github_actions_models/dependabot/
v2.rs

1//! "v2" Dependabot models.
2//!
3//! Resources:
4//! * [Configuration options for the `dependabot.yml` file](https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file)
5//! * [JSON Schema for Dependabot v2](https://json.schemastore.org/dependabot-2.0.json)
6
7use indexmap::{IndexMap, IndexSet};
8use serde::Deserialize;
9
10use crate::common::custom_error;
11
12/// A `dependabot.yml` configuration file.
13#[derive(Deserialize, Debug)]
14#[serde(rename_all = "kebab-case")]
15pub struct Dependabot {
16    /// Invariant: `2`
17    pub version: u64,
18    #[serde(default)]
19    pub enable_beta_ecosystems: bool,
20    #[serde(default)]
21    pub multi_ecosystem_groups: IndexMap<String, MultiEcosystemGroup>,
22    #[serde(default)]
23    pub registries: IndexMap<String, Registry>,
24    pub updates: Vec<Update>,
25}
26
27/// A multi-ecosystem update group.
28#[derive(Deserialize, Debug)]
29#[serde(rename_all = "kebab-case")]
30pub struct MultiEcosystemGroup {
31    pub schedule: Schedule,
32    #[serde(default = "default_labels")]
33    pub labels: IndexSet<String>,
34    pub milestone: Option<u64>,
35    #[serde(default)]
36    pub assignees: IndexSet<String>,
37    pub target_branch: Option<String>,
38    pub commit_message: Option<CommitMessage>,
39    pub pull_request_branch_name: Option<PullRequestBranchName>,
40}
41
42/// Different registries known to Dependabot.
43#[derive(Deserialize, Debug)]
44#[serde(rename_all = "kebab-case", tag = "type")]
45pub enum Registry {
46    ComposerRepository {
47        url: String,
48        username: Option<String>,
49        password: Option<String>,
50    },
51    DockerRegistry {
52        url: String,
53        username: Option<String>,
54        password: Option<String>,
55        #[serde(default)]
56        replaces_base: bool,
57    },
58    Git {
59        url: String,
60        username: Option<String>,
61        password: Option<String>,
62    },
63    HexOrganization {
64        organization: String,
65        key: Option<String>,
66    },
67    HexRepository {
68        repo: Option<String>,
69        url: String,
70        auth_key: Option<String>,
71        public_key_fingerprint: Option<String>,
72    },
73    MavenRepository {
74        url: String,
75        username: Option<String>,
76        password: Option<String>,
77    },
78    NpmRegistry {
79        url: String,
80        username: Option<String>,
81        password: Option<String>,
82        #[serde(default)]
83        replaces_base: bool,
84    },
85    NugetFeed {
86        url: String,
87        username: Option<String>,
88        password: Option<String>,
89    },
90    PythonIndex {
91        url: String,
92        username: Option<String>,
93        password: Option<String>,
94        #[serde(default)]
95        replaces_base: bool,
96    },
97    RubygemsServer {
98        url: String,
99        username: Option<String>,
100        password: Option<String>,
101        #[serde(default)]
102        replaces_base: bool,
103    },
104    TerraformRegistry {
105        url: String,
106        token: Option<String>,
107    },
108}
109
110/// Cooldown settings for Dependabot updates.
111#[derive(Deserialize, Debug)]
112#[serde(rename_all = "kebab-case")]
113pub struct Cooldown {
114    pub default_days: Option<u64>,
115    pub semver_major_days: Option<u64>,
116    pub semver_minor_days: Option<u64>,
117    pub semver_patch_days: Option<u64>,
118    #[serde(default)]
119    pub include: Vec<String>,
120    #[serde(default)]
121    pub exclude: Vec<String>,
122}
123
124/// A `directory` or `directories` field in a Dependabot `update` directive.
125#[derive(Deserialize, Debug, PartialEq)]
126#[serde(rename_all = "kebab-case")]
127pub enum Directories {
128    Directory(String),
129    Directories(Vec<String>),
130}
131
132/// A single `update` directive.
133#[derive(Deserialize, Debug)]
134#[serde(rename_all = "kebab-case", remote = "Self")]
135pub struct Update {
136    /// Dependency allow rules for this update directive.
137    #[serde(default)]
138    pub allow: Vec<Allow>,
139
140    /// People to assign to this update's pull requests.
141    #[serde(default)]
142    pub assignees: IndexSet<String>,
143
144    /// Commit message settings for this update's pull requests.
145    pub commit_message: Option<CommitMessage>,
146
147    /// Cooldown settings for this update directive.
148    pub cooldown: Option<Cooldown>,
149
150    /// The directory or directories in which to look for manifests
151    /// and dependencies.
152    #[serde(flatten)]
153    pub directories: Directories,
154
155    /// Group settings for batched updates.
156    #[serde(default)]
157    pub groups: IndexMap<String, Group>,
158
159    /// Dependency ignore settings for this update directive.
160    #[serde(default)]
161    pub ignore: Vec<Ignore>,
162
163    /// Whether to allow insecure external code execution during updates.
164    #[serde(default)]
165    pub insecure_external_code_execution: AllowDeny,
166
167    /// Labels to apply to this update group's pull requests.
168    ///
169    /// The default label is `dependencies`.
170    #[serde(default = "default_labels")]
171    pub labels: IndexSet<String>,
172    pub milestone: Option<u64>,
173    /// The maximum number of pull requests to open at a time from this
174    /// update group.
175    ///
176    /// The default maximum is 5.
177    #[serde(default = "default_open_pull_requests_limit")]
178    pub open_pull_requests_limit: u64,
179
180    /// The packaging ecosystem to update.
181    pub package_ecosystem: PackageEcosystem,
182
183    /// The strategy to use when rebasing pull requests.
184    #[serde(default)]
185    pub rebase_strategy: RebaseStrategy,
186    #[serde(default, deserialize_with = "crate::common::scalar_or_vector")]
187    pub registries: Vec<String>,
188    #[serde(default)]
189    pub reviewers: IndexSet<String>,
190    pub schedule: Option<Schedule>,
191    pub target_branch: Option<String>,
192    pub pull_request_branch_name: Option<PullRequestBranchName>,
193    #[serde(default)]
194    pub vendor: bool,
195    pub versioning_strategy: Option<VersioningStrategy>,
196
197    /// If assign, this update directive is assigned to the
198    /// named multi-ecosystem group.
199    ///
200    /// See: <https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference#multi-ecosystem-group>
201    pub multi_ecosystem_group: Option<String>,
202
203    /// Required if `multi-ecosystem-group` is set.
204    /// A list of glob patterns that determine which dependencies
205    /// are assigned to this group.
206    ///
207    /// See: <https://docs.github.com/en/code-security/dependabot/working-with-dependabot/configuring-multi-ecosystem-updates#2-assign-ecosystems-to-groups-with-patterns>
208    pub patterns: Option<IndexSet<String>>,
209
210    /// Paths that Dependabot will ignore when scanning for manifests
211    /// and dependencies.
212    ///
213    /// See: <https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference#exclude-paths->
214    #[serde(default)]
215    pub exclude_paths: Option<IndexSet<String>>,
216}
217
218impl<'de> Deserialize<'de> for Update {
219    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
220    where
221        D: serde::Deserializer<'de>,
222    {
223        let update = Self::deserialize(deserializer)?;
224
225        // https://docs.github.com/en/code-security/dependabot/working-with-dependabot/configuring-multi-ecosystem-updates#2-assign-ecosystems-to-groups-with-patterns
226        if update.multi_ecosystem_group.is_some() && update.patterns.is_none() {
227            return Err(custom_error::<D>(
228                "`patterns` must be set when `multi-ecosystem-group` is set",
229            ));
230        }
231
232        // If an update uses `multi-ecosystem-group`, it must
233        // not specify its own `milestone`, `target-branch`, `commit-message`,
234        // or `pull-request-branch-name`.
