dependabot-uv 0.332.0 → 0.334.0

data/lib/dependabot/uv/file_updater/compile_file_updater.rb

@@ -1,7 +1,9 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "open3"
+require "sorbet-runtime"
+
 require "dependabot/dependency"
 require "dependabot/uv/requirement_parser"
 require "dependabot/uv/file_fetcher"
@@ -18,40 +20,64 @@ module Dependabot
     class FileUpdater
       # rubocop:disable Metrics/ClassLength
       class CompileFileUpdater
+        extend T::Sig
+
         require_relative "requirement_replacer"
         require_relative "requirement_file_updater"
 
-        UNSAFE_PACKAGES = %w(setuptools distribute pip).freeze
-        INCOMPATIBLE_VERSIONS_REGEX = /There are incompatible versions in the resolved dependencies:.*\z/m
-        WARNINGS = /\s*# WARNING:.*\Z/m
-        UNSAFE_NOTE = /\s*# The following packages are considered to be unsafe.*\Z/m
-        RESOLVER_REGEX = /(?<=--resolver=)(\w+)/
-        NATIVE_COMPILATION_ERROR =
-          "pip._internal.exceptions.InstallationSubprocessError: Getting requirements to build wheel exited with 1"
-
+        UNSAFE_PACKAGES = T.let(%w(setuptools distribute pip).freeze, T::Array[String])
+        INCOMPATIBLE_VERSIONS_REGEX = T.let(/There are incompatible versions in the resolved dependencies:.*\z/m,
+                                            Regexp)
+        WARNINGS = T.let(/\s*# WARNING:.*\Z/m, Regexp)
+        UNSAFE_NOTE = T.let(/\s*# The following packages are considered to be unsafe.*\Z/m, Regexp)
+        RESOLVER_REGEX = T.let(/(?<=--resolver=)(\w+)/, Regexp)
+        NATIVE_COMPILATION_ERROR = T.let(
+          "pip._internal.exceptions.InstallationSubprocessError: Getting requirements to build wheel exited with 1",
+          String
+        )
+
+        sig { returns(T::Array[Dependabot::Dependency]) }
         attr_reader :dependencies
+
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         attr_reader :dependency_files
+
+        sig { returns(T::Array[Dependabot::Credential]) }
         attr_reader :credentials
 
+        sig do
+          params(
+            dependencies: T::Array[Dependabot::Dependency],
+            dependency_files: T::Array[Dependabot::DependencyFile],
+            credentials: T::Array[Dependabot::Credential],
+            index_urls: T.nilable(T::Array[T.nilable(String)])
+          ).void
+        end
         def initialize(dependencies:, dependency_files:, credentials:, index_urls: nil)
-          @dependencies = dependencies
-          @dependency_files = dependency_files
-          @credentials = credentials
-          @index_urls = index_urls
-          @build_isolation = true
+          @dependencies = T.let(dependencies, T::Array[Dependabot::Dependency])
+          @dependency_files = T.let(dependency_files, T::Array[Dependabot::DependencyFile])
+          @credentials = T.let(credentials, T::Array[Dependabot::Credential])
+          @index_urls = T.let(index_urls, T.nilable(T::Array[T.nilable(String)]))
+          @build_isolation = T.let(true, T::Boolean)
         end
 
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         def updated_dependency_files
-          @updated_dependency_files ||= fetch_updated_dependency_files
+          @updated_dependency_files ||= T.let(
+            fetch_updated_dependency_files,
+            T.nilable(T::Array[Dependabot::DependencyFile])
+          )
         end
 
         private
 
+        sig { returns(T.nilable(Dependabot::Dependency)) }
         def dependency
           # For now, we'll only ever be updating a single dependency
           dependencies.first
         end
 
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         def fetch_updated_dependency_files
           updated_compiled_files = compile_new_requirement_files
           updated_manifest_files = update_manifest_files
@@ -66,6 +92,7 @@ module Dependabot
           ]
         end
 
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         def compile_new_requirement_files
           SharedHelpers.in_a_temporary_directory do
             write_updated_dependency_files
@@ -92,6 +119,7 @@ module Dependabot
           end
         end
 
