dependabot-vcpkg 0.383.0 → 0.384.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fce9caf8a451b37dc7557dc8bc678dfc4604c2faf70044d5be5c120ea9dc212b
-  data.tar.gz: 026f63261fb9d236ab4a34cc604e663f7be2f126fa28010236c8a1f611305b37
+  metadata.gz: df9224704a4f2c080b3a6c4372aaf4de2a1f724a5462b8abb65ee356356f4c2e
+  data.tar.gz: 78ed42e14df7d26603d4cd9f6083ae259d64a799563cf6e4f5307cc1a99504fd
 SHA512:
-  metadata.gz: 5de97c1ba1717c229d23e2a595ef8fd32d9715d77a41bd29a2a71ea27cc20b25499f219718a37cdc3b4b4caa696763dd7712449bb0563804e7230f2eee58d78e
-  data.tar.gz: 931fd85db08c28cbe63a64bd30ede201f8db237c76a94ab9098908cd7a8380a662fb675c9e03f3b5ed36c93e2d64b9c20df82d1ce1909a38badcd7f717e21cec
+  metadata.gz: fbe1b6dace0ccbb55540a1e799725502e32504ecff58d2ff5a38f91d690c280abf97b98de2a5bafcd67cae89e1c904e261cd41912de90283c22e5c768e4e532d
+  data.tar.gz: 9e0d437eb0790fb81054d448bec4270008064595ac0209e9e0dcaefbd3ac972ceb18343a9d906a469c97d0b581b9f6f2d647ae7de7bc6f99d7498c062851adfd

data/lib/dependabot/vcpkg/file_parser.rb

@@ -21,7 +21,10 @@ module Dependabot
 
       sig { override.returns(T::Array[Dependabot::Dependency]) }
       def parse
-        dependency_files.flat_map { |file| parse_dependency_file(file) }.compact
+        dependencies = dependency_files.flat_map { |file| parse_dependency_file(file) }.compact
+        baseline = missing_baseline_dependency
+        dependencies << baseline if baseline
+        dependencies
       end
 
       sig { override.returns(Ecosystem) }
@@ -236,6 +239,106 @@ module Dependabot
         end
       end
 
+      # A project relying on a global vcpkg install has no baseline to update.
+      # Synthesize one so the updater adds it to the manifest; later runs keep it
+      # current. See https://github.com/dependabot/dependabot-core/issues/13051
+      sig { returns(T.nilable(Dependabot::Dependency)) }
+      def missing_baseline_dependency
+        manifest = vcpkg_manifest_file
+        return nil unless manifest
+        return nil unless manifest_declares_dependencies?(manifest)
+        return nil if baseline_resolvable?
+
+        config = vcpkg_configuration_file
+        if config.nil?
+          synthetic_baseline_dependency(file_name: manifest.name)
+        elsif default_registry.nil?
+          synthetic_baseline_dependency(
+            file_name: config.name,
+            metadata: { default: true, create_default_registry: true }
+          )
+        end
+      end
+
+      sig do
+        params(file_name: String, metadata: T::Hash[Symbol, T.untyped]).returns(Dependabot::Dependency)
+      end
+      def synthetic_baseline_dependency(file_name:, metadata: {})
+        Dependabot::Dependency.new(
+          name: VCPKG_DEFAULT_BASELINE_DEPENDENCY_NAME,
+          version: nil,
+          package_manager: "vcpkg",
+          requirements: [{
+            requirement: nil,
+            groups: [],
+            source: {
+              type: "git",
+              url: VCPKG_DEFAULT_BASELINE_URL,
+              ref: VCPKG_DEFAULT_BASELINE_DEFAULT_BRANCH
+            },
+            file: file_name
+          }],
+          metadata: metadata
+        )
+      end
+
+      sig { returns(T::Boolean) }
+      def baseline_resolvable?
+        manifest_baseline_present? || default_registry_baseline_present?
+      end
+
+      sig { returns(T::Boolean) }
+      def manifest_baseline_present?
+        manifest = vcpkg_manifest_file
+        return false unless manifest
+
+        parsed_json(manifest)&.dig("builtin-baseline").is_a?(String)
+      end
+
+      sig { returns(T::Boolean) }
+      def default_registry_baseline_present?
+        registry = default_registry
+        !!(registry && registry["baseline"].is_a?(String))
+      end
+
+      sig { returns(T.nilable(T::Hash[String, T.untyped])) }
+      def default_registry
+        config = vcpkg_configuration_file
+        return nil unless config
+
+        registry = parsed_json(config)&.dig("default-registry")
+        registry.is_a?(Hash) ? registry : nil
+      end
+
+      sig { params(file: Dependabot::DependencyFile).returns(T::Boolean) }
+      def manifest_declares_dependencies?(file)
+        declared = parsed_json(file)&.dig("dependencies")
+        return false unless declared.is_a?(Array)
+
+        !declared.empty?
+      end
+
+      sig { returns(T.nilable(Dependabot::DependencyFile)) }
+      def vcpkg_manifest_file
+        dependency_files.find { |file| file.name == VCPKG_JSON_FILENAME }
+      end
+
+      sig { returns(T.nilable(Dependabot::DependencyFile)) }
+      def vcpkg_configuration_file
+        dependency_files.find { |file| file.name == VCPKG_CONFIGURATION_JSON_FILENAME }
+      end
+
+      sig { params(file: Dependabot::DependencyFile).returns(T.nilable(T::Hash[String, T.untyped])) }
+      def parsed_json(file)
+        content = file.content
+        return nil unless content
+
+        parsed = JSON.parse(content)
+        parsed.is_a?(Hash) ? parsed : nil
+      rescue JSON::ParserError
+        nil
+      end
+
       sig { returns(Ecosystem::VersionManager) }
       def package_manager = @package_manager ||= T.let(PackageManager.new, T.nilable(Dependabot::Vcpkg::PackageManager))
 

data/lib/dependabot/vcpkg/file_updater.rb

@@ -117,9 +117,32 @@ module Dependabot
       sig { params(content: T::Hash[String, T.untyped], dependency: Dependabot::Dependency, filename: String).void }
       def update_default_registry(content, dependency, filename)
         default_registry = content["default-registry"]
-        return unless default_registry.is_a?(Hash)
+        if default_registry.is_a?(Hash)
+          update_baseline_field(default_registry, dependency, filename, "baseline")
+        elsif dependency.metadata[:create_default_registry]
+          created_registry = build_default_registry(dependency, filename)
+          content["default-registry"] = created_registry if created_registry
+        end
+      end
+
+      sig do
+        params(dependency: Dependabot::Dependency, filename: String)
+          .returns(T.nilable(T::Hash[String, String]))
+      end
+      def build_default_registry(dependency, filename)
+        requirement = dependency.requirements.find { |r| r[:file] == filename }
+        return unless requirement
 
-        update_baseline_field(default_registry, dependency, filename, "baseline")
+        case requirement[:source]
+        in { ref: String => baseline }
+          {
+            "kind" => "git",
+            "repository" => VCPKG_DEFAULT_REGISTRY_REPOSITORY,
+            "baseline" => baseline
+          }
+        else
+          nil
+        end
       end
 
       sig { params(content: T::Hash[String, T.untyped], dependency: Dependabot::Dependency, filename: String).void }

data/lib/dependabot/vcpkg/update_checker/latest_version_finder.rb

@@ -50,6 +50,15 @@ module Dependabot
           )
         end
 
+        # The release tag for the given commit SHA, if any.
+        sig { params(commit_sha: String).returns(T.nilable(String)) }
+        def tag_for_commit_sha(commit_sha)
+          package_details
+            &.releases
+            &.find { |release| release.details["commit_sha"] == commit_sha }
+            &.tag
+        end
+
         private
 
         sig { returns(T::Boolean) }

data/lib/dependabot/vcpkg/update_checker.rb

@@ -30,6 +30,16 @@ module Dependabot
       sig { override.returns(T.nilable(T.any(String, Dependabot::Version))) }
       def latest_resolvable_version_with_no_unlock = latest_version
 
+      # The release tag for the current baseline commit SHA (else the SHA), so the
+      # PR title's "from" shows the tag, not the "master" ref.
+      sig { params(_updated_version: String).returns(T.nilable(String)) }
+      def latest_resolvable_previous_version(_updated_version)
+        current_version = dependency.version
+        return current_version unless registry_dependency? && current_version&.match?(/\A[0-9a-f]{40}\z/)
+
+        latest_version_finder.tag_for_commit_sha(current_version) || current_version
+      end
+
       sig { override.returns(T::Array[Dependabot::DependencyRequirement]) }
       def updated_requirements
         return dependency.requirements unless latest_version
@@ -66,6 +76,18 @@ module Dependabot
         !registry_dependency? && dependency.requirements.any? { |req| req[:requirement] }
       end
 
+      # `latest_version` is a git tag but the baseline is a commit SHA, so the base check never
+      # matches and reports an up-to-date baseline as stale. Match the release commit SHA by prefix.
+      sig { returns(T::Boolean) }
+      def sha1_version_up_to_date?
+        return super unless registry_dependency?
+
+        latest_commit_sha = latest_version_finder.latest_release_info&.details&.dig("commit_sha")
+        return super unless latest_commit_sha
+
+        latest_commit_sha.start_with?(T.must(dependency.version))
+      end
+
       # Vcpkg doesn't support full unlocking since dependencies are tracked via baselines
       sig { override.returns(T::Boolean) }
       def latest_version_resolvable_with_full_unlock? = false

data/lib/dependabot/vcpkg.rb

@@ -38,6 +38,9 @@ module Dependabot
 
     VCPKG_DEFAULT_BASELINE_URL = "https://github.com/microsoft/vcpkg.git"
 
+    # Repository URL without the `.git` suffix, for generated `default-registry` blocks.
+    VCPKG_DEFAULT_REGISTRY_REPOSITORY = "https://github.com/microsoft/vcpkg"
+
     VCPKG_DEFAULT_BASELINE_DEFAULT_BRANCH = "master"
 
     VCPKG_SUPPORTED_REGISTRY_TYPES = %w(git builtin).freeze

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-vcpkg
 version: !ruby/object:Gem::Version
-  version: 0.383.0
+  version: 0.384.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.383.0
+        version: 0.384.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.383.0
+        version: 0.384.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -256,7 +256,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.383.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.384.0
 rdoc_options: []
 require_paths:
 - lib
@@ -271,7 +271,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: 3.3.0
 requirements: []
-rubygems_version: 3.7.2
+rubygems_version: 4.0.14
 specification_version: 4
 summary: Provides Dependabot support for the VCPKG package manager.
 test_files: []