Module: Dependabot::Bundler::NativeHelpers

Extended by:
T::Generic, T::Sig
Defined in:
lib/dependabot/bundler/native_helpers.rb

Defined Under Namespace

Classes: BundleCommand

Class Method Summary collapse

Class Method Details

.native_helpers_root ⇒ Object 



106
107
108
109
110
111
 
# File 'lib/dependabot/bundler/native_helpers.rb', line 106

def self.native_helpers_root
  helpers_root = ENV.fetch("DEPENDABOT_NATIVE_HELPERS_PATH", nil)
  return File.join(helpers_root, "bundler") unless helpers_root.nil?

  File.expand_path("../../../helpers", __dir__)
end

.run_bundler_subprocess(function:, args:, bundler_version:, options: {}) ⇒ Object 



57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
 
# File 'lib/dependabot/bundler/native_helpers.rb', line 57

def self.run_bundler_subprocess(function:, args:, bundler_version:, options: {})
  # Run helper suprocess with all bundler-related ENV variables removed
  helpers_path = versioned_helper_path(bundler_version)
  ::Bundler.with_original_env do
    command = BundleCommand
              .new(options[:timeout_per_operation_seconds])
              .build(File.join(helpers_path, "run.rb"))
    SharedHelpers.run_helper_subprocess(
      command: command,
      function: function,
      args: args,
      env: subprocess_env(helpers_path, options)
    )
  rescue SharedHelpers::HelperSubprocessFailed => e
    # TODO: Remove once we stop stubbing out the V2 native helper
    raise Dependabot::NotImplemented, e.message if e.error_class == "Functions::NotImplementedError"

    raise
  end
end

.subprocess_env(helpers_path, options) ⇒ Object 



87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
 
# File 'lib/dependabot/bundler/native_helpers.rb', line 87

def self.subprocess_env(helpers_path, options)
  env = {
    # Set BUNDLE_PATH to a thread-safe location
    "BUNDLE_PATH" => File.join(Dependabot::Utils::BUMP_TMP_DIR_PATH, ".bundle"),
    # Set GEM_HOME to where the proper version of Bundler is installed
    "GEM_HOME" => File.join(helpers_path, ".bundle")
  }

  # Bundler 4+ enforces the Gemfile `source cooldown:` window natively, holding
  # back releases (including transitive dependencies) younger than the configured
  # number of days. Disable it only for security updates so vulnerability
  # remediation is never blocked; normal runs keep native enforcement as the
  # per-source source of truth.
  env["BUNDLE_COOLDOWN"] = "0" if options.fetch(:security_updates_only, false)

  env
end

.versioned_helper_path(bundler_major_version) ⇒ Object 



79
80
81
 
# File 'lib/dependabot/bundler/native_helpers.rb', line 79

def self.versioned_helper_path(bundler_major_version)
  File.join(native_helpers_root, "v#{bundler_major_version}")
end