+        sig { params(filename: String).void }
         def compile_file(filename)
           # Shell out to pip-compile, generate a new set of requirements.
           # This is slow, as pip-compile needs to do installs.
@@ -100,12 +128,12 @@ module Dependabot
 
           name_part = "pyenv exec uv pip compile " \
                       "#{options} -P " \
-                      "#{dependency.name}"
+                      "#{T.must(dependency).name}"
           fingerprint_name_part = "pyenv exec uv pip compile " \
                                   "#{options_fingerprint} -P " \
                                   "<dependency_name>"
 
-          version_part = "#{dependency.version} #{filename}"
+          version_part = "#{T.must(dependency).version} #{filename}"
           fingerprint_version_part = "<dependency_version> <filename>"
 
           # Don't escape pyenv `dep-name==version` syntax
@@ -126,10 +154,12 @@ module Dependabot
           raise
         end
 
+        sig { params(error: SharedHelpers::HelperSubprocessFailed).returns(T::Boolean) }
         def compilation_error?(error)
           error.message.include?(NATIVE_COMPILATION_ERROR)
         end
 
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         def update_manifest_files
           dependency_files.filter_map do |file|
             next unless file.name.end_with?(".in")
@@ -143,31 +173,44 @@ module Dependabot
           end
         end
 
+        # rubocop:disable Metrics/AbcSize
+        sig do
+          params(updated_files: T::Array[Dependabot::DependencyFile]).returns(T::Array[Dependabot::DependencyFile])
+        end
         def update_uncompiled_files(updated_files)
           updated_filenames = updated_files.map(&:name)
-          old_reqs = dependency.previous_requirements
-                               .reject { |r| updated_filenames.include?(r[:file]) }
-          new_reqs = dependency.requirements
-                               .reject { |r| updated_filenames.include?(r[:file]) }
+          all_old_reqs = T.must(dependency).previous_requirements
+          old_reqs = T.must(all_old_reqs).reject { |r| updated_filenames.include?(r[:file]) }
+          all_new_reqs = T.must(dependency).requirements
+          new_reqs = all_new_reqs.reject { |r| updated_filenames.include?(r[:file]) }
 
           return [] if new_reqs.none?
 
           files = dependency_files
                   .reject { |file| updated_filenames.include?(file.name) }
 
-          args = dependency.to_h
+          args = T.must(dependency).to_h
           args = args.keys.to_h { |k| [k.to_sym, args[k]] }
           args[:requirements] = new_reqs
           args[:previous_requirements] = old_reqs
 
           RequirementFileUpdater.new(
-            dependencies: [Dependency.new(**args)],
+            dependencies: [Dependency.new(**T.unsafe(args))],
             dependency_files: files,
             credentials: credentials
           ).updated_dependency_files
         end
+        # rubocop:enable Metrics/AbcSize
 
-        def run_command(cmd, env: python_env, allow_unsafe_shell_command: false, fingerprint:)
+        sig do
+          params(
+            cmd: String,
+            fingerprint: String,
+            env: T.nilable(T::Hash[String, String]),
+            allow_unsafe_shell_command: T::Boolean
+          ).returns(String)
+        end
+        def run_command(cmd, fingerprint:, env: python_env, allow_unsafe_shell_command: false)
           SharedHelpers.run_shell_command(
             cmd,
             env: env,
@@ -185,7 +228,8 @@ module Dependabot
           raise
         end
 
-        def run_uv_compile_command(command, allow_unsafe_shell_command: false, fingerprint:)
+        sig { params(command: String, fingerprint: String, allow_unsafe_shell_command: T::Boolean).returns(String) }
+        def run_uv_compile_command(command, fingerprint:, allow_unsafe_shell_command: false)
           run_command(
             "pyenv local #{language_version_manager.python_major_minor}",
             fingerprint: "pyenv local <python_major_minor>"
@@ -198,12 +242,13 @@ module Dependabot
           )
         end
 
+        sig { returns(T::Hash[String, T.untyped]) }
         def python_env
           env = {}
 
           # Handle Apache Airflow 1.10.x installs
-          if dependency_files.any? { |f| f.content.include?("apache-airflow") }
-            if dependency_files.any? { |f| f.content.include?("unidecode") }
+          if dependency_files.any? { |f| T.must(f.content).include?("apache-airflow") }
+            if dependency_files.any? { |f| T.must(f.content).include?("unidecode") }
               env["AIRFLOW_GPL_UNIDECODE"] = "yes"
             else
               env["SLUGIFY_USES_TEXT_UNIDECODE"] = "yes"
@@ -213,6 +258,7 @@ module Dependabot
           env
         end
 
+        sig { void }
         def write_updated_dependency_files
           dependency_files.each do |file|
             path = file.name
@@ -224,50 +270,54 @@ module Dependabot
           File.write(".python-version", language_version_manager.python_major_minor)
         end
 
+        sig { params(file: Dependabot::DependencyFile).returns(T.nilable(String)) }
         def freeze_dependency_requirement(file)
           return file.content unless file.name.end_with?(".in")
 
-          old_req = dependency.previous_requirements
-                              .find { |r| r[:file] == file.name }
+          old_req = T.must(dependency).previous_requirements
+          old_req = old_req&.find { |r| r[:file] == file.name }
 
           return file.content unless old_req
-          return file.content if old_req == "==#{dependency.version}"
+          return file.content if old_req == "==#{T.must(dependency).version}"
 
           RequirementReplacer.new(
-            content: file.content,
-            dependency_name: dependency.name,
+            content: T.must(file.content),
+            dependency_name: T.must(dependency).name,
             old_requirement: old_req[:requirement],
-            new_requirement: "==#{dependency.version}",
+            new_requirement: "==#{T.must(dependency).version}",
             index_urls: @index_urls
           ).updated_content
         end
 
+        sig { params(file: Dependabot::DependencyFile).returns(T.nilable(String)) }
         def update_dependency_requirement(file)
           return file.content unless file.name.end_with?(".in")
 
-          old_req = dependency.previous_requirements
-                              .find { |r| r[:file] == file.name }
-          new_req = dependency.requirements
-                              .find { |r| r[:file] == file.name }
+          old_req = T.must(dependency).previous_requirements
+          old_req = old_req&.find { |r| r[:file] == file.name }
+          new_req = T.must(dependency).requirements
+          new_req = new_req.find { |r| r[:file] == file.name }
           return file.content unless old_req&.fetch(:requirement)
           return file.content if old_req == new_req
 
           RequirementReplacer.new(
-            content: file.content,
-            dependency_name: dependency.name,
+            content: T.must(file.content),
+            dependency_name: T.must(dependency).name,
             old_requirement: old_req[:requirement],
-            new_requirement: new_req[:requirement],
+            new_requirement: T.must(new_req)[:requirement],
             index_urls: @index_urls
           ).updated_content
         end
 
+        sig { params(updated_content: String, file: Dependabot::DependencyFile).returns(String) }
         def post_process_compiled_file(updated_content, file)
-          content = replace_header_with_original(updated_content, file.content)
-          content = remove_new_warnings(content, file.content)
-          content = update_hashes_if_required(content, file.content)
-          replace_absolute_file_paths(content, file.content)
+          content = replace_header_with_original(updated_content, T.must(file.content))
+          content = remove_new_warnings(content, T.must(file.content))
+          content = update_hashes_if_required(content, T.must(file.content))
+          replace_absolute_file_paths(content, T.must(file.content))
         end
 
+        sig { params(updated_content: String, original_content: String).returns(String) }
         def replace_header_with_original(updated_content, original_content)
           original_header_lines =
             original_content.lines.take_while { |l| l.start_with?("#") }
@@ -278,6 +328,7 @@ module Dependabot
           [*original_header_lines, *updated_content_lines].join
         end
 
+        sig { params(updated_content: String, original_content: String).returns(String) }
         def replace_absolute_file_paths(updated_content, original_content)
           content = updated_content
 
@@ -299,6 +350,7 @@ module Dependabot
           content
         end
 
+        sig { params(updated_content: String, original_content: String).returns(String) }
         def remove_new_warnings(updated_content, original_content)
           content = updated_content
 
@@ -312,6 +364,7 @@ module Dependabot
           content
         end
 
+        sig { params(updated_content: String, original_content: String).returns(String) }
         def update_hashes_if_required(updated_content, original_content)
           deps_to_update =
             deps_to_augment_hashes_for(updated_content, original_content)
@@ -324,7 +377,7 @@ module Dependabot
                 name: mtch.named_captures.fetch("name"),
                 version: mtch.named_captures.fetch("version"),
                 algorithm: mtch.named_captures.fetch("algorithm")
-              ).sort.join(hash_separator(mtch.to_s))
+              ).sort.join(T.must(hash_separator(mtch.to_s)))
             )
 
             updated_content_with_hashes = updated_content_with_hashes
@@ -333,6 +386,7 @@ module Dependabot
           updated_content_with_hashes
         end
 
+        sig { params(updated_content: String, original_content: String).returns(T::Array[T.untyped]) }
         def deps_to_augment_hashes_for(updated_content, original_content)
           regex = /^#{RequirementParser::INSTALL_REQ_WITH_REQUIREMENT}/o
 
@@ -362,6 +416,7 @@ module Dependabot
           [*new_deps, *changed_hashes_deps]
         end
 
+        sig { params(name: String, version: String, algorithm: String).returns(T::Array[String]) }
         def package_hashes_for(name:, version:, algorithm:)
           index_urls = @index_urls || [nil]
           hashes = []
@@ -391,6 +446,7 @@ module Dependabot
           hashes
         end
 
+        sig { params(requirement_string: String).returns(T.nilable(String)) }
         def hash_separator(requirement_string)
           hash_regex = RequirementParser::HASH
           return unless requirement_string.match?(hash_regex)
@@ -398,17 +454,18 @@ module Dependabot
           current_separator =
             requirement_string
             .match(/#{hash_regex}((?<separator>\s*\\?\s*?)#{hash_regex})*/)
-            .named_captures.fetch("separator")
+            &.named_captures&.fetch("separator")
 
           default_separator =
             requirement_string
             .match(RequirementParser::HASH)
-            .pre_match.match(/(?<separator>\s*\\?\s*?)\z/)
-            .named_captures.fetch("separator")
+            &.pre_match&.match(/(?<separator>\s*\\?\s*?)\z/)
+            &.named_captures&.fetch("separator")
 
           current_separator || default_separator
         end
 
+        sig { params(options: String).returns(String) }
         def compile_options_fingerprint(options)
           options.sub(
             /--output-file=\S+/, "--output-file=<output_file>"
@@ -419,6 +476,7 @@ module Dependabot
           )
         end
 
+        sig { params(filename: String).returns(String) }
         def compile_options(filename)
           options = @build_isolation ? ["--build-isolation"] : ["--no-build-isolation"]
           options += compile_index_options
@@ -430,23 +488,26 @@ module Dependabot
           options.join(" ")
         end
 
+        sig { params(requirements_file: Dependabot::DependencyFile).returns(T::Array[String]) }
         def uv_compile_options_from_compiled_file(requirements_file)
           options = ["--output-file=#{requirements_file.name}"]
-          options << "--emit-index-url" if requirements_file.content.include?("index-url http")
-          options << "--generate-hashes" if requirements_file.content.include?("--hash=sha")
-          options << "--no-annotate" unless requirements_file.content.include?("# via ")
-          options << "--pre" if requirements_file.content.include?("--pre")
-          options << "--no-strip-extras" if requirements_file.content.include?("--no-strip-extras")
-
-          if requirements_file.content.include?("--no-binary") || requirements_file.content.include?("--only-binary")
+          options << "--emit-index-url" if T.must(requirements_file.content).include?("index-url http")
+          options << "--generate-hashes" if T.must(requirements_file.content).include?("--hash=sha")
+          options << "--no-annotate" unless T.must(requirements_file.content).include?("# via ")
+          options << "--pre" if T.must(requirements_file.content).include?("--pre")
+          options << "--no-strip-extras" if T.must(requirements_file.content).include?("--no-strip-extras")
+
+          if T.must(requirements_file.content).include?("--no-binary") ||
+             T.must(requirements_file.content).include?("--only-binary")
             options << "--emit-build-options"
           end
 
