Address Copilot review: validate parsed JSON shape, pre-register experiments

- Validate parsed response is a Hash before calling fetch on it
- Add test for non-object JSON body (e.g. bare array)
- Pre-register experiments from job definition before the blocked_versions gate
- Add test verifying experiment flag works when set via job definition

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: kbukum1

updater/lib/dependabot/api_client.rb

@@ -403,6 +403,10 @@ def fetch_blocked_versions(package_manager)
         end
 
         parsed = JSON.parse(response.body)
+        unless parsed.is_a?(Hash)
+          Dependabot.logger.warn("Unexpected blocked versions format, continuing without them")
+          return []
+        end
         data = parsed.fetch("data", [])
         unless data.is_a?(Array)
           Dependabot.logger.warn("Unexpected blocked versions format, continuing without them")

updater/lib/dependabot/update_files_command.rb

@@ -73,6 +73,12 @@ def job
           definition = JSON.parse(JSON.generate(Environment.job_definition))
           job_hash = definition["job"]
 
+          # Register experiments from the job definition early so experiment
+          # gates below can read flags that arrive via the job payload.
+          (job_hash["experiments"] || {}).each do |name, value|
+            Experiments.register(name, value)
+          end
+
           # Fetch blocked versions from the API if the experiment is enabled.
           # Inject them into the job definition so they're available at construction time.
           if Experiments.enabled?(:dependabot_blocked_versions)

updater/spec/dependabot/api_client_spec.rb

@@ -907,5 +907,19 @@
         expect(result).to eq([])
       end
     end
+
+    context "when the API returns a non-object JSON body" do
+      before do
+        stub_request(:get, blocked_versions_url)
+          .with(query: { "package-manager": "npm_and_yarn" })
+          .to_return(status: 200, body: "[]", headers: headers)
+      end
+
+      it "returns an empty array and logs a warning" do
+        expect(Dependabot.logger).to receive(:warn).with(/Unexpected blocked versions format/)
+        result = client.fetch_blocked_versions("npm_and_yarn")
+        expect(result).to eq([])
+      end
+    end
   end
 end

updater/spec/dependabot/update_files_command_spec.rb

@@ -472,6 +472,34 @@
       expect(job_instance.blocked_versions).to eq(blocked_versions)
     end
 
+    context "when the experiment is enabled via the job definition" do
+      let(:job_definition) do
+        definition = JSON.parse(fixture("jobs/job_without_credentials.json"))
+        definition["job"]["experiments"] = { "dependabot_blocked_versions" => true }
+        definition
+      end
+
+      before do
+        Dependabot::Experiments.reset!
+        allow(service).to receive(:fetch_blocked_versions).and_return(blocked_versions)
+      end
+
+      it "reads the experiment flag from the job definition and fetches blocked versions" do
+        dummy_runner = double(run: nil)
+        allow(Dependabot::Updater).to receive(:new).and_return(dummy_runner)
+        allow(dummy_runner).to receive(:run)
+        allow(service).to receive(:mark_job_as_processed)
+        allow(service).to receive(:update_dependency_list)
+
+        expect(service).to receive(:fetch_blocked_versions).with("bundler")
+
+        perform_job
+
+        job_instance = job.send(:job)
+        expect(job_instance.blocked_versions).to eq(blocked_versions)
+      end
+    end
+
     context "when the API returns no blocked versions" do
       let(:blocked_versions) { [] }