235        if update.multi_ecosystem_group.is_some() {
236            if update.milestone.is_some() {
237                return Err(custom_error::<D>(
238                    "`milestone` may not be set when `multi-ecosystem-group` is set",
239                ));
240            }
241            if update.target_branch.is_some() {
242                return Err(custom_error::<D>(
243                    "`target-branch` may not be set when `multi-ecosystem-group` is set",
244                ));
245            }
246            if update.commit_message.is_some() {
247                return Err(custom_error::<D>(
248                    "`commit-message` may not be set when `multi-ecosystem-group` is set",
249                ));
250            }
251            if update.pull_request_branch_name.is_some() {
252                return Err(custom_error::<D>(
253                    "`pull-request-branch-name` may not be set when `multi-ecosystem-group` is set",
254                ));
255            }
256        }
257
258        Ok(update)
259    }
260}
261
262#[inline]
263fn default_labels() -> IndexSet<String> {
264    IndexSet::from(["dependencies".to_string()])
265}
266
267#[inline]
268fn default_open_pull_requests_limit() -> u64 {
269    // https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#open-pull-requests-limit
270    5
271}
272
273/// Allow rules for Dependabot updates.
274#[derive(Deserialize, Debug)]
275#[serde(rename_all = "kebab-case")]
276pub struct Allow {
277    pub dependency_name: Option<String>,
278    pub dependency_type: Option<DependencyType>,
279}
280
281/// Dependency types in `allow` rules.
282#[derive(Deserialize, Debug)]
283#[serde(rename_all = "kebab-case")]
284pub enum DependencyType {
285    Direct,
286    Indirect,
287    All,
288    Production,
289    Development,
290}
291
292/// Commit message settings for Dependabot updates.
293#[derive(Deserialize, Debug)]
294#[serde(rename_all = "kebab-case")]
295pub struct CommitMessage {
296    pub prefix: Option<String>,
297    pub prefix_development: Option<String>,
298    /// Invariant: `"scope"`
299    pub include: Option<String>,
300}
301
302/// Group settings for batched updates.
303#[derive(Deserialize, Debug)]
304#[serde(rename_all = "kebab-case")]
305pub struct Group {
306    /// This can only be [`DependencyType::Development`] or
307    /// [`DependencyType::Production`].
308    pub dependency_type: Option<DependencyType>,
309    #[serde(default)]
310    pub patterns: IndexSet<String>,
311    #[serde(default)]
312    pub exclude_patterns: IndexSet<String>,
313    #[serde(default)]
314    pub update_types: IndexSet<UpdateType>,
315}
316
317/// Update types for grouping.
318#[derive(Deserialize, Debug, Hash, Eq, PartialEq)]
319#[serde(rename_all = "kebab-case")]
320pub enum UpdateType {
321    Major,
322    Minor,
323    Patch,
324}
325
326/// Dependency ignore settings for updates.
327#[derive(Deserialize, Debug)]
328#[serde(rename_all = "kebab-case")]
329pub struct Ignore {
330    pub dependency_name: Option<String>,
331    /// These are, inexplicably, not [`UpdateType`] variants.
332    /// Instead, they're strings like `"version-update:semver-{major,minor,patch}"`.
333    #[serde(default)]
334    pub update_types: IndexSet<String>,
335    #[serde(default)]
336    pub versions: IndexSet<String>,
337}
338
339/// An "allow"/"deny" toggle.
340#[derive(Deserialize, Debug, Default)]
341#[serde(rename_all = "kebab-case")]
342pub enum AllowDeny {
343    Allow,
344    #[default]
345    Deny,
346}
347
348/// Supported packaging ecosystems.
