Merge branch 'main' into jamiemagee/update-config-strict

.devcontainer/on-create.sh

@@ -1,6 +1,2 @@
 #!/bin/bash
-# Prebuilding Python since it takes a long time. This also gets us a pre-built update-core image
-# which will make building all of the other images faster too. If another image is taking a long
-# time to build, consider adding it here.
-script/build python
 docker pull ghcr.io/github/dependabot-update-job-proxy/dependabot-update-job-proxy:latest

common/lib/dependabot/dependency_file.rb

@@ -38,6 +38,11 @@ class DependencyFile
     sig { returns(T.nilable(String)) }
     attr_accessor :mode
 
+    # The directory that this file was fetched for. This is useful for multi-directory
+    # updates, where a set of files that are related to each other are updated together.
+    sig { returns(T.nilable(String)) }
+    attr_accessor :job_directory
+
     class ContentEncoding
       UTF_8 = "utf-8"
       BASE64 = "base64"
@@ -66,14 +71,15 @@ class Mode
         content_encoding: String,
         deleted: T::Boolean,
         operation: String,
-        mode: T.nilable(String)
+        mode: T.nilable(String),
+        job_directory: T.nilable(String)
       )
         .void
     end
     def initialize(name:, content:, directory: "/", type: "file",
                    support_file: false, vendored_file: false, symlink_target: nil,
                    content_encoding: ContentEncoding::UTF_8, deleted: false,
-                   operation: Operation::UPDATE, mode: nil)
+                   operation: Operation::UPDATE, mode: nil, job_directory: nil)
       @name = name
       @content = content
       @directory = T.let(clean_directory(directory), String)
@@ -82,6 +88,7 @@ def initialize(name:, content:, directory: "/", type: "file",
       @vendored_file = vendored_file
       @content_encoding = content_encoding
       @operation = operation
+      @job_directory = job_directory
 
       # Make deleted override the operation. Deleted is kept when operation
       # was introduced to keep compatibility with downstream dependants.
@@ -120,6 +127,7 @@ def to_h
         "mode" => mode
       }
 
+      details["job_directory"] = job_directory if job_directory
       details["symlink_target"] = symlink_target if symlink_target
       details
     end

common/lib/dependabot/file_fetchers/base.rb

@@ -104,7 +104,10 @@ def target_branch
 
       sig { returns(T::Array[DependencyFile]) }
       def files
-        @files ||= T.let(fetch_files, T.nilable(T::Array[DependencyFile]))
+        @files ||= T.let(
+          fetch_files.each { |f| f.job_directory = directory },
+          T.nilable(T::Array[DependencyFile])
+        )
       end
 
       sig { abstract.returns(T::Array[DependencyFile]) }

updater/lib/dependabot/dependency_change.rb

@@ -58,7 +58,10 @@ def humanized
     end
 
     def updated_dependency_files_hash
-      updated_dependency_files.map(&:to_h)
+      files = updated_dependency_files.map(&:to_h)
+      # incidental to the job, no need to send to the server
+      files.each { |f| f.delete("job_directory") }
+      files
     end
 
     def grouped_update?

updater/lib/dependabot/updater/dependency_group_change_batch.rb

@@ -27,11 +27,10 @@ def initialize(initial_dependency_files:)
       def current_dependency_files(job)
         directory = Pathname.new(job.source.directory).cleanpath.to_s
 
-        # GitHub Actions adds a special case where root directory scans the .github/workflows folder
-        directory = "/.github/workflows" if job.package_manager == "github_actions" && directory == "/"
+        @dependency_file_batch.filter_map do |_path, data|
+          next data[:file] if data[:file].job_directory.nil?
 
-        @dependency_file_batch.filter_map do |path, data|
-          data[:file] if Pathname.new(path).dirname.to_s == directory
+          data[:file] if Pathname.new(data[:file].job_directory).cleanpath.to_s == directory
         end
       end
 

updater/spec/dependabot/updater/dependency_group_change_batch_spec.rb

@@ -11,11 +11,15 @@
   describe "current_dependency_files" do
     let(:files) do
       [
-        Dependabot::DependencyFile.new(name: "Gemfile", content: "mock-gemfile", directory: "/"),
-        Dependabot::DependencyFile.new(name: "Gemfile.lock", content: "mock-gemfile-lock", directory: "/hello/.."),
-        Dependabot::DependencyFile.new(name: "Gemfile", content: "mock-package-json", directory: "/elsewhere"),
-        Dependabot::DependencyFile.new(name: "Gemfile", content: "mock-package-json", directory: "unknown"),
-        Dependabot::DependencyFile.new(name: "Gemfile", content: "mock-package-json", directory: "../../oob")
+        Dependabot::DependencyFile.new(name: "Gemfile", content: "mock-gemfile", directory: "/", job_directory: "/"),
+        Dependabot::DependencyFile.new(name: "Gemfile.lock", content: "mock-gemfile-lock", directory: "/hello/..",
+                                       job_directory: "/"),
+        Dependabot::DependencyFile.new(name: "Gemfile", content: "mock-package-json", directory: "/elsewhere",
+                                       job_directory: "/other"),
+        Dependabot::DependencyFile.new(name: "Gemfile", content: "mock-package-json", directory: "unknown",
+                                       job_directory: "/hello"),
+        Dependabot::DependencyFile.new(name: "Gemfile", content: "mock-package-json", directory: "../../oob",
+                                       job_directory: "/oob")
       ]
     end
 
@@ -53,21 +57,5 @@
           .current_dependency_files(job).map(&:name)).to eq(%w(Gemfile Gemfile.lock))
       end
     end
-
-    context "when the package manager is github-actions" do
-      let(:package_manager) { "github_actions" }
-      let(:files) do
-        [
-          Dependabot::DependencyFile.new(name: "workflow.yml", content: "mock-workflow",
-                                         directory: "/.github/workflows"),
-          Dependabot::DependencyFile.new(name: "common.yml", content: "mock-gemfile-lock", directory: "/reusable")
-        ]
-      end
-
-      it "returns the current dependency files filtered by directory" do
-        expect(described_class.new(initial_dependency_files: files)
-                              .current_dependency_files(job).map(&:name)).to eq(%w(workflow.yml))
-      end
-    end
   end
 end