dependabot-devbox 0.1.1 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 99efa19eeff967724728c2c6010b2c1f625619a0b7716dbbfc13db644defa666
-  data.tar.gz: 170cfde66463d21dbad418809c9028456753bdc64a23b7ff43e75817ba3ac7aa
+  metadata.gz: 35d218d66727572ab52df9c11c35b6869478d549cd15c5d9042833d0e94a7aad
+  data.tar.gz: 262ca126fac5c3083505dc7afd6ef41a285d9b0a2444e635ebbbe8d6acd95d2f
 SHA512:
-  metadata.gz: '02429b6a5c826d6130271e1d63120af02d0d49e74082421ed45f62e772fc6dc2fd6fe198d4f84082b55d0b9e0ef29ff6d7f6b62344977403aa52e2589677d6b6'
-  data.tar.gz: 855892e0fafa13e2b658110baf461931a717326219968d77732b86fe01b143e5ecbbb54ba44607dff99f2c994f3ebedb0670370f73e326159a430355d5010b21
+  metadata.gz: 0baa0a5ecfcc39ff64e8e5d546ca570349040f7087db824870f756e50812755d10c8504c35f5666e548c7a0e097b725196d435de65cf10f6f008ed5987d0cd73
+  data.tar.gz: 3e056cf0ae29dc2385a63947e2df367901b5aa26f98cb356d4a77310001c00541c79556d9054612cc69929be0cd81b3bf87e0b61eeda9fecf6e2501dbdc19d4e

data/exe/dependabot-devbox-update

@@ -7,12 +7,14 @@ require "dependabot/update_checkers"
 require "dependabot/file_updaters"
 require "dependabot/pull_request_creator"
 require "dependabot/devbox"
+require "dependabot/devbox/update_runner"
 
 repo      = ENV.fetch("GITHUB_REPOSITORY")
 token     = ENV["GITHUB_ACCESS_TOKEN"] || ENV.fetch("GITHUB_TOKEN")
 directory = ENV.fetch("DIRECTORY_PATH", "/")
-branch    = ENV["BASE_BRANCH"].then { |b| b&.empty? ? nil : b }
+branch    = ENV["BASE_BRANCH"].then { |b| b.nil? || b.empty? ? nil : b }
 group     = ENV.fetch("GROUP_UPDATES", "false") == "true"
+cooldown  = Dependabot::Devbox::UpdateRunner.build_cooldown(ENV.fetch("COOLDOWN_DAYS", "0").to_i)
 
 credentials = [
   {
@@ -50,93 +52,29 @@ parser = Dependabot::FileParsers.for_package_manager("devbox").new(
 dependencies = parser.parse
 puts "Found #{dependencies.length} devbox package(s)"
 
-def check_dep(dep, files, credentials)
-  puts "Checking #{dep.name} (#{dep.version})..."
-
-  checker = Dependabot::UpdateCheckers.for_package_manager("devbox").new(
-    dependency: dep,
-    dependency_files: files,
-    credentials: credentials
-  )
-
-  return nil if checker.up_to_date? && puts("  up to date")
-
-  requirements_to_unlock = checker.requirements_unlocked_or_can_be? ? :own : :none
-
-  begin
-    checker.updated_dependencies(requirements_to_unlock: requirements_to_unlock)
-  rescue Dependabot::AllVersionsIgnored
-    puts "  all versions ignored"
-    nil
-  end
-end
-
 if group
-  all_updated_deps = dependencies.filter_map { |dep| check_dep(dep, files, credentials) }.flatten
+  all_updated_deps = dependencies.filter_map do |dep|
+    Dependabot::Devbox::UpdateRunner.check_dependency(dep, files, credentials, cooldown)
+  end.flatten
 
   if all_updated_deps.empty?
     puts "All packages up to date."
   else
-    updater = Dependabot::FileUpdaters.for_package_manager("devbox").new(
-      dependencies: all_updated_deps,
-      dependency_files: files,
-      credentials: credentials
-    )
-
-    updated_files = updater.updated_dependency_files
+    majors, rest = Dependabot::Devbox::UpdateRunner.partition_majors(all_updated_deps)
 
-    pr_creator = Dependabot::PullRequestCreator.new(
-      source: source,
-      base_commit: commit,
-      dependencies: all_updated_deps,
-      files: updated_files,
-      credentials: credentials,
-      label_language: true
-    )
+    Dependabot::Devbox::UpdateRunner.open_pr(source, commit, rest, files, credentials) unless rest.empty?
 
-    begin
-      pr = pr_creator.create
-      if pr
-        puts "PR created: #{pr.html_url}"
-      else
-        puts "PR already exists or no changes needed"
-      end
-    rescue Dependabot::PullRequestCreator::UnmergedPRExists => e
-      puts "Skipping: #{e.message} (closed but not merged — delete the branch to recreate)"
+    majors.each do |dep|
+      puts "Opening individual PR for major bump: #{dep.name}"
+      Dependabot::Devbox::UpdateRunner.open_pr(source, commit, [dep], files, credentials, indent: "  ")
     end
   end
 else
-  dependencies.each do |dep| # rubocop:disable Metrics/BlockLength
-    updated_deps = check_dep(dep, files, credentials)
+  dependencies.each do |dep|
+    updated_deps = Dependabot::Devbox::UpdateRunner.check_dependency(dep, files, credentials, cooldown)
     next unless updated_deps
 
-    updater = Dependabot::FileUpdaters.for_package_manager("devbox").new(
-      dependencies: updated_deps,
-      dependency_files: files,
-      credentials: credentials
-    )
-
-    updated_files = updater.updated_dependency_files
-
-    pr_creator = Dependabot::PullRequestCreator.new(
-      source: source,
-      base_commit: commit,
-      dependencies: updated_deps,
-      files: updated_files,
-      credentials: credentials,
-      label_language: true
-    )
-
-    begin
-      pr = pr_creator.create
-      if pr
-        puts "  PR created: #{pr.html_url}"
-      else
-        puts "  PR already exists or no changes needed"
-      end
-    rescue Dependabot::PullRequestCreator::UnmergedPRExists => e
-      puts "  Skipping: #{e.message} (closed but not merged — delete the branch to recreate)"
-    end
+    Dependabot::Devbox::UpdateRunner.open_pr(source, commit, updated_deps, files, credentials, indent: "  ")
   end
 end
 

data/lib/dependabot/devbox/file_fetcher.rb

@@ -9,8 +9,8 @@ module Dependabot
     class FileFetcher < Dependabot::FileFetchers::Base
       extend T::Sig
 
-      MANIFEST_FILENAME = T.let("devbox.json", String)
-      LOCKFILE_FILENAME = T.let("devbox.lock", String)
+      MANIFEST_FILENAME = "devbox.json"
+      LOCKFILE_FILENAME = "devbox.lock"
 
       sig { override.returns(String) }
       def self.required_files_message

data/lib/dependabot/devbox/file_parser.rb

@@ -13,12 +13,12 @@ module Dependabot
     class FileParser < Dependabot::FileParsers::Base
       extend T::Sig
 
-      ECOSYSTEM = T.let("devbox", String)
-      MANIFEST_FILENAME = T.let("devbox.json", String)
-      LOCKFILE_FILENAME = T.let("devbox.lock", String)
+      ECOSYSTEM = "devbox"
+      MANIFEST_FILENAME = "devbox.json"
+      LOCKFILE_FILENAME = "devbox.lock"
       # An entry without an "@constraint" suffix tracks the newest release.
-      DEFAULT_CONSTRAINT = T.let("latest", String)
-      SOURCE_TYPE = T.let("nixhub", String)
+      DEFAULT_CONSTRAINT = "latest"
+      SOURCE_TYPE = "nixhub"
 
       sig { override.returns(T::Array[Dependabot::Dependency]) }
       def parse

data/lib/dependabot/devbox/file_updater.rb

@@ -14,9 +14,9 @@ module Dependabot
     class FileUpdater < Dependabot::FileUpdaters::Base
       extend T::Sig
 
-      MANIFEST_FILENAME = T.let("devbox.json", String)
-      LOCKFILE_FILENAME = T.let("devbox.lock", String)
-      LATEST = T.let("latest", String)
+      MANIFEST_FILENAME = "devbox.json"
+      LOCKFILE_FILENAME = "devbox.lock"
+      LATEST = "latest"
 
       sig { override.returns(T::Array[Dependabot::DependencyFile]) }
       def updated_dependency_files

data/lib/dependabot/devbox/helpers.rb

@@ -15,15 +15,12 @@ module Dependabot
       # block comment, or a trailing comma. The alternation lets gsub preserve
       # strings while stripping the JSONC-only constructs, so e.g. "//" inside a
       # URL value is not mistaken for the start of a comment.
-      JSONC_TOKEN = T.let(
-        %r{
+      JSONC_TOKEN = %r{
           ("(?:\\.|[^"\\])*")    # JSON string literal
           | //[^\n]*             # line comment
           | /\*.*?\*/            # block comment
           | ,(?=\s*[\}\]])       # trailing comma
-        }mx,
-        Regexp
-      )
+        }mx
 
       sig { params(content: T.nilable(String)).returns(T::Hash[String, Object]) }
       def self.parse_json_or_jsonc(content)

data/lib/dependabot/devbox/metadata_finder.rb

@@ -12,7 +12,7 @@ module Dependabot
     class MetadataFinder < Dependabot::MetadataFinders::Base
       extend T::Sig
 
-      SEARCH_URL = T.let("https://search.devbox.sh/v1/search", String)
+      SEARCH_URL = "https://search.devbox.sh/v1/search"
 
       private
 

data/lib/dependabot/devbox/package/package_details_fetcher.rb

@@ -15,7 +15,7 @@ module Dependabot
       class PackageDetailsFetcher
         extend T::Sig
 
-        SEARCH_URL = T.let("https://search.devbox.sh/v1/search", String)
+        SEARCH_URL = "https://search.devbox.sh/v1/search"
 
         sig { params(dependency: Dependabot::Dependency).void }
         def initialize(dependency:)

data/lib/dependabot/devbox/update_checker.rb

@@ -13,7 +13,7 @@ module Dependabot
 
       require_relative "update_checker/latest_version_finder"
 
-      LATEST = T.let("latest", String)
+      LATEST = "latest"
 
       sig { override.returns(T.nilable(T.any(String, Gem::Version))) }
       def latest_version

data/lib/dependabot/devbox/update_runner.rb

@@ -0,0 +1,121 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+require "dependabot/dependency"
+require "dependabot/update_checkers"
+require "dependabot/file_updaters"
+require "dependabot/pull_request_creator"
+require "dependabot/package/release_cooldown_options"
+
+module Dependabot
+  module Devbox
+    # Extracted from exe/dependabot-devbox-update so its per-dependency and
+    # per-PR logic can be unit tested without loading the executable itself
+    # (which RubyGems' bin stub runs via Kernel#load, under which the
+    # conventional `$PROGRAM_NAME == __FILE__` require-guard never matches).
+    module UpdateRunner
+      extend T::Sig
+
+      sig { params(days: Integer).returns(T.nilable(Dependabot::Package::ReleaseCooldownOptions)) }
+      def self.build_cooldown(days)
+        return nil unless days.positive?
+
+        Dependabot::Package::ReleaseCooldownOptions.new(default_days: days)
+      end
+
+      # Classifies by comparing the major segment of the previous and new
+      # version strings, so it works for both semver ("24.11.1" -> "26.4.0")
+      # and nixpkgs' shorter version strings ("0.99.4" -> "1.0.4").
+      sig { params(dependency: Dependabot::Dependency).returns(T::Boolean) }
+      def self.major_bump?(dependency)
+        previous = dependency.previous_version
+        current = dependency.version
+        return false unless previous && current
+
+        previous.to_s.split(".").first != current.to_s.split(".").first
+      end
+
+      sig do
+        params(dependencies: T::Array[Dependabot::Dependency])
+          .returns([T::Array[Dependabot::Dependency], T::Array[Dependabot::Dependency]])
+      end
+      def self.partition_majors(dependencies)
+        dependencies.partition { |dep| major_bump?(dep) }
+      end
+
+      sig do
+        params(
+          dependency: Dependabot::Dependency,
+          files: T::Array[Dependabot::DependencyFile],
+          credentials: T::Array[T.untyped],
+          cooldown: T.nilable(Dependabot::Package::ReleaseCooldownOptions)
+        ).returns(T.nilable(T::Array[Dependabot::Dependency]))
+      end
+      def self.check_dependency(dependency, files, credentials, cooldown)
+        puts "Checking #{dependency.name} (#{dependency.version})..."
+
+        checker = Dependabot::UpdateCheckers.for_package_manager("devbox").new(
+          dependency: dependency,
+          dependency_files: files,
+          credentials: credentials,
+          update_cooldown: cooldown
+        )
+
+        if checker.up_to_date?
+          puts "  up to date"
+          return nil
+        end
+
+        requirements_to_unlock = checker.requirements_unlocked_or_can_be? ? :own : :none
+
+        begin
+          checker.updated_dependencies(requirements_to_unlock: requirements_to_unlock)
+        rescue Dependabot::AllVersionsIgnored
+          puts "  all versions ignored"
+          nil
+        end
+      end
+
+      sig do
+        params(
+          source: T.untyped,
+          commit: String,
+          dependencies: T::Array[Dependabot::Dependency],
+          files: T::Array[Dependabot::DependencyFile],
+          credentials: T::Array[T.untyped],
+          indent: String
+        ).void
+      end
+      def self.open_pr(source, commit, dependencies, files, credentials, indent: "")
+        updater = Dependabot::FileUpdaters.for_package_manager("devbox").new(
+          dependencies: dependencies,
+          dependency_files: files,
+          credentials: credentials
+        )
+
+        updated_files = updater.updated_dependency_files
+
+        pr_creator = Dependabot::PullRequestCreator.new(
+          source: source,
+          base_commit: commit,
+          dependencies: dependencies,
+          files: updated_files,
+          credentials: credentials,
+          label_language: true
+        )
+
+        pr = pr_creator.create
+        if pr
+          puts "#{indent}PR created: #{pr.html_url}"
+        else
+          puts "#{indent}PR already exists or no changes needed"
+        end
+      rescue Dependabot::PullRequestCreator::UnmergedPRExists => e
+        puts "#{indent}Skipping: #{e.message} (closed but not merged — delete the branch to recreate)"
+      rescue Dependabot::PullRequestCreator::BranchAlreadyExists => e
+        puts "#{indent}Skipping: #{e.message} (stale branch with no open PR — delete it to retry)"
+      end
+    end
+  end
+end

data/lib/dependabot/devbox/version.rb

@@ -20,7 +20,7 @@ module Dependabot
       # A value that sorts above any realistic nixpkgs version, used as the
       # internal representation of the "latest" sentinel since Gem::Version
       # cannot parse the word itself.
-      LATEST_SENTINEL = T.let("999999", String)
+      LATEST_SENTINEL = "999999"
 
       sig { override.params(version: VersionParameter).returns(T::Boolean) }
       def self.correct?(version)

data/lib/dependabot/devbox.rb

@@ -32,6 +32,7 @@ require "dependabot/devbox/package/package_details_fetcher"
 require "dependabot/devbox/helpers"
 require "dependabot/devbox/version"
 require "dependabot/devbox/requirement"
+require "dependabot/devbox/update_runner"
 
 require "dependabot/pull_request_creator/labeler"
 Dependabot::PullRequestCreator::Labeler

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-devbox
 version: !ruby/object:Gem::Version
-  version: 0.1.1
+  version: 0.2.0
 platform: ruby
 authors:
 - Andoni A.
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-06-29 00:00:00.000000000 Z
+date: 2026-07-15 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -44,6 +44,7 @@ files:
 - lib/dependabot/devbox/requirement.rb
 - lib/dependabot/devbox/update_checker.rb
 - lib/dependabot/devbox/update_checker/latest_version_finder.rb
+- lib/dependabot/devbox/update_runner.rb
 - lib/dependabot/devbox/version.rb
 homepage: https://github.com/andoniaf/dependabot-devbox
 licenses: