added sending bundler v1 deprecation warning alert (#10485)

updater/lib/dependabot/api_client.rb

@@ -102,8 +102,11 @@ def close_pull_request(dependency_names, reason)
     sig { params(error_type: T.any(String, Symbol), error_details: T.nilable(T::Hash[T.untyped, T.untyped])).void }
     def record_update_job_error(error_type:, error_details:)
       ::Dependabot::OpenTelemetry.tracer.in_span("record_update_job_error", kind: :internal) do |_span|
-        ::Dependabot::OpenTelemetry.record_update_job_error(job_id: job_id, error_type: error_type,
-                                                            error_details: error_details)
+        ::Dependabot::OpenTelemetry.record_update_job_error(
+          job_id: job_id,
+          error_type: error_type,
+          error_details: error_details
+        )
         api_url = "#{base_url}/update_jobs/#{job_id}/record_update_job_error"
         body = {
           data: {
@@ -123,6 +126,41 @@ def record_update_job_error(error_type:, error_details:)
       end
     end
 
+    sig do
+      params(
+        warn_type: T.any(String, Symbol),
+        warn_title: String,
+        warn_description: String
+      ).void
+    end
+    def record_update_job_warning(warn_type:, warn_title:, warn_description:)
+      ::Dependabot::OpenTelemetry.tracer.in_span("record_update_job_message", kind: :internal) do |_span|
+        ::Dependabot::OpenTelemetry.record_update_job_warning(
+          job_id: job_id,
+          warn_type: warn_type,
+          warn_title: warn_title,
+          warn_description: warn_description
+        )
+        api_url = "#{base_url}/update_jobs/#{job_id}/record_update_job_warning"
+        body = {
+          data: {
+            "warn-type": warn_type,
+            "warn-title": warn_title,
+            "warn-description": warn_description
+          }
+        }
+        response = http_client.post(api_url, json: body)
+        raise ApiError, response.body if response.code >= 400
+      rescue HTTP::ConnectionError, OpenSSL::SSL::SSLError
+        retry_count ||= 0
+        retry_count += 1
+        raise if retry_count > 3
+
+        sleep(rand(3.0..10.0))
+        retry
+      end
+    end
+
     sig { params(error_type: T.any(Symbol, String), error_details: T.nilable(T::Hash[T.untyped, T.untyped])).void }
     def record_update_job_unknown_error(error_type:, error_details:)
       error_type = "unknown_error" if error_type.nil?

updater/lib/dependabot/opentelemetry.rb

@@ -10,6 +10,9 @@ module OpenTelemetry
 
     module Attributes
       JOB_ID = "dependabot.job.id"
+      WARN_TYPE = "dependabot.job.warn_type"
+      WARN_TITLE = "dependabot.job.warn_title"
+      WARN_DESCRIPTION = "dependabot.job.warn_description"
       ERROR_TYPE = "dependabot.job.error_type"
       ERROR_DETAILS = "dependabot.job.error_details"
       METRIC = "dependabot.metric"
@@ -89,6 +92,26 @@ def self.record_update_job_error(job_id:, error_type:, error_details:)
       current_span.add_event(error_type, attributes: attributes)
     end
 
+    sig do
+      params(
+        job_id: T.any(String, Integer),
+        warn_type: T.any(String, Symbol),
+        warn_title: String,
+        warn_description: String
+      ).void
+    end
+    def self.record_update_job_warning(job_id:, warn_type:, warn_title:, warn_description:)
+      current_span = ::OpenTelemetry::Trace.current_span
+
+      attributes = {
+        Attributes::JOB_ID => job_id,
+        Attributes::WARN_TYPE => warn_type,
+        Attributes::WARN_TITLE => warn_title,
+        Attributes::WARN_DESCRIPTION => warn_description
+      }
+      current_span.add_event(warn_type, attributes: attributes)
+    end
+
     sig do
       params(
         error: StandardError,

updater/lib/dependabot/service.rb

@@ -81,6 +81,21 @@ def record_update_job_error(error_type:, error_details:, dependency: nil)
       client.record_update_job_error(error_type: error_type, error_details: error_details)
     end
 
+    sig do
+      params(
+        warn_type: T.any(String, Symbol),
+        warn_title: String,
+        warn_description: String
+      ).void
+    end
+    def record_update_job_warning(warn_type:, warn_title:, warn_description:)
+      client.record_update_job_warning(
+        warn_type: warn_type,
+        warn_title: warn_title,
+        warn_description: warn_description
+      )
+    end
+
     sig { params(error_type: T.any(String, Symbol), error_details: T.nilable(T::Hash[T.untyped, T.untyped])).void }
     def record_update_job_unknown_error(error_type:, error_details:)
       client.record_update_job_unknown_error(error_type: error_type, error_details: error_details)

updater/lib/dependabot/updater/group_update_creation.rb

@@ -24,6 +24,7 @@ class Updater
     module GroupUpdateCreation
       extend T::Sig
       extend T::Helpers
+      include PullRequestHelpers
 
       abstract!
 
@@ -122,6 +123,10 @@ def compile_all_dependency_changes_for(group)
           return nil
         end
 
+        # Send warning alerts to the API if any warning notices are present.
+        # Note that only notices with notice.show_alert set to true will be sent.
+        record_warning_notices(notices) if notices.any?
+
         dependency_change
       ensure
         cleanup_workspace

updater/lib/dependabot/updater/operations/create_security_update_pull_request.rb

@@ -13,6 +13,7 @@ module Operations
       class CreateSecurityUpdatePullRequest
         extend T::Sig
         include SecurityUpdateHelpers
+        include PullRequestHelpers
 
         sig { params(job: Job).returns(T::Boolean) }
         def self.applies_to?(job:)
@@ -180,9 +181,14 @@ def check_and_create_pull_request(dependency)
             dependency_files: dependency_snapshot.dependency_files,
             updated_dependencies: updated_deps,
             change_source: checker.dependency,
+            # Sending notices to the pr message builder to be used in the PR message if show_in_pr is true
             notices: @notices
           )
 
+          # Send warning alerts to the API if any warning notices are present.
+          # Note that only notices with notice.show_alert set to true will be sent.
+          record_warning_notices(notices) if notices.any?
+
           create_pull_request(dependency_change)
         rescue Dependabot::AllVersionsIgnored
           Dependabot.logger.info("All updates for #{dependency.name} were ignored")

updater/lib/dependabot/updater/operations/refresh_security_update_pull_request.rb

@@ -19,6 +19,7 @@ module Operations
       class RefreshSecurityUpdatePullRequest
         extend T::Sig
         include SecurityUpdateHelpers
+        include PullRequestHelpers
 
         sig { params(job: Job).returns(T::Boolean) }
         def self.applies_to?(job:)
@@ -158,9 +159,14 @@ def check_and_update_pull_request(dependencies)
             dependency_files: dependency_snapshot.dependency_files,
             updated_dependencies: updated_deps,
             change_source: checker.dependency,
+            # Sending notices to the pr message builder to be used in the PR message if show_in_pr is true
             notices: @notices
           )
 
+          # Send warning alerts to the API if any warning notices are present.
+          # Note that only notices with notice.show_alert set to true will be sent.
+          record_warning_notices(notices) if notices.any?
+
           # NOTE: Gradle, Maven and Nuget dependency names can be case-insensitive
           # and the dependency name in the security advisory often doesn't match
           # what users have specified in their manifest.

updater/lib/dependabot/updater/operations/refresh_version_update_pull_request.rb

@@ -16,6 +16,7 @@ class Updater
     module Operations
       class RefreshVersionUpdatePullRequest
         extend T::Sig
+        include PullRequestHelpers
 
         sig { params(job: Dependabot::Job).returns(T::Boolean) }
         def self.applies_to?(job:)
@@ -146,9 +147,14 @@ def check_and_update_pull_request(dependencies)
             dependency_files: dependency_snapshot.dependency_files,
             updated_dependencies: updated_deps,
             change_source: checker.dependency,
+            # Sending notices to the pr message builder to be used in the PR message if show_in_pr is true
             notices: @notices
           )
 
+          # Send warning alerts to the API if any warning notices are present.
+          # Note that only notices with notice.show_alert set to true will be sent.
+          record_warning_notices(notices) if notices.any?
+
           # NOTE: Gradle, Maven and Nuget dependency names can be case-insensitive
           # and the dependency name in the security advisory often doesn't match
           # what users have specified in their manifest.

updater/lib/dependabot/updater/operations/update_all_versions.rb

@@ -12,6 +12,7 @@ class Updater
     module Operations
       class UpdateAllVersions
         extend T::Sig
+        include PullRequestHelpers
 
         sig { params(_job: Dependabot::Job).returns(T::Boolean) }
         def self.applies_to?(_job:)
@@ -167,13 +168,18 @@ def check_and_create_pull_request(dependency)
             dependency_files: dependency_snapshot.dependency_files,
             updated_dependencies: updated_deps,
             change_source: checker.dependency,
+            # Sending notices to the pr message builder to be used in the PR message if show_in_pr is true
             notices: @notices
           )
 
           if dependency_change.updated_dependency_files.empty?
             raise "UpdateChecker found viable dependencies to be updated, but FileUpdater failed to update any files"
           end
 
