dependabot-uv 0.381.0 → 0.382.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 34812d487d1efef68f06ec5410de289820633662674188962fce43e27a3ed169
-  data.tar.gz: d5ae7d9564f1f64f92c3b6b1de39c28d9d5fe58c8480ced385b35b7baa56affb
+  metadata.gz: 4f8d39e39ce8e18f7c946928ed3a7b5cd780ce3ae7d8808dad8c96c3b8248e6b
+  data.tar.gz: 2747bc7341934590fb3c0d1b0af95f788e055ff7845570dc10918179c0a9a26b
 SHA512:
-  metadata.gz: e5fa6c65e7d20b4361aeac44eba7fec0f754967d17f048ebcfa4a7612f219c2fa965384c108d766ee53cf5b1fdf918c2bdfc920061d6f953bc1e4a82e1ab43dd
-  data.tar.gz: 523a44b91c088a6158e0d7fd11a91d35f01914233eef1709102a28a63806d7b26609bc27da53b09a2b4c4b05a96157f7a953848a1844ebcc2665f6f072f4222f
+  metadata.gz: 4f6677be24fdf402b476d7018f98ca323491fb6c4ea7ba5eeb4634d0e48b097e98dde9c679b9c1229dcc6343d38600e17d83a2fb931ca3a6918742d8bc88f777
+  data.tar.gz: f56c52f7b7d3b38d894bfa5452a6c4d68a61cf0ea995f2a26ec75a7d68c4bc4abb7a41a495ba0e699c85597bb8d74b9ddc5ee2413ba009db260102807f716d5c

data/lib/dependabot/uv/file_updater/lock_file_updater.rb

@@ -482,27 +482,34 @@ module Dependabot
         # themselves and for dry-run.
         sig { returns(T::Hash[String, String]) }
         def pyproject_index_env_vars
-          env_vars = {}
+          python_index_creds = credentials.select { |cred| cred["type"] == "python_index" }
+          python_index_creds.each_with_object(T.let({}, T::Hash[String, String])) do |cred, env_vars|
+            env_vars.merge!(index_auth_env_vars_for(cred))
+          end
+        end
+
+        sig { params(cred: Dependabot::Credential).returns(T::Hash[String, String]) }
+        def index_auth_env_vars_for(cred)
+          env_vars = T.let({}, T::Hash[String, String])
+          index_name = find_index_name_for_credential(cred)
 
-          matched_credentials = credentials
-                                .select { |cred| cred["type"] == "python_index" }
-                                .filter_map do |cred|
-                                  index_name = find_index_name_for_credential(cred)
-                                  [cred, index_name] if index_name
-                                end
+          unless index_name
+            Dependabot.logger.debug(
+              "python_index credential did not match a [[tool.uv.index]] entry; skipping UV_INDEX_* env vars"
+            )
+            return env_vars
+          end
 
-          matched_credentials.each do |cred, index_name|
-            env_name = index_name.upcase.gsub(/[^A-Z0-9]/, "_")
+          env_name = index_name.upcase.gsub(/[^A-Z0-9]/, "_")
+          username = cred["username"]
+          password = cred["password"] || cred["token"]
 
-            env_vars["UV_INDEX_#{env_name}_USERNAME"] = cred["username"] if cred["username"]
+          env_vars["UV_INDEX_#{env_name}_USERNAME"] = username if username
+          env_vars["UV_INDEX_#{env_name}_PASSWORD"] = password if password
 
-            if cred["password"]
-              env_vars["UV_INDEX_#{env_name}_PASSWORD"] = cred["password"]
-            elsif cred["token"]
-              env_vars["UV_INDEX_#{env_name}_PASSWORD"] = cred["token"]
-            end
-          end
+          return env_vars unless username || password
 
+          Dependabot.logger.debug("Configured uv auth env vars for a matched [[tool.uv.index]] entry")
           env_vars
         end
 

data/lib/dependabot/uv/file_updater/pyproject_preparer.rb

@@ -17,12 +17,9 @@ module Dependabot
       class PyprojectPreparer
         extend T::Sig
 
-        Credentials = T.type_alias { T::Array[T::Hash[String, String]] }
-
-        sig { params(pyproject_content: String, lockfile: T.nilable(Dependabot::DependencyFile)).void }
-        def initialize(pyproject_content:, lockfile: nil)
+        sig { params(pyproject_content: String).void }
+        def initialize(pyproject_content:)
           @pyproject_content = pyproject_content
-          @lockfile = lockfile
           @lines = T.let(pyproject_content.split("\n"), T::Array[String])
         end
 
@@ -44,41 +41,11 @@ module Dependabot
           @pyproject_content = updated_lines.join("\n")
         end
 
-        sig { params(credentials: T.nilable(Credentials)).returns(T.nilable(Credentials)) }
-        def add_auth_env_vars(credentials)
-          return unless credentials
-
-          credentials.each do |credential|
-            next unless credential["type"] == "python_index"
-
-            token = credential["token"]
-            index_url = credential["index-url"]
-
-            next unless token && index_url
-
-            # Set environment variables for uv auth
-            ENV["UV_INDEX_URL_TOKEN_#{sanitize_env_name(index_url)}"] = token
-
-            # Also set pip-style credentials for compatibility
-            ENV["PIP_INDEX_URL"] ||= "https://#{token}@#{index_url.gsub(%r{^https?://}, '')}"
-          end
-        end
-
         sig { returns(String) }
         def sanitize
           # No special sanitization needed for UV files at this point
           @pyproject_content
         end
-
-        private
-
-        sig { returns(T.nilable(Dependabot::DependencyFile)) }
-        attr_reader :lockfile
-
-        sig { params(url: String).returns(String) }
-        def sanitize_env_name(url)
-          url.gsub(%r{^https?://}, "").gsub(/[^a-zA-Z0-9]/, "_").upcase
-        end
       end
     end
   end

data/lib/dependabot/uv/update_checker.rb

@@ -31,14 +31,16 @@ module Dependabot
       require_relative "update_checker/latest_version_finder"
       require_relative "update_checker/lock_file_resolver"
 
-      sig { override.returns(T::Array[T::Hash[Symbol, T.untyped]]) }
+      sig { override.returns(T::Array[Dependabot::DependencyRequirement]) }
       def updated_requirements
-        RequirementsUpdater.new(
-          requirements: requirements,
-          latest_resolvable_version: preferred_resolvable_version&.to_s,
-          update_strategy: requirements_update_strategy,
-          has_lockfile: requirements_text_file?
-        ).updated_requirements
+        wrap_requirements(
+          RequirementsUpdater.new(
+            requirements: requirements,
+            latest_resolvable_version: preferred_resolvable_version&.to_s,
+            update_strategy: requirements_update_strategy,
+            has_lockfile: requirements_text_file?
+          ).updated_requirements
+        )
       end
 
       private

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-uv
 version: !ruby/object:Gem::Version
-  version: 0.381.0
+  version: 0.382.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,28 +15,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.381.0
+        version: 0.382.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.381.0
+        version: 0.382.0
 - !ruby/object:Gem::Dependency
   name: dependabot-python
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.381.0
+        version: 0.382.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.381.0
+        version: 0.382.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -302,7 +302,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.381.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.382.0
 rdoc_options: []
 require_paths:
 - lib