dependanot 0.1.0 → 0.1.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 903577dd56009cdee245614d973c80cced1d51989293b5d32d0d2c3f4c7fb44a
-  data.tar.gz: 1c7fcc29caf4195e7e6987ca829e64469388de8220011a94e9dad59e8a194e65
+  metadata.gz: 53cce6d2d8b3c96ccdb354fc9016430582edb927c88d378d2435d7124740c14f
+  data.tar.gz: 377486bb6cc1f981601b078f0963158fa0179c10d284b7f5d3eda7e2584897b4
 SHA512:
-  metadata.gz: 9ad22a5b055398e49eecca1fa2e5756a725da82ea733d1fd15d0693a087e0e4130320389e964032106112b0701cb42b021016c276d9d25e4e94095f259e82705
-  data.tar.gz: 04e15bdb15a22cac8106b278f6909e23ed937d1bbceb7ccadc8dc75cfb7618f62c497edf7cfb6bdb635541b6be20eecf7e19e52a3adf0c46f4ca1ac3cf3e576f
+  metadata.gz: e343e2f4588671e2b40f40bf1c606e0bb45a6c7cfd64447b311092188fa5ace12de92e77bb90a6a3f0c66c2b8aad434ca481be249f252a7d28eea84b7e32fb9e
+  data.tar.gz: e1f282d4000ae6a3acd8a595dee0d36b0be50005603cab945e460438d08a733c4c50f79ca8667ea67ddd533b548f082df08e4d46582d8c5b44a0ae9000543503

data/README.md

@@ -32,7 +32,7 @@ To install this gem onto your local machine, run `bundle exec rake install`. To
 
 ## Contributing
 
-Bug reports and pull requests are welcome on GitHub at https://github.com/xlgmokha/dependabot.
+Bug reports and pull requests are welcome on GitHub at https://github.com/dependanot/cli.
 
 ## License
 

data/dependabot.gemspec

@@ -7,9 +7,9 @@ Gem::Specification.new do |spec|
   spec.bindir = "exe"
   spec.description = "The Dependabot CLI"
   spec.email = ["xlgmokha@github.com"]
-  spec.executables = spec.files.grep(%r{\Aexe/}) { |f| File.basename(f) }
+  spec.executables = ["dependabot"]
   spec.files = Dir.glob("lib/**/*.rb") + Dir.glob("exe/*") + Dir.glob("*.gemspec") + ["LICENSE.txt", "README.md"]
-  spec.homepage = "https://github.com/dependanot/dependanot"
+  spec.homepage = "https://github.com/dependanot/cli"
   spec.license = "MIT"
   spec.metadata["homepage_uri"] = spec.homepage
   spec.name = "dependanot"
@@ -17,6 +17,8 @@ Gem::Specification.new do |spec|
   spec.required_ruby_version = ">= 3.0.0"
   spec.summary = "The Dependabot CLI"
   spec.version = Dependabot::VERSION
+  spec.add_dependency "octokit", "~> 4.0"
+  spec.add_dependency "rugged", "~> 1.2"
   spec.add_dependency "spandx", "~> 0.1"
   spec.add_dependency "thor", "~> 1.1"
 end

data/lib/dependabot/bundler/update.rb

@@ -2,13 +2,13 @@
 
 module Dependabot
   module Bundler
-    class Update < Spandx::Core::Plugin
+    class Update < ::Spandx::Core::Plugin
       def enhance(dependency)
         return unless dependency.package_manager == :rubygems
 
         Dir.chdir(dependency.path.parent) do
           ::Bundler.with_unbundled_env do
-            system "bundle update #{dependency.name} --conservative --quiet --full-index"
+            system "bundle update #{dependency.name} --conservative --quiet"
           end
         end
       end

data/lib/dependabot/cli/scan.rb

@@ -1,7 +1,6 @@
 # frozen_string_literal: true
 
 module Dependabot
-
   module CLI
     class Scan
       attr_reader :path
@@ -13,30 +12,44 @@ module Dependabot
 
       def run
         each_dependency do |dependency|
-          Dir.chdir(dependency.path.parent) do
-            puts "Updating... #{dependency.name}"
-            ::Spandx::Core::Plugin.enhance(dependency)
-            system "git diff --patch --no-color"
-            system "git checkout ."
-          end
+          update!(dependency)
         end
       end
 
       private
 
-      def each_file
+      def each_file(&block)
         ::Spandx::Core::PathTraversal
           .new(path, recursive: false)
-          .each { |file| yield file }
+          .each(&block)
       end
 
-      def each_dependency
+      def each_dependency(&block)
         each_file do |file|
-          ::Spandx::Core::Parser.parse(file).each do |dependency|
-            yield dependency
-          end
+          ::Spandx::Core::Parser.parse(file).each(&block)
+        end
+      end
+
+      def update!(dependency)
+        puts "Updating #{dependency.name}..."
+        git_for(dependency) do |git|
+          ::Spandx::Core::Plugin.enhance(dependency)
+          puts git.patch
+          git.commit(all: true, message: "Updating #{dependency.name}")
         end
       end
+
+      def branch_name_for(dependency)
+        "dependanot/#{dependency.package_manager}/#{dependency.name}"
+      end
+
+      def git_for(dependency, branch_name: branch_name_for(dependency))
+        git = ::Dependabot::Git.new(dependency.path.parent)
+        git.checkout(branch: branch_name)
+        yield git
+      ensure
+        git.repo.checkout_head(strategy: :force)
+      end
     end
   end
 end

