Skip to content

Commit 5ea07d9

Browse files
vamshi-stepsecurityvamshi-stepsecurity
authored
Merge pull request step-security#2600 from vamshi-stepsecurity/feat/dpb-full-ecosys-options
add all options
2 parents 8bbb83d + 5be693a commit 5ea07d9

26 files changed

Lines changed: 2358 additions & 724 deletions

‎remediation/dependabot/dependabotconfig.go‎

Lines changed: 129 additions & 724 deletions
Large diffs are not rendered by default.

‎remediation/dependabot/dependabotconfig_test.go‎

Lines changed: 281 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,13 @@ import (
66
"log"
77
"path"
88
"testing"
9+
10+
dependabotconfig "github.com/paulvollmer/dependabot-config-go"
911
)
1012

13+
func intPtr(i int) *int { return &i }
14+
func boolPtr(b bool) *bool { return &b }
15+
1116
func TestConfigDependabotFile(t *testing.T) {
1217

1318
const inputDirectory = "../../testfiles/dependabotfiles/input"
@@ -301,6 +306,80 @@ func TestAdditiveCoolDown(t *testing.T) {
301306
},
302307
isChanged: true,
303308
},
309+
{
310+
// Additive — add github-actions with all library fields (assignees, reviewers,
311+
// labels, milestone, commit-message, allow, ignore, etc.) to a config that
312+
// already has npm. Comments, blank lines, and registries block preserved.
313+
inputFileName: "additive-library-fields.yml",
314+
outputFileName: "additive-library-fields.yml",
315+
ecosystems: []Ecosystem{
316+
{
317+
PackageEcosystem: "github-actions",
318+
Directory: "/",
319+
Interval: "weekly",
320+
Assignees: []string{"ci-bot"},
321+
Reviewers: []string{"platform-team"},
322+
Labels: []string{"ci", "github-actions"},
323+
Milestone: intPtr(2),
324+
OpenPullRequestsLimit: intPtr(3),
325+
CommitMessage: &dependabotconfig.CommitMessage{
326+
Prefix: "[CI]",
327+
Include: "scope",
328+
},
329+
RebaseStrategy: "auto",
330+
VersioningStrategy: "increase",
331+
TargetBranch: "main",
332+
PullRequestBranchName: &dependabotconfig.PullRequestBranchName{Separator: "/"},
333+
Allow: []dependabotconfig.Allow{{DependencyName: "actions/*"}},
334+
Ignore: []dependabotconfig.Ignore{{DependencyName: "actions/checkout", Versions: []string{">= 5"}}},
335+
},
336+
},
337+
isChanged: true,
338+
},
339+
{
340+
// Additive — add npm with all extended fields (registries, exclude-paths,
341+
// vendor, insecure-external-code-execution, multi-ecosystem-group,
342+
// enable-beta-ecosystems, cooldown) to a config that already has pip.
343+
// Comments, blank lines, and registries block preserved.
344+
inputFileName: "additive-extended-fields.yml",
345+
outputFileName: "additive-extended-fields.yml",
346+
ecosystems: []Ecosystem{
347+
{
348+
PackageEcosystem: "npm",
349+
Directory: "/frontend",
350+
Interval: "daily",
351+
Registries: []string{"github-npm"},
352+
ExcludePaths: []string{"node_modules/*", ".cache/*"},
353+
Vendor: boolPtr(false),
354+
InsecureExternalCodeExecution: "deny",
355+
MultiEcosystemGroup: "frontend-deps",
356+
EnableBetaEcosystems: boolPtr(true),
357+
CoolDown: &CoolDown{DefaultDays: 5, SemverMajorDays: 14},
358+
},
359+
},
360+
isChanged: true,
361+
},
362+
{
363+
// Additive — add github-actions with directories (plural), labels, groups,
364+
// and open-pull-requests-limit to a monorepo config that already has npm
365+
// with directories. Comments, blank lines, and registries block preserved.
366+
inputFileName: "additive-directories.yml",
367+
outputFileName: "additive-directories.yml",
368+
ecosystems: []Ecosystem{
369+
{
370+
PackageEcosystem: "github-actions",
371+
Directory: "/",
372+
Interval: "weekly",
373+
Directories: []string{"/", "/.github"},
374+
Labels: []string{"ci"},
375+
OpenPullRequestsLimit: intPtr(5),
376+
Groups: map[string]Group{
377+
"actions": {Patterns: []string{"actions/*"}},
378+
},
379+
},
380+
},
381+
isChanged: true,
382+
},
304383
}
305384

306385
for _, test := range tests {
@@ -750,6 +829,208 @@ func TestUpdateSubtractiveFields(t *testing.T) {
750829
},
751830
isChanged: true,
752831
},
832+
{
833+
// Subtractive — update all library-supported fields: scalars (interval,
834+
// rebase-strategy, target-branch, versioning-strategy, milestone,
835+
// open-pull-requests-limit), string lists (assignees, reviewers, labels),
836+
// commit-message sub-fields, pull-request-branch-name separator,
837+
// schedule sub-fields (day, time, timezone), and object lists (allow, ignore).
838+
fileName: "subtractive-library-fields.yml",
839+
ecosystems: []Ecosystem{
840+
{
841+
PackageEcosystem: "npm",
842+
Directory: "/",
843+
Interval: "weekly",
844+
Day: "friday",
845+
Time: "14:00",
846+
Timezone: "Europe/London",
847+
Allow: []dependabotconfig.Allow{
848+
{DependencyName: "react"},
849+
{DependencyName: "angular", DependencyType: "development"},
850+
},
851+
Assignees: []string{"user3", "user4", "user5"},
852+
CommitMessage: &dependabotconfig.CommitMessage{
853+
Prefix: "chore",
854+
PrefixDevelopment: "build",
855+
},
856+
Ignore: []dependabotconfig.Ignore{
857+
{DependencyName: "jquery", Versions: []string{"3.x"}},
858+
},
859+
Labels: []string{"deps", "automated"},
860+
Milestone: intPtr(10),
861+
OpenPullRequestsLimit: intPtr(5),
862+
PullRequestBranchName: &dependabotconfig.PullRequestBranchName{Separator: "-"},
863+
RebaseStrategy: "disabled",
864+
Reviewers: []string{"lead-dev"},
865+
TargetBranch: "main",
866+
VersioningStrategy: "lockfile-only",
867+
},
868+
},
869+
isChanged: true,
870+
},
871+
{
872+
// Subtractive — add new library-supported fields to a minimal config
873+
// that only has package-ecosystem, directory, and schedule.interval.
874+
fileName: "subtractive-add-library-fields.yml",
875+
ecosystems: []Ecosystem{
876+
{
877+
PackageEcosystem: "npm",
878+
Directory: "/",
879+
RebaseStrategy: "auto",
880+
TargetBranch: "develop",
881+
VersioningStrategy: "increase",
882+
Milestone: intPtr(3),
883+
OpenPullRequestsLimit: intPtr(7),
884+
Assignees: []string{"dev1", "dev2"},
885+
Reviewers: []string{"lead"},
886+
Labels: []string{"deps"},
887+
CommitMessage: &dependabotconfig.CommitMessage{Prefix: "deps"},
888+
PullRequestBranchName: &dependabotconfig.PullRequestBranchName{Separator: "/"},
889+
Allow: []dependabotconfig.Allow{{DependencyName: "lodash"}},
890+
Ignore: []dependabotconfig.Ignore{{DependencyName: "webpack", Versions: []string{"5.x"}}},
891+
},
892+
},
893+
isChanged: true,
894+
},
895+
{
896+
// Subtractive — add schedule sub-fields (day, time, timezone) to a
897+
// config that only has schedule.interval.
898+
fileName: "subtractive-schedule-subfields.yml",
899+
ecosystems: []Ecosystem{
900+
{
901+
PackageEcosystem: "npm",
902+
Directory: "/",
903+
Day: "wednesday",
904+
Time: "10:00",
905+
Timezone: "Asia/Kolkata",
906+
},
907+
},
908+
isChanged: true,
909+
},
910+
{
911+
// Test updating all 6 ExtendedUpdate-only fields in-place.
912+
fileName: "subtractive-extended-fields.yml",
913+
ecosystems: []Ecosystem{
914+
{
915+
PackageEcosystem: "npm",
916+
Directory: "/",
917+
Registries: []string{"npm-private", "github-registry"},
918+
ExcludePaths: []string{"dist/*", "build/*"},
919+
Vendor: boolPtr(false),
920+
InsecureExternalCodeExecution: "deny",
921+
MultiEcosystemGroup: "updated-group",
922+
EnableBetaEcosystems: boolPtr(true),
923+
},
924+
},
925+
isChanged: true,
926+
},
927+
{
928+
// Test adding all 6 ExtendedUpdate-only fields to a minimal config.
929+
fileName: "subtractive-add-extended-fields.yml",
930+
ecosystems: []Ecosystem{
931+
{
932+
PackageEcosystem: "npm",
933+
Directory: "/",
934+
Registries: []string{"npm-private", "github-registry"},
935+
ExcludePaths: []string{"dist/*", "build/*"},
936+
Vendor: boolPtr(false),
937+
InsecureExternalCodeExecution: "deny",
938+
MultiEcosystemGroup: "updated-group",
939+
EnableBetaEcosystems: boolPtr(true),
940+
},
941+
},
942+
isChanged: true,
943+
},
944+
{
945+
// Realistic multi-ecosystem config: updates 3 existing ecosystems
946+
// (bundler, docker, github-actions) with a mix of scalar, list, block,
947+
// and boolean field changes, and adds a brand-new npm ecosystem.
948+
// Verifies comments, blank lines, and top-level registries are preserved.
949+
fileName: "subtractive-complex-multi-ecosystem.yml",
950+
ecosystems: []Ecosystem{
951+
{
952+
PackageEcosystem: "bundler",
953+
Directory: "/manager",
954+
Interval: "weekly",
955+
Day: "monday",
956+
CoolDown: &CoolDown{
957+
DefaultDays: 3,
958+
SemverMajorDays: 14,
959+
SemverMinorDays: 5,
960+
},
961+
InsecureExternalCodeExecution: "deny",
962+
Labels: []string{"dependabot-gem-upgrade", "security"},
963+
OpenPullRequestsLimit: intPtr(0),
964+
CommitMessage: &dependabotconfig.CommitMessage{
965+
Prefix: "[DEPS] ",
966+
Include: "scope",
967+
},
968+
TargetBranch: "develop",
969+
Vendor: boolPtr(true),
970+
},
971+
{
972+
PackageEcosystem: "docker",
973+
Directory: "/.github",
974+
Interval: "weekly",
975+
Assignees: []string{"infra-team", "devops-lead"},
976+
Reviewers: []string{"platform-team"},
977+
OpenPullRequestsLimit: intPtr(3),
978+
RebaseStrategy: "auto",
979+
},
980+
{
981+
PackageEcosystem: "github-actions",
982+
Directory: "/",
983+
OpenPullRequestsLimit: intPtr(5),
984+
CommitMessage: &dependabotconfig.CommitMessage{
985+
Prefix: "[CI] ",
986+
Include: "scope",
987+
},
988+
TargetBranch: "main",
989+
Ignore: []dependabotconfig.Ignore{
990+
{DependencyName: "actions/checkout", Versions: []string{">= 5"}},
991+
},
992+
},
993+
{
994+
PackageEcosystem: "npm",
995+
Directory: "/frontend",
996+
Interval: "weekly",
997+
Labels: []string{"dependabot-npm-upgrade"},
998+
OpenPullRequestsLimit: intPtr(5),
999+
CommitMessage: &dependabotconfig.CommitMessage{
1000+
Prefix: "[DEPS] ",
1001+
Include: "scope",
1002+
},
1003+
Ignore: []dependabotconfig.Ignore{
1004+
{DependencyName: "typescript", Versions: []string{"5.x"}},
1005+
},
1006+
},
1007+
},
1008+
isChanged: true,
1009+
},
1010+
{
1011+
// Subtractive — update an existing directories list (plural).
1012+
fileName: "subtractive-directories-update.yml",
1013+
ecosystems: []Ecosystem{
1014+
{
1015+
PackageEcosystem: "npm",
1016+
Directory: "/frontend",
1017+
Directories: []string{"/frontend", "/backend", "/shared"},
1018+
},
1019+
},
1020+
isChanged: true,
1021+
},
1022+
{
1023+
// Subtractive — add directories to a config that only has directory (singular).
1024+
fileName: "subtractive-directories-add.yml",
1025+
ecosystems: []Ecosystem{
1026+
{
1027+
PackageEcosystem: "npm",
1028+
Directory: "/",
1029+
Directories: []string{"/frontend", "/backend"},
1030+
},
1031+
},
1032+
isChanged: true,
1033+
},
7531034
}
7541035

7551036
for _, test := range tests {

0 commit comments

Comments
 (0)