Class: Dependabot::NpmAndYarn::FileFetcher

Inherits:
FileFetchers::Base
  • Object
show all
Extended by:
T::Helpers, T::Sig
Defined in:
lib/dependabot/npm_and_yarn/file_fetcher.rb,
lib/dependabot/npm_and_yarn/file_fetcher/path_dependency_builder.rb

Overview

rubocop:disable Metrics/ClassLength

Defined Under Namespace

Classes: PathDependencyBuilder

Constant Summary collapse

NPM_PATH_DEPENDENCY_STARTS =

Npm always prefixes file paths in the lockfile "version" with "file:" even when a naked path is used (e.g. "../dep")

T.let(%w(file:).freeze, [String])
PATH_DEPENDENCY_STARTS =

"link:" is only supported by Yarn but is interchangeable with "file:" when it specifies a path. Only include Yarn "link:"'s that start with a path and ignore symlinked package names that have been registered with "yarn link", e.g. "link:react"

T.let(
  %w(file: link:. link:/ link:~/ / ./ ../ ~/).freeze,
  [String, String, String, String, String, String, String, String]
)
PATH_DEPENDENCY_CLEAN_REGEX = 
/^file:|^link:/
DEFAULT_NPM_REGISTRY = 
"https://registry.npmjs.org"

Class Method Summary collapse

Instance Method Summary collapse

Class Method Details

.required_files_in?(filenames) ⇒ Boolean

Returns:

  • (Boolean) 


40
41
42
 
# File 'lib/dependabot/npm_and_yarn/file_fetcher.rb', line 40

def self.required_files_in?(filenames)
  filenames.include?("package.json")
end

.required_files_message ⇒ Object 



45
46
47
 
# File 'lib/dependabot/npm_and_yarn/file_fetcher.rb', line 45

def self.required_files_message
  "Repo must contain a package.json."
end

Instance Method Details

#clone_repo_contents ⇒ Object 



51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
 
# File 'lib/dependabot/npm_and_yarn/file_fetcher.rb', line 51

def clone_repo_contents
  return @git_lfs_cloned_repo_contents_path unless @git_lfs_cloned_repo_contents_path.nil?

  @git_lfs_cloned_repo_contents_path ||= T.let(super, T.nilable(String))
  begin
    SharedHelpers.with_git_configured(credentials: credentials) do
      Dir.chdir(@git_lfs_cloned_repo_contents_path) do
        cache_dir = Helpers.fetch_yarnrc_yml_value("cacheFolder", "./yarn/cache")
        SharedHelpers.run_shell_command("git lfs pull --include .yarn,#{cache_dir}")
      end
      @git_lfs_cloned_repo_contents_path
    end
  rescue StandardError
    @git_lfs_cloned_repo_contents_path
  end
end

#ecosystem_versions ⇒ Object 



69
70
71
72
73
74
75
76
77
78
79
80
 
# File 'lib/dependabot/npm_and_yarn/file_fetcher.rb', line 69

def ecosystem_versions
  package_managers = {}

  package_managers["npm"] = npm_version if npm_version
  package_managers["yarn"] = yarn_version if yarn_version
  package_managers["pnpm"] = pnpm_version if pnpm_version
  package_managers["unknown"] = 1 if package_managers.empty?

  {
    package_managers: package_managers
  }
end

#fetch_files ⇒ Object

rubocop:disable Metrics/AbcSize, Metrics/PerceivedComplexity



83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
 
# File 'lib/dependabot/npm_and_yarn/file_fetcher.rb', line 83

def fetch_files # rubocop:disable Metrics/AbcSize, Metrics/PerceivedComplexity
  fetched_files = T.let([], T::Array[DependencyFile])
  fetched_files << package_json
  fetched_files << T.must(npmrc) if npmrc && !scope_overrides_npmrc?
  fetched_files += npm_files if npm_version
  fetched_files += yarn_files if yarn_version
  fetched_files += pnpm_files if pnpm_version
  fetched_files += lerna_files
  fetched_files += workspace_package_jsons
  fetched_files += path_dependencies(fetched_files)

  # When no package manager version is detected at all (no lockfile, no
  # packageManager, no engines) AND no committed .npmrc exists, the
  # inferred_npmrc path inside npm_files is never reached. Try generating
  # an .npmrc from scope credentials, or reject if no config is available.
  # Skip for yarn/pnpm-only projects where npm isn't the relevant manager.
  if no_package_manager_detected? && npmrc.nil?
    generated = inferred_npmrc
    fetched_files << generated if generated
    reject_if_private_registry_without_config! unless generated
  end

  # Filter excluded files from final collection
  filtered_files = fetched_files.uniq.reject do |file|
    !@exclude_paths.empty? && Dependabot::FileFiltering.exclude_path?(file.name, @exclude_paths)
  end

  filtered_files
end