dependabot-terraform 0.147.1 → 0.148.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1513bb43b2a242c080012555ab17869d6c062e941912c36dcc5ea76476be03b9
-  data.tar.gz: 731c9a7cd5658b622f7a24e87ea9a48909094af9cba08deb9850cb55a7f19bd9
+  metadata.gz: 7d7706b0b1a4caf093c24a35a6c49398abfa8c96b6ad18dc7db44bab894c7581
+  data.tar.gz: f482a7a71f487f0815ff464b189edab66c0a77e3d4ffdd1b5a5080e17680de27
 SHA512:
-  metadata.gz: 3ea9a436607ccb4b54b21743d6952d41b4a86bd344724372facdb6368b1fd6b1d24b7327ae569738280b8bd4187ae78f9fad0b458ac8832665a0741ca380eb33
-  data.tar.gz: b438039b06970eaf03a187567432a785e4f7eb2e9f61b18dffbdec99aa39080e2c322467d40b830af9b83356355a1d4702f61bbe84c9bdac50187309e7709a4d
+  metadata.gz: bc1983b4f79f865bac2a1f12f379c96f649b7b4056d67c96a6a3d6d2ad0a27e653b216baad1f85aba931bd8c1510a01e4913e32307b91a4311b2160c60e80f44
+  data.tar.gz: d7b18e3cb48784d3fe22c305b6f609d75a7c553d3191305c3b30d2cecd45274a85b615f9513867f08a9d9ff07ae8b248dab1a8198a3c724b159c58016c0126f4

data/lib/dependabot/terraform/file_parser.rb

@@ -27,7 +27,16 @@ module Dependabot
         terraform_files.each do |file|
           modules = parsed_file(file).fetch("module", {})
           modules.each do |name, details|
-            dependency_set << build_terraform_dependency(file, name, details)
+            dependency_set << build_terraform_dependency(file, name, details, false)
+          end
+
+          parsed_file(file).fetch("terraform", []).each do |terraform|
+            required_providers = terraform.fetch("required_providers", {})
+            required_providers.each do |provider|
+              provider.each do |name, details|
+                dependency_set << build_terraform_dependency(file, name, details, true)
+              end
+            end
           end
         end
 
@@ -45,12 +54,15 @@ module Dependabot
 
       private
 
-      def build_terraform_dependency(file, name, details)
-        details = details.first
+      def build_terraform_dependency(file, name, details, provider)
+        details = details.is_a?(Array) ? details.first : details
 
-        source = source_from(details)
-        dep_name =
-          source[:type] == "registry" ? source[:module_identifier] : name
+        source = source_from(details, provider)
+        dep_name = case source[:type]
+                   when "registry" then source[:module_identifier]
+                   when "provider" then details["source"]
+                   else name
+                   end
         version_req = details["version"]&.strip
         version =
           if source[:type] == "git" then version_from_ref(source[:ref])
@@ -71,7 +83,7 @@ module Dependabot
       end
 
       def build_terragrunt_dependency(file, details)
-        source = source_from(details)
+        source = source_from(details, false)
         dep_name =
           if Source.from_url(source[:url])
             Source.from_url(source[:url]).repo
@@ -95,7 +107,7 @@ module Dependabot
       end
 
       # Full docs at https://www.terraform.io/docs/modules/sources.html
-      def source_from(details_hash)
+      def source_from(details_hash, provider)
         raw_source = details_hash.fetch("source")
         bare_source = get_proxied_source(raw_source)
 
@@ -106,17 +118,23 @@ module Dependabot
           when :github, :bitbucket, :git
             git_source_details_from(bare_source)
           when :registry
-            registry_source_details_from(bare_source)
+            registry_source_details_from(bare_source, provider)
           end
 
         source_details[:proxy_url] = raw_source if raw_source != bare_source
         source_details
       end
 
-      def registry_source_details_from(source_string)
+      def registry_source_details_from(source_string, provider)
         parts = source_string.split("//").first.split("/")
 
-        if parts.count == 3
+        if provider && parts.count == 2
+          {
+            "type": "provider",
+            "registry_hostname": "registry.terraform.io",
+            "module_identifier": source_string
+          }
+        elsif parts.count == 3
           {
             type: "registry",
             registry_hostname: "registry.terraform.io",

data/lib/dependabot/terraform/file_updater.rb

@@ -47,7 +47,7 @@ module Dependabot
           case new_req[:source][:type]
           when "git"
             update_git_declaration(new_req, old_req, content, file.name)
-          when "registry"
+          when "registry", "provider"
             update_registry_declaration(new_req, old_req, content)
           else
             raise "Don't know how to update a #{new_req[:source][:type]} "\

data/lib/dependabot/terraform/metadata_finder.rb

@@ -15,6 +15,7 @@ module Dependabot
         case new_source_type
         when "git" then find_source_from_git_url
         when "registry" then find_source_from_registry_details
+        when "provider" then find_source_from_provider_details
         else raise "Unexpected source type: #{new_source_type}"
         end
       end
@@ -36,29 +37,11 @@ module Dependabot
         Source.from_url(url)
       end
 
