dependabot-terraform 0.148.7 → 0.148.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8abef0b1470a4358728a3683ee251009d1d3bff2d4c50b6eae8268abf010ea94
-  data.tar.gz: f8e565b36fd766ff178ae5099dfe338104bce9942e5762bd81e6c7a16aaf041a
+  metadata.gz: cfde4822b690f9e4a302a1c9128ab55445f5143bc20c02de5b8ad1cafab64836
+  data.tar.gz: 26cb654b6ad3b04b35268d1d5b96bdb7e4203bb9dec061508892dc3537e97e90
 SHA512:
-  metadata.gz: 71fb871a1ac7ccb2f97c9698f95eab70c0131840f56b6412967a73d76547dca04500fdab4193f74168d05f63a41bd64079b98f3d3455821bd4f653c7211f3c0b
-  data.tar.gz: d8e8c0b3737f17e1f62703e62b48209898e9d54810a44b361027d9a2b84dcb63bfd9a8c4112dbc4f481291a98775154302dff4ca3585afebb6e8d56915e0dcf6
+  metadata.gz: d58215f50bafc56bd50bd6a78a897a857be6afb219e5c6140705aef283d5d4c646c29d216d725bcf1ee15714f83e5a8d1bfda8f6849ca460d5c71357dab67831
+  data.tar.gz: 7eea2d1dff06c749a432cf57ce1706a12fdc71867dd8cc0a30b846c68ab37113b9f3ed69927e7d4b29843215e2c26cc75f632ad257c029edd582a39fde4dc2d8

data/lib/dependabot/terraform/file_parser.rb

@@ -20,6 +20,10 @@ module Dependabot
       include FileSelector
 
       ARCHIVE_EXTENSIONS = %w(.zip .tbz2 .tgz .txz).freeze
+      DEFAULT_REGISTRY = "registry.terraform.io"
+      DEFAULT_NAMESPACE = "hashicorp"
+      # https://www.terraform.io/docs/language/providers/requirements.html#source-addresses
+      PROVIDER_SOURCE_ADDRESS = %r{\A((?<hostname>.+)/)?(?<namespace>.+)/(?<name>.+)\z}.freeze
 
       def parse
         dependency_set = DependencySet.new
@@ -27,14 +31,14 @@ module Dependabot
         terraform_files.each do |file|
           modules = parsed_file(file).fetch("module", {})
           modules.each do |name, details|
-            dependency_set << build_terraform_dependency(file, name, details, false)
+            dependency_set << build_terraform_dependency(file, name, details)
           end
 
           parsed_file(file).fetch("terraform", []).each do |terraform|
             required_providers = terraform.fetch("required_providers", {})
             required_providers.each do |provider|
               provider.each do |name, details|
-                dependency_set << build_terraform_dependency(file, name, details, true)
+                dependency_set << build_provider_dependency(file, name, details)
               end
             end
           end
@@ -54,10 +58,10 @@ module Dependabot
 
       private
 
-      def build_terraform_dependency(file, name, details, provider)
-        details = details.is_a?(Array) ? details.first : details
+      def build_terraform_dependency(file, name, details)
+        details = details.first
 
-        source = source_from(details, provider)
+        source = source_from(details)
         dep_name = case source[:type]
                    when "registry" then source[:module_identifier]
                    when "provider" then details["source"]
@@ -82,8 +86,31 @@ module Dependabot
         )
       end
 
+      def build_provider_dependency(file, name, details = {})
+        source_address = details.fetch("source", nil)
+        version = details["version"]&.strip
+        hostname, namespace, name = provider_source_from(source_address, name)
+        dependency_name = source_address ? "#{namespace}/#{name}" : name
+
+        Dependency.new(
+          name: dependency_name,
+          version: version, # resolved version should come from `.terraform.lock.hcl`.
+          package_manager: "terraform",
+          requirements: [
+            requirement: version,
+            groups: [],
+            file: file.name,
+            source: {
+              type: "provider",
+              registry_hostname: hostname,
+              module_identifier: "#{namespace}/#{name}"
+            }
+          ]
+        )
+      end
+
       def build_terragrunt_dependency(file, details)
-        source = source_from(details, false)
+        source = source_from(details)
         dep_name =
           if Source.from_url(source[:url])
             Source.from_url(source[:url]).repo
@@ -107,7 +134,7 @@ module Dependabot
       end
 
       # Full docs at https://www.terraform.io/docs/modules/sources.html
-      def source_from(details_hash, provider)
+      def source_from(details_hash)
         raw_source = details_hash.fetch("source")
         bare_source = get_proxied_source(raw_source)
 
@@ -118,23 +145,28 @@ module Dependabot
           when :github, :bitbucket, :git
             git_source_details_from(bare_source)
           when :registry
-            registry_source_details_from(bare_source, provider)
+            registry_source_details_from(bare_source)
           end
 
         source_details[:proxy_url] = raw_source if raw_source != bare_source
         source_details
       end
 
-      def registry_source_details_from(source_string, provider)
+      def provider_source_from(source_address, name)
+        return [DEFAULT_REGISTRY, DEFAULT_NAMESPACE, name] unless source_address
+
+        matches = source_address.match(PROVIDER_SOURCE_ADDRESS)
+        [
+          matches[:hostname] || DEFAULT_REGISTRY,
+          matches[:namespace],
+          matches[:name] || name
+        ]
+      end
+
+      def registry_source_details_from(source_string)
         parts = source_string.split("//").first.split("/")
 
-        if provider && parts.count == 2
-          {
-            "type": "provider",
-            "registry_hostname": "registry.terraform.io",
-            "module_identifier": source_string
-          }
-        elsif parts.count == 3
+        if parts.count == 3
           {
             type: "registry",
             registry_hostname: "registry.terraform.io",

data/lib/dependabot/terraform/file_updater.rb

@@ -98,9 +98,9 @@ module Dependabot
       end
 
       def provider_declaration_regex
+        name = Regexp.escape(dependency.name)
         /
-          (?:required_providers\s\{)*
-          (source\s*=\s*["']#{Regexp.escape(dependency.name)}["']
+          ((source\s*=\s*["']#{name}["']|\s*#{name}\s*=\s*\{.*)
           (?:(?!^\}).)+)
         /mx
       end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-terraform
 version: !ruby/object:Gem::Version
-  version: 0.148.7
+  version: 0.148.8
 platform: ruby
 authors:
 - Dependabot
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.148.7
+        version: 0.148.8
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.148.7
+        version: 0.148.8
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement