Pushing changes in progress for git-lfs support adding to entire ecosystem.

common/lib/dependabot/file_fetchers/base.rb

@@ -861,19 +861,35 @@ def decode_binary_string(str)
 
       sig { params(path: String).returns(T::Array[String]) }
       def find_submodules(path)
-        SharedHelpers.run_shell_command(
-          <<~CMD
-            git -C #{path} ls-files --stage
-          CMD
-        ).split("\n").filter_map do |line|
+        lfsEnabled = true
+        commandString = getCommandString(path,lfsEnabled)
+        /debugger
+        p commandString/
+        SharedHelpers.run_shell_command(commandString
+         ).split("\n").filter_map do |line|
           info = line.split
 
           type = info.first
           path = T.must(info.last)
-
+debugger
           next path if type == DependencyFile::Mode::SUBMODULE
         end
       end
+
+      def getCommandString(path,lfsEnabled)
+	      #the HEREDOC command will see any stray spaces.
+        return "git -C #{path} ls-files --stage" unless lfsEnabled
+        Dependabot.logger.warn("LFS is enabled in this repo.  Please use an LFS enabled client")
+        commandString = "CWD=\"#{__dir__}\";cd #{path};git-lfs ls-files --stage;cd $CWD"
+#        return "\"CWD=`pwd`;cd #{path};#git-lfs ls-files --stage;cd $CWD\""
+        return commandString
+      end
+
+      def getGitCommand(lfsEnabled)
+        return "git" unless !!lfsEnabled
+        Dependabot.logger.warn("LFS is enabled in this repo.  Please use an LFS enabled client")
+        return "git-lfs"
+      end
     end
   end
 end

common/spec/dependabot/file_fetchers/base_spec.rb

@@ -302,6 +302,42 @@ def fetch_files
     before do
       allow(file_fetcher_instance).to receive(:commit).and_return("sha")
     end
+    #start of lfs testing
+  context "with data stored in git-lfs" do
+#	  debugger
+#    let(:source) do
+#      Dependabot::Source.new(
+#        provider: "github",
+#        repo: repo,
+#        directory: directory
+#      )
+#    end
+    let(:url) { "https://api.github.com/repos/dependabot-fixtures/dependabot-yarn-lfs-fixture/contents/" }
+    let(:repo) { "dependabot-fixtures/dependabot-yarn-lfs-fixture" }
+    let(:repo_contents_path) { Dir.mktmpdir }
+    after { FileUtils.rm_rf(repo_contents_path) }
+
+    let(:file_fetcher_instance) do
+      described_class.new(source: source, credentials: credentials, repo_contents_path: repo_contents_path)
+    end
+
+    it "pulls files from lfs after cloning" do
+      # Calling #files triggers the clone
+      expect(file_fetcher_instance.files.map(&:name)).to contain_exactly("package.json", "yarn.lock", ".yarnrc.yml")
+      expect(
+        File.read(
+          File.join(repo_contents_path, ".yarn", "releases", "yarn-3.2.4.cjs")
+        )
+      ).to start_with("#!/usr/bin/env node")
+
+      # LFS files not needed by dependabot are not pulled
+      expect(
+        File.read(
+          File.join(repo_contents_path, ".pnp.cjs")
+        )
+      ).to start_with("version https://git-lfs.github.com/spec/v1")
+    end
+  end
 
     context "with a GitHub source" do
       its(:length) { is_expected.to eq(1) }