dependabot-uv 0.331.0 → 0.333.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6f8fc7f0cbee2c5f3b9166a9ec6a52a9b1c5f2b00b7dbbb452cf28f87be830b9
-  data.tar.gz: 1a614a6c05a9081496efb729181b7ffb399c64eac080584895d00b26d7cfcb56
+  metadata.gz: 9fd131434f7311972e5cb5f18dac008d471445b715dc45be558bd503ea2311d1
+  data.tar.gz: 1d6f177e73bfabbf8e7c2b109743b3e286fc6442782c36f86531a112ff57ca8a
 SHA512:
-  metadata.gz: 4c0cf03354750037d6b3e1cd88a49e8e2cc4f02bf730707c20401c5e915eeab76e2055a53c83cdeac9d9bcfcf7b30f4cb490682b16c1d09a5aeb04c7ee5a506b
-  data.tar.gz: 2e7d837110017ea0c0dd71abcf58e6afa2ee6c068a9f7078a3db1fa3c5b6b426059fa4a73e6270754a3730a6412840f37f55ce1be3452deebeffa38b47c4a2e5
+  metadata.gz: 33a61475c14eee350de8b5c437867311746a92518d4769cc983dc986c5c1deae73a7cc66911c2a2cdc71adee8af20274ad563ba6522cdea95ad7e0add51415d1
+  data.tar.gz: e2e942f0af3f09b03dcb913ad2c214cfb2e9dc7f7ebe80d12407afb5b989d3535d1e0e7f90e106cfd912ac71ac3d452dead20856298a528e8c535ef65577fdf7

data/lib/dependabot/uv/authed_url_builder.rb

@@ -1,12 +1,17 @@
-# typed: true
+# typed: strong
 # frozen_string_literal: true
 
+require "sorbet-runtime"
+
 module Dependabot
   module Uv
     class AuthedUrlBuilder
+      extend T::Sig
+
+      sig { params(credential: Credential).returns(String) }
       def self.authed_url(credential:)
-        token = credential.fetch("token", nil)
-        url = credential.fetch("index-url", nil)
+        token = T.let(credential.fetch("token", nil), T.nilable(String))
+        url = T.let(credential.fetch("index-url", nil), T.nilable(String))
         return "" unless url
         return url unless token
 

data/lib/dependabot/uv/file_fetcher.rb

@@ -13,10 +13,11 @@ require "dependabot/uv/requirement_parser"
 require "dependabot/uv/file_parser/pyproject_files_parser"
 require "dependabot/uv/file_parser/python_requirement_parser"
 require "dependabot/errors"
+require "dependabot/file_filtering"
 
 module Dependabot
   module Uv
-    class FileFetcher < Dependabot::FileFetchers::Base
+    class FileFetcher < Dependabot::FileFetchers::Base # rubocop:disable Metrics/ClassLength
       extend T::Sig
       extend T::Helpers
 
@@ -87,7 +88,12 @@ module Dependabot
         fetched_files += project_files
         fetched_files << python_version_file if python_version_file
 
-        uniq_files(fetched_files)
+        uniques = uniq_files(fetched_files)
+        filtered_files = uniques.reject do |file|
+          Dependabot::FileFiltering.should_exclude_path?(file.name, "file from final collection", @exclude_paths)
+        end
+
+        filtered_files
       end
 
       private
@@ -235,6 +241,14 @@ module Dependabot
           next if previously_fetched_files.map(&:name).include?(path)
           next if file.name == path
 
+          if Dependabot::Experiments.enabled?(:enable_exclude_paths_subdirectory_manifest_files) &&
+             !@exclude_paths.empty? && Dependabot::FileFiltering.exclude_path?(path, @exclude_paths)
+            raise Dependabot::DependencyFileNotEvaluatable,
+                  "Cannot process requirements: '#{file.name}' references excluded file '#{path}'. " \
+                  "Please either remove the reference from '#{file.name}' " \
+                  "or update your exclude_paths configuration."
+          end
+
           fetched_file = fetch_file_from_host(path)
           grandchild_requirement_files = fetch_child_requirement_files(
             file: fetched_file,

data/lib/dependabot/uv/file_parser/pyproject_files_parser.rb

@@ -15,6 +15,7 @@ module Dependabot
     class FileParser
       class PyprojectFilesParser
         extend T::Sig
+
         POETRY_DEPENDENCY_TYPES = %w(dependencies dev-dependencies).freeze
 
         # https://python-poetry.org/docs/dependency-specification/

data/lib/dependabot/uv/file_parser/python_requirement_parser.rb

@@ -1,8 +1,10 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
-require "toml-rb"
 require "open3"
+require "sorbet-runtime"
+require "toml-rb"
+
 require "dependabot/errors"
 require "dependabot/shared_helpers"
 require "dependabot/uv/file_parser"
@@ -13,12 +15,17 @@ module Dependabot
   module Uv
     class FileParser
       class PythonRequirementParser
+        extend T::Sig
+
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         attr_reader :dependency_files
 
+        sig { params(dependency_files: T::Array[Dependabot::DependencyFile]).void }
         def initialize(dependency_files:)
           @dependency_files = dependency_files
         end
 
+        sig { returns(T::Array[String]) }
         def user_specified_requirements
           [
             pyproject_python_requirement,
@@ -30,22 +37,24 @@ module Dependabot
 
         # TODO: Add better Python version detection using dependency versions
         # (e.g., Django 2.x implies Python 3)
+        sig { returns(T::Array[String]) }
         def imputed_requirements
           requirement_files.flat_map do |file|
-            file.content.lines
-                .select { |l| l.include?(";") && l.include?("python") }
-                .filter_map { |l| l.match(/python_version(?<req>.*?["'].*?['"])/) }
-                .map { |re| re.named_captures.fetch("req").gsub(/['"]/, "") }
-                .select { |r| valid_requirement?(r) }
+            T.must(file.content).lines
+             .select { |l| l.include?(";") && l.include?("python") }
+             .filter_map { |l| l.match(/python_version(?<req>.*?["'].*?['"])/) }
+             .map { |re| T.must(re.named_captures.fetch("req")).gsub(/['"]/, "") }
+             .select { |r| valid_requirement?(r) }
           end
         end
 
         private
 
+        sig { returns(T.nilable(String)) }
         def pyproject_python_requirement
           return unless pyproject
 
-          pyproject_object = TomlRB.parse(pyproject.content)
+          pyproject_object = TomlRB.parse(T.must(pyproject).content)
 
           # Check for PEP621 requires-python
           pep621_python = pyproject_object.dig("project", "requires-python")
@@ -58,9 +67,10 @@ module Dependabot
             poetry_object&.dig("dev-dependencies", "python")
         end
 
+        sig { returns(T.nilable(String)) }
         def pip_compile_python_requirement
           requirement_files.each do |file|
-            next unless requirements_in_file_matcher.compiled_file?(file)
+            next unless T.must(requirements_in_file_matcher).compiled_file?(file)
 
             marker = /^# This file is autogenerated by pip-compile with [pP]ython (?<version>\d+.\d+)$/m
             match = marker.match(file.content)
@@ -72,48 +82,56 @@ module Dependabot
           nil
         end
 
+        sig { returns(T.nilable(String)) }
         def python_version_file_version
           return unless python_version_file
 
           # read the content, split into lines and remove any lines with '#'
-          content_lines = python_version_file.content.each_line.map do |line|
+          content_lines = T.must(T.must(python_version_file).content).each_line.map do |line|
             line.sub(/#.*$/, " ").strip
           end.reject(&:empty?)
 
           file_version = content_lines.first
           return if file_version&.empty?
-          return unless pyenv_versions.include?("#{file_version}\n")
+          return unless T.must(pyenv_versions).include?("#{file_version}\n")
 
           file_version
         end
 
+        sig { returns(T.nilable(String)) }
         def runtime_file_python_version
           return unless runtime_file
 
-          file_version = runtime_file.content
-                                     .match(/(?<=python-).*/)&.to_s&.strip
+          file_version = T.must(T.must(runtime_file).content)
+                          .match(/(?<=python-).*/)&.to_s&.strip
           return if file_version&.empty?
-          return unless pyenv_versions.include?("#{file_version}\n")
+          return unless T.must(pyenv_versions).include?("#{file_version}\n")
 
           file_version
         end
 
+        sig { returns(T.nilable(String)) }
         def pyenv_versions
-          @pyenv_versions ||= run_command("pyenv install --list")
+          @pyenv_versions = T.let(run_command("pyenv install --list"), T.nilable(String))
         end
 
+        sig { params(command: String, env: T::Hash[String, String]).returns(String) }
         def run_command(command, env: {})
           SharedHelpers.run_shell_command(command, env: env, stderr_to_stdout: true)
         end
 
+        sig { returns(T.nilable(RequiremenstFileMatcher)) }
         def requirements_in_file_matcher
-          @requirements_in_file_matcher ||= RequiremenstFileMatcher.new(pip_compile_files)
+          @requirements_in_file_matcher = T.let(RequiremenstFileMatcher.new(pip_compile_files),
+                                                T.nilable(RequiremenstFileMatcher))
         end
 
+        sig { returns(T.class_of(Dependabot::Uv::Requirement)) }
         def requirement_class
           Dependabot::Uv::Requirement
         end
 
+        sig { params(req_string: String).returns(T::Boolean) }
         def valid_requirement?(req_string)
           requirement_class.new(req_string)
           true
@@ -121,22 +139,27 @@ module Dependabot
           false
         end
 
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def pyproject
           dependency_files.find { |f| f.name == "pyproject.toml" }
         end
 
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def python_version_file
           dependency_files.find { |f| f.name == ".python-version" }
         end
 
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def runtime_file
           dependency_files.find { |f| f.name.end_with?("runtime.txt") }
         end
 
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         def requirement_files
           dependency_files.select { |f| f.name.end_with?(".txt") }
         end
 
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         def pip_compile_files
           dependency_files.select { |f| f.name.end_with?(".in") }
         end

data/lib/dependabot/uv/file_parser/setup_file_parser.rb

@@ -15,6 +15,7 @@ module Dependabot
     class FileParser
       class SetupFileParser
         extend T::Sig
+
         INSTALL_REQUIRES_REGEX = /install_requires\s*=\s*\[/m
         SETUP_REQUIRES_REGEX = /setup_requires\s*=\s*\[/m
         TESTS_REQUIRE_REGEX = /tests_require\s*=\s*\[/m