-      # Registry API docs:
-      # https://www.terraform.io/docs/registry/api.html
       def find_source_from_registry_details
         info = dependency.requirements.map { |r| r[:source] }.compact.first
-
         hostname = info[:registry_hostname] || info["registry_hostname"]
 
-        # TODO: Implement service discovery for custom registries
-        return unless hostname == "registry.terraform.io"
-
-        url = "https://registry.terraform.io/v1/modules/"\
-              "#{dependency.name}/#{dependency.version}"
-
-        response = Excon.get(
-          url,
-          idempotent: true,
-          **SharedHelpers.excon_defaults
-        )
-
-        raise "Response from registry was #{response.status}" unless response.status == 200
-
-        source_url = JSON.parse(response.body).fetch("source")
-        Source.from_url(source_url) if source_url
+        RegistryClient.new(hostname: hostname).source(dependency: dependency)
       end
     end
   end

data/lib/dependabot/terraform/registry_client.rb

@@ -0,0 +1,103 @@
+# frozen_string_literal: true
+
+require "dependabot/dependency"
+require "dependabot/source"
+require "dependabot/terraform/version"
+
+module Dependabot
+  module Terraform
+    # Terraform::RegistryClient is a basic API client to interact with a
+    # terraform registry: https://www.terraform.io/docs/registry/api.html
+    class RegistryClient
+      PUBLIC_HOSTNAME = "registry.terraform.io"
+
+      def initialize(hostname:)
+        @hostname = hostname
+      end
+
+      # Fetch all the versions of a provider, and return a Version
+      # representation of them.
+      #
+      # @param identifier [String] the identifier for the dependency, i.e:
+      # "hashicorp/aws"
+      # @return [Array<Dependabot::Terraform::Version>]
+      # @raise [RuntimeError] when the versions cannot be retrieved
+      def all_provider_versions(identifier:)
+        # TODO: Implement service discovery for custom registries
+        return [] unless hostname == PUBLIC_HOSTNAME
+
+        response = get(endpoint: "providers/#{identifier}/versions")
+
+        JSON.parse(response).
+          fetch("versions").
+          map { |release| version_class.new(release.fetch("version")) }
+      end
+
+      # Fetch all the versions of a module, and return a Version
+      # representation of them.
+      #
+      # @param identifier [String] the identifier for the dependency, i.e:
+      # "hashicorp/consul/aws"
+      # @return [Array<Dependabot::Terraform::Version>]
+      # @raise [RuntimeError] when the versions cannot be retrieved
+      def all_module_versions(identifier:)
+        # TODO: Implement service discovery for custom registries
+        return [] unless hostname == PUBLIC_HOSTNAME
+
+        response = get(endpoint: "modules/#{identifier}/versions")
+
+        JSON.parse(response).
+          fetch("modules").first.fetch("versions").
+          map { |release| version_class.new(release.fetch("version")) }
+      end
+
+      # Fetch the "source" for a module or provider. We use the API to fetch
+      # the source for a dependency, this typically points to a source code
+      # repository, and then instantiate a Dependabot::Source object that we
+      # can use to fetch Metadata about a specific version of the dependency.
+      #
+      # @param dependency [Dependabot::Dependency] the dependency who's source
+      # we're attempting to find
+      # @return Dependabot::Source
+      # @raise [RuntimeError] when the source cannot be retrieved
+      def source(dependency:)
+        # TODO: Implement service discovery for custom registries
+        return unless hostname == PUBLIC_HOSTNAME
+
+        endpoint = if dependency.requirements.first[:source][:type] == "registry"
+                     "modules/#{dependency.name}/#{dependency.version}"
+                   elsif dependency.source[:type] == "provider"
+                     "providers/#{dependency.name}/#{dependency.version}"
+                   else
+                     raise "Invalid source type"
+                   end
+        response = get(endpoint: endpoint)
+
+        source_url = JSON.parse(response).fetch("source")
+        Source.from_url(source_url) if source_url
+      end
+
+      private
+
+      attr_reader :hostname
+
+      def get(endpoint:)
+        url = "https://#{hostname}/v1/#{endpoint}"
+
+        response = Excon.get(
+          url,
+          idempotent: true,
+          **SharedHelpers.excon_defaults
+        )
+
+        raise "Response from registry was #{response.status}" unless response.status == 200
+
+        response.body
+      end
+
+      def version_class
+        Version
+      end
+    end
+  end
+end