-          options << "--universal" if requirements_file.content.include?("--universal")
+          options << "--universal" if T.must(requirements_file.content).include?("--universal")
 
           options
         end
 
+        sig { returns(T::Array[String]) }
         def compile_index_options
           credentials
             .select { |cred| cred["type"] == "python_index" }
@@ -461,15 +522,17 @@ module Dependabot
             end
         end
 
+        sig { params(content: String).returns(T::Boolean) }
         def includes_unsafe_packages?(content)
           UNSAFE_PACKAGES.any? { |n| content.match?(/^#{Regexp.quote(n)}==/) }
         end
 
+        sig { returns(T::Array[String]) }
         def filenames_to_compile
           files_from_reqs =
-            dependency.requirements
-                      .map { |r| r[:file] }
-                      .select { |fn| fn.end_with?(".in") }
+            T.must(dependency).requirements
+             .map { |r| r[:file] }
+             .select { |fn| fn.end_with?(".in") }
 
           files_from_compiled_files =
             compile_files.map(&:name).select do |fn|
@@ -482,10 +545,11 @@ module Dependabot
           order_filenames_for_compilation(filenames)
         end
 
+        sig { params(filename: String).returns(T.nilable(Dependabot::DependencyFile)) }
         def compiled_file_for_filename(filename)
           compiled_file =
             compiled_files
-            .find { |f| f.content.match?(output_file_regex(filename)) }
+            .find { |f| T.must(f.content).match?(output_file_regex(filename)) }
 
           compiled_file ||=
             compiled_files
@@ -494,26 +558,30 @@ module Dependabot
           compiled_file
         end
 
+        sig { params(filename: T.any(String, Symbol)).returns(String) }
         def output_file_regex(filename)
           "--output-file[=\s]+.*\s#{Regexp.escape(filename)}\s*$"
         end
 
+        sig { params(compiled_file: T.nilable(Dependabot::DependencyFile)).returns(T::Boolean) }
         def compiled_file_includes_dependency?(compiled_file)
           return false unless compiled_file
 
           regex = RequirementParser::INSTALL_REQ_WITH_REQUIREMENT
 
           matches = []
-          compiled_file.content.scan(regex) { matches << Regexp.last_match }
-          matches.any? { |m| normalise(m[:name]) == dependency.name }
+          T.must(compiled_file.content).scan(regex) { matches << Regexp.last_match }
+          matches.any? { |m| normalise(m[:name]) == T.must(dependency).name }
         end
 
+        sig { params(name: String).returns(String) }
         def normalise(name)
           NameNormaliser.normalise(name)
         end
 
         # If the files we need to update require one another then we need to
         # update them in the right order
+        sig { params(filenames: T::Array[String]).returns(T::Array[String]) }
         def order_filenames_for_compilation(filenames)
           ordered_filenames = T.let([], T::Array[String])
 
@@ -521,7 +589,7 @@ module Dependabot
             ordered_filenames +=
               remaining_filenames
               .reject do |fn|
-                unupdated_reqs = requirement_map[fn] - ordered_filenames
+                unupdated_reqs = (requirement_map[fn] || []) - ordered_filenames
                 unupdated_reqs.intersect?(filenames)
               end
           end
@@ -529,11 +597,12 @@ module Dependabot
           ordered_filenames
         end
 
+        sig { returns(T::Hash[String, T::Array[String]]) }
         def requirement_map
           child_req_regex = Uv::FileFetcher::CHILD_REQUIREMENT_REGEX
-          @requirement_map ||=
+          @requirement_map ||= T.let(
             compile_files.each_with_object({}) do |file, req_map|
-              paths = file.content.scan(child_req_regex).flatten
+              paths = T.must(file.content).scan(child_req_regex).flatten
               current_dir = File.dirname(file.name)
 
               req_map[file.name] =
@@ -545,27 +614,37 @@ module Dependabot
 
                   path
                 end.uniq.compact
-            end
+            end,
+            T.nilable(T::Hash[String, T::Array[String]])
+          )
         end
 
