Skip to content

Commit 6d8049b

Browse files
committed
Merge branch 'main' into fix-security-job-existing-pr-wrong-dir
# Conflicts: # updater/lib/dependabot/updater/operations/create_security_update_pull_request.rb # updater/spec/dependabot/updater_spec.rb
2 parents 25a89fb + b3d4669 commit 6d8049b

File tree

1,087 files changed

+87194
-35248
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

1,087 files changed

+87194
-35248
lines changed

.codespellrc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,4 +3,4 @@ skip = .git,*.pdf,*.svg,gems,index,fixtures,CHANGELOG_ARCHIVE_*,yarn.lock,Gemfil
33
ignore-regex = \bsha512-[^"]*|ENV\["ROUGE"\]|\b(com\.google\.errorprone)\b|\bto(_not)? include .*versio"|https://\S*
44
# some modules, parts of regexes, and variable names to ignore, some
55
# misspellings in fixtures/external responses we do not own
6-
ignore-words-list = caf,bu,nwo,nd,kernal,crate,unparseable,couldn,defintions,hashin
6+
ignore-words-list = caf,bu,nwo,nd,kernal,crate,unparseable,couldn,defintions,hashin,swith

.devcontainer/core-dev/devcontainer.json

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,9 @@
5151
"-v", "${localWorkspaceFolder}/hex/dependabot-hex.gemspec:/home/dependabot/dependabot-core/hex/dependabot-hex.gemspec",
5252
"-v", "${localWorkspaceFolder}/hex/lib:/home/dependabot/dependabot-core/hex/lib",
5353
"-v", "${localWorkspaceFolder}/hex/spec:/home/dependabot/dependabot-core/hex/spec",
54+
"-v", "${localWorkspaceFolder}/julia/dependabot-julia.gemspec:/home/dependabot/dependabot-core/julia/dependabot-julia.gemspec",
55+
"-v", "${localWorkspaceFolder}/julia/lib:/home/dependabot/dependabot-core/julia/lib",
56+
"-v", "${localWorkspaceFolder}/julia/spec:/home/dependabot/dependabot-core/julia/spec",
5457
"-v", "${localWorkspaceFolder}/maven/dependabot-maven.gemspec:/home/dependabot/dependabot-core/maven/dependabot-maven.gemspec",
5558
"-v", "${localWorkspaceFolder}/maven/lib:/home/dependabot/dependabot-core/maven/lib",
5659
"-v", "${localWorkspaceFolder}/maven/spec:/home/dependabot/dependabot-core/maven/spec",

.devcontainer/devcontainer.json

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,9 +23,13 @@
2323
"ghcr.io/devcontainers/features/github-cli": "latest",
2424
"ghcr.io/devcontainers/features/node": "lts",
2525
"ghcr.io/devcontainers/features/go": "latest",
26-
"ghcr.io/devcontainers/features/ruby": "3.4.5",
26+
"ghcr.io/devcontainers/features/ruby": "3.4.7",
2727
"ghcr.io/devcontainers/features/rust": "latest",
28-
"ghcr.io/devcontainers/features/dotnet": "latest",
28+
"ghcr.io/devcontainers/features/dotnet:2": {
29+
// these versions should be kept in sync with the files `nuget/Dockerfile` and `nuget/helpers/lib/NuGetUpdater/global.json`
30+
"version": "8.0.412",
31+
"additionalVersions": "9.0.302"
32+
},
2933
"ghcr.io/devcontainers/features/sshd:1": {
3034
"version": "latest"
3135
}

.devcontainer/post-create.sh

Lines changed: 1 addition & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -4,11 +4,6 @@ tar xzvf ./*.tar.gz >/dev/null 2>&1
44
sudo mv dependabot /usr/local/bin
55
rm ./*.tar.gz
66

7-
# The image comes loaded with 8.0 SDK, but we need the 7.0 and 9.0 runtimes for running tests
8-
sudo wget https://builds.dotnet.microsoft.com/dotnet/scripts/v1/dotnet-install.sh
9-
sudo chmod +x dotnet-install.sh
10-
sudo ./dotnet-install.sh -c 7.0 --runtime dotnet --install-dir /usr/share/dotnet/shared
11-
sudo ./dotnet-install.sh -c 9.0 --install-dir /usr/share/dotnet
12-
sudo rm ./dotnet-install.sh
7+
bundle install
138

