Skip to content

Commit 32f37b9

Browse files
varunsh-codervarunsh-coder
authored
Merge pull request #2586 from vamshi-stepsecurity/cp/vk/dependabot-preserve-formatting
cherry pick: preserve formatting
2 parents a67b8ba + 24fd3c5 commit 32f37b9

13 files changed

Lines changed: 1315 additions & 113 deletions

‎remediation/dependabot/dependabotconfig.go‎

Lines changed: 547 additions & 106 deletions
Large diffs are not rendered by default.

‎remediation/dependabot/dependabotconfig_test.go‎

Lines changed: 133 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -159,6 +159,22 @@ func TestGroups(t *testing.T) {
159159
subtractive: true,
160160
isChanged: true,
161161
},
162+
{
163+
// Additive (non-subtractive) — complex real-world file with registries, comments, labels, etc.;
164+
// adding a new npm ecosystem preserves original content exactly and appends the new entry.
165+
inputFileName: "complex-multi-ecosystem.yml",
166+
outputFileName: "complex-multi-ecosystem-additive.yml",
167+
ecosystems: []Ecosystem{
168+
{
169+
PackageEcosystem: "npm",
170+
Directory: "/frontend",
171+
Interval: "daily",
172+
CoolDown: &CoolDown{DefaultDays: 7, SemverMajorDays: 30},
173+
},
174+
},
175+
subtractive: false,
176+
isChanged: true,
177+
},
162178
{
163179
// Additive (non-subtractive) — ecosystem already exists, groups not applied, output unchanged.
164180
inputFileName: "group-prs-modify-patterns-only.yml",
@@ -291,6 +307,103 @@ func TestUpdateSubtractiveFields(t *testing.T) {
291307
},
292308
isChanged: true,
293309
},
310+
{
311+
// Subtractive — input uses flow sequence syntax patterns: ["*"];
312+
// verifies that flow style is preserved when patterns are updated and
313+
// cooldown is added.
314+
fileName: "flow-sequence-syntax.yml",
315+
ecosystems: []Ecosystem{
316+
{
317+
PackageEcosystem: "npm",
318+
Directory: "/",
319+
Interval: "weekly",
320+
CoolDown: &CoolDown{DefaultDays: 5},
321+
Groups: map[string]Group{
322+
"all": {Patterns: []string{"lodash", "axios"}},
323+
},
324+
},
325+
{
326+
PackageEcosystem: "pip",
327+
Directory: "/backend",
328+
Groups: map[string]Group{
329+
"all": {Patterns: []string{"requests", "flask"}},
330+
},
331+
},
332+
},
333+
isChanged: true,
334+
},
335+
{
336+
// Subtractive — rich file with registries, comments, cooldown (semver + include/exclude),
337+
// and groups with multiple slice fields. Updates npm cooldown semver days, replaces
338+
// include/exclude lists, updates group patterns/exclude-patterns/update-types,
339+
// and adds a new group. Verifies comments, registries, labels are all preserved.
340+
fileName: "subtractive-rich-update.yml",
341+
ecosystems: []Ecosystem{
342+
{
343+
PackageEcosystem: "npm",
344+
Directory: "/",
345+
Interval: "weekly",
346+
CoolDown: &CoolDown{
347+
SemverMajorDays: 30,
348+
SemverMinorDays: 14,
349+
SemverPatchDays: 7,
350+
Include: []string{"lodash", "axios", "react"},
351+
Exclude: []string{"express", "webpack"},
352+
},
353+
Groups: map[string]Group{
354+
"production": {
355+
Patterns: []string{"react", "react-dom", "redux"},
356+
ExcludePatterns: []string{"lodash", "axios"},
357+
UpdateTypes: []string{"minor", "patch"},
358+
},
359+
"dev-tools": {
360+
Patterns: []string{"jest", "eslint", "prettier"},
361+
UpdateTypes: []string{"minor", "patch"},
362+
},
363+
"new-group": {
364+
AppliesTo: "version-updates",
365+
DependencyType: "production",
366+
Patterns: []string{"typescript", "ts-node"},
367+
},
368+
},
369+
},
370+
},
371+
isChanged: true,
372+
},
373+
{
374+
// Subtractive — complex file with bundler, docker, github-actions;
375+
// update bundler cooldown and interval, and github-actions interval + add cooldown + group.
376+
// Docker entry is untouched.
377+
fileName: "complex-multi-ecosystem.yml",
378+
ecosystems: []Ecosystem{
379+
{
380+
PackageEcosystem: "bundler",
381+
Directory: "/manager",
382+
Interval: "weekly",
383+
CoolDown: &CoolDown{
384+
DefaultDays: 3,
385+
SemverMajorDays: 14,
386+
SemverPatchDays: 2,
387+
},
388+
Groups: map[string]Group{
389+
"rubocop": {Patterns: []string{"rubocop", "rubocop-rspec", "rubocop-rails", "rubocop-performance", "rubocop-minitest"}},
390+
},
391+
},
392+
{
393+
PackageEcosystem: "github-actions",
394+
Directory: "/",
395+
Interval: "monthly",
396+
CoolDown: &CoolDown{
397+
DefaultDays: 14,
398+
SemverMajorDays: 60,
399+
},
400+
Groups: map[string]Group{
401+
"actions": {Patterns: []string{"*"}},
402+
},
403+
},
404+
},
405+
isChanged: true,
406+
},
294407
{
295408
fileName: "subtractive-modify-interval-and-major.yml",
296409
ecosystems: []Ecosystem{
@@ -360,6 +473,26 @@ func TestUpdateSubtractiveFields(t *testing.T) {
360473
},
361474
isChanged: true,
362475
},
476+
{
477+
// Subtractive — cooldown fields appear in non-standard order (jumbled);
478+
// verifies that values are updated at the correct lines regardless of field order.
479+
fileName: "subtractive-jumbled-cooldown.yml",
480+
ecosystems: []Ecosystem{
481+
{
482+
PackageEcosystem: "npm",
483+
Directory: "/",
484+
Interval: "weekly",
485+
CoolDown: &CoolDown{
486+
SemverMajorDays: 30,
487+
SemverMinorDays: 14,
488+
SemverPatchDays: 7,
489+
Include: []string{"lodash", "axios", "react"},
490+
Exclude: []string{"express", "webpack"},
491+
},
492+
},
493+
},
494+
isChanged: true,
495+
},
363496
}
364497

