Prevent unnecessary downloads of library packages - just update the j…

…son/lock files

composer/helpers/v2/src/LibraryInstaller.php

@@ -0,0 +1,27 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Dependabot\Composer;
+
+use Composer\Installer\BinaryPresenceInterface;
+use Composer\Installer\NoopInstaller;
+use Composer\Package\PackageInterface;
+
+class LibraryInstaller extends NoopInstaller implements BinaryPresenceInterface
+{
+    /**
+     * {@inheritDoc}
+     */
+    public function supports($packageType)
+    {
+        return $packageType === 'library';
+    }
+
+    /**
+     * {@inheritDoc}
+     */
+    public function ensureBinariesPresence(PackageInterface $package): void
+    {
+    }
+}

composer/helpers/v2/src/UpdateChecker.php

@@ -53,7 +53,7 @@ public static function getLatestResolvableVersion(array $args): ?string
         $fs = new Filesystem(null);
         $binaryInstaller = new Installer\BinaryInstaller($io, rtrim($composer->getConfig()->get('bin-dir'), '/'), $composer->getConfig()->get('bin-compat'), $fs);
 
-        $installationManager->addInstaller(new Installer\LibraryInstaller($io, $composer, null, $fs, $binaryInstaller));
+        $installationManager->addInstaller(new LibraryInstaller());
         $installationManager->addInstaller(new Installer\PluginInstaller($io, $composer, $fs, $binaryInstaller));
         $installationManager->addInstaller(new Installer\MetapackageInstaller($io));
 

composer/helpers/v2/src/Updater.php

@@ -7,6 +7,7 @@
 use Composer\DependencyResolver\Request;
 use Composer\Factory;
 use Composer\Installer;
+use Composer\Util\Filesystem;
 
 final class Updater
 {
@@ -62,14 +63,23 @@ public static function update(array $args): array
             $io->loadConfiguration($config);
         }
 
+        $installationManager = new DependabotInstallationManager($composer->getLoop(), $io);
+
+        $fs = new Filesystem(null);
+        $binaryInstaller = new Installer\BinaryInstaller($io, rtrim($composer->getConfig()->get('bin-dir'), '/'), $composer->getConfig()->get('bin-compat'), $fs);
+
+        $installationManager->addInstaller(new LibraryInstaller());
+        $installationManager->addInstaller(new Installer\PluginInstaller($io, $composer, $fs, $binaryInstaller));
+        $installationManager->addInstaller(new Installer\MetapackageInstaller($io));
+
         $install = new Installer(
             $io,
             $config,
             $composer->getPackage(), // @phpstan-ignore-line
             $composer->getDownloadManager(),
             $composer->getRepositoryManager(),
             $composer->getLocker(),
-            $composer->getInstallationManager(),
+            $installationManager,
             $composer->getEventDispatcher(),
             $composer->getAutoloadGenerator()
         );

composer/spec/dependabot/composer/file_updater/lockfile_updater_spec.rb

@@ -311,37 +311,8 @@
       let(:project_name) { "env_variable" }
 
       context "that hasn't been provided" do
-        it "raises a MissingEnvironmentVariable error" do
-          expect { updated_lockfile_content }.to raise_error do |error|
-            expect(error).to be_a(Dependabot::MissingEnvironmentVariable)
-            expect(error.message).to eq("Missing environment variable ACF_PRO_KEY")
-          end
-        end
-      end
-
-      context "that has been provided" do
-        let(:updater) do
-          described_class.new(
-            dependency_files: files,
-            dependencies: [dependency],
-            credentials: [{
-              "type" => "git_source",
-              "host" => "github.com",
-              "username" => "x-access-token",
-              "password" => "token"
-            }, {
-              "type" => "php_environment_variable",
-              "env-key" => "ACF_PRO_KEY",
-              "env-value" => "example_key"
-            }]
-          )
-        end
-
-        it "runs just fine (we get a 404 here because our key is wrong)" do
-          expect { updated_lockfile_content }.to raise_error do |error|
-            expect(error).to be_a(Dependabot::DependencyFileNotResolvable)
-            expect(error.message).to include("404")
-          end
+        it "does not attempt to download and has details of the updated item" do
+          expect(updated_lockfile_content).to include("\"version\":\"5.9.2\"")
         end
       end
     end
@@ -544,11 +515,8 @@
           }]
         end
 
-        it "raises a helpful errors" do
-          expect { updated_lockfile_content }.to raise_error do |error|
-            expect(error).to be_a Dependabot::PrivateSourceAuthenticationFailure
-            expect(error.source).to eq("nova.laravel.com")
-          end
+        it "does not attempt to download and has details of the updated item" do
+          expect(updated_lockfile_content).to include("\"version\":\"v2.0.9\"")
         end
       end
     end
@@ -577,11 +545,8 @@
         )
       end
 
-      it "raises a helpful errors" do
-        expect { updated_lockfile_content }.to raise_error do |error|
-          expect(error).to be_a Dependabot::GitDependencyReferenceNotFound
-          expect(error.dependency).to eq("monolog/monolog")
-        end
+      it "does not attempt to install it and has details of the updated item" do
+        expect(updated_lockfile_content).to include("\"version\":\"v1.6.0\"")
       end
     end
 
@@ -609,12 +574,8 @@
         )
       end
 
-      it "raises a helpful errors" do
-        expect { updated_lockfile_content }.to raise_error do |error|
-          expect(error).to be_a Dependabot::GitDependencyReferenceNotFound
-          expect(error.dependency).
-            to eq("monolog/monolog")
-        end
+      it "does not attempt to install it and has details of the updated item" do
+        expect(updated_lockfile_content).to include("\"version\":\"v1.6.0\"")
       end
     end