunt_files
+    dependency_files.select { |f| terragrunt_file?(f.name) }
+  end
+
+  def terragrunt_file?(file_name)
+    file_name != ".terraform.lock.hcl" &&
+      (file_name.end_with?(".tfvars") || file_name.end_with?(".hcl"))
+  end
+end

data/lib/dependabot/terraform/file_updater.rb

@@ -3,12 +3,15 @@
 require "dependabot/file_updaters"
 require "dependabot/file_updaters/base"
 require "dependabot/errors"
+require "dependabot/terraform/file_selector"
 
 module Dependabot
   module Terraform
     class FileUpdater < Dependabot::FileUpdaters::Base
+      include FileSelector
+
       def self.updated_files_regex
-        [/\.tf$/, /\.tfvars$/]
+        [/\.tf$/, /\.tfvars$/, /\.hcl$/]
       end
 
       def updated_dependency_files
@@ -87,14 +90,6 @@ module Dependabot
         dependency_files.select { |file| filenames.include?(file.name) }
       end
 
-      def terraform_files
-        dependency_files.select { |f| f.name.end_with?(".tf") }
-      end
-
-      def terragrunt_files
-        dependency_files.select { |f| f.name.end_with?(".tfvars") }
-      end
-
       def check_required_files
         return if [*terraform_files, *terragrunt_files].any?
 
@@ -113,7 +108,7 @@ module Dependabot
       def git_declaration_regex(filename)
         # For terragrunt dependencies there's not a lot we can base the
         # regex on. Just look for declarations within a `terraform` block
-        return /terraform\s*\{(?:(?!^\}).)*/m if filename.end_with?(".tfvars")
+        return /terraform\s*\{(?:(?!^\}).)*/m if terragrunt_file?(filename)
 
         # For modules we can do better - filter for module blocks that use the
         # name of the dependency

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-terraform
 version: !ruby/object:Gem::Version
-  version: 0.146.0
+  version: 0.146.1
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-05-11 00:00:00.000000000 Z
+date: 2021-05-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.146.0
+        version: 0.146.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.146.0
+        version: 0.146.1
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement
@@ -189,6 +189,7 @@ files:
 - lib/dependabot/terraform.rb
 - lib/dependabot/terraform/file_fetcher.rb
 - lib/dependabot/terraform/file_parser.rb
+- lib/dependabot/terraform/file_selector.rb
 - lib/dependabot/terraform/file_updater.rb
 - lib/dependabot/terraform/metadata_finder.rb
 - lib/dependabot/terraform/requirement.rb