Support for security-only updates in TaskV2

[rhyskoedijk]

This change adds support for "security-only" updates in TaskV2.

Security-only updates (i.e. open-pull-requests-limit: 0) incur a performance overhead due to limitations in Dependabot CLI (#360). To work around this, vulnerable dependencies will first be discovered using an "ignore everything" update job; After which, security advisories for the discovered dependencies will be checked against the GitHub Advisory Database before finally performing the requested security-only update job. Because of these required extra steps, the task will take longer to complete than usual.

This is the only way I can think of to reasonably implement this feature without making changes to dependabot-core and dependabot-cli.

High-level sequence diagram of security-only update process

 sequenceDiagram
    participant ext as TaskV2
    participant cli as Dependabot CLI
    participant gha as GitHub Advisory Database

    ext->>ext: Write `list-dependencies-job.yml`
    Note right of ext: The job file contains `ignore: [ 'dependency-name': '*' ]`.<br>This will make Dependabot to discover all dependencies, but not update anything.<br>We can then extract the dependency list from the "depenedency_list" output.
    ext->>+cli: Execute `dependabot update -f list-dependencies-job.yml -o output.yml`
    cli->>cli: Run update job
    cli->>cli: Write `output.yaml`
    cli-->>-ext: Update completed

    ext->>ext: Read and parse `output.yaml`, extract "dependency_list"
    loop for each dependency
      ext->>gha: Check security advisories for dependency
    end
    ext->>ext: Filter dependency list to only ones containing security advisories
    ext->>ext: Write `security-only-update-job.yml`
    Note right of ext: The job file contains the list of `dependency-names` and `security-advisories`.<br>This will make Dependanbot only update the dependencies named in the job file.
    ext->>+cli: Execute `dependabot update -f security-only-update-job-job.yml -o output.yml`
    cli->>cli: Run update job
    cli->>cli: Write `output.yaml`
    cli-->>-ext: Update completed
    ext->>ext: Read and parse `output.yaml`
    Note right of ext: Normal update logic resumes from this point.<br/>Outputs are parsed, pull requests are created/updated/closed based on the outputs

Loading