data/lib/dependabot/cli.rb

@@ -1,7 +1,6 @@
 # frozen_string_literal: true
 
 require "thor"
-require "spandx"
 require "dependabot"
 require "dependabot/cli/scan"
 

data/lib/dependabot/git.rb

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+module Dependabot
+  class Git
+    attr_reader :repo
+
+    def initialize(path)
+      @path = path
+      @repo = Rugged::Repository.discover(path)
+    end
+
+    def checkout(branch:)
+      repo.create_branch(branch, repo.head.name)
+      repo.checkout(branch)
+    end
+
+    def patch
+      repo.index.diff.patch
+    end
+
+    def commit(message:, all: false)
+      repo.status { |path, status| stage(path) if status.include?(:worktree_modified) } if all
+
+      Rugged::Commit.create(repo, {
+        message: message,
+        parents: repo.empty? ? [] : [repo.head.target].compact,
+        tree: repo.index.write_tree(repo),
+        update_ref: "HEAD",
+        author: { email: "dependabot[bot]@users.noreply.github.com", name: "dependabot[bot]" },
+        committer: { email: "dependabot[bot]@users.noreply.github.com", name: "dependabot[bot]" },
+      })
+    end
+
+    private
+
+    def stage(path)
+      repo.index.read_tree(repo.head.target.tree)
+      repo.index.add(
+        path: path,
+        oid: repo.write(File.binread(path), :blob),
+        mode: File.stat(path).mode
+      )
+    end
+  end
+end

data/lib/dependabot/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.1.0"
+  VERSION = "0.1.4"
 end

data/lib/dependabot.rb

@@ -1,8 +1,13 @@
 # frozen_string_literal: true
 
+require "github"
 require "logger"
+require "octokit"
+require "rugged"
+require "spandx"
 
 require_relative "dependabot/bundler/update"
+require_relative "dependabot/git"
 require_relative "dependabot/tracer"
 require_relative "dependabot/version"
 
@@ -10,10 +15,24 @@ module Dependabot
   class Error < StandardError; end
 
   def self.logger
-    @logger ||= Logger.new(&stdout)
+    @logger ||= Logger.new($stderr)
   end
 
   def self.tracer
     @tracer ||= Tracer.new(logger)
   end
+
+  def self.octokit
+    @octokit ||= Octokit::Client.new.tap do |client|
+      client.access_token = github.token
+      client.api_endpoint = github.api_url
+      client.auto_paginate = true
+      client.connection_options = { request: { open_timeout: 5, timeout: 5 } }
+      client.web_endpoint = github.server_url
+    end
+  end
+
+  def self.github
+    @github ||= GitHub.new
+  end
 end

data/lib/github.rb

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+# https://docs.github.com/en/actions/learn-github-actions/environment-variables#default-environment-variables
+class GitHub
+  attr_reader :api_url, :repository, :server_url, :token, :workspace
+
+  def initialize(
+    api_url: default_api_url,
+    repository: ENV["GITHUB_REPOSITORY"],
+    server_url: ENV.fetch("GITHUB_SERVER_URL", "https://github.com"),
+    token: default_token,
+    workspace: ENV.fetch("GITHUB_WORKSPACE", Dir.pwd)
+  )
+    @api_url = api_url
+    @repository = repository
+    @server_url = server_url
+    @token = token
+    @workspace = workspace
+  end
+
+  private
+
+  def default_api_url
+    ENV.fetch("GITHUB_API_URL", "https://api.github.com")
+  end
+
+  def default_token
+    ENV.fetch("GITHUB_TOKEN") do |_name|
+      file = Pathname.new(Dir.home).join(".config/gh/hosts.yml")
+      if file.exist?
+        YAML
+          .safe_load(file.read)
+          &.fetch("github.com")
+          &.fetch("oauth_token")
+      end
+    end
+  end
+end

metadata

@@ -1,15 +1,43 @@
 --- !ruby/object:Gem::Specification
 name: dependanot
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.1.4
 platform: ruby
 authors:
 - mo khan
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2021-12-13 00:00:00.000000000 Z
+date: 2021-12-20 00:00:00.000000000 Z
 dependencies:
+- !ruby/object:Gem::Dependency
+  name: octokit
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '4.0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '4.0'
+- !ruby/object:Gem::Dependency
+  name: rugged
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.2'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.2'
 - !ruby/object:Gem::Dependency
   name: spandx
   requirement: !ruby/object:Gem::Requirement
@@ -41,7 +69,8 @@ dependencies:
 description: The Dependabot CLI
 email:
 - xlgmokha@github.com
-executables: []
+executables:
+- dependabot
 extensions: []
 extra_rdoc_files: []
 files:
@@ -53,13 +82,15 @@ files:
 - lib/dependabot/bundler/update.rb
 - lib/dependabot/cli.rb
 - lib/dependabot/cli/scan.rb
+- lib/dependabot/git.rb
 - lib/dependabot/tracer.rb
 - lib/dependabot/version.rb
-homepage: https://github.com/dependanot/dependanot
+- lib/github.rb
+homepage: https://github.com/dependanot/cli
 licenses:
 - MIT
 metadata:
-  homepage_uri: https://github.com/dependanot/dependanot
+  homepage_uri: https://github.com/dependanot/cli
 post_install_message:
 rdoc_options: []
 require_paths:
@@ -75,7 +106,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.2.33
+rubygems_version: 3.2.32
 signing_key:
 specification_version: 4
 summary: The Dependabot CLI