data/lib/dependabot/terraform/requirements_updater.rb

@@ -72,7 +72,7 @@ module Dependabot
         requirements.map do |req|
           case req.dig(:source, :type)
           when "git" then update_git_requirement(req)
-          when "registry" then update_registry_requirement(req)
+          when "registry", "provider" then update_registry_requirement(req)
           else req
           end
         end

data/lib/dependabot/terraform/update_checker.rb

@@ -6,6 +6,7 @@ require "dependabot/git_commit_checker"
 require "dependabot/terraform/requirements_updater"
 require "dependabot/terraform/requirement"
 require "dependabot/terraform/version"
+require "dependabot/terraform/registry_client"
 
 module Dependabot
   module Terraform
@@ -13,6 +14,7 @@ module Dependabot
       def latest_version
         return latest_version_for_git_dependency if git_dependency?
         return latest_version_for_registry_dependency if registry_dependency?
+        return latest_version_for_provider_dependency if provider_dependency?
         # Other sources (mercurial, path dependencies) just return `nil`
       end
 
@@ -65,34 +67,40 @@ module Dependabot
 
         return @latest_version_for_registry_dependency if @latest_version_for_registry_dependency
 
-        versions = all_registry_versions
+        versions = all_module_versions
         versions.reject!(&:prerelease?) unless wants_prerelease?
         versions.reject! { |v| ignore_requirements.any? { |r| r.satisfied_by?(v) } }
 
         @latest_version_for_registry_dependency = versions.max
       end
 
-      def all_registry_versions
-        hostname = dependency_source_details.fetch(:registry_hostname)
+      def all_module_versions
         identifier = dependency_source_details.fetch(:module_identifier)
+        registry_client.all_module_versions(identifier: identifier)
+      end
+
+      def all_provider_versions
+        identifier = dependency_source_details.fetch(:module_identifier)
+        registry_client.all_provider_versions(identifier: identifier)
+      end
 
-        # TODO: Implement service discovery for custom registries
-        return [] unless hostname == "registry.terraform.io"
+      def registry_client
+        @registry_client ||= begin
+          hostname = dependency_source_details.fetch(:registry_hostname)
+          RegistryClient.new(hostname: hostname)
+        end
+      end
 
-        url = "https://registry.terraform.io/v1/modules/"\
-              "#{identifier}/versions"
+      def latest_version_for_provider_dependency
+        return unless provider_dependency?
 
-        response = Excon.get(
-          url,
-          idempotent: true,
-          **SharedHelpers.excon_defaults
-        )
+        return @latest_version_for_provider_dependency if @latest_version_for_provider_dependency
 
-        raise "Response from registry was #{response.status}" unless response.status == 200
+        versions = all_provider_versions
+        versions.reject!(&:prerelease?) unless wants_prerelease?
+        versions.reject! { |v| ignore_requirements.any? { |r| r.satisfied_by?(v) } }
 
-        JSON.parse(response.body).
-          fetch("modules").first.fetch("versions").
-          map { |release| version_class.new(release.fetch("version")) }
+        @latest_version_for_provider_dependency = versions.max
       end
 
       def wants_prerelease?
@@ -160,6 +168,12 @@ module Dependabot
         dependency_source_details.fetch(:type) == "registry"
       end
 
+      def provider_dependency?
+        return false if dependency_source_details.nil?
+
+        dependency_source_details.fetch(:type) == "provider"
+      end
+
       def dependency_source_details
         sources =
           dependency.requirements.map { |r| r.fetch(:source) }.uniq.compact

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-terraform
 version: !ruby/object:Gem::Version
-  version: 0.147.1
+  version: 0.148.0
 platform: ruby
 authors:
 - Dependabot
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.147.1
+        version: 0.148.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.147.1
+        version: 0.148.0
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement
@@ -192,6 +192,7 @@ files:
 - lib/dependabot/terraform/file_selector.rb
 - lib/dependabot/terraform/file_updater.rb
 - lib/dependabot/terraform/metadata_finder.rb
+- lib/dependabot/terraform/registry_client.rb
 - lib/dependabot/terraform/requirement.rb
 - lib/dependabot/terraform/requirements_updater.rb
 - lib/dependabot/terraform/update_checker.rb