Class: Dependabot::GitCommitChecker

Inherits:
Object
  • Object
show all
Extended by:
T::Sig
Includes:
GitCooldownDateResolver
Defined in:
lib/dependabot/git_commit_checker.rb,
lib/dependabot/git_commit_checker/source_details.rb

Overview

rubocop:disable Metrics/ClassLength

Defined Under Namespace

Classes: SourceDetails

Constant Summary collapse

VERSION_REGEX = 
/
  (?<version>
    (?<=^v)[0-9]+(?:\-[a-z0-9]+)?
    |
    [12][0-9]{3}(?:0[1-9]|1[0-2])(?:0[1-9]|[12][0-9]|3[01])
    |
    [0-9]+\.[0-9]+(?:\.[a-z0-9\-]+)*
  )$
/ix
VERSION_TAG_MATCH_PATTERN =

String pattern for matching version tags with optional prefixes (e.g., "v1.2.3" matches "1.2.3")

"(?:[^0-9\\.]|\\A)%s\\z"

Instance Method Summary collapse

Methods included from GitCooldownDateResolver

#cached_github_releases, #github_release_published_at, #normalize_tag_name, #resolve_candidate_date, #tag_creation_date

Constructor Details

#initialize(dependency:, credentials:, ignored_versions: [], raise_on_ignored: false, consider_version_branches_pinned: false, dependency_source_details: nil, git_metadata_fetcher: nil) ⇒ GitCommitChecker

Returns a new instance of GitCommitChecker.



56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
 
# File 'lib/dependabot/git_commit_checker.rb', line 56

def initialize(
  dependency:,
  credentials:,
  ignored_versions: [],
  raise_on_ignored: false,
  consider_version_branches_pinned: false,
  dependency_source_details: nil,
  git_metadata_fetcher: nil
)
  @dependency = dependency
  @credentials = credentials
  @ignored_versions = ignored_versions
  @raise_on_ignored = raise_on_ignored
  @consider_version_branches_pinned = consider_version_branches_pinned
  @dependency_source_details = T.let(
    dependency_source_details && SourceDetails.from_hash(dependency_source_details),
    T.nilable(SourceDetails)
  )
  @git_metadata_fetcher = git_metadata_fetcher
end

Instance Method Details

#all_version_tags ⇒ Object 



325
326
327
 
# File 'lib/dependabot/git_commit_checker.rb', line 325

def all_version_tags
  allowed_versions(local_tags, filter_by_prefix: false)
end

#allowed_version_refs ⇒ Object 



236
237
238
 
# File 'lib/dependabot/git_commit_checker.rb', line 236

def allowed_version_refs
  allowed_versions(local_refs)
end

#allowed_version_tags ⇒ Object 



231
232
233
 
# File 'lib/dependabot/git_commit_checker.rb', line 231

def allowed_version_tags
  allowed_versions(local_tags)
end

#allowed_version_tags_with_release_dates ⇒ Object 



333
334
335
336
337
338
339
340
341
 
# File 'lib/dependabot/git_commit_checker.rb', line 333

def allowed_version_tags_with_release_dates
  allowed_version_tags.map do |tag|
    Dependabot::Package::PackageRelease.new(
      version: T.cast(version_from_tag(tag), Dependabot::Version),
      tag: tag.name,
      released_at: release_date_for_tag_name(tag.name)
    )
  end
end

#branch_or_ref_in_release?(version) ⇒ Boolean

Returns:

  • (Boolean) 


156
157
158
 
# File 'lib/dependabot/git_commit_checker.rb', line 156

def branch_or_ref_in_release?(version)
  pinned_ref_in_release?(version) || branch_behind_release?(version)
end

#cooldown_credentials ⇒ Object 



349
350
351
 
# File 'lib/dependabot/git_commit_checker.rb', line 349

def cooldown_credentials
  credentials
end

#cooldown_source_url ⇒ Object 



344
345
346
 
# File 'lib/dependabot/git_commit_checker.rb', line 344

def cooldown_source_url
  dependency_source_details&.url
end

#current_version ⇒ Object 



241
242
243
244
245
 
# File 'lib/dependabot/git_commit_checker.rb', line 241

def current_version
  return unless dependency.version && version_tag?(T.must(dependency.version))

  version_from_ref(T.must(dependency.version))
end

#dependency_source_details ⇒ Object 



292
293
294
295
296
297
 
# File 'lib/dependabot/git_commit_checker.rb', line 292

def dependency_source_details
  @dependency_source_details ||= begin
    details = dependency.source_details(allowed_types: ["git"])
    SourceDetails.from_hash(details) if details
  end
end

#filter_lower_versions(tags) ⇒ Object 



248
249
250
251
252
253
254
255
256
257
258
 
# File 'lib/dependabot/git_commit_checker.rb', line 248

def filter_lower_versions(tags)
  return tags unless current_version

  versions = tags.map do |t|
    version_from_tag(t)
  end

  versions.select do |version|
    version > current_version
  end
end

#git_dependency? ⇒ Boolean

Returns:

  • (Boolean) 


78
79
80
 
# File 'lib/dependabot/git_commit_checker.rb', line 78

def git_dependency?
  dependency_source_details&.type == "git"
end

#git_repo_reachable? ⇒ Boolean

Returns:

  • (Boolean) 


284
285
286
287
288
289
 
# File 'lib/dependabot/git_commit_checker.rb', line 284

def git_repo_reachable?
  local_upload_pack
  true
rescue Dependabot::GitDependenciesNotReachable
  false
end

#head_commit_for_current_branch ⇒ Object

Raises:



161
162
163
164
165
166
167
168
 
# File 'lib/dependabot/git_commit_checker.rb', line 161

def head_commit_for_current_branch
  ref = ref_or_branch || "HEAD"

  sha = head_commit_for_local_branch(ref)
  return sha if pinned? || sha

  raise Dependabot::GitDependencyReferenceNotFound, dependency.name
end

#head_commit_for_local_branch(name) ⇒ Object 



171
172
173
 
# File 'lib/dependabot/git_commit_checker.rb', line 171

def head_commit_for_local_branch(name)
  local_repo_git_metadata_fetcher.head_commit_for_ref(name)
end

#head_commit_for_pinned_ref ⇒ Object 



120
121
122
 
# File 'lib/dependabot/git_commit_checker.rb', line 120

def head_commit_for_pinned_ref
  local_repo_git_metadata_fetcher.head_commit_for_ref_sha(T.must(ref))
end

#local_ref_for_latest_version_lower_precision ⇒ Object 



183
184
185
186
187
 
# File 'lib/dependabot/git_commit_checker.rb', line 183

def local_ref_for_latest_version_lower_precision
  allowed_refs = local_tag_for_pinned_sha ? allowed_version_tags : allowed_version_refs

  max_local_tag_for_lower_precision(allowed_refs)
end

#local_ref_for_latest_version_matching_existing_precision ⇒ Object 



176
177
178
179
180
 
# File 'lib/dependabot/git_commit_checker.rb', line 176

def local_ref_for_latest_version_matching_existing_precision
  allowed_refs = local_tag_for_pinned_sha ? allowed_version_tags : allowed_version_refs

  max_local_tag_for_current_precision(allowed_refs)
end

#local_tag_for_latest_version(cooldown_options = nil) ⇒ Object 



197
198
199
200
201
202
 
# File 'lib/dependabot/git_commit_checker.rb', line 197

def local_tag_for_latest_version(cooldown_options = nil)
  filtered_tags = apply_cooldown(allowed_version_tags, cooldown_options)
  return nil if filtered_tags.nil?

  max_local_tag(filtered_tags)
end

#local_tag_for_pinned_sha ⇒ Object 



267
268
269
270
271
272
273
274
 
# File 'lib/dependabot/git_commit_checker.rb', line 267

def local_tag_for_pinned_sha
  return unless pinned_ref_looks_like_commit_sha?

  @local_tag_for_pinned_sha = T.let(
    most_specific_version_tag_for_sha(ref),
    T.nilable(String)
  )
end

#local_tag_for_pinned_version_ref(cooldown_options = nil) ⇒ Object 



214
215
216
217
218
 
# File 'lib/dependabot/git_commit_checker.rb', line 214

def local_tag_for_pinned_version_ref(cooldown_options = nil)
  return nil unless pinned_ref_looks_like_version?

  local_tag_for_latest_version(cooldown_options)
end

#local_tags_for_allowed_versions ⇒ Object 



226
227
228
 
# File 'lib/dependabot/git_commit_checker.rb', line 226

def local_tags_for_allowed_versions
  allowed_version_tags.filter_map { |t| to_local_tag(t) }
end

#local_tags_for_allowed_versions_matching_existing_precision ⇒ Object 



221
222
223
 
# File 'lib/dependabot/git_commit_checker.rb', line 221

def local_tags_for_allowed_versions_matching_existing_precision
  select_matching_existing_precision(allowed_version_tags).filter_map { |t| to_local_tag(t) }
end

#max_local_tag(tags) ⇒ Object 



318
319
320
321
322
 
# File 'lib/dependabot/git_commit_checker.rb', line 318

def max_local_tag(tags)
  max_version_tag = tags.max_by { |t| version_from_tag(t) }

  to_local_tag(max_version_tag)
end

#most_specific_tag_equivalent_to_pinned_ref ⇒ Object 



261
262
263
264
 
# File 'lib/dependabot/git_commit_checker.rb', line 261

def most_specific_tag_equivalent_to_pinned_ref
  commit_sha = head_commit_for_local_branch(T.must(ref))
  most_specific_version_tag_for_sha(commit_sha)
end

#most_specific_version_tag_for_sha(commit_sha) ⇒ Object 



305
306
307
308
309
310
 
# File 'lib/dependabot/git_commit_checker.rb', line 305

def most_specific_version_tag_for_sha(commit_sha)
  tags = local_tags_matching_sha(commit_sha)
  return if tags.empty?

  tags[-1]&.name
end

#most_specific_version_tags_for_sha(commit_sha) ⇒ Object 



313
314
315
 
# File 'lib/dependabot/git_commit_checker.rb', line 313

def most_specific_version_tags_for_sha(commit_sha)
  local_tags_matching_sha(commit_sha).map(&:name)
end

#pinned? ⇒ Boolean

Returns:

  • (Boolean) 


84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
 
# File 'lib/dependabot/git_commit_checker.rb', line 84

def pinned?
  raise "Not a git dependency!" unless git_dependency?

  branch = dependency_source_details&.branch

  return false if ref.nil?
  return false if branch == ref
  return true if branch
  return true if dependency.version&.start_with?(T.must(ref))
  return true if ref_matches_tag?

  # Assume we're pinned unless the specified `ref` is actually a branch
  return true unless local_upload_pack&.match?(%r{ refs/heads/#{ref}$})

  # TODO: Research whether considering branches that look like versions pinned makes sense for all ecosystems
  @consider_version_branches_pinned && version_tag?(T.must(ref))
end

#pinned_ref_looks_like_commit_sha? ⇒ Boolean

Returns:

  • (Boolean) 


111
112
113
114
115
116
117
 
# File 'lib/dependabot/git_commit_checker.rb', line 111

def pinned_ref_looks_like_commit_sha?
  return false unless ref && ref_looks_like_commit_sha?(T.must(ref))

  return false unless pinned?

  local_repo_git_metadata_fetcher.head_commit_for_ref(T.must(ref)).nil?
end

#pinned_ref_looks_like_version? ⇒ Boolean

Returns:

  • (Boolean) 


104
105
106
107
108
 
# File 'lib/dependabot/git_commit_checker.rb', line 104

def pinned_ref_looks_like_version?
  return false unless pinned?

  version_tag?(T.must(ref))
end

#ref_details(ref) ⇒ Object 



133
134
135
136
137
138
139
140
141
142
143
 
# File 'lib/dependabot/git_commit_checker.rb', line 133

def ref_details(ref)
  T.must(
    T.let(
      GitMetadataFetcher.new(
        url: T.must(source_details&.url),
        credentials: credentials
      ).ref_details_for_pinned_ref(ref),
      T.nilable(Excon::Response)
    )
  )
end

#ref_details_for_pinned_ref ⇒ Object 



146
147
148
 
# File 'lib/dependabot/git_commit_checker.rb', line 146

def ref_details_for_pinned_ref
  ref_details(ref_pinned)
end

#ref_looks_like_commit_sha?(ref) ⇒ Boolean

Returns:

  • (Boolean) 


151
152
153
 
# File 'lib/dependabot/git_commit_checker.rb', line 151

def ref_looks_like_commit_sha?(ref)
  ref.match?(/^[0-9a-f]{6,40}$/)
end

#refs_for_tag_with_detail ⇒ Object 



300
301
302
 
# File 'lib/dependabot/git_commit_checker.rb', line 300

def refs_for_tag_with_detail
  local_repo_git_metadata_fetcher.refs_for_tag_with_detail
end

#tags ⇒ Object 



125
126
127
128
129
130
 
# File 'lib/dependabot/git_commit_checker.rb', line 125

def tags
  GitMetadataFetcher.new(
    url: T.must(source_details&.url),
    credentials: credentials
  ).tags
end

#version_for_pinned_sha ⇒ Object 



277
278
279
280
281
 
# File 'lib/dependabot/git_commit_checker.rb', line 277

def version_for_pinned_sha
  return unless local_tag_for_pinned_sha && version_class.correct?(local_tag_for_pinned_sha)

  version_class.new(local_tag_for_pinned_sha)
end