349#[derive(Deserialize, Debug, PartialEq)]
350#[serde(rename_all = "kebab-case")]
351pub enum PackageEcosystem {
352    /// `bazel`
353    Bazel,
354    /// `bun`
355    Bun,
356    /// `bundler`
357    Bundler,
358    /// `cargo`
359    Cargo,
360    /// `composer`
361    Composer,
362    /// `conda`
363    Conda,
364    /// `devcontainers`
365    Devcontainers,
366    /// `docker`
367    Docker,
368    /// `docker-compose`
369    DockerCompose,
370    /// `dotnet-sdk`
371    DotnetSdk,
372    /// `helm`
373    Helm,
374    /// `julia`
375    Julia,
376    /// `elm`
377    Elm,
378    /// `gitsubmodule`
379    Gitsubmodule,
380    /// `github-actions`
381    GithubActions,
382    /// `gomod`
383    Gomod,
384    /// `gradle`
385    Gradle,
386    /// `maven`
387    Maven,
388    /// `mix`
389    Mix,
390    /// `nix`
391    Nix,
392    /// `npm`
393    Npm,
394    /// `nuget`
395    Nuget,
396    /// `opentofu`
397    Opentofu,
398    /// `pip`
399    Pip,
400    /// `pre-commit`
401    PreCommit,
402    /// `pub`
403    Pub,
404    /// `rust-toolchain`
405    RustToolchain,
406    /// `swift`
407    Swift,
408    /// `terraform`
409    Terraform,
410    /// `uv`
411    Uv,
412    /// `vcpkg`
413    Vcpkg,
414}
415
416/// Rebase strategies for Dependabot updates.
417#[derive(Deserialize, Debug, Default, PartialEq)]
418#[serde(rename_all = "kebab-case")]
419pub enum RebaseStrategy {
420    #[default]
421    Auto,
422    Disabled,
423}
424
425/// Scheduling settings for Dependabot updates.
426#[derive(Deserialize, Debug)]
427#[serde(rename_all = "kebab-case", remote = "Self")]
428pub struct Schedule {
429    pub interval: Interval,
430    pub day: Option<Day>,
431    pub time: Option<String>,
432    pub timezone: Option<String>,
433    pub cronjob: Option<String>,
434}
435
436impl<'de> Deserialize<'de> for Schedule {
437    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
438    where
439        D: serde::Deserializer<'de>,
440    {
441        let schedule = Self::deserialize(deserializer)?;
442
443        if schedule.interval == Interval::Cron && schedule.cronjob.is_none() {
444            return Err(custom_error::<D>(
445                "`schedule.cronjob` must be set when `schedule.interval` is `cron`",
446            ));
447        }
448
449        if schedule.interval != Interval::Cron && schedule.cronjob.is_some() {
450            return Err(custom_error::<D>(
451                "`schedule.cronjob` may only be set when `schedule.interval` is `cron`",
452            ));
453        }
454
455        // NOTE(ww): `day` only makes sense with `interval: weekly`, but
456        // Dependabot appears to silently ignore it otherwise. Consequently,
457        // we don't check that for now.
458        // See https://github.com/zizmorcore/zizmor/issues/1305.
459
460        Ok(schedule)
461    }
462}
463
464/// Schedule intervals.
465#[derive(Deserialize, Debug, PartialEq)]
466#[serde(rename_all = "kebab-case")]
467pub enum Interval {
468    Daily,
469    Weekly,
470    Monthly,
471    Quarterly,
472    Semiannually,
473    Yearly,
474    Cron,
475}
476
477/// Days of the week.
478#[derive(Deserialize, Debug, PartialEq)]
479#[serde(rename_all = "kebab-case")]
480pub enum Day {
481    Monday,
482    Tuesday,
483    Wednesday,
484    Thursday,
485    Friday,
486    Saturday,
487    Sunday,
488}
489
490/// Pull request branch name settings.
491#[derive(Deserialize, Debug)]
492#[serde(rename_all = "kebab-case")]
493pub struct PullRequestBranchName {
494    pub separator: Option<String>,
495}
496
497/// Versioning strategies.
498#[derive(Deserialize, Debug, PartialEq)]
499#[serde(rename_all = "kebab-case")]
500pub enum VersioningStrategy {
501    Auto,
502    Increase,
503    IncreaseIfNecessary,
504    LockfileOnly,
505    Widen,
506}
github_actions_models/dependabot/v2.rs

github_actions_models/dependabot/
v2.rs