149
echo "export LOCAL_GITHUB_ACCESS_TOKEN=$GITHUB_TOKEN" >> ~/.bashrc

.git-blame-ignore-revs

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,3 +6,18 @@
66
#
77
# Changed Layout/DotPosition from leading to trailing
88
3fc49229761517cf3dc6979018a9a2d84f733ece
9+
10+
# Enabled Layout/MultilineMethodArgumentLineBreaks and Layout/FirstMethodArgumentLineBreak
11+
653539603c43f638abb4d1fbdabe7c4c9df4bd81
12+
13+
# Enabled Layout/MultilineMethodParameterLineBreaks and Layout/FirstMethodParameterLineBreak
14+
f8acdfb85fdc4749f9cd1f29eb428cafd11478cd
15+
16+
# Enabled Layout/EmptyLinesAroundAttributeAccessor
17+
0f69e2d8016435d393646a30c81e64c1ed0a942c
18+
19+
# Enabled Layout/SpaceAroundMethodCallOperator
20+
cdeed7e3a9e4fb5d2ac4c47e1c0409c64c2c76ef
21+
22+
# Enabled Layout/RescueEnsureAlignment
23+
f94250eddf49c168fb1dcc2dfdd4a924ce648370

.github/ci-filters.yml

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,17 @@ shared: &shared
55
- 'updater/Gemfil*'
66
- 'omnibus/**'
77
- '.github/workflows/ci.yml'
8+
rakefile_tests:
9+
- 'rakelib/**'
10+
- 'Rakefile'
11+
- 'script/test-rakefile'
812
dry_run:
913
- *shared
1014
- 'bin/dry-run.rb'
1115
- 'bin/spec/**'
16+
bazel:
17+
- *shared
18+
- 'bazel/**'
1219
bun:
1320
- *shared
1421
- 'bun/**'
@@ -58,6 +65,9 @@ gradle:
5865
hex:
5966
- *shared
6067
- 'hex/**'
68+
julia:
69+
- *shared
70+
- 'julia/**'
6171
maven:
6272
- *shared
6373
- 'maven/**'

.github/copilot-instructions.md

Lines changed: 108 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -159,15 +159,65 @@ bundle exec srb tc path/to/file.rb
159159
bundle exec srb tc -a path/to/file.rb
160160
```
161161

162-
**Important**: Sorbet's autocorrect feature (`-a` flag) should be used cautiously as it can cause more issues than it resolves. Only use autocorrect when you have high confidence that the changes will not break code functionality.
162+
**Important**: Sorbet's autocorrect feature (`-a` flag) should be used cautiously as it can cause more issues than it resolves. Only use autocorrect when you have high confidence that the changes will not break code functionality.
163163

164164
Autocorrect can handle some simple cases like:
165-
- Adding missing `override.` annotations for method overrides
165+
- Adding missing `override.` annotations for method overrides
166166
- Adding `T.let` declarations for instance variables in strict-typed files
167167
- Adding type annotations for constants
168168

169169
However, autocorrect often creates incorrect fixes for complex type mismatches, method signature issues, and structural problems. **Always manually resolve Sorbet errors** rather than relying on autocorrect, and carefully review any autocorrected changes to ensure they maintain code correctness and intent.
170170

171+
### Code Comments and Documentation
172+
173+
**Prioritize self-documenting code over comments**. Write clear, intention-revealing code with descriptive method and variable names that eliminate the need for explanatory comments.
174+
175+
**When to use comments**:
176+
- **Business logic context**: Explain *why* something is done when the reason isn't obvious from the code
177+
- **Complex algorithms**: Document the approach or mathematical concepts
178+
- **Workarounds**: Explain why a non-obvious solution was necessary
179+
- **External constraints**: Document API limitations, system requirements, or ecosystem-specific behaviors
180+
- **TODO/FIXME**: Temporary markers for future improvements (with issue references when possible)
181+
182+
**Avoid these comment types**:
183+
- **Implementation decisions**: Don't explain what was *not* implemented or alternative approaches considered
184+
- **Obvious code explanations**: Don't restate what the code clearly does
185+
- **Apologies or justifications**: Comments defending coding choices suggest code quality issues
186+
- **Outdated information**: Remove comments that no longer apply to current implementation
187+
- **Version history**: Use git history instead of inline change logs
188+
189+
**Comment style guidelines**:
190+
```ruby
191+
# Good: Explains WHY, adds business context
192+
# Retry failed requests up to 3 times due to GitHub API rate limiting
193+
retry_count = 3
194+
195+
# Bad: Explains WHAT the code does (obvious from code)
196+
# Set retry count to 3
197+
retry_count = 3
198+
199+
# Good: Documents external constraint
200+
# GitHub API requires User-Agent header or returns 403
201+
headers['User-Agent'] = 'Dependabot/1.0'
202+
203+
# Bad: Implementation decision discussion
204+
# We decided not to cache this because it would complicate the code
205+
# and other ecosystems don't do caching here either
206+
response = fetch_data(url)
207+
```
208+
209+
**Prefer code refactoring over explanatory comments**:
210+
```ruby
211+
# Instead of commenting complex logic:
212+
# Calculate the SHA256 of downloaded file for security verification
213+
digest = Digest::SHA256.hexdigest(response.body)
214+
215+
# Extract to a well-named method:
216+
def calculate_security_checksum(content)
217+
Digest::SHA256.hexdigest(content)
218+
end
219+
```
220+
171221
### Native Helpers
172222

173223
Many ecosystems use native language helpers (Go, Node.js, Python) located in `{ecosystem}/helpers/`. These helpers run exclusively within containers and changes require rebuilding:
@@ -263,6 +313,62 @@ bin/dry-run.rb {ecosystem} {repo} --profile
263313

264314
When implementing new ecosystems or modifying existing ones, always ensure the 7 core classes are implemented and follow the established inheritance patterns from `dependabot-common`.
265315

316+
## Core Class Structure Pattern
317+
318+
**CRITICAL**: All Dependabot core classes with nested helper classes must follow the exact pattern to avoid "superclass mismatch" errors. This pattern is used consistently across all established ecosystems (bundler, npm_and_yarn, go_modules, etc.).
319+
320+
### Main Class Structure (applies to FileFetcher, FileParser, FileUpdater, UpdateChecker, etc.)
321+
```ruby
322+
# {ecosystem}/lib/dependabot/{ecosystem}/file_updater.rb (or file_fetcher.rb, file_parser.rb, etc.)
323+
require "dependabot/file_updaters"
324+
require "dependabot/file_updaters/base"
325+
326+
module Dependabot
327+
module {Ecosystem}
328+
class FileUpdater < Dependabot::FileUpdaters::Base
329+
# require_relative statements go INSIDE the class
330+
require_relative "file_updater/helper_class"
331+
332+
# Main logic here...
333+
end
334+
end
335+
end
336+
337+
Dependabot::FileUpdaters.register("{ecosystem}", Dependabot::{Ecosystem}::FileUpdater)
338+
```
339+
340+
### Helper Class Structure
341+
```ruby
342+
# {ecosystem}/lib/dependabot/{ecosystem}/file_updater/helper_class.rb
343+
require "dependabot/{ecosystem}/file_updater"
344+
345+
module Dependabot
346+
module {Ecosystem}
347+
class FileUpdater < Dependabot::FileUpdaters::Base
348+
class HelperClass
349+
# Helper logic nested INSIDE the main class
350+
end
351+
end
352+
end
353+
end
354+
```
355+
356+
### Key Rules:
357+
1. **Main classes** inherit from appropriate base: `Dependabot::FileUpdaters::Base`, `Dependabot::FileFetchers::Base`, etc.
358+
2. **Helper classes** are nested inside the main class
359+
3. **require_relative** statements go INSIDE the main class, not at module level
360+
4. **Helper classes require the main file** first: `require "dependabot/{ecosystem}/file_updater"`
361+
5. **Never define multiple top-level classes** with same name in the same namespace
362+
6. **Backward compatibility** can use static methods that delegate to instance methods
363+
364+
### Applies To:
365+
- **FileFetcher** and its helpers (e.g., `FileFetcher::GitCommitChecker`)
366+
- **FileParser** and its helpers (e.g., `FileParser::ManifestParser`)
367+
- **FileUpdater** and its helpers (e.g., `FileUpdater::LockfileUpdater`)
368+
- **UpdateChecker** and its helpers (e.g., `UpdateChecker::VersionResolver`)
369+
- **MetadataFinder** and its helpers
370+
- **Version** and **Requirement** classes (if they have nested classes)
371+
266372
## Adding New Ecosystems
267373

268374
If you are adding a new ecosystem, follow the detailed guide in `./NEW_ECOSYSTEMS.md` which provides step-by-step instructions for implementing a new package manager ecosystem.

.github/dependabot.yml

Lines changed: 13 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -194,6 +194,17 @@ updates:
194194
multi-ecosystem-group: "uv-ecosystem"
195195
patterns: ["*"]
196196
ignore:
197-
# TODO: Remove when we drop support for Python 3.10
198-
- dependency-name: "tomli"
197+
# Ignore major updates as most major updates will need manual intervention
198+
- dependency-name: "*"
199199
update-types: [ "version-update:semver-major" ]
200+
- package-ecosystem: "docker"
201+
directory: "/docker"
202+
schedule:
203+
interval: "weekly"
204+
day: "sunday"
205+
time: "16:00"
206+
groups:
207+
regclient:
208+
patterns:
209+
- "regclient/regctl*"
210+
- "sigstore/cosign/cosign*"

.github/issue-labeler.yml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -72,3 +72,9 @@
7272

7373
"L: helm":
7474
- '(helm)'
75+
76+
"L: bazel":
77+
- '(bazel)'
78+
79+
"L: julia":
80+
- '(julia)'

.github/smoke-filters.yml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,9 @@ common: &common
44
- Dockerfile.updater-core
55
- 'common/**'
66
- 'updater/**'
7+
bazel:
8+
- *common
9+
- 'bazel/**'
710
github_actions:
811
- *common
912
- 'github_actions/**'
@@ -74,6 +77,9 @@ uv:
7477
helm:
7578
- *common
7679
- 'helm/**'
80+
julia:
81+
- *common
82+
- 'julia/**'
7783
vcpkg:
7884
- *common
7985
- 'vcpkg/**'

0 commit comments

Comments
 (0)