dependabot-terraform 0.151.1 → 0.152.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8146a401a16bb6762d3591d500d543d67d69481fd68915c267da34bf91d97035
-  data.tar.gz: 63b53b125a38f6854142a704f4c7f9434bb9853e388b5433860e08f199de7d4c
+  metadata.gz: dfefb1320f00b268bba02b10255217750cb091d1cd275183a436d6bddcb799f3
+  data.tar.gz: 751a7d3e23094385b25cb7dd7d228dc92d6ca4a3ed4da5c61edd7e9b662a6348
 SHA512:
-  metadata.gz: b73b71323fed5fa3fc1d4262d0aedf04c87952505a4ccb3f849a884445335d45fa95f97045682c2ee1b035de3945900a1ed97eefae204207ad33c831515d8c53
-  data.tar.gz: b33210e410056f887413ab65809ed8cef4c63d1ce3a5b049dfe7462515a211fe614f0931d7f131e6690e4e5de6a1deb0f339fc14115864b9d348d559b0717fdd
+  metadata.gz: 02cc22ac7e9c4a6eb94d3d87fb2924aa04a8e671e477e35495960d067366f63832f11413b4cbbb9490c1ff732830676be5eabfe4eb6d08e83e7562ff5223f190
+  data.tar.gz: 48ffc333db0dbe7ca16e9caad59d5aeb36c49cd235145763be36d405503e16c6915f3f567f7303e726dd5024dce7904681505dc99bbf66db7d74f4f38218861d

data/lib/dependabot/terraform/file_fetcher.rb

@@ -23,6 +23,7 @@ module Dependabot
         fetched_files = []
         fetched_files += terraform_files
         fetched_files += terragrunt_files
+        fetched_files += [lock_file] if lock_file
 
         return fetched_files if fetched_files.any?
 
@@ -45,6 +46,10 @@ module Dependabot
           select { |f| f.type == "file" && terragrunt_file?(f.name) }.
           map { |f| fetch_file_from_host(f.name) }
       end
+
+      def lock_file
+        @lock_file ||= fetch_file_if_present(".terraform.lock.hcl")
+      end
     end
   end
 end

data/lib/dependabot/terraform/file_selector.rb

@@ -12,6 +12,14 @@ module FileSelector
   end
 
   def terragrunt_file?(file_name)
-    file_name != ".terraform.lock.hcl" && file_name.end_with?(".hcl")
+    !lock_file?(file_name) && file_name.end_with?(".hcl")
+  end
+
+  def lock_file?(filename)
+    filename == ".terraform.lock.hcl"
+  end
+
+  def lock_file
+    dependency_files.find { |f| lock_file?(f.name) }
   end
 end

data/lib/dependabot/terraform/file_updater.rb

@@ -4,6 +4,7 @@ require "dependabot/file_updaters"
 require "dependabot/file_updaters/base"
 require "dependabot/errors"
 require "dependabot/terraform/file_selector"
+require "dependabot/shared_helpers"
 
 module Dependabot
   module Terraform
@@ -21,10 +22,18 @@ module Dependabot
           next unless file_changed?(file)
 
           updated_content = updated_terraform_file_content(file)
+
           raise "Content didn't change!" if updated_content == file.content
 
           updated_files << updated_file(file: file, content: updated_content)
         end
+        updated_lockfile_content = update_lockfile_declaration
+
+        if updated_lockfile_content && lock_file.content != updated_lockfile_content
+          updated_files << updated_file(file: lock_file, content: updated_lockfile_content)
+        end
+
+        updated_files.compact!
 
         raise "No files changed!" if updated_files.none?
 
@@ -39,7 +48,7 @@ module Dependabot
         reqs = dependency.requirements.zip(dependency.previous_requirements).
                reject { |new_req, old_req| new_req == old_req }
 
-        # Loop through each changed requirement and update the files
+        # Loop through each changed requirement and update the files and lockfile
         reqs.each do |new_req, old_req|
           raise "Bad req match" unless new_req[:file] == old_req[:file]
           next unless new_req.fetch(:file) == file.name
@@ -81,6 +90,45 @@ module Dependabot
         end
       end
 
+      def update_lockfile_declaration
+        return if lock_file.nil?
+
+        new_req = dependency.requirements.first
+        content = lock_file.content.dup
+
+        provider_source = new_req[:source][:registry_hostname] + "/" + new_req[:source][:module_identifier]
+        declaration_regex = lockfile_declaration_regex(provider_source)
+        lockfile_dependency_removed = content.sub(declaration_regex, "")
+
+        SharedHelpers.in_a_temporary_directory do
+          write_dependency_files
+
+          File.write(".terraform.lock.hcl", lockfile_dependency_removed)
+          SharedHelpers.run_shell_command("terraform providers lock #{provider_source}")
+
+          updated_lockfile = File.read(".terraform.lock.hcl")
+          updated_dependency = updated_lockfile.scan(declaration_regex).first
+
+          # Terraform will occasionally update h1 hashes without updating the version of the dependency
+          # Here we make sure the dependency's version actually changes in the lockfile
+          unless updated_dependency.scan(declaration_regex).first.scan(/^\s*version\s*=.*/) ==
+                 content.scan(declaration_regex).first.scan(/^\s*version\s*=.*/)
+            content.sub!(declaration_regex, updated_dependency)
+          end
+        end
+
+        content
+      end
+
+      def write_dependency_files
+        dependency_files.each do |file|
+          # Do not include the .terraform directory or .terraform.lock.hcl
+          next if file.name.include?(".terraform")
+
+          File.write(file.name, file.content)
+        end
+      end
+
       def dependency
         # Terraform updates will only ever be updating a single dependency
         dependencies.first
@@ -131,6 +179,14 @@ module Dependabot
         source = dependency.requirements.map { |r| r[:source] }.compact.first
         source[:registry_hostname] || source["registry_hostname"] || "registry.terraform.io"
       end
+
+      def lockfile_declaration_regex(provider_source)
+        /
+          (?:(?!^\}).)*
+          provider\s*["']#{Regexp.escape(provider_source)}["']\s*\{
+          (?:(?!^\}).)*}
+        /mx
+      end
     end
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-terraform
 version: !ruby/object:Gem::Version
-  version: 0.151.1
+  version: 0.152.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-06-07 00:00:00.000000000 Z
+date: 2021-06-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.151.1
+        version: 0.152.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.151.1
+        version: 0.152.0
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement