Skip to content

Commit ec74a28

Browse files
vamshi-stepsecurityvamshi-stepsecurity
committed
resolve merge conflict
2 parents 29c7900 + 5ea07d9 commit ec74a28

26 files changed

Lines changed: 2360 additions & 725 deletions

‎remediation/dependabot/dependabotconfig.go‎

Lines changed: 131 additions & 725 deletions
Large diffs are not rendered by default.

‎remediation/dependabot/dependabotconfig_test.go‎

Lines changed: 281 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,13 @@ import (
66
"log"
77
"path"
88
"testing"
9+
10+
dependabotconfig "github.com/paulvollmer/dependabot-config-go"
911
)
1012

13+
func intPtr(i int) *int { return &i }
14+
func boolPtr(b bool) *bool { return &b }
15+
1116
func TestConfigDependabotFile(t *testing.T) {
1217

1318
const inputDirectory = "../../testfiles/dependabotfiles/input"
@@ -322,6 +327,80 @@ func TestAdditiveCoolDown(t *testing.T) {
322327
},
323328
isChanged: true,
324329
},
330+
{
331+
// Additive — add github-actions with all library fields (assignees, reviewers,
332+
// labels, milestone, commit-message, allow, ignore, etc.) to a config that
333+
// already has npm. Comments, blank lines, and registries block preserved.
334+
inputFileName: "additive-library-fields.yml",
335+
outputFileName: "additive-library-fields.yml",
336+
ecosystems: []Ecosystem{
337+
{
338+
PackageEcosystem: "github-actions",
339+
Directory: "/",
340+
Interval: "weekly",
341+
Assignees: []string{"ci-bot"},
342+
Reviewers: []string{"platform-team"},
343+
Labels: []string{"ci", "github-actions"},
344+
Milestone: intPtr(2),
345+
OpenPullRequestsLimit: intPtr(3),
346+
CommitMessage: &dependabotconfig.CommitMessage{
347+
Prefix: "[CI]",
348+
Include: "scope",
349+
},
350+
RebaseStrategy: "auto",
351+
VersioningStrategy: "increase",
352+
TargetBranch: "main",
353+
PullRequestBranchName: &dependabotconfig.PullRequestBranchName{Separator: "/"},
354+
Allow: []dependabotconfig.Allow{{DependencyName: "actions/*"}},
355+
Ignore: []dependabotconfig.Ignore{{DependencyName: "actions/checkout", Versions: []string{">= 5"}}},
356+
},
357+
},
358+
isChanged: true,
359+
},
360+
{
361+
// Additive — add npm with all extended fields (registries, exclude-paths,
362+
// vendor, insecure-external-code-execution, multi-ecosystem-group,
363+
// enable-beta-ecosystems, cooldown) to a config that already has pip.
364+
// Comments, blank lines, and registries block preserved.
365+
inputFileName: "additive-extended-fields.yml",
366+
outputFileName: "additive-extended-fields.yml",
367+
ecosystems: []Ecosystem{
368+
{
369+
PackageEcosystem: "npm",
370+
Directory: "/frontend",
371+
Interval: "daily",
372+
Registries: []string{"github-npm"},
373+
ExcludePaths: []string{"node_modules/*", ".cache/*"},
374+
Vendor: boolPtr(false),
375+
InsecureExternalCodeExecution: "deny",
376+
MultiEcosystemGroup: "frontend-deps",
377+
EnableBetaEcosystems: boolPtr(true),
378+
CoolDown: &CoolDown{DefaultDays: 5, SemverMajorDays: 14},
379+
},
380+
},
381+
isChanged: true,
382+
},
383+
{
384+
// Additive — add github-actions with directories (plural), labels, groups,
385+
// and open-pull-requests-limit to a monorepo config that already has npm
386+
// with directories. Comments, blank lines, and registries block preserved.
387+
inputFileName: "additive-directories.yml",
388+
outputFileName: "additive-directories.yml",
389+
ecosystems: []Ecosystem{
390+
{
391+
PackageEcosystem: "github-actions",
392+
Directory: "/",
393+
Interval: "weekly",
394+
Directories: []string{"/", "/.github"},
395+
Labels: []string{"ci"},
396+
OpenPullRequestsLimit: intPtr(5),
397+
Groups: map[string]Group{
398+
"actions": {Patterns: []string{"actions/*"}},
399+
},
400+
},
401+
},
402+
isChanged: true,
403+
},
325404
}
326405

327406
for _, test := range tests {
@@ -789,6 +868,208 @@ func TestUpdateSubtractiveFields(t *testing.T) {
789868
},
790869
isChanged: true,
791870
},
871+
{
872+
// Subtractive — update all library-supported fields: scalars (interval,
873+
// rebase-strategy, target-branch, versioning-strategy, milestone,
874+
// open-pull-requests-limit), string lists (assignees, reviewers, labels),
875+
// commit-message sub-fields, pull-request-branch-name separator,
876+
// schedule sub-fields (day, time, timezone), and object lists (allow, ignore).
877+
fileName: "subtractive-library-fields.yml",
878+
ecosystems: []Ecosystem{
879+
{
880+
PackageEcosystem: "npm",
881+
Directory: "/",
882+
Interval: "weekly",
883+
Day: "friday",
884+
Time: "14:00",
885+
Timezone: "Europe/London",
886+
Allow: []dependabotconfig.Allow{
887+
{DependencyName: "react"},
888+
{DependencyName: "angular", DependencyType: "development"},
889+
},
890+
Assignees: []string{"user3", "user4", "user5"},
891+
CommitMessage: &dependabotconfig.CommitMessage{
892+
Prefix: "chore",
893+
PrefixDevelopment: "build",
894+
},
895+
Ignore: []dependabotconfig.Ignore{
896+
{DependencyName: "jquery", Versions: []string{"3.x"}},
897+
},
898+
Labels: []string{"deps", "automated"},
899+
Milestone: intPtr(10),
900+
OpenPullRequestsLimit: intPtr(5),
901+
PullRequestBranchName: &dependabotconfig.PullRequestBranchName{Separator: "-"},
902+
RebaseStrategy: "disabled",
903+
Reviewers: []string{"lead-dev"},
904+
TargetBranch: "main",
905+
VersioningStrategy: "lockfile-only",
906+
},
907+
},
908+
isChanged: true,
909+
},
910+
{
911+
// Subtractive — add new library-supported fields to a minimal config
912+
// that only has package-ecosystem, directory, and schedule.interval.
913+
fileName: "subtractive-add-library-fields.yml",
914+
ecosystems: []Ecosystem{
915+
{
916+
PackageEcosystem: "npm",
917+
Directory: "/",
918+
RebaseStrategy: "auto",
919+
TargetBranch: "develop",
920+
VersioningStrategy: "increase",
921+
Milestone: intPtr(3),
922+
OpenPullRequestsLimit: intPtr(7),
923+
Assignees: []string{"dev1", "dev2"},
924+
Reviewers: []string{"lead"},
925+
Labels: []string{"deps"},
926+
CommitMessage: &dependabotconfig.CommitMessage{Prefix: "deps"},
927+
PullRequestBranchName: &dependabotconfig.PullRequestBranchName{Separator: "/"},
928+
Allow: []dependabotconfig.Allow{{DependencyName: "lodash"}},
929+
Ignore: []dependabotconfig.Ignore{{DependencyName: "webpack", Versions: []string{"5.x"}}},
930+
},
931+
},
932+
isChanged: true,
933+
},
934+
{
935+
// Subtractive — add schedule sub-fields (day, time, timezone) to a
936+
// config that only has schedule.interval.
937+
fileName: "subtractive-schedule-subfields.yml",
938+
ecosystems: []Ecosystem{
939+
{
940+
PackageEcosystem: "npm",
941+
Directory: "/",
942+
Day: "wednesday",
943+
Time: "10:00",
944+
Timezone: "Asia/Kolkata",
945+
},
946+
},
947+
isChanged: true,
948+
},
949+
{
950+
// Test updating all 6 ExtendedUpdate-only fields in-place.
951+
fileName: "subtractive-extended-fields.yml",
952+
ecosystems: []Ecosystem{
953+
{
954+
PackageEcosystem: "npm",
955+
Directory: "/",
956+
Registries: []string{"npm-private", "github-registry"},
957+
ExcludePaths: []string{"dist/*", "build/*"},
958+
Vendor: boolPtr(false),
959+
InsecureExternalCodeExecution: "deny",
960+
MultiEcosystemGroup: "updated-group",
961+
EnableBetaEcosystems: boolPtr(true),
962+
},
963+
},
964+
isChanged: true,
965+
},
966+
{
967+
// Test adding all 6 ExtendedUpdate-only fields to a minimal config.
968+
fileName: "subtractive-add-extended-fields.yml",
969+
ecosystems: []Ecosystem{
970+
{
971+
PackageEcosystem: "npm",
972+
Directory: "/",
973+
Registries: []string{"npm-private", "github-registry"},
974+
ExcludePaths: []string{"dist/*", "build/*"},
975+
Vendor: boolPtr(false),
976+
InsecureExternalCodeExecution: "deny",
977+
MultiEcosystemGroup: "updated-group",
978+
EnableBetaEcosystems: boolPtr(true),
979+
},
980+
},
981+
isChanged: true,
982+
},
983+
{
984+
// Realistic multi-ecosystem config: updates 3 existing ecosystems
985+
// (bundler, docker, github-actions) with a mix of scalar, list, block,
986+
// and boolean field changes, and adds a brand-new npm ecosystem.
987+
// Verifies comments, blank lines, and top-level registries are preserved.
988+
fileName: "subtractive-complex-multi-ecosystem.yml",
989+
ecosystems: []Ecosystem{
990+
{
991+
PackageEcosystem: "bundler",
992+
Directory: "/manager",
993+
Interval: "weekly",
994+
Day: "monday",
995+
CoolDown: &CoolDown{
996+
DefaultDays: 3,
997+
SemverMajorDays: 14,
998+
SemverMinorDays: 5,
999+
},
1000+
InsecureExternalCodeExecution: "deny",
1001+
Labels: []string{"dependabot-gem-upgrade", "security"},
1002+
OpenPullRequestsLimit: intPtr(0),
1003+
CommitMessage: &dependabotconfig.CommitMessage{
1004+
Prefix: "[DEPS] ",
1005+
Include: "scope",
1006+
},
1007+
TargetBranch: "develop",
1008+
Vendor: boolPtr(true),
1009+
},
1010+
{
1011+
PackageEcosystem: "docker",
1012+
Directory: "/.github",
1013+
Interval: "weekly",
1014+
Assignees: []string{"infra-team", "devops-lead"},
1015+
Reviewers: []string{"platform-team"},
1016+
OpenPullRequestsLimit: intPtr(3),
1017+
RebaseStrategy: "auto",
1018+
},
1019+
{
1020+
PackageEcosystem: "github-actions",
1021+
Directory: "/",
1022+
OpenPullRequestsLimit: intPtr(5),
1023+
CommitMessage: &dependabotconfig.CommitMessage{
1024+
Prefix: "[CI] ",
1025+
Include: "scope",
1026+
},
1027+
TargetBranch: "main",
1028+
Ignore: []dependabotconfig.Ignore{
1029+
{DependencyName: "actions/checkout", Versions: []string{">= 5"}},
1030+
},
1031+
},
1032+
{
1033+
PackageEcosystem: "npm",
1034+
Directory: "/frontend",
1035+
Interval: "weekly",
1036+
Labels: []string{"dependabot-npm-upgrade"},
1037+
OpenPullRequestsLimit: intPtr(5),
1038+
CommitMessage: &dependabotconfig.CommitMessage{
1039+
Prefix: "[DEPS] ",
1040+
Include: "scope",
1041+
},
1042+
Ignore: []dependabotconfig.Ignore{
1043+
{DependencyName: "typescript", Versions: []string{"5.x"}},
1044+
},
1045+
},
1046+
},
1047+
isChanged: true,
1048+
},
1049+
{
1050+
// Subtractive — update an existing directories list (plural).
1051+
fileName: "subtractive-directories-update.yml",
1052+
ecosystems: []Ecosystem{
1053+
{
1054+
PackageEcosystem: "npm",
1055+
Directory: "/frontend",
1056+
Directories: []string{"/frontend", "/backend", "/shared"},
1057+
},
1058+
},
1059+
isChanged: true,
1060+
},
1061+
{
1062+
// Subtractive — add directories to a config that only has directory (singular).
1063+
fileName: "subtractive-directories-add.yml",
1064+
ecosystems: []Ecosystem{
1065+
{
1066+
PackageEcosystem: "npm",
1067+
Directory: "/",
1068+
Directories: []string{"/frontend", "/backend"},
1069+
},
1070+
},
1071+
isChanged: true,
1072+
},
7921073
}
7931074

7941075
for _, test := range tests {

0 commit comments

Comments
 (0)