| 1 | //! Makes a security update: raises one package to a fixed version in the |
| 2 | //! lockfiles that resolve a vulnerable one, with the ecosystem's own tool, |
| 3 | //! commits that as g1t and pushes it to a branch of its own. The push is |
| 4 | //! what tells the security service to open the pull request; this opens |
| 5 | //! nothing itself. |
| 6 | //! |
| 7 | //! What each lockfile is updated with (the lockfiles `g1t_scan::lockfiles` |
| 8 | //! reads): |
| 9 | //! |
| 10 | //! | Lockfile | A direct dependency | Any other | |
| 11 | //! | --- | --- | --- | |
| 12 | //! | `package-lock.json` | `npm install --package-lock-only <pkg>@<range>` | `npm update --package-lock-only <pkg>`, then an `overrides` entry | |
| 13 | //! | `pnpm-lock.yaml` | `pnpm update <pkg>@<range> --lockfile-only` | `pnpm update <pkg> --depth Infinity --lockfile-only`, then `pnpm.overrides` | |
| 14 | //! | `yarn.lock` (2 and later) | `yarn up <pkg>@<range> --mode=update-lockfile` | `yarn up --recursive <pkg>`, then `resolutions` | |
| 15 | //! | `yarn.lock` (1) | `yarn upgrade <pkg>@<range>` | `resolutions` | |
| 16 | //! | `Cargo.lock` | `cargo update -p <pkg>@<old> --precise <version>`, else `cargo update -p <pkg>@<old>` | the same | |
| 17 | //! | `go.mod`, `go.sum` | `go get <module>@v<version>`, then `go mod tidy` | the same | |
| 18 | //! | `poetry.lock` | `poetry add <pkg>@^<version> --lock` | `poetry update --lock <pkg>` | |
| 19 | //! | `requirements.txt` | its `==` pins rewritten | the same | |
| 20 | //! |
| 21 | //! A direct dependency keeps its range's style (`^`, `~` or exact). No |
| 22 | //! install script runs. pnpm and yarn run through corepack, so the |
| 23 | //! version a project names in `packageManager` is the one used. Poetry is |
| 24 | //! installed into a virtual environment if the sandbox has none. |
| 25 | //! |
| 26 | //! Afterwards every lockfile is read again, and the update counts only if |
| 27 | //! none of them resolves the package below the version any more. When the |
| 28 | //! tool cannot get there (another package holds it back), the job fails |
| 29 | //! saying it needs code changes, with the tool's last lines. |
| 30 | //! |
| 31 | //! Configuration: |
| 32 | //! |
| 33 | //! - `GIT_REMOTE`, `GIT_BRANCH_BASE`: the repository and its default branch. |
| 34 | //! - `GIT_BRANCH`: the branch to push, under `g1t/security/`. |
| 35 | //! - `BUMP_ECOSYSTEM` (OSV's name: `npm`, `crates.io`, `Go`, `PyPI`), |
| 36 | //! `BUMP_PACKAGE`, `BUMP_VERSION`: what to raise, to what. |
| 37 | //! - `BUMP_LOCKFILES`: the lockfiles' paths from the root, one per line or |
| 38 | //! as a JSON array. |
| 39 | //! - `COMMIT_MESSAGE`: the commit's message. |
| 40 | //! - `G1T_USER`, `G1T_TOKEN`: to clone and push; passed per command, never |
| 41 | //! written to the clone's config or remote. |
| 42 | //! |
| 43 | //! It prints one line of JSON on stdout saying what happened, and exits 0 |
| 44 | //! once the branch is pushed; otherwise non-zero, with why on stderr: |
| 45 | //! `NEEDS_CHANGES_EXIT` when the update needs code changes, |
| 46 | //! `UNSUPPORTED_EXIT` for a lockfile or tool it cannot update. |
| 47 | |
| 48 | use std::collections::BTreeSet; |
| 49 | use std::path::Path; |
| 50 | use std::process::Command; |
| 51 | |
| 52 | use anyhow::{Context, Result, anyhow, bail}; |
| 53 | use g1t_scan::lockfiles::{Ecosystem, Lockfile}; |
| 54 | use g1t_scan::version; |
| 55 | use serde_json::{Value, json}; |
| 56 | |
| 57 | use crate::{WORKDIR, auth_option, env, git}; |
| 58 | |
| 59 | use crate::{AUTHOR_EMAIL, AUTHOR_NAME}; |
| 60 | /// Every security update's branch starts with this: |
| 61 | /// `g1t_contracts::security::UPDATE_BRANCH_PREFIX`. |
| 62 | const BRANCH_PREFIX: &str = "g1t/security/"; |
| 63 | |
| 64 | /// The exit code when the update needs code changes, not just a lockfile. |
| 65 | pub const NEEDS_CHANGES_EXIT: i32 = 3; |
| 66 | /// The exit code for a lockfile or ecosystem this cannot update. |
| 67 | pub const UNSUPPORTED_EXIT: i32 = 4; |
| 68 | |
| 69 | /// Why a bump stopped, when that is not just an error. |
| 70 | #[derive(Debug)] |
| 71 | enum Stop { |
| 72 | /// The tool could not raise it: something else holds it back. |
| 73 | NeedsChanges(String), |
| 74 | /// Not something this can update. |
| 75 | Unsupported(String), |
| 76 | } |
| 77 | |
| 78 | impl std::fmt::Display for Stop { |
| 79 | fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result { |
| 80 | match self { |
| 81 | Stop::NeedsChanges(why) => write!(f, "needs code changes: {why}"), |
| 82 | Stop::Unsupported(why) => write!(f, "unsupported: {why}"), |
| 83 | } |
| 84 | } |
| 85 | } |
| 86 | |
| 87 | impl std::error::Error for Stop {} |
| 88 | |
| 89 | fn needs_changes(why: impl Into<String>) -> anyhow::Error { |
| 90 | anyhow!(Stop::NeedsChanges(why.into())) |
| 91 | } |
| 92 | |
| 93 | fn unsupported(why: impl Into<String>) -> anyhow::Error { |
| 94 | anyhow!(Stop::Unsupported(why.into())) |
| 95 | } |
| 96 | |
| 97 | /// What to raise, to what, where. |
| 98 | #[derive(Debug)] |
| 99 | struct Bump { |
| 100 | ecosystem: Ecosystem, |
| 101 | package: String, |
| 102 | /// The fixed version, as the ecosystem's tools write it (Go's with `v`). |
| 103 | version: String, |
| 104 | jobs: Vec<Job>, |
| 105 | } |
| 106 | |
| 107 | /// One directory's lockfiles of one kind, updated by one tool run. |
| 108 | #[derive(Debug, PartialEq, Eq)] |
| 109 | struct Job { |
| 110 | /// From the repository's root; empty for the root. |
| 111 | dir: String, |
| 112 | lockfile: Lockfile, |
| 113 | /// The lockfiles' paths from the root, each read again afterwards. |
| 114 | paths: Vec<String>, |
| 115 | } |
| 116 | |
| 117 | impl Job { |
| 118 | fn file(&self, name: &str) -> String { |
| 119 | if self.dir.is_empty() { name.to_owned() } else { format!("{}/{name}", self.dir) } |
| 120 | } |
| 121 | |
| 122 | /// What the tool may change: the lockfiles and their manifest. Only |
| 123 | /// these are committed, whatever else a tool leaves behind. |
| 124 | fn touched(&self) -> Vec<String> { |
| 125 | let mut files: Vec<String> = self.paths.clone(); |
| 126 | let manifests: &[&str] = match self.lockfile { |
| 127 | Lockfile::PackageLock | Lockfile::PnpmLock | Lockfile::YarnLock => &["package.json"], |
| 128 | Lockfile::GoMod | Lockfile::GoSum => &["go.mod", "go.sum"], |
| 129 | Lockfile::PoetryLock => &["pyproject.toml"], |
| 130 | Lockfile::CargoLock | Lockfile::Requirements => &[], |
| 131 | }; |
| 132 | files.extend(manifests.iter().map(|name| self.file(name))); |
| 133 | files.sort(); |
| 134 | files.dedup(); |
| 135 | files |
| 136 | } |
| 137 | } |
| 138 | |
| 139 | /// `BUMP_LOCKFILES`: a JSON array, or one path per line. |
| 140 | fn lockfile_list(text: &str) -> Result<Vec<String>> { |
| 141 | let text = text.trim(); |
| 142 | let paths: Vec<String> = if text.starts_with('[') { |
| 143 | serde_json::from_str(text).context("BUMP_LOCKFILES is not a JSON array of paths")? |
| 144 | } else { |
| 145 | text.lines().map(str::to_owned).collect() |
| 146 | }; |
| 147 | Ok(paths.into_iter().map(|path| path.trim().trim_start_matches("./").to_owned()).filter(|path| !path.is_empty()).collect()) |
| 148 | } |
| 149 | |
| 150 | /// The lockfiles grouped into what one tool run updates: `go.mod` and |
| 151 | /// `go.sum` in one directory are one module. Each must be a lockfile of |
| 152 | /// `ecosystem`, inside the repository. |
| 153 | fn jobs(ecosystem: Ecosystem, paths: &[String]) -> Result<Vec<Job>> { |
| 154 | let mut jobs: Vec<Job> = Vec::new(); |
| 155 | for path in paths { |
| 156 | if path.starts_with('/') || path.contains('\\') || path.split('/').any(|part| part == ".." || part.is_empty()) { |
| 157 | bail!("{path} is not a path inside the repository"); |
| 158 | } |
| 159 | let lockfile = Lockfile::for_path(path).ok_or_else(|| unsupported(format!("{path} is not a lockfile g1t can update")))?; |
| 160 | if lockfile.ecosystem() != ecosystem { |
| 161 | bail!("{path} is not a {} lockfile", ecosystem.osv()); |
| 162 | } |
| 163 | let dir = path.rsplit_once('/').map(|(dir, _)| dir.to_owned()).unwrap_or_default(); |
| 164 | let lockfile = if lockfile == Lockfile::GoSum { Lockfile::GoMod } else { lockfile }; |
| 165 | match jobs.iter_mut().find(|job| job.dir == dir && job.lockfile == lockfile) { |
| 166 | Some(job) => { |
| 167 | if !job.paths.contains(path) { |
| 168 | job.paths.push(path.clone()); |
| 169 | } |
| 170 | } |
| 171 | None => jobs.push(Job { dir, lockfile, paths: vec![path.clone()] }), |
| 172 | } |
| 173 | } |
| 174 | if jobs.is_empty() { |
| 175 | bail!("BUMP_LOCKFILES names no lockfile"); |
| 176 | } |
| 177 | Ok(jobs) |
| 178 | } |
| 179 | |
| 180 | /// A version as the ecosystem's tools take it: Go's with a leading `v`, |
| 181 | /// everyone else's without. |
| 182 | fn tool_version(ecosystem: Ecosystem, version: &str) -> String { |
| 183 | let version = version.trim(); |
| 184 | let bare = match version.strip_prefix(['v', 'V']) { |
| 185 | Some(rest) if rest.starts_with(|c: char| c.is_ascii_digit()) => rest, |
| 186 | _ => version, |
| 187 | }; |
| 188 | match ecosystem { |
| 189 | Ecosystem::Go => format!("v{bare}"), |
| 190 | _ => bare.to_owned(), |
| 191 | } |
| 192 | } |
| 193 | |
| 194 | /// A package name or version is passed to tools as one argument: it must |
| 195 | /// not read as an option, and holds only what names and versions do. |
| 196 | fn safe_argument(what: &str, text: &str) -> Result<()> { |
| 197 | let allowed = |c: char| c.is_ascii_alphanumeric() || "@/._-+~".contains(c); |
| 198 | if text.is_empty() || text.starts_with('-') || !text.chars().all(allowed) || text.len() > 214 { |
| 199 | bail!("{what} {text:?} is not a package name or version g1t can pass to a tool"); |
| 200 | } |
| 201 | Ok(()) |
| 202 | } |
| 203 | |
| 204 | /// The range to ask for a direct dependency now at `current`: the same |
| 205 | /// style (`^1.2.3`, `~1.2.3`, exact), and `^` for any other. |
| 206 | fn raised_range(current: &str, version: &str) -> String { |
| 207 | let current = current.trim(); |
| 208 | if current.starts_with('~') { |
| 209 | format!("~{version}") |
| 210 | } else if current.starts_with(|c: char| c.is_ascii_digit()) || current.starts_with('=') { |
| 211 | version.to_owned() |
| 212 | } else { |
| 213 | format!("^{version}") |
| 214 | } |
| 215 | } |
| 216 | |
| 217 | /// The range `package.json` asks for `package` with, if it is a direct |
| 218 | /// dependency from the registry (not a workspace, link, alias or URL). |
| 219 | fn direct_range(manifest: &Value, package: &str) -> Option<String> { |
| 220 | ["dependencies", "devDependencies", "optionalDependencies"].iter().find_map(|section| { |
| 221 | let range = manifest.get(section)?.get(package)?.as_str()?; |
| 222 | let registry = !range.contains(':') && !range.contains('/'); |
| 223 | registry.then(|| range.to_owned()) |
| 224 | }) |
| 225 | } |
| 226 | |
| 227 | /// Which JavaScript package manager wrote a lockfile. |
| 228 | #[derive(Clone, Copy, Debug, PartialEq, Eq)] |
| 229 | enum Node { |
| 230 | Npm, |
| 231 | Pnpm, |
| 232 | /// Yarn 1. |
| 233 | YarnClassic, |
| 234 | /// Yarn 2 and later, whose lockfile has `__metadata`. |
| 235 | YarnBerry, |
| 236 | } |
| 237 | |
| 238 | impl Node { |
| 239 | fn of(lockfile: Lockfile, text: &str) -> Option<Node> { |
| 240 | Some(match lockfile { |
| 241 | Lockfile::PackageLock => Node::Npm, |
| 242 | Lockfile::PnpmLock => Node::Pnpm, |
| 243 | Lockfile::YarnLock if text.lines().any(|line| line.starts_with("__metadata:")) => Node::YarnBerry, |
| 244 | Lockfile::YarnLock => Node::YarnClassic, |
| 245 | _ => return None, |
| 246 | }) |
| 247 | } |
| 248 | |
| 249 | /// The command, through corepack for pnpm and yarn, so the version the |
| 250 | /// project's `packageManager` names is the one that runs. |
| 251 | fn command(self, args: &[&str]) -> Vec<String> { |
| 252 | let mut command: Vec<&str> = match self { |
| 253 | Node::Npm => vec!["npm"], |
| 254 | Node::Pnpm => vec!["corepack", "pnpm"], |
| 255 | Node::YarnClassic | Node::YarnBerry => vec!["corepack", "yarn"], |
| 256 | }; |
| 257 | command.extend(args); |
| 258 | command.into_iter().map(str::to_owned).collect() |
| 259 | } |
| 260 | |
| 261 | /// Raises a direct dependency to `range`. |
| 262 | fn direct(self, package: &str, range: &str) -> Vec<String> { |
| 263 | let spec = format!("{package}@{range}"); |
| 264 | match self { |
| 265 | Node::Npm => self.command(&["install", "--package-lock-only", "--ignore-scripts", "--no-audit", "--no-fund", &spec]), |
| 266 | Node::Pnpm => self.command(&["update", &spec, "--lockfile-only", "--ignore-scripts"]), |
| 267 | Node::YarnBerry => self.command(&["up", &spec, "--mode=update-lockfile"]), |
| 268 | Node::YarnClassic => self.command(&["upgrade", &spec, "--ignore-scripts", "--non-interactive"]), |
| 269 | } |
| 270 | } |
| 271 | |
| 272 | /// Moves a package something else depends on as far as the ranges |
| 273 | /// that ask for it allow. Yarn 1 has no such command. |
| 274 | fn transitive(self, package: &str) -> Option<Vec<String>> { |
| 275 | Some(match self { |
| 276 | Node::Npm => self.command(&["update", "--package-lock-only", "--ignore-scripts", "--no-audit", "--no-fund", package]), |
| 277 | Node::Pnpm => self.command(&["update", package, "--depth", "Infinity", "--lockfile-only", "--ignore-scripts"]), |
| 278 | Node::YarnBerry => self.command(&["up", "--recursive", package, "--mode=update-lockfile"]), |
| 279 | Node::YarnClassic => return None, |
| 280 | }) |
| 281 | } |
| 282 | |
| 283 | /// Where `package.json` forces a version on everything that asks for |
| 284 | /// a package. |
| 285 | fn override_path(self) -> &'static [&'static str] { |
| 286 | match self { |
| 287 | Node::Npm => &["overrides"], |
| 288 | Node::Pnpm => &["pnpm", "overrides"], |
| 289 | Node::YarnClassic | Node::YarnBerry => &["resolutions"], |
| 290 | } |
| 291 | } |
| 292 | |
| 293 | /// Writes the lockfile again from `package.json`. |
| 294 | fn relock(self) -> Vec<String> { |
| 295 | match self { |
| 296 | Node::Npm => self.command(&["install", "--package-lock-only", "--ignore-scripts", "--no-audit", "--no-fund"]), |
| 297 | Node::Pnpm => self.command(&["install", "--lockfile-only", "--ignore-scripts"]), |
| 298 | Node::YarnBerry => self.command(&["install", "--mode=update-lockfile"]), |
| 299 | Node::YarnClassic => self.command(&["install", "--ignore-scripts", "--non-interactive"]), |
| 300 | } |
| 301 | } |
| 302 | } |
| 303 | |
| 304 | /// Adds `package: version` to the overrides at `path` in `package.json`, |
| 305 | /// creating the objects on the way. Returns false when it is already there. |
| 306 | fn add_override(manifest: &mut Value, path: &[&str], package: &str, version: &str) -> Result<bool> { |
| 307 | let mut at = manifest; |
| 308 | for key in path { |
| 309 | let object = at.as_object_mut().ok_or_else(|| anyhow!("package.json is not an object"))?; |
| 310 | at = object.entry(key.to_string()).or_insert_with(|| json!({})); |
| 311 | } |
| 312 | let object = at.as_object_mut().ok_or_else(|| anyhow!("package.json's {} is not an object", path.join(".")))?; |
| 313 | if object.get(package).and_then(Value::as_str) == Some(version) { |
| 314 | return Ok(false); |
| 315 | } |
| 316 | object.insert(package.to_owned(), Value::String(version.to_owned())); |
| 317 | Ok(true) |
| 318 | } |
| 319 | |
| 320 | /// What Cargo runs for each locked version of `package` below `version`: |
| 321 | /// straight to it, or, when that is past what a dependent's requirement |
| 322 | /// allows, as far as the requirement does. |
| 323 | fn cargo_commands(package: &str, old: &str, version: &str) -> [Vec<String>; 2] { |
| 324 | let spec = format!("{package}@{old}"); |
| 325 | [ |
| 326 | ["cargo", "update", "-p", &spec, "--precise", version].map(str::to_owned).to_vec(), |
| 327 | ["cargo", "update", "-p", &spec].map(str::to_owned).to_vec(), |
| 328 | ] |
| 329 | } |
| 330 | |
| 331 | fn go_commands(module: &str, version: &str) -> [Vec<String>; 2] { |
| 332 | [ |
| 333 | vec!["go".into(), "get".into(), format!("{module}@{version}")], |
| 334 | ["go", "mod", "tidy"].map(str::to_owned).to_vec(), |
| 335 | ] |
| 336 | } |
| 337 | |
| 338 | /// Which dependency group of `pyproject.toml` names `package`: `Some(None)` |
| 339 | /// for the main one, `Some(Some(group))` for another, `None` when it is not |
| 340 | /// a direct dependency. |
| 341 | fn poetry_group(pyproject: &toml::Value, package: &str) -> Option<Option<String>> { |
| 342 | let wanted = Ecosystem::PyPI.normalize(package); |
| 343 | let names = |table: Option<&toml::Value>| -> bool { |
| 344 | table |
| 345 | .and_then(toml::Value::as_table) |
| 346 | .is_some_and(|table| table.keys().any(|key| Ecosystem::PyPI.normalize(key) == wanted)) |
| 347 | }; |
| 348 | let poetry = pyproject.get("tool").and_then(|tool| tool.get("poetry")); |
| 349 | if names(poetry.and_then(|poetry| poetry.get("dependencies"))) { |
| 350 | return Some(None); |
| 351 | } |
| 352 | let pep621 = pyproject |
| 353 | .get("project") |
| 354 | .and_then(|project| project.get("dependencies")) |
| 355 | .and_then(toml::Value::as_array) |
| 356 | .is_some_and(|list| { |
| 357 | list.iter().filter_map(toml::Value::as_str).any(|requirement| { |
| 358 | let name: String = requirement.chars().take_while(|c| c.is_ascii_alphanumeric() || "-_.".contains(*c)).collect(); |
| 359 | Ecosystem::PyPI.normalize(&name) == wanted |
| 360 | }) |
| 361 | }); |
| 362 | if pep621 { |
| 363 | return Some(None); |
| 364 | } |
| 365 | if names(poetry.and_then(|poetry| poetry.get("dev-dependencies"))) { |
| 366 | return Some(Some("dev".to_owned())); |
| 367 | } |
| 368 | let groups = poetry.and_then(|poetry| poetry.get("group")).and_then(toml::Value::as_table)?; |
| 369 | groups |
| 370 | .iter() |
| 371 | .find(|(_, group)| names(group.get("dependencies"))) |
| 372 | .map(|(name, _)| Some(name.clone())) |
| 373 | } |
| 374 | |
| 375 | fn poetry_commands(poetry: &[String], package: &str, version: &str, group: Option<Option<String>>) -> Vec<String> { |
| 376 | let mut command = poetry.to_vec(); |
| 377 | match group { |
| 378 | Some(group) => { |
| 379 | command.extend(["add".to_owned(), format!("{package}@^{version}"), "--lock".to_owned()]); |
| 380 | if let Some(group) = group { |
| 381 | command.extend(["--group".to_owned(), group]); |
| 382 | } |
| 383 | } |
| 384 | None => command.extend(["update".to_owned(), "--lock".to_owned(), package.to_owned()]), |
| 385 | } |
| 386 | command |
| 387 | } |
| 388 | |
| 389 | /// `requirements.txt` with every `==` (or `===`) pin of `package` below |
| 390 | /// `version` raised to it, and nothing else changed. Returns the text and |
| 391 | /// how many pins moved. |
| 392 | fn rewrite_pins(text: &str, package: &str, version: &str) -> (String, usize) { |
| 393 | let wanted = Ecosystem::PyPI.normalize(package); |
| 394 | let mut moved = 0; |
| 395 | let mut out = String::with_capacity(text.len() + 8); |
| 396 | for line in text.split_inclusive('\n') { |
| 397 | let rewritten = (|| { |
| 398 | let code = line.split('#').next().unwrap_or_default(); |
| 399 | let trimmed = code.trim_start(); |
| 400 | if trimmed.starts_with('-') || code.contains("://") { |
| 401 | return None; |
| 402 | } |
| 403 | let operator = code.find("===").map(|at| (at, 3)).or_else(|| code.find("==").map(|at| (at, 2)))?; |
| 404 | let name = code[..operator.0].split('[').next().unwrap_or_default().trim(); |
| 405 | if Ecosystem::PyPI.normalize(name) != wanted { |
| 406 | return None; |
| 407 | } |
| 408 | let start = operator.0 + operator.1; |
| 409 | let rest = &code[start..]; |
| 410 | let leading = rest.len() - rest.trim_start().len(); |
| 411 | let from = start + leading; |
| 412 | let end = code[from..] |
| 413 | .find(|c: char| c.is_whitespace() || ",;\\".contains(c)) |
| 414 | .map_or(code.len(), |at| from + at); |
| 415 | let old = &line[from..end]; |
| 416 | if old.is_empty() || old.contains('*') || version::compare(old, version).is_ge() { |
| 417 | return None; |
| 418 | } |
| 419 | Some(format!("{}{version}{}", &line[..from], &line[end..])) |
| 420 | })(); |
| 421 | match rewritten { |
| 422 | Some(line) => { |
| 423 | moved += 1; |
| 424 | out.push_str(&line); |
| 425 | } |
| 426 | None => out.push_str(line), |
| 427 | } |
| 428 | } |
| 429 | (out, moved) |
| 430 | } |
| 431 | |
| 432 | /// The versions of `package` a lockfile still resolves below `version`. |
| 433 | fn below(lockfile: Lockfile, text: &str, ecosystem: Ecosystem, package: &str, version: &str) -> Vec<String> { |
| 434 | let name = ecosystem.normalize(package); |
| 435 | let found: BTreeSet<String> = lockfile |
| 436 | .parse(text) |
| 437 | .into_iter() |
| 438 | .filter(|found| found.name == name && version::compare(&found.version, version).is_lt()) |
| 439 | .map(|found| found.version) |
| 440 | .collect(); |
| 441 | found.into_iter().collect() |
| 442 | } |
| 443 | |
| 444 | /// The last lines of what a tool said, for the reason it failed. |
| 445 | fn tail(text: &str, lines: usize) -> String { |
| 446 | let all: Vec<&str> = text.lines().filter(|line| !line.trim().is_empty()).collect(); |
| 447 | all[all.len().saturating_sub(lines)..].join("\n") |
| 448 | } |
| 449 | |
| 450 | /// Runs a tool in `dir` and returns what it said, failing with the last |
| 451 | /// lines of its output. A tool that is not installed is unsupported. |
| 452 | fn run(dir: &Path, command: &[String]) -> Result<String> { |
| 453 | let (program, args) = command.split_first().ok_or_else(|| anyhow!("no command"))?; |
| 454 | eprintln!("g1t-runner: {} (in {})", command.join(" "), dir.display()); |
| 455 | let output = Command::new(program) |
| 456 | .current_dir(dir) |
| 457 | .args(args) |
| 458 | // Lockfiles only: nothing installs, prompts, audits or runs scripts. |
| 459 | .env("CI", "true") |
| 460 | .env("npm_config_audit", "false") |
| 461 | .env("npm_config_fund", "false") |
| 462 | .env("npm_config_update_notifier", "false") |
| 463 | .env("npm_config_ignore_scripts", "true") |
| 464 | .env("COREPACK_ENABLE_DOWNLOAD_PROMPT", "0") |
| 465 | .env("YARN_ENABLE_IMMUTABLE_INSTALLS", "false") |
| 466 | .env("YARN_ENABLE_SCRIPTS", "false") |
| 467 | .env("YARN_ENABLE_TELEMETRY", "0") |
| 468 | .env("POETRY_NO_INTERACTION", "1") |
| 469 | .env("POETRY_VIRTUALENVS_CREATE", "false") |
| 470 | .env("GOFLAGS", "-mod=mod") |
| 471 | .output() |
| 472 | .map_err(|error| { |
| 473 | if error.kind() == std::io::ErrorKind::NotFound { |
| 474 | unsupported(format!("{program} is not installed in this sandbox")) |
| 475 | } else { |
| 476 | anyhow!("could not run {program}: {error}") |
| 477 | } |
| 478 | })?; |
| 479 | let said = format!("{}\n{}", String::from_utf8_lossy(&output.stdout), String::from_utf8_lossy(&output.stderr)); |
| 480 | if !output.status.success() { |
| 481 | bail!("{} failed:\n{}", command.join(" "), tail(&said, 20)); |
| 482 | } |
| 483 | Ok(said) |
| 484 | } |
| 485 | |
| 486 | fn read(path: &Path) -> Result<String> { |
| 487 | std::fs::read_to_string(path).with_context(|| format!("could not read {}", path.display())) |
| 488 | } |
| 489 | |
| 490 | /// Poetry, installed into a virtual environment from PyPI when the |
| 491 | /// sandbox has none. |
| 492 | fn poetry() -> Result<Vec<String>> { |
| 493 | if Command::new("poetry").arg("--version").output().is_ok_and(|output| output.status.success()) { |
| 494 | return Ok(vec!["poetry".to_owned()]); |
| 495 | } |
| 496 | let venv = "/tmp/g1t-poetry"; |
| 497 | let here = Path::new("/"); |
| 498 | run(here, &["python3", "-m", "venv", venv].map(str::to_owned))?; |
| 499 | run(here, &[format!("{venv}/bin/pip"), "install".into(), "--quiet".into(), "poetry".into()])?; |
| 500 | Ok(vec![format!("{venv}/bin/poetry")]) |
| 501 | } |
| 502 | |
| 503 | impl Bump { |
| 504 | fn from_env() -> Result<Bump> { |
| 505 | let ecosystem_name = env("BUMP_ECOSYSTEM")?; |
| 506 | let ecosystem = Ecosystem::parse(ecosystem_name.trim()) |
| 507 | .ok_or_else(|| unsupported(format!("g1t cannot update {ecosystem_name} dependencies")))?; |
| 508 | let package = env("BUMP_PACKAGE")?.trim().to_owned(); |
| 509 | let version = tool_version(ecosystem, &env("BUMP_VERSION")?); |
| 510 | safe_argument("package", &package)?; |
| 511 | safe_argument("version", &version)?; |
| 512 | let jobs = jobs(ecosystem, &lockfile_list(&env("BUMP_LOCKFILES")?)?)?; |
| 513 | Ok(Bump { ecosystem, package, version, jobs }) |
| 514 | } |
| 515 | |
| 516 | /// The versions every lockfile of `job` still resolves below the target. |
| 517 | fn still_below(&self, workdir: &Path, job: &Job) -> Result<Vec<String>> { |
| 518 | let mut found = BTreeSet::new(); |
| 519 | for path in &job.paths { |
| 520 | let lockfile = Lockfile::for_path(path).unwrap_or(job.lockfile); |
| 521 | let file = workdir.join(path); |
| 522 | if !file.exists() { |
| 523 | bail!("{path} is not in the repository's default branch"); |
| 524 | } |
| 525 | found.extend(below(lockfile, &read(&file)?, self.ecosystem, &self.package, &self.version)); |
| 526 | } |
| 527 | Ok(found.into_iter().collect()) |
| 528 | } |
| 529 | |
| 530 | /// Runs the tool for one job. Errors from the tool are kept for the |
| 531 | /// reason, should the lockfile still be behind afterwards. |
| 532 | fn update(&self, workdir: &Path, job: &Job) -> Result<Vec<String>> { |
| 533 | let dir = workdir.join(&job.dir); |
| 534 | let mut said = Vec::new(); |
| 535 | let attempt = |command: Vec<String>, said: &mut Vec<String>| -> Result<bool> { |
| 536 | match run(&dir, &command) { |
| 537 | Ok(_) => Ok(true), |
| 538 | Err(error) if error.downcast_ref::<Stop>().is_some() => Err(error), |
| 539 | Err(error) => { |
| 540 | said.push(format!("{error:#}")); |
| 541 | Ok(false) |
| 542 | } |
| 543 | } |
| 544 | }; |
| 545 | match job.lockfile { |
| 546 | Lockfile::PackageLock | Lockfile::PnpmLock | Lockfile::YarnLock => { |
| 547 | let lock = read(&workdir.join(&job.paths[0]))?; |
| 548 | let node = Node::of(job.lockfile, &lock).ok_or_else(|| anyhow!("not a JavaScript lockfile"))?; |
| 549 | let manifest_path = dir.join("package.json"); |
| 550 | let mut manifest: Value = serde_json::from_str(&read(&manifest_path)?).context("package.json is not JSON")?; |
| 551 | match direct_range(&manifest, &self.package) { |
| 552 | Some(range) => { |
| 553 | attempt(node.direct(&self.package, &raised_range(&range, &self.version)), &mut said)?; |
| 554 | } |
| 555 | None => { |
| 556 | if let Some(command) = node.transitive(&self.package) { |
| 557 | attempt(command, &mut said)?; |
| 558 | } |
| 559 | // Held back by what asks for it: force the version. |
| 560 | if !self.still_below(workdir, job)?.is_empty() { |
| 561 | manifest = serde_json::from_str(&read(&manifest_path)?).context("package.json is not JSON")?; |
| 562 | if add_override(&mut manifest, node.override_path(), &self.package, &self.version)? { |
| 563 | let indent = if read(&manifest_path)?.contains("\n \"") { " " } else { " " }; |
| 564 | write_json(&manifest_path, &manifest, indent)?; |
| 565 | } |
| 566 | attempt(node.relock(), &mut said)?; |
| 567 | } |
| 568 | } |
| 569 | } |
| 570 | } |
| 571 | Lockfile::CargoLock => { |
| 572 | for old in self.still_below(workdir, job)? { |
| 573 | let [precise, compatible] = cargo_commands(&self.package, &old, &self.version); |
| 574 | if !attempt(precise, &mut said)? { |
| 575 | attempt(compatible, &mut said)?; |
| 576 | } |
| 577 | } |
| 578 | } |
| 579 | Lockfile::GoMod | Lockfile::GoSum => { |
| 580 | for command in go_commands(&self.package, &self.version) { |
| 581 | if !attempt(command, &mut said)? { |
| 582 | break; |
| 583 | } |
| 584 | } |
| 585 | } |
| 586 | Lockfile::PoetryLock => { |
| 587 | let pyproject_path = dir.join("pyproject.toml"); |
| 588 | let pyproject: toml::Value = toml::from_str(&read(&pyproject_path)?).context("pyproject.toml is not TOML")?; |
| 589 | let command = poetry_commands(&poetry()?, &self.package, &self.version, poetry_group(&pyproject, &self.package)); |
| 590 | attempt(command, &mut said)?; |
| 591 | } |
| 592 | Lockfile::Requirements => { |
| 593 | for path in &job.paths { |
| 594 | let file = workdir.join(path); |
| 595 | let text = read(&file)?; |
| 596 | if text.contains("--hash") { |
| 597 | return Err(unsupported(format!("{path} pins hashes, which need its compiler to update"))); |
| 598 | } |
| 599 | let (rewritten, moved) = rewrite_pins(&text, &self.package, &self.version); |
| 600 | if moved > 0 { |
| 601 | std::fs::write(&file, rewritten).with_context(|| format!("could not write {path}"))?; |
| 602 | } |
| 603 | } |
| 604 | } |
| 605 | } |
| 606 | Ok(said) |
| 607 | } |
| 608 | } |
| 609 | |
| 610 | /// Writes JSON as package managers do: indented, with a final newline. |
| 611 | fn write_json(path: &Path, value: &Value, indent: &str) -> Result<()> { |
| 612 | let mut out = Vec::new(); |
| 613 | let formatter = serde_json::ser::PrettyFormatter::with_indent(indent.as_bytes()); |
| 614 | let mut serializer = serde_json::Serializer::with_formatter(&mut out, formatter); |
| 615 | serde::Serialize::serialize(value, &mut serializer)?; |
| 616 | out.push(b'\n'); |
| 617 | std::fs::write(path, out).with_context(|| format!("could not write {}", path.display())) |
| 618 | } |
| 619 | |
| 620 | /// What was pushed. |
| 621 | struct Pushed { |
| 622 | commit: String, |
| 623 | /// The branch was there already, with the same files. |
| 624 | existed: bool, |
| 625 | } |
| 626 | |
| 627 | fn bump() -> Result<(Bump, String, Pushed)> { |
| 628 | let bump = Bump::from_env()?; |
| 629 | let remote = env("GIT_REMOTE")?; |
| 630 | let base = env("GIT_BRANCH_BASE")?; |
| 631 | let branch = env("GIT_BRANCH")?; |
| 632 | if !branch.starts_with(BRANCH_PREFIX) || branch.contains("..") || branch.chars().any(char::is_whitespace) { |
| 633 | bail!("{branch} is not a security update's branch"); |
| 634 | } |
| 635 | let message = env("COMMIT_MESSAGE").unwrap_or_else(|_| format!("Update {} to {}", bump.package, bump.version)); |
| 636 | let auth = auth_option(&env("G1T_USER")?, &env("G1T_TOKEN")?); |
| 637 | let workdir = Path::new(WORKDIR); |
| 638 | |
| 639 | std::fs::create_dir_all("/work")?; |
| 640 | crate::clone::clone(Path::new("/work"), &auth, &["--branch", &base], &remote, WORKDIR) |
| 641 | .with_context(|| format!("could not clone {base}"))?; |
| 642 | git(workdir, &["checkout", "--quiet", "-b", &branch])?; |
| 643 | git(workdir, &["config", "user.name", AUTHOR_NAME])?; |
| 644 | git(workdir, &["config", "user.email", AUTHOR_EMAIL])?; |
| 645 | |
| 646 | let mut behind = Vec::new(); |
| 647 | for job in &bump.jobs { |
| 648 | if bump.still_below(workdir, job)?.is_empty() { |
| 649 | continue; // Already at the version or later here. |
| 650 | } |
| 651 | let said = bump.update(workdir, job)?; |
| 652 | let left = bump.still_below(workdir, job)?; |
| 653 | if !left.is_empty() { |
| 654 | let why = said.last().map(|said| format!("\n{said}")).unwrap_or_default(); |
| 655 | behind.push(format!( |
| 656 | "{} still resolves {} {} (wanted {} or later){why}", |
| 657 | job.paths.join(", "), |
| 658 | bump.package, |
| 659 | left.join(", "), |
| 660 | bump.version |
| 661 | )); |
| 662 | } |
| 663 | } |
| 664 | if !behind.is_empty() { |
| 665 | return Err(needs_changes(behind.join("\n\n"))); |
| 666 | } |
| 667 | |
| 668 | let touched: Vec<String> = bump |
| 669 | .jobs |
| 670 | .iter() |
| 671 | .flat_map(Job::touched) |
| 672 | .filter(|path| workdir.join(path).exists()) |
| 673 | .collect(); |
| 674 | let mut add = vec!["add", "--"]; |
| 675 | add.extend(touched.iter().map(String::as_str)); |
| 676 | git(workdir, &add)?; |
| 677 | if git(workdir, &["diff", "--cached", "--name-only"])?.is_empty() { |
| 678 | bail!( |
| 679 | "nothing to change: {} already resolves {} {} or later", |
| 680 | bump.jobs.iter().flat_map(|job| job.paths.iter().map(String::as_str)).collect::<Vec<_>>().join(", "), |
| 681 | bump.package, |
| 682 | bump.version |
| 683 | ); |
| 684 | } |
| 685 | git(workdir, &["commit", "--quiet", "--message", &message])?; |
| 686 | let commit = git(workdir, &["rev-parse", "HEAD"])?; |
| 687 | let refspec = format!("HEAD:refs/heads/{branch}"); |
| 688 | let pushed = git(workdir, &["-c", &auth, "push", "--quiet", "origin", &refspec]); |
| 689 | if let Err(error) = pushed { |
| 690 | // Pushed before (a retried job): the same files there is success. |
| 691 | let theirs = git(workdir, &["-c", &auth, "ls-remote", "origin", &format!("refs/heads/{branch}")]).unwrap_or_default(); |
| 692 | if theirs.is_empty() { |
| 693 | return Err(error.context("could not push the update")); |
| 694 | } |
| 695 | crate::clone::fetch(workdir, &auth, "origin", &format!("refs/heads/{branch}")).context("could not read the branch already pushed")?; |
| 696 | let same = git(workdir, &["rev-parse", "FETCH_HEAD^{tree}"])? == git(workdir, &["rev-parse", "HEAD^{tree}"])?; |
| 697 | if !same { |
| 698 | return Err(error.context(format!("{branch} already exists with other changes"))); |
| 699 | } |
| 700 | let commit = git(workdir, &["rev-parse", "FETCH_HEAD"])?; |
| 701 | return Ok((bump, branch, Pushed { commit, existed: true })); |
| 702 | } |
| 703 | Ok((bump, branch, Pushed { commit, existed: false })) |
| 704 | } |
| 705 | |
| 706 | pub fn main() -> i32 { |
| 707 | match bump() { |
| 708 | Ok((bump, branch, pushed)) => { |
| 709 | println!( |
| 710 | "{}", |
| 711 | json!({ |
| 712 | "bump": if pushed.existed { "exists" } else { "pushed" }, |
| 713 | "branch": branch, |
| 714 | "commit": pushed.commit, |
| 715 | "ecosystem": bump.ecosystem.osv(), |
| 716 | "package": bump.package, |
| 717 | "version": bump.version, |
| 718 | "lockfiles": bump.jobs.iter().flat_map(|job| job.paths.clone()).collect::<Vec<_>>(), |
| 719 | }) |
| 720 | ); |
| 721 | 0 |
| 722 | } |
| 723 | Err(error) => { |
| 724 | let (reason, code) = match error.downcast_ref::<Stop>() { |
| 725 | Some(Stop::NeedsChanges(_)) => ("needs_code_changes", NEEDS_CHANGES_EXIT), |
| 726 | Some(Stop::Unsupported(_)) => ("unsupported", UNSUPPORTED_EXIT), |
| 727 | None => ("failed", 1), |
| 728 | }; |
| 729 | println!("{}", json!({ "bump": "failed", "reason": reason, "message": format!("{error:#}") })); |
| 730 | eprintln!("g1t-runner: {error:#}"); |
| 731 | code |
| 732 | } |
| 733 | } |
| 734 | } |
| 735 | |
| 736 | #[cfg(test)] |
| 737 | mod tests { |
| 738 | use super::*; |
| 739 | |
| 740 | fn strings(items: &[&str]) -> Vec<String> { |
| 741 | items.iter().map(|item| item.to_string()).collect() |
| 742 | } |
| 743 | |
| 744 | #[test] |
| 745 | fn lockfiles_come_as_lines_or_json() { |
| 746 | assert_eq!(lockfile_list("Cargo.lock\n web/package-lock.json \n\n").unwrap(), ["Cargo.lock", "web/package-lock.json"]); |
| 747 | assert_eq!(lockfile_list(r#"["./go.mod","go.sum"]"#).unwrap(), ["go.mod", "go.sum"]); |
| 748 | assert!(lockfile_list("[not json").is_err()); |
| 749 | } |
| 750 | |
| 751 | #[test] |
| 752 | fn lockfiles_group_by_directory_and_tool() { |
| 753 | let found = jobs(Ecosystem::Go, &strings(&["go.mod", "go.sum", "tools/go.sum"])).unwrap(); |
| 754 | assert_eq!( |
| 755 | found, |
| 756 | [ |
| 757 | Job { dir: String::new(), lockfile: Lockfile::GoMod, paths: strings(&["go.mod", "go.sum"]) }, |
| 758 | Job { dir: "tools".into(), lockfile: Lockfile::GoMod, paths: strings(&["tools/go.sum"]) }, |
| 759 | ] |
| 760 | ); |
| 761 | assert_eq!(found[0].touched(), ["go.mod", "go.sum"]); |
| 762 | let web = jobs(Ecosystem::Npm, &strings(&["web/package-lock.json"])).unwrap(); |
| 763 | assert_eq!(web[0].touched(), ["web/package-lock.json", "web/package.json"]); |
| 764 | } |
| 765 | |
| 766 | #[test] |
| 767 | fn lockfiles_must_be_the_ecosystems_and_inside_the_repository() { |
| 768 | assert!(jobs(Ecosystem::Npm, &strings(&["Cargo.lock"])).is_err()); |
| 769 | assert!(jobs(Ecosystem::Npm, &strings(&["../package-lock.json"])).is_err()); |
| 770 | assert!(jobs(Ecosystem::Npm, &strings(&["/etc/package-lock.json"])).is_err()); |
| 771 | assert!(jobs(Ecosystem::Npm, &[]).is_err()); |
| 772 | let error = jobs(Ecosystem::PyPI, &strings(&["uv.lock"])).unwrap_err(); |
| 773 | assert!(matches!(error.downcast_ref::<Stop>(), Some(Stop::Unsupported(_)))); |
| 774 | } |
| 775 | |
| 776 | #[test] |
| 777 | fn versions_as_each_tool_takes_them() { |
| 778 | assert_eq!(tool_version(Ecosystem::Go, "0.17.0"), "v0.17.0"); |
| 779 | assert_eq!(tool_version(Ecosystem::Go, "v0.17.0"), "v0.17.0"); |
| 780 | assert_eq!(tool_version(Ecosystem::Npm, "v4.17.21"), "4.17.21"); |
| 781 | assert_eq!(tool_version(Ecosystem::Cargo, " 1.6.1 "), "1.6.1"); |
| 782 | assert_eq!(tool_version(Ecosystem::PyPI, "2.31.0"), "2.31.0"); |
| 783 | } |
| 784 | |
| 785 | #[test] |
| 786 | fn names_and_versions_cannot_be_options() { |
| 787 | assert!(safe_argument("package", "@babel/core").is_ok()); |
| 788 | assert!(safe_argument("package", "golang.org/x/net").is_ok()); |
| 789 | assert!(safe_argument("version", "1.2.3-rc.1+build").is_ok()); |
| 790 | assert!(safe_argument("package", "--registry=evil").is_err()); |
| 791 | assert!(safe_argument("package", "a b").is_err()); |
| 792 | assert!(safe_argument("version", "1.0;rm").is_err()); |
| 793 | assert!(safe_argument("version", "").is_err()); |
| 794 | } |
| 795 | |
| 796 | #[test] |
| 797 | fn a_direct_dependency_keeps_its_range_style() { |
| 798 | assert_eq!(raised_range("^4.17.0", "4.17.21"), "^4.17.21"); |
| 799 | assert_eq!(raised_range("~1.2.0", "1.2.5"), "~1.2.5"); |
| 800 | assert_eq!(raised_range("1.2.0", "1.2.5"), "1.2.5"); |
| 801 | assert_eq!(raised_range("=1.2.0", "1.2.5"), "1.2.5"); |
| 802 | assert_eq!(raised_range(">=1 <2", "1.2.5"), "^1.2.5"); |
| 803 | assert_eq!(raised_range("*", "1.2.5"), "^1.2.5"); |
| 804 | } |
| 805 | |
| 806 | #[test] |
| 807 | fn direct_dependencies_from_the_registry_only() { |
| 808 | let manifest = json!({ |
| 809 | "dependencies": { "lodash": "^4.17.0", "local": "file:../local", "shared": "workspace:*" }, |
| 810 | "devDependencies": { "vitest": "~1.0.0", "fork": "github:me/fork" }, |
| 811 | }); |
| 812 | assert_eq!(direct_range(&manifest, "lodash").as_deref(), Some("^4.17.0")); |
| 813 | assert_eq!(direct_range(&manifest, "vitest").as_deref(), Some("~1.0.0")); |
| 814 | assert_eq!(direct_range(&manifest, "local"), None); |
| 815 | assert_eq!(direct_range(&manifest, "shared"), None); |
| 816 | assert_eq!(direct_range(&manifest, "fork"), None); |
| 817 | assert_eq!(direct_range(&manifest, "minimist"), None); |
| 818 | } |
| 819 | |
| 820 | #[test] |
| 821 | fn javascript_commands_by_lockfile() { |
| 822 | let npm = Node::of(Lockfile::PackageLock, "{}").unwrap(); |
| 823 | assert_eq!( |
| 824 | npm.direct("lodash", "^4.17.21"), |
| 825 | strings(&["npm", "install", "--package-lock-only", "--ignore-scripts", "--no-audit", "--no-fund", "lodash@^4.17.21"]) |
| 826 | ); |
| 827 | assert_eq!( |
| 828 | npm.transitive("minimist").unwrap(), |
| 829 | strings(&["npm", "update", "--package-lock-only", "--ignore-scripts", "--no-audit", "--no-fund", "minimist"]) |
| 830 | ); |
| 831 | assert_eq!(npm.override_path(), ["overrides"]); |
| 832 | |
| 833 | let pnpm = Node::of(Lockfile::PnpmLock, "lockfileVersion: '9.0'").unwrap(); |
| 834 | assert_eq!(pnpm.direct("lodash", "^4.17.21"), strings(&["corepack", "pnpm", "update", "lodash@^4.17.21", "--lockfile-only", "--ignore-scripts"])); |
| 835 | assert_eq!(pnpm.override_path(), ["pnpm", "overrides"]); |
| 836 | |
| 837 | let berry = Node::of(Lockfile::YarnLock, "__metadata:\n version: 6\n").unwrap(); |
| 838 | assert_eq!(berry, Node::YarnBerry); |
| 839 | assert_eq!(berry.direct("lodash", "^4.17.21"), strings(&["corepack", "yarn", "up", "lodash@^4.17.21", "--mode=update-lockfile"])); |
| 840 | assert_eq!(berry.transitive("minimist").unwrap(), strings(&["corepack", "yarn", "up", "--recursive", "minimist", "--mode=update-lockfile"])); |
| 841 | |
| 842 | let classic = Node::of(Lockfile::YarnLock, "# yarn lockfile v1\n").unwrap(); |
| 843 | assert_eq!(classic, Node::YarnClassic); |
| 844 | assert_eq!(classic.transitive("minimist"), None); |
| 845 | assert_eq!(classic.override_path(), ["resolutions"]); |
| 846 | assert_eq!(Node::of(Lockfile::CargoLock, ""), None); |
| 847 | } |
| 848 | |
| 849 | #[test] |
| 850 | fn overrides_are_added_once() { |
| 851 | let mut manifest = json!({ "name": "app" }); |
| 852 | assert!(add_override(&mut manifest, &["pnpm", "overrides"], "minimist", "1.2.6").unwrap()); |
| 853 | assert_eq!(manifest["pnpm"]["overrides"]["minimist"], "1.2.6"); |
| 854 | assert!(!add_override(&mut manifest, &["pnpm", "overrides"], "minimist", "1.2.6").unwrap()); |
| 855 | assert!(add_override(&mut manifest, &["pnpm", "overrides"], "minimist", "1.2.8").unwrap()); |
| 856 | assert_eq!(manifest["pnpm"]["overrides"]["minimist"], "1.2.8"); |
| 857 | } |
| 858 | |
| 859 | #[test] |
| 860 | fn cargo_and_go_commands() { |
| 861 | let [precise, compatible] = cargo_commands("time", "0.1.43", "0.1.45"); |
| 862 | assert_eq!(precise, strings(&["cargo", "update", "-p", "time@0.1.43", "--precise", "0.1.45"])); |
| 863 | assert_eq!(compatible, strings(&["cargo", "update", "-p", "time@0.1.43"])); |
| 864 | let [get, tidy] = go_commands("golang.org/x/net", "v0.23.0"); |
| 865 | assert_eq!(get, strings(&["go", "get", "golang.org/x/net@v0.23.0"])); |
| 866 | assert_eq!(tidy, strings(&["go", "mod", "tidy"])); |
| 867 | } |
| 868 | |
| 869 | #[test] |
| 870 | fn poetry_adds_a_direct_dependency_and_updates_any_other() { |
| 871 | let pyproject: toml::Value = toml::from_str( |
| 872 | "[tool.poetry.dependencies]\npython = \"^3.11\"\nRequests = \"^2.0\"\n\n[tool.poetry.group.test.dependencies]\npytest = \"^7\"\n", |
| 873 | ) |
| 874 | .unwrap(); |
| 875 | assert_eq!(poetry_group(&pyproject, "requests"), Some(None)); |
| 876 | assert_eq!(poetry_group(&pyproject, "pytest"), Some(Some("test".to_owned()))); |
| 877 | assert_eq!(poetry_group(&pyproject, "urllib3"), None); |
| 878 | let pep621: toml::Value = toml::from_str("[project]\ndependencies = [\"jinja2>=3.0\", \"Flask_Cors\"]\n").unwrap(); |
| 879 | assert_eq!(poetry_group(&pep621, "Jinja2"), Some(None)); |
| 880 | assert_eq!(poetry_group(&pep621, "flask-cors"), Some(None)); |
| 881 | |
| 882 | let poetry = strings(&["poetry"]); |
| 883 | assert_eq!(poetry_commands(&poetry, "requests", "2.31.0", Some(None)), strings(&["poetry", "add", "requests@^2.31.0", "--lock"])); |
| 884 | assert_eq!( |
| 885 | poetry_commands(&poetry, "pytest", "7.4.0", Some(Some("test".into()))), |
| 886 | strings(&["poetry", "add", "pytest@^7.4.0", "--lock", "--group", "test"]) |
| 887 | ); |
| 888 | assert_eq!(poetry_commands(&poetry, "urllib3", "2.0.7", None), strings(&["poetry", "update", "--lock", "urllib3"])); |
| 889 | } |
| 890 | |
| 891 | #[test] |
| 892 | fn requirements_pins_are_rewritten_in_place() { |
| 893 | let text = "# pinned\nrequests==2.25.0 # http\nDjango[argon2]===3.2.0 ; python_version >= \"3.8\"\nurllib3==1.26.18\nrequests_toolbelt==0.9.1\n-r base.txt\nflask>=2.0\n"; |
| 894 | let (out, moved) = rewrite_pins(text, "requests", "2.31.0"); |
| 895 | assert_eq!(moved, 1); |
| 896 | assert!(out.contains("requests==2.31.0 # http\n")); |
| 897 | assert!(out.contains("requests_toolbelt==0.9.1\n")); |
| 898 | let (out, moved) = rewrite_pins(&out, "django", "3.2.25"); |
| 899 | assert_eq!(moved, 1); |
| 900 | assert!(out.contains("Django[argon2]===3.2.25 ; python_version >= \"3.8\"\n")); |
| 901 | // Already at or past the version: left alone. |
| 902 | let (same, moved) = rewrite_pins(text, "urllib3", "1.26.18"); |
| 903 | assert_eq!((same.as_str(), moved), (text, 0)); |
| 904 | // A line without a final newline keeps it that way. |
| 905 | assert_eq!(rewrite_pins("Requests==2.0", "requests", "2.31.0").0, "Requests==2.31.0"); |
| 906 | assert_eq!(rewrite_pins("requests == 2.0,<3\n", "requests", "2.31.0").0, "requests == 2.31.0,<3\n"); |
| 907 | } |
| 908 | |
| 909 | #[test] |
| 910 | fn lockfiles_are_read_again_for_what_is_still_below() { |
| 911 | let lock = r#"{"lockfileVersion":3,"packages":{"":{},"node_modules/lodash":{"version":"4.17.21"},"node_modules/a/node_modules/lodash":{"version":"4.17.4"}}}"#; |
| 912 | assert_eq!(below(Lockfile::PackageLock, lock, Ecosystem::Npm, "lodash", "4.17.21"), ["4.17.4"]); |
| 913 | let sum = "golang.org/x/net v0.17.0 h1:x=\ngolang.org/x/net v0.23.0 h1:y=\n"; |
| 914 | assert!(below(Lockfile::GoSum, sum, Ecosystem::Go, "golang.org/x/net", "v0.23.0").is_empty()); |
| 915 | assert_eq!(below(Lockfile::Requirements, "Requests==2.0\n", Ecosystem::PyPI, "requests", "2.31.0"), ["2.0"]); |
| 916 | } |
| 917 | |
| 918 | #[test] |
| 919 | fn a_failure_says_its_last_lines() { |
| 920 | assert_eq!(tail("a\n\nb\nc\n", 2), "b\nc"); |
| 921 | assert_eq!(tail("only", 5), "only"); |
| 922 | } |
| 923 | } |