dependanot 0.1.3 → 0.1.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c6c42ad297f803bdccb1d62233bfe82e202c4427afe4a11466e1fd726f3b52d6
-  data.tar.gz: a28ae84f166c0ce446660fe28f01f3f55c776398236816719254ca22cf2eee8f
+  metadata.gz: 2107d2fc9ef2ce61680a0a62bbb248548e91dea25ac4c05e2c426197fb0aebc6
+  data.tar.gz: 965595379cb72610d767afcbab36a51891aa1f0a4be7ae83b9e6437a802f36b4
 SHA512:
-  metadata.gz: 8fe7d3235412ccced81df898d4d12b7f248bdac24a6d5a7d56e1161b3b1beb57f6e04a735deeb6468af1e174b2cecee0977b8ec186542f4bf48061cbf53402f1
-  data.tar.gz: 5e2d053a77a7bfdeda8d151d849f1ee51fb74a5a2f875b49249da24b54342f950e42ceade96f69f09d17c7fde6eebdf5fff32b5f07bbe1351e840f4d70c3641c
+  metadata.gz: 2ea7a9dac327b8ff470db6392f6734bef39e71b41665d1f1d350bcdb0adb3093627ed0ad1d5e1cc16fd08745ab088fe9e2f7f9b7098e825ac7abc47dbfba2c5d
+  data.tar.gz: 6a29693a707725fcec357cc453a9f33bf9a329ec9947e23ba893f87f0acd8aad5ca41221a805d83b8f957393129ef33e0a4c0db38d84a9d26f6e245361cf2de3

data/dependabot.gemspec

@@ -12,13 +12,16 @@ Gem::Specification.new do |spec|
   spec.homepage = "https://github.com/dependanot/cli"
   spec.license = "MIT"
   spec.metadata["homepage_uri"] = spec.homepage
+  spec.metadata["rubygems_mfa_required"] = "true"
   spec.name = "dependanot"
   spec.require_paths = ["lib"]
   spec.required_ruby_version = ">= 3.0.0"
   spec.summary = "The Dependabot CLI"
   spec.version = Dependabot::VERSION
+  spec.add_dependency "bundler", "~> 2.0"
   spec.add_dependency "octokit", "~> 4.0"
   spec.add_dependency "rugged", "~> 1.2"
-  spec.add_dependency "spandx", "~> 0.1"
+  spec.add_dependency "spandx", ">= 0.18.3"
   spec.add_dependency "thor", "~> 1.1"
+  spec.add_development_dependency "debug", "~> 1.4"
 end

data/lib/dependabot/bundler/update.rb

@@ -8,7 +8,7 @@ module Dependabot
 
         Dir.chdir(dependency.path.parent) do
           ::Bundler.with_unbundled_env do
-            system "bundle update #{dependency.name} --conservative --quiet"
+            system({ "RUBYOPT" => "-W0" }, "bundle update #{dependency.name} --conservative --quiet")
           end
         end
       end

data/lib/dependabot/cli/scan.rb

@@ -3,7 +3,7 @@
 module Dependabot
   module CLI
     class Scan
-      attr_reader :path
+      attr_reader :path, :options
 
       def initialize(path, options)
         @path = ::Pathname.new(path)
@@ -12,7 +12,7 @@ module Dependabot
 
       def run
         each_dependency do |dependency|
-          update!(dependency)
+          update(dependency) if match?(dependency)
         end
       end
 
@@ -20,7 +20,7 @@ module Dependabot
 
       def each_file(&block)
         ::Spandx::Core::PathTraversal
-          .new(path, recursive: false)
+          .new(path, recursive: options[:recursive])
           .each(&block)
       end
 
@@ -30,25 +30,13 @@ module Dependabot
         end
       end
 
-      def update!(dependency)
-        puts "Updating #{dependency.name}..."
-        git_for(dependency) do |git|
-          ::Spandx::Core::Plugin.enhance(dependency)
-          puts git.patch
-          git.commit(all: true, message: "Updating #{dependency.name}")
-        end
-      end
-
-      def branch_name_for(dependency)
-        "dependanot/#{dependency.package_manager}/#{dependency.name}"
+      def update(dependency)
+        ::Dependabot.logger.debug("Updating #{dependency.name}…")
+        ::Dependabot::Publish.new(dependency).update!(push: options[:push])
       end
 
-      def git_for(dependency, branch_name: branch_name_for(dependency))
-        git = ::Dependabot::Git.new(dependency.path.parent)
-        git.checkout(branch: branch_name)
-        yield git
-      ensure
-        git.repo.checkout_head(strategy: :force)
+      def match?(dependency)
+        options[:dependency].nil? || options[:dependency] == dependency.name
       end
     end
   end

data/lib/dependabot/cli.rb

@@ -7,7 +7,10 @@ require "dependabot/cli/scan"
 module Dependabot
   module CLI
     class Application < Thor
-      desc "scan [DIRECTORY]", "Scan a directory"
+      desc "scan [OPTION]... [FILE]", "Scan a directory or file for dependencies to update"
+      method_option :dependency, aliases: "-d", type: :string, desc: "Update a specific dependency", default: nil
+      method_option :push, aliases: "-p", type: :boolean, desc: "Push the update as a pull request. Default: --no-push", default: false
+      method_option :recursive, aliases: "-r", type: :boolean, desc: "Perform a recursive. Default: --no-recursive", default: false
       def scan(path = Pathname.pwd)
         ::Dependabot::CLI::Scan.new(path, options).run
       end

data/lib/dependabot/git.rb

@@ -14,6 +14,10 @@ module Dependabot
       repo.checkout(branch)
     end
 
+    def push(remote: "origin", branch: "HEAD")
+      repo.push(remote, ["refs/heads/#{branch}"], credentials: credentials_for(remote))
+    end
+
     def patch
       repo.index.diff.patch
     end
@@ -27,18 +31,26 @@ module Dependabot
         tree: repo.index.write_tree(repo),
         update_ref: "HEAD",
         author: { email: "dependabot[bot]@users.noreply.github.com", name: "dependabot[bot]" },
+        committer: { email: "dependabot[bot]@users.noreply.github.com", name: "dependabot[bot]" },
       })
     end
 
     private
 
     def stage(path)
-      repo.index.read_tree(repo.head.target.tree)
-      repo.index.add(
-        path: path,
-        oid: repo.write(File.binread(path), :blob),
-        mode: File.stat(path).mode
-      )
+      repo.index.add(path)
+    end
+
+    def credentials_for(remote)
+      if ssh?(repo.remotes[remote].url)
+        Rugged::Credentials::SshKeyFromAgent.new(username: "git")
+      else
+        Rugged::Credentials::UserPassword.new(username: "x-access-token", password: Dependabot.github.token)
+      end
+    end
+
+    def ssh?(url)
+      url.include?("git@github.com:")
     end
   end
 end

data/lib/dependabot/publish.rb

@@ -0,0 +1,63 @@
+# frozen_string_literal: true
+
+module Dependabot
+  class Publish
+    attr_reader :dependency
+
+    def initialize(dependency)
+      @dependency = dependency
+    end
+
+    def update!(push: false)
+      git_for(dependency, push: push) do |git|
+        ::Spandx::Core::Plugin.enhance(dependency)
+        Dependabot.logger.debug(git.patch) unless git.patch.empty?
+      end
+    end
+
+    private
+
+    def branch_name_for(dependency)
+      "dependanot/#{dependency.package_manager}/#{dependency.name}"
+    end
+
+    def git_for(dependency, branch_name: branch_name_for(dependency), push: false)
+      git = ::Dependabot::Git.new(dependency.path.parent)
+      default_branch = git.repo.head.name
+      git.checkout(branch: branch_name)
+      yield git
+      publish_pull_request_for(dependency, default_branch, branch_name, git, push) unless git.patch.empty?
+    ensure
+      git.repo.checkout_head(strategy: :force)
+      git.repo.checkout(default_branch)
+    end
+
+    def description_for(dependency)
+      <<~MARKDOWN
+        Bumps [#{dependency.name}](#)
+
+        <details>
+        <summary>Changelog</summary>
+        </details>
+
+        <details>
+        <summary>Commits</summary>
+        </details>
+      MARKDOWN
+    end
+
+    def publish_pull_request_for(dependency, default_branch, branch_name, git, push)
+      git.commit(all: true, message: "chore: Update #{dependency.name}")
+      return unless push
+
+      git.push(remote: "origin", branch: branch_name)
+      Dependabot.octokit.create_pull_request(
+        GitHub.name_with_owner_from(git.repo.remotes["origin"].url),
+        default_branch,
+        branch_name,
+        "chore(deps): bump #{dependency}",
+        description_for(dependency)
+      )
+    end
+  end
+end

data/lib/dependabot/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.1.3"
+  VERSION = "0.1.7"
 end

data/lib/dependabot.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require "bundler"
 require "github"
 require "logger"
 require "octokit"
@@ -8,6 +9,7 @@ require "spandx"
 
 require_relative "dependabot/bundler/update"
 require_relative "dependabot/git"
+require_relative "dependabot/publish"
 require_relative "dependabot/tracer"
 require_relative "dependabot/version"
 
@@ -15,7 +17,11 @@ module Dependabot
   class Error < StandardError; end
 
   def self.logger
-    @logger ||= Logger.new($stderr)
+    @logger ||= Logger.new($stderr, level: ENV.fetch("LOG_LEVEL", Logger::WARN)).tap do |x|
+      x.formatter = proc do |_severity, _datetime, _progname, message|
+        "[v#{VERSION}] #{message}\n"
+      end
+    end
   end
 
   def self.tracer

data/lib/github.rb

@@ -18,6 +18,14 @@ class GitHub
     @workspace = workspace
   end
 
+  class << self
+    def name_with_owner_from(url)
+      regex = %r{(?<x>(?<scheme>https|ssh)://)?(?<username>git@)?github.com[:|/](?<nwo>\w+/\w+)(?<extension>\.git)?}
+      match = url.match(regex)
+      match && match["nwo"]
+    end
+  end
+
   private
 
   def default_api_url

metadata

@@ -1,15 +1,29 @@
 --- !ruby/object:Gem::Specification
 name: dependanot
 version: !ruby/object:Gem::Version
-  version: 0.1.3
+  version: 0.1.7
 platform: ruby
 authors:
 - mo khan
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2021-12-20 00:00:00.000000000 Z
+date: 2021-12-21 00:00:00.000000000 Z
 dependencies:
+- !ruby/object:Gem::Dependency
+  name: bundler
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.0'
 - !ruby/object:Gem::Dependency
   name: octokit
   requirement: !ruby/object:Gem::Requirement
@@ -42,16 +56,16 @@ dependencies:
   name: spandx
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '0.1'
+        version: 0.18.3
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '0.1'
+        version: 0.18.3
 - !ruby/object:Gem::Dependency
   name: thor
   requirement: !ruby/object:Gem::Requirement
@@ -66,6 +80,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '1.1'
+- !ruby/object:Gem::Dependency
+  name: debug
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.4'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.4'
 description: The Dependabot CLI
 email:
 - xlgmokha@github.com
@@ -83,6 +111,7 @@ files:
 - lib/dependabot/cli.rb
 - lib/dependabot/cli/scan.rb
 - lib/dependabot/git.rb
+- lib/dependabot/publish.rb
 - lib/dependabot/tracer.rb
 - lib/dependabot/version.rb
 - lib/github.rb
@@ -91,6 +120,7 @@ licenses:
 - MIT
 metadata:
   homepage_uri: https://github.com/dependanot/cli
+  rubygems_mfa_required: 'true'
 post_install_message:
 rdoc_options: []
 require_paths: