dependabot-common 0.95.81 → 0.95.82

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 54d26a8eefe4230ff3ea0bfaed45e832b3fcf5246dc264165e7e34a8c595c1ce
-  data.tar.gz: 942ac9d1ee81be41c8bbccfa9020fd9d92a1301cbf524a9bfd8aa66dc9b58ec3
+  metadata.gz: eb8de31607df04625bc55b3cb97f8219ad0fccef4a8c315c5649b791c4fc1b9e
+  data.tar.gz: c5cf91d1b6349880b3d9c5f1c7e32bb7a21ce2fb72d12c59f88bb333b12b991c
 SHA512:
-  metadata.gz: '0484196c2271e376d020f66e47269ce0c87e33c77ebd484cbb855e067ddfb10f752cea68b30d2cded34e4a91359e876c57aac0dfa23b871ced169c5abc0d875d'
-  data.tar.gz: 908f5d42bf28d842bda30ced2db2cf59b23ec7bc27bfd3f59e70a8de3e85d38734485400e77bfcef7e6b6acdd277431bd8a8aea2ec7c8b55530807a4f5fbfab4
+  metadata.gz: 64c8f675cda1f9cee4cf66b0be725c1955b76d841f310032d029d6cffa73ca3dce23d14d002e1581f3ebd55a1ac0b9140229d51e61a0a54cac40b63a193fb9a0
+  data.tar.gz: cfa382738bc7e01d418c33b4369f47baa9a8ed584417fd1ff6c2a15f4503157d4e99eeb9e379045bbddf70b17703d9b35e53ce25bb25006ce6fbccc23376a59a

data/lib/dependabot/metadata_finders/base/commits_finder.rb

@@ -52,7 +52,11 @@ module Dependabot
         def new_tag
           new_version = dependency.version
 
-          return new_version if git_source?(dependency.requirements)
+          if git_source?(dependency.requirements) && git_sha?(new_version)
+            return new_version
+          end
+
+          return new_ref if git_source?(dependency.requirements) && ref_changed?
 
           tags = dependency_tags.
                  select { |t| t =~ version_regex(new_version) }.
@@ -63,21 +67,28 @@ module Dependabot
 
         private
 
+        # rubocop:disable Metrics/CyclomaticComplexity
+        # rubocop:disable Metrics/PerceivedComplexity
         def previous_tag
           previous_version = dependency.previous_version
 
-          if git_source?(dependency.previous_requirements)
-            previous_version || previous_ref
+          if git_source?(dependency.previous_requirements) &&
+             git_sha?(previous_version)
+            previous_version
+          elsif git_source?(dependency.previous_requirements) && ref_changed?
+            previous_ref
           elsif previous_version
             tags = dependency_tags.
                    select { |t| t =~ version_regex(previous_version) }.
                    sort_by(&:length)
 
             tags.find { |t| t.include?(dependency.name) } || tags.first
-          else
+          elsif !git_source?(dependency.previous_requirements)
             lowest_tag_satisfying_previous_requirements
           end
         end
+        # rubocop:enable Metrics/CyclomaticComplexity
+        # rubocop:enable Metrics/PerceivedComplexity
 
         def lowest_tag_satisfying_previous_requirements
           tags = dependency_tags.
@@ -123,6 +134,12 @@ module Dependabot
           source_type == "git"
         end
 
+        def ref_changed?
+          return false unless previous_ref && new_ref
+
+          previous_ref != new_ref
+        end
+
         def previous_ref
           return unless git_source?(dependency.previous_requirements)
 
@@ -131,6 +148,14 @@ module Dependabot
           end.compact.first
         end
 
+        def new_ref
+          return unless git_source?(dependency.previous_requirements)
+
+          dependency.requirements.map do |r|
+            r.dig(:source, "ref") || r.dig(:source, :ref)
+          end.compact.first
+        end
+
         def version_regex(version)
           /(?:[^0-9\.]|\A)#{Regexp.escape(version || "unknown")}\z/
         end
@@ -279,6 +304,12 @@ module Dependabot
           )
         end
 
+        def git_sha?(version)
+          return false unless version
+
+          version.match?(/^[0-9a-f]{40}$/)
+        end
+
         def reliable_source_directory?
           MetadataFinders::Base::PACKAGE_MANAGERS_WITH_RELIABLE_DIRECTORIES.
             include?(dependency.package_manager)

data/lib/dependabot/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.95.81"
+  VERSION = "0.95.82"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.95.81
+  version: 0.95.82
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-02-27 00:00:00.000000000 Z
+date: 2019-02-28 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aws-sdk-ecr