Class: Dependabot::GithubActions::Lockfile::CliEngine

Inherits:
Object
  • Object
show all
Extended by:
T::Sig
Defined in:
lib/dependabot/github_actions/lockfile/cli_engine.rb

Overview

Shells out to gh-actions-lock to regenerate actions.lock.

Constant Summary collapse

JsonObject = 
T.type_alias { T::Hash[String, Object] }
FIXED_FINDING_CATEGORIES = 
T.let(%w(onboarding-required ref-changed stale).freeze, T::Array[String])
UNRESOLVABLE_CATEGORIES = 
T.let(%w(impostor-commit lockfile-forgery).freeze, T::Array[String])

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(credentials) ⇒ CliEngine

Returns a new instance of CliEngine.



31
32
33
 
# File 'lib/dependabot/github_actions/lockfile/cli_engine.rb', line 31

def initialize(credentials)
  @credentials = credentials
end

Class Method Details

.binary_path ⇒ Object 



37
38
39
40
 
# File 'lib/dependabot/github_actions/lockfile/cli_engine.rb', line 37

def self.binary_path
  base = ENV.fetch("DEPENDABOT_NATIVE_HELPERS_PATH", nil)
  base ? File.join(base, "github_actions", "bin", "gh-actions-lock") : "gh-actions-lock"
end

Instance Method Details

#relock(workflow_files:, lockfile:, workflow_paths: workflow_files.map { |file| repo_path(file) }) ⇒ Object 



52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
 
# File 'lib/dependabot/github_actions/lockfile/cli_engine.rb', line 52

def relock(workflow_files:, lockfile:, workflow_paths: workflow_files.map { |file| repo_path(file) })
  in_repo(workflow_files, lockfile) do |dir|
    args = %w(--no-onboard --no-narrow --no-interactive --json=findings) + workflow_paths
    json, exit_status = run(dir, args)

    skipped = onboarding_skips(json, lockfile)
    log_skips(skipped)

    # `findings` is the PRE-fix diagnosis; at exit 0 fix-mode already resolved
    # them. Only exit 1 can carry a survivor (impostor/forgery or a skip).
    raise_on_findings(json) if exit_status == 1

    File.read(File.join(dir, LOCKFILE_PATH))
  end
end