+        sig { returns(Dependabot::Uv::FileParser::PythonRequirementParser) }
         def python_requirement_parser
-          @python_requirement_parser ||=
+          @python_requirement_parser ||= T.let(
             FileParser::PythonRequirementParser.new(
               dependency_files: dependency_files
-            )
+            ),
+            T.nilable(FileParser::PythonRequirementParser)
+          )
         end
 
+        sig { returns(Dependabot::Uv::LanguageVersionManager) }
         def language_version_manager
-          @language_version_manager ||=
+          @language_version_manager ||= T.let(
             LanguageVersionManager.new(
               python_requirement_parser: python_requirement_parser
-            )
+            ),
+            T.nilable(LanguageVersionManager)
+          )
         end
 
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         def compile_files
           dependency_files.select { |f| f.name.end_with?(".in") }
         end
 
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         def compiled_files
           dependency_files.select { |f| f.name.end_with?(".txt") }
         end

data/lib/dependabot/uv/file_updater/lock_file_updater.rb

@@ -18,6 +18,7 @@ module Dependabot
     class FileUpdater
       class LockFileUpdater
         extend T::Sig
+
         require_relative "pyproject_preparer"
 
         REQUIRED_FILES = %w(pyproject.toml uv.lock).freeze # At least one of these files should be present
@@ -31,7 +32,7 @@ module Dependabot
         sig { returns(T::Array[Dependabot::Credential]) }
         attr_reader :credentials
 
-        sig { returns(T.nilable(T::Array[String])) }
+        sig { returns(T.nilable(T::Array[T.nilable(String)])) }
         attr_reader :index_urls
 
         sig do
@@ -39,7 +40,7 @@ module Dependabot
             dependencies: T::Array[Dependency],
             dependency_files: T::Array[DependencyFile],
             credentials: T::Array[Dependabot::Credential],
-            index_urls: T.nilable(T::Array[String])
+            index_urls: T.nilable(T::Array[T.nilable(String)])
           ).void
         end
         def initialize(dependencies:, dependency_files:, credentials:, index_urls: nil)

data/lib/dependabot/uv/file_updater/requirement_file_updater.rb

@@ -29,7 +29,7 @@ module Dependabot
             dependencies: T::Array[Dependency],
             dependency_files: T::Array[DependencyFile],
             credentials: T::Array[Dependabot::Credential],
-            index_urls: T.nilable(T::Array[String])
+            index_urls: T.nilable(T::Array[T.nilable(String)])
           ).void
         end
         def initialize(dependencies:, dependency_files:, credentials:, index_urls: nil)
@@ -47,16 +47,16 @@ module Dependabot
 
         private
 
-        sig { returns(T.nilable(Dependency)) }
+        sig { returns(Dependency) }
         def dependency
           # For now, we'll only ever be updating a single dependency
-          dependencies.first
+          T.must(dependencies.first)
         end
 
         sig { returns(T::Array[DependencyFile]) }
         def fetch_updated_dependency_files
-          previous_requirements = dependency&.previous_requirements || []
-          reqs = T.must(dependency).requirements.zip(previous_requirements)
+          previous_requirements = dependency.previous_requirements || []
+          reqs = dependency.requirements.zip(previous_requirements)
 
           reqs.filter_map do |(new_req, old_req)|
             next if new_req == old_req
@@ -77,11 +77,11 @@ module Dependabot
           raise "Could not find a dependency file for #{new_req}" unless original_file
 
           RequirementReplacer.new(
-            content: original_file.content,
-            dependency_name: dependency&.name,
+            content: T.must(original_file.content),
+            dependency_name: dependency.name,
             old_requirement: old_req.fetch(:requirement),
             new_requirement: new_req.fetch(:requirement),
-            new_hash_version: dependency&.version,
+            new_hash_version: dependency.version,
             index_urls: @index_urls
           ).updated_content
         end