365498
for _, test := range tests {

‎testfiles/dependabotfiles/input/complex-multi-ecosystem.yml‎

Lines changed: 128 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,128 @@
1+
version: 2
2+
3+
registries:
4+
artifactory:
5+
type: rubygems-server
6+
url: https://artifactory.example.com/api/gems/rubygems/
7+
replaces-base: true
8+
username: "xxx"
9+
password: "xxx"
10+
11+
# For submodules and private gems
12+
github:
13+
type: git
14+
url: https://github.com
15+
username: x-access-token
16+
password: ${{ secrets.GH_API_TOKEN }}
17+
18+
updates:
19+
# Ruby/Bundler dependencies
20+
- package-ecosystem: bundler
21+
directory: /manager/
22+
schedule:
23+
interval: daily
24+
# How long to wait before updating a package
25+
cooldown:
26+
default-days: 5
27+
semver-major-days: 30
28+
semver-minor-days: 7
29+
# Required for private gem resolution
30+
insecure-external-code-execution: allow
31+
registries:
32+
- artifactory
33+
- github
34+
labels:
35+
- dependabot-gem-upgrade
36+
open-pull-requests-limit: 2
37+
commit-message:
38+
prefix: "[PROJ-1234] "
39+
include: scope
40+
# Update only gems listed in Gemfile
41+
allow:
42+
- dependency-type: direct
43+
# Group gems that release together as part of the same project
44+
groups:
45+
# RSpec ecosystem - all RSpec gems coordinate releases
46+
rspec:
47+
patterns:
48+
- rspec
49+
- rspec-rails
50+
- rspec-mocks
51+
- rspec-its
52+
- rspec-collection_matchers
53+
- rspec_junit_formatter
54+
- rspec-retry
55+
# RuboCop ecosystem - RuboCop and its official extensions
56+
rubocop:
57+
patterns:
58+
- rubocop
59+
- rubocop-rspec
60+
- rubocop-rails
61+
- rubocop-performance
62+
# SimpleCov ecosystem - code coverage reporting
63+
simplecov:
64+
patterns:
65+
- simplecov
66+
- simplecov-cobertura
67+
- simplecov-console
68+
- simplecov-rcov
69+
# Pry ecosystem - Pry debugger and its extensions
70+
pry:
71+
patterns:
72+
- pry
73+
- pry-rails
74+
- pry-byebug
75+
- pry-doc
76+
# Ruby stdlib networking gems - released together with Ruby
77+
ruby-net:
78+
patterns:
79+
- net-ssh
80+
- net-scp
81+
- net-smtp
82+
- net-ftp
83+
- net-pop
84+
- net-imap
85+
ignore:
86+
# Rails major and minor upgrades should be updated manually
87+
- dependency-name: rails
88+
update-types:
89+
- version-update:semver-major
90+
- version-update:semver-minor
91+
# Internal dependency managed separately
92+
- dependency-name: net-ldap
93+
update-types:
94+
- version-update:semver-major
95+
- version-update:semver-minor
96+
- version-update:semver-patch
97+
# Maintained by our team
98+
- dependency-name: rubyntlm
99+
update-types:
100+
- version-update:semver-major
101+
- version-update:semver-minor
102+
- version-update:semver-patch
103+
104+
# Docker dependencies
105+
- package-ecosystem: docker
106+
directory: /.github
107+
schedule:
108+
interval: daily
109+
labels:
110+
- dependabot-docker-upgrade
111+
open-pull-requests-limit: 2
112+
commit-message:
113+
prefix: "[PROJ-1234] "
114+
include: scope
115+
116+
# GitHub Actions dependencies
117+
- package-ecosystem: github-actions
118+
directory: /
119+
schedule:
120+
interval: daily
121+
registries:
122+
- github
123+
labels:
124+
- dependabot-gh-actions-upgrade
125+
open-pull-requests-limit: 2
126+
commit-message:
127+
prefix: "[PROJ-1234] "
128+
include: scope

‎testfiles/dependabotfiles/input/flow-sequence-syntax.yml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
version: 2
2+
3+
updates:
4+
- package-ecosystem: npm
5+
directory: /
6+
schedule:
7+
interval: daily
8+
groups:
9+
all:
10+
applies-to: version-updates
11+
patterns: ["*"]
12+
13+
- package-ecosystem: pip
14+
directory: /backend
15+
schedule:
16+
interval: weekly
17+
groups:
18+
all:
19+
patterns:
20+
- "*"

‎testfiles/dependabotfiles/input/subtractive-jumbled-cooldown.yml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: npm
4+
directory: /
5+
schedule:
6+
interval: daily
7+
cooldown:
8+
semver-patch-days: 2
9+
semver-major-days: 10
10+
default-days: 3
11+
exclude:
12+
- express
13+
semver-minor-days: 5
14+
include:
15+
- lodash
16+
- axios

‎testfiles/dependabotfiles/input/subtractive-rich-update.yml‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
version: 2
2+
3+
registries:
4+
artifactory:
5+
type: npm-registry
6+
url: https://artifactory.example.com/api/npm/npm/
7+
token: ${{ secrets.ARTIFACTORY_TOKEN }}
8+
replaces-base: true
9+
10+
updates:
11+
# npm dependencies
12+
- package-ecosystem: npm
13+
directory: /
14+
schedule:
15+
interval: daily
16+
# Cooldown to avoid too many PRs
17+
cooldown:
18+
default-days: 3
19+
semver-major-days: 10
20+
semver-minor-days: 5
21+
semver-patch-days: 2
22+
include:
23+
- lodash
24+
- axios
25+
exclude:
26+
- express
27+
registries:
28+
- artifactory
29+
labels:
30+
- dependencies
31+
# Group related packages together
32+
groups:
33+
# Production dependencies
34+
production:
35+
applies-to: version-updates
36+
dependency-type: production
37+
patterns:
38+
- react
39+
- react-dom
40+
exclude-patterns:
41+
- lodash
42+
update-types:
43+
- minor
44+
- patch
45+
# Dev tools
46+
dev-tools:
47+
applies-to: version-updates
48+
dependency-type: development
49+
patterns:
50+
- jest
51+
- eslint
52+
update-types:
53+
- patch
54+
55+
# pip dependencies
56+
- package-ecosystem: pip
57+
directory: /backend
58+
schedule:
59+
interval: weekly
60+
labels:
61+
- python-deps
62+
63+
# GitHub Actions
64+
- package-ecosystem: github-actions
65+
directory: /
66+
schedule:
67+
interval: weekly
68+
labels:
69+
- ci

0 commit comments

Comments
 (0)