+          # Send warning alerts to the API if any warning notices are present.
+          # Note that only notices with notice.show_alert set to true will be sent.
+          record_warning_notices(notices) if notices.any?
+
           create_pull_request(dependency_change)
         end
         # rubocop:enable Metrics/PerceivedComplexity

updater/lib/dependabot/updater/security_update_helpers.rb

@@ -181,5 +181,52 @@ def security_update_not_possible_message(checker, latest_allowed_version, confli
         end
       end
     end
+
+    module PullRequestHelpers
+      extend T::Sig
+      extend T::Helpers
+
+      sig { returns(Dependabot::Service) }
+      attr_reader :service
+
+      abstract!
+
+      sig { params(notices: T.nilable(T::Array[Dependabot::Notice])).void }
+      def record_warning_notices(notices)
+        return if !notices || notices.empty?
+
+        # Find unique warning notices which are going to be shown on insight page.
+        warn_notices = unique_warn_notices(notices)
+
+        warn_notices.each do |notice|
+          # If alert is enabled, sending the deprecation notice to the service for showing on the UI insight page
+          send_alert_notice(notice) if notice.show_alert
+        end
+        rescue StandardError => e
+          Dependabot.logger.error(
+            "Failed to send notice warning: #{e.message}"
+          )
+      end
+
+      private
+
+      # Resurns unique warning notices which are going to be shown on insight page.
+      sig { params(notices: T::Array[Dependabot::Notice]).returns(T::Array[Dependabot::Notice]) }
+      def unique_warn_notices(notices)
+        notices
+          .select { |notice| notice.mode == Dependabot::Notice::NoticeMode::WARN }
+          .uniq { |notice| [notice.type, notice.package_manager_name] }
+      end
+
+      sig { params(notice: Dependabot::Notice).void }
+      def send_alert_notice(notice)
+        # Sending the notice to the service for showing on the dependabot insight page
+        service.record_update_job_warning(
+          warn_type: notice.type,
+          warn_title: notice.title,
+          warn_description: notice.description
+        )
+      end
+    end
   end
 end

updater/spec/dependabot/api_client_spec.rb

@@ -379,6 +379,47 @@
     end
   end
 
+  describe "record_update_job_warning" do
+    let(:record_update_job_warning_url) { "http://example.com/update_jobs/1/record_update_job_warning" }
+
+    let(:warn_type) { "test_warning_type" }
+    let(:warn_title) { "Test Warning Title" }
+    let(:warn_description) { "Test Warning Description" }
+
+    before do
+      stub_request(:post, record_update_job_warning_url)
+        .to_return(status: 204, headers: headers)
+    end
+
+    it "hits the correct endpoint" do
+      client.record_update_job_warning(
+        warn_type: warn_type,
+        warn_title: warn_title,
+        warn_description: warn_description
+      )
+
+      expect(WebMock)
+        .to have_requested(:post, record_update_job_warning_url)
+        .with(headers: { "Authorization" => "token" })
+    end
+
+    it "encodes the payload correctly" do
+      client.record_update_job_warning(
+        warn_type: warn_type,
+        warn_title: warn_title,
+        warn_description: warn_description
+      )
+
+      expect(WebMock).to(have_requested(:post, record_update_job_warning_url).with do |req|
+        data = JSON.parse(req.body)["data"]
+
+        expect(data["warn-type"]).to eq(warn_type)
+        expect(data["warn-title"]).to eq(warn_title)
+        expect(data["warn-description"]).to eq(warn_description)
+      end)
+    end
+  end
+
   describe "mark_job_as_processed" do
     let(:url) { "http://example.com/update_jobs/1/mark_as_processed" }
     let(:base_commit) { "sha" }

updater/spec/dependabot/service_spec.rb

@@ -23,7 +23,8 @@
       update_pull_request: nil,
       close_pull_request: nil,
       record_update_job_error: nil,
-      record_update_job_unknown_error: nil
+      record_update_job_unknown_error: nil,
+      record_update_job_warning: nil
     })
     allow(api_client).to receive(:is_a?).with(Dependabot::ApiClient).and_return(true)
     api_client
@@ -305,6 +306,28 @@
     end
   end
 
+  describe "#record_update_job_warning" do
+    let(:warn_type) { :deprecated_dependency }
+    let(:warn_title) { "Deprecated Dependency Used" }
+    let(:warn_description) { "The dependency xyz is deprecated and should be updated or removed." }
+
+    before do
+      service.record_update_job_warning(
+        warn_type: warn_type,
+        warn_title: warn_title,
+        warn_description: warn_description
+      )
+    end
+
+    it "delegates to @client" do
+      expect(mock_client).to have_received(:record_update_job_warning).with(
+        warn_type: warn_type,
+        warn_title: warn_title,
+        warn_description: warn_description
+      )
+    end
+  end
+
   describe "#capture_exception" do
     before do
       allow(Dependabot::Experiments).to receive(:enabled?).with(:record_update_job_unknown_error).and_return(true)