dependabot-uv 0.383.0 → 0.385.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ec6b2f2a71183f96ba54935778ae0881d4e54de983b0185651871b5582f43527
-  data.tar.gz: 6d52e75689a7a2b202deded8bb158f6e882e682a77b03738c6af717ce6a7b37e
+  metadata.gz: b27887feca6e05276a0219581805762553eb6b94c300b30bac15f816ccc01011
+  data.tar.gz: 7f80bf8bcda56d65f2b05ee7800928b740ff539326c27b787572a1ef236f2117
 SHA512:
-  metadata.gz: d193574d174b6266342042d95e59ba99b0a89b90ef4878e4735c9dfd27c0fb76be68a54ff85c9d5876e9ebbed85d505909f0cd9f598eb7dae8e443d7fb8d8bc4
-  data.tar.gz: fc9b36d7a7482e8642cb8bb6ecc348496972ccb938139c645cf5a96d7f6b0239b8ec1219f0d8cb497bb82eed12fca7336c86febd3f2d1a6aafc3920e985a9c4d
+  metadata.gz: 17735f62633b1d8114dd41b7ac482a04347d099e7e96b8a3f9571e7c3890563eba4cfebfc58a2a8343b9aa1347201a520fe77f001624e9d5fbdca45dc09f9577
+  data.tar.gz: ae24b3cbcd20e0bafb4f7fd0a3e2e1236f3740ead9269cab2bb91282ae7c73c99fd73a7e30eff16b23dcb0574713f9342b56f17279fe644aead8da3ca16e04eb

data/lib/dependabot/uv/file_updater/lock_file_updater.rb

@@ -96,10 +96,15 @@ module Dependabot
           updated_files = pyproject_files.filter_map do |file|
             next unless file_changed?(file)
 
-            updated_file(
+            updated = updated_file(
               file: file,
               content: T.must(updated_pyproject_content_for(file))
             )
+            # support_file must be false to prevent DependencyChangeBuilder from discarding the inner TOML,
+            # since doing so causes a conflict between the updated lock file and the committed TOML
+            # and breaks `uv sync --locked` in CI.
+            updated.support_file = false
+            updated
           end
 
           if lockfile && !build_system_only_dependency?
@@ -365,14 +370,49 @@ module Dependabot
 
         sig { returns(T::Array[String]) }
         def lock_index_options
-          filtered_credentials = credentials
-                                 .select { |cred| cred["type"] == "python_index" }
-                                 .reject do |cred|
-                                   cred.replaces_base? ? defined_in_pyproject?(cred) : explicit_index?(cred)
-                                 end
-
+          filtered_credentials = filtered_python_index_credentials
           options = T.let([], T::Array[String])
           used_credential_urls = T.let([], T::Array[String])
+          default_index_used = T.let(false, T::Boolean)
+
+          default_index_used = add_lockfile_registry_options(
+            filtered_credentials: filtered_credentials,
+            options: options,
+            used_credential_urls: used_credential_urls,
+            default_index_used: default_index_used
+          )
+
+          add_fallback_index_options(
+            filtered_credentials: filtered_credentials,
+            options: options,
+            used_credential_urls: used_credential_urls,
+            default_index_used: default_index_used
+          )
+
+          options.uniq
+        end
+
+        sig { returns(T::Array[Dependabot::Credential]) }
+        def filtered_python_index_credentials
+          credentials
+            .select { |cred| cred["type"] == "python_index" }
+            .reject { |cred| skip_lock_index_credential?(cred) }
+        end
+
+        sig { params(credential: Dependabot::Credential).returns(T::Boolean) }
+        def skip_lock_index_credential?(credential)
+          credential.replaces_base? ? defined_in_pyproject?(credential) : explicit_index?(credential)
+        end
+
+        sig do
+          params(
+            filtered_credentials: T::Array[Dependabot::Credential],
+            options: T::Array[String],
+            used_credential_urls: T::Array[String],
+            default_index_used: T::Boolean
+          ).returns(T::Boolean)
+        end
+        def add_lockfile_registry_options(filtered_credentials:, options:, used_credential_urls:, default_index_used:)
           credential_matcher = LockIndexCredentialMatcher.new(credentials: filtered_credentials)
 
           uv_lock_registry_urls.each do |registry_url|
@@ -380,23 +420,59 @@ module Dependabot
             next unless credential
 
             used_credential_urls << credential["index-url"].to_s
-            options << option_for_credential_url(credential, authed_registry_url(credential, registry_url))
+            default_index_used = add_lock_index_option(
+              credential: credential,
+              url: authed_registry_url(credential, registry_url),
+              options: options,
+              default_index_used: default_index_used
+            )
           end
 
+          default_index_used
+        end
+
+        sig do
+          params(
+            filtered_credentials: T::Array[Dependabot::Credential],
+            options: T::Array[String],
+            used_credential_urls: T::Array[String],
+            default_index_used: T::Boolean
+          ).returns(T::Boolean)
+        end
+        def add_fallback_index_options(filtered_credentials:, options:, used_credential_urls:, default_index_used:)
           # Fall back to credential URLs for indices not represented in uv.lock.
           filtered_credentials.each do |credential|
             next if used_credential_urls.include?(credential["index-url"].to_s)
 
-            authed_url = AuthedUrlBuilder.authed_url(credential: credential)
-            options << option_for_credential_url(credential, authed_url)
+            default_index_used = add_lock_index_option(
+              credential: credential,
+              url: AuthedUrlBuilder.authed_url(credential: credential),
+              options: options,
+              default_index_used: default_index_used
+            )
           end
 
-          options.uniq
+          default_index_used
+        end
+
+        sig do
+          params(
+            credential: Dependabot::Credential,
+            url: String,
+            options: T::Array[String],
+            default_index_used: T::Boolean
+          ).returns(T::Boolean)
+        end
+        def add_lock_index_option(credential:, url:, options:, default_index_used:)
+          options << option_for_credential_url(credential, url, default_index_used: default_index_used)
+          default_index_used || credential.replaces_base?
         end
 
-        sig { params(credential: Dependabot::Credential, url: String).returns(String) }
-        def option_for_credential_url(credential, url)
-          if credential.replaces_base?
+        sig do
+          params(credential: Dependabot::Credential, url: String, default_index_used: T::Boolean).returns(String)
+        end
+        def option_for_credential_url(credential, url, default_index_used:)
+          if credential.replaces_base? && !default_index_used
             "--default-index #{url}"
           else
             "--index #{url}"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-uv
 version: !ruby/object:Gem::Version
-  version: 0.383.0
+  version: 0.385.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,28 +15,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.383.0
+        version: 0.385.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.383.0
+        version: 0.385.0
 - !ruby/object:Gem::Dependency
   name: dependabot-python
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.383.0
+        version: 0.385.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.383.0
+        version: 0.385.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -301,7 +301,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.383.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.385.0
 rdoc_options: []
 require_paths:
 - lib
@@ -316,7 +316,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: 3.3.0
 requirements: []
-rubygems_version: 3.7.2
+rubygems_version: 4.0.14
 specification_version: 4
 summary: Provides Dependabot support for Python uv
 test_files: []