Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Report gradle security update errors when dependency not found in repository #7878

Merged
merged 2 commits into from
Aug 23, 2023
Merged

Report gradle security update errors when dependency not found in repository #7878

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
dd54c89
Be explicit that this is a security update
deivid-rodriguez Aug 23, 2023
7c7afb7
Record a specific error for security updates on missing dependencies
deivid-rodriguez Aug 23, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 9 additions & 2 deletions updater/lib/dependabot/updater/operations/create_security_update_pull_request.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,8 +40,15 @@ def initialize(service:, job:, dependency_snapshot:, error_handler:)
# risk, so we'll maintain the interface as-is for now, but this is
# something we should make much more intentional in future.
def perform
Dependabot.logger.info("Starting update job for #{job.source.repo}")
dependency_snapshot.job_dependencies.each { |dep| check_and_create_pr_with_error_handling(dep) }
Dependabot.logger.info("Starting security update job for #{job.source.repo}")

target_dependencies = dependency_snapshot.job_dependencies

if target_dependencies.empty?
record_security_update_dependency_not_found
else
target_dependencies.each { |dep| check_and_create_pr_with_error_handling(dep) }
end
end

private
Expand Down
7 changes: 7 additions & 0 deletions updater/lib/dependabot/updater/security_update_helpers.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -120,6 +120,13 @@ def record_pull_request_exists_for_security_update(existing_pull_request)
)
end

def record_security_update_dependency_not_found
service.record_update_job_error(
error_type: "security_update_dependency_not_found",
error_details: {}
)
end

def earliest_fixed_version_message(lowest_non_vulnerable_version)
if lowest_non_vulnerable_version
"The earliest fixed version is #{lowest_non_vulnerable_version}."
Expand Down