nuget: fix PR missing commits in message when using private registry

nuget/lib/dependabot/nuget/metadata_finder.rb

@@ -12,7 +12,51 @@ class MetadataFinder < Dependabot::MetadataFinders::Base
       def look_up_source
         return Source.from_url(dependency_source_url) if dependency_source_url
 
-        look_up_source_in_nuspec(dependency_nuspec_file)
+        src_repo = look_up_source_in_nuspec(dependency_nuspec_file)
+        return src_repo if src_repo
+
+        src_repo_from_project
+      end
+
+      def src_repo_from_project
+        source = dependency.requirements.find { |r| r&.fetch(:source) }&.fetch(:source)
+        return unless source
+
+        response = Excon.get(
+          source.fetch(:url), # e.g. https://nuget.pkg.github.com/ORG/index.json
+          idempotent: true,
+          **SharedHelpers.excon_defaults(headers: auth_header)
+        )
+        return unless response.status == 200
+
+        # Extract the query url e.g. https://nuget.pkg.github.com/ORG/query
+        search_base = JSON.parse(response.body).
+          fetch("resources", []).
+          find { |r| r.fetch("@type") == "SearchQueryService" }&.
+          fetch("@id")
+        return unless search_base
+
+        # Query for the package
+        response = Excon.get(
+          search_base + "?q=#{dependency.name.downcase}&prerelease=true&semVerLevel=2.0.0",
+          idempotent: true,
+          **SharedHelpers.excon_defaults(headers: auth_header)
+        )
+        return unless response.status == 200
+
+        # Find a projectUrl or licenseUrl that look like a source URL
+        JSON.parse(response.body).fetch("data", []).each do |searchResult|
+          next unless searchResult["id"].downcase == dependency.name.downcase
+
+          if searchResult.fetch("projectUrl")
+            source = Source.from_url(searchResult.fetch("projectUrl"))
+            return source unless source.repo.nil?
+          end
+          if searchResult.fetch("licenseUrl")
+            source = Source.from_url(searchResult.fetch("licenseUrl"))
+            return source unless source.repo.nil?
+          end
+        end
       end
 
       def look_up_source_in_nuspec(nuspec)