dependabot-terraform 0.148.8 → 0.148.9

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cfde4822b690f9e4a302a1c9128ab55445f5143bc20c02de5b8ad1cafab64836
-  data.tar.gz: 26cb654b6ad3b04b35268d1d5b96bdb7e4203bb9dec061508892dc3537e97e90
+  metadata.gz: d7ec549a6b6283f3ab90166318138d130e95ee433a8b17ec48157c376b322bfe
+  data.tar.gz: fe1e3b9b7e348e614c5da531da53ef226b4be07db71a0744e382a5d863cbbad5
 SHA512:
-  metadata.gz: d58215f50bafc56bd50bd6a78a897a857be6afb219e5c6140705aef283d5d4c646c29d216d725bcf1ee15714f83e5a8d1bfda8f6849ca460d5c71357dab67831
-  data.tar.gz: 7eea2d1dff06c749a432cf57ce1706a12fdc71867dd8cc0a30b846c68ab37113b9f3ed69927e7d4b29843215e2c26cc75f632ad257c029edd582a39fde4dc2d8
+  metadata.gz: 11878a5dff8b23bf22568e1dc44734578175012b41eff9b5d0d7e8e774e1040d1720150d135e570f0814234d3c663bd04ed79c0339a5188ab8cc19729167e8f9
+  data.tar.gz: ac36440f83d0e54ee77e7aab101790bd58cce625dd8bbe4bbad4a2a90f599cc9356a452b63ecc6784c938619afc87f7c97ec33a3e07a3d136ea6c0dd59703634

data/lib/dependabot/terraform/file_parser.rb

@@ -88,16 +88,16 @@ module Dependabot
 
       def build_provider_dependency(file, name, details = {})
         source_address = details.fetch("source", nil)
-        version = details["version"]&.strip
+        version_req = details["version"]&.strip
         hostname, namespace, name = provider_source_from(source_address, name)
         dependency_name = source_address ? "#{namespace}/#{name}" : name
 
         Dependency.new(
           name: dependency_name,
-          version: version, # resolved version should come from `.terraform.lock.hcl`.
+          version: determine_version_for(hostname, namespace, name, version_req),
           package_manager: "terraform",
           requirements: [
-            requirement: version,
+            requirement: version_req,
             groups: [],
             file: file.name,
             source: {
@@ -332,6 +332,23 @@ module Dependabot
 
         raise "No Terraform configuration file!"
       end
+
+      def determine_version_for(hostname, namespace, name, constraint)
+        return constraint if constraint&.match?(/\A\d/)
+
+        lock_file_content.
+          dig("provider", "#{hostname}/#{namespace}/#{name}", 0, "version")
+      end
+
+      def lock_file_content
+        @lock_file_content ||=
+          begin
+            lock_file = dependency_files.find do |file|
+              file.name == ".terraform.lock.hcl"
+            end
+            lock_file ? parsed_file(lock_file) : {}
+          end
+      end
     end
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-terraform
 version: !ruby/object:Gem::Version
-  version: 0.148.8
+  version: 0.148.9
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-05-25 00:00:00.000000000 Z
+date: 2021-05-26 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.148.8
+        version: 0.148.9
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.148.8
+        version: 0.148.9
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement