dependabot-devcontainers 0.317.0 → 0.318.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 359ea7ce7d31cf9697ec9ad2a93c49708e352b61a8ac549a7b717db97d5c4695
-  data.tar.gz: cc2c965edcff88f6e6936a127d0466bd95b003e1ff3052a19136a9a3eff506f6
+  metadata.gz: de9793d223415fa88f25d8b0f21aff4459ab698e3bbb8ddc9fc7ac62ac036b53
+  data.tar.gz: 9a0ae4b5d3b0036d6b182ed19a331687b4227c08f116271b7d76565145fceca9
 SHA512:
-  metadata.gz: 17beba0287560f94f88fb11f0699a019d527fd090662bee985b0595c5686665c9e300e3cf49cffdf2db220a635a70384f39e171f0d53f3e9a1a22922732c51c6
-  data.tar.gz: 8937c503484c97aa861ed7f88eb948fd9386c09b47a03db871b660c6d683dd4a4023e69d5f440bba540950ef316aea7b3382df770dd4efd3917c7f61f35faa52
+  metadata.gz: 1f9d44c19e7f5eebff0f81d3125d9a2cc23ebef7e62972a0f85f9bb0be2c845e01d3add6f42c0f83a48334f5ac0ed53f1d738ff84792c1d21d6bfcccad9e6daa
+  data.tar.gz: 90241270d8b5eaa2ea652e6abf3423475618ab6a17c91b4a6e620868d1a111c66dcc09069648441a5c53d07c2bee247cd59d9663addf88dd315208e9ce3702e5

data/lib/dependabot/devcontainers/package/package_details_fetcher.rb

@@ -0,0 +1,136 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "json"
+require "time"
+require "cgi"
+require "excon"
+require "nokogiri"
+require "sorbet-runtime"
+require "dependabot/registry_client"
+require "dependabot/devcontainers"
+require "dependabot/devcontainers/version"
+require "dependabot/package/package_release"
+require "dependabot/package/package_details"
+
+module Dependabot
+  module Devcontainers
+    module Package
+      class PackageDetailsFetcher
+        extend T::Sig
+
+        sig do
+          params(
+            dependency: Dependabot::Dependency
+          ).void
+        end
+        def initialize(dependency:)
+          @dependency = dependency
+        end
+
+        sig { returns(Dependabot::Dependency) }
+        attr_reader :dependency
+
+        sig { returns(T.nilable(T::Array[Dependabot::Package::PackageRelease])) }
+        def fetch_package_releases
+          releases = T.let([], T::Array[Dependabot::Package::PackageRelease])
+
+          begin
+            Dependabot.logger.info("Fetching package info (Dev Containers) for #{dependency.name}")
+
+            cmd = "devcontainer features info tags #{dependency.name} --output-format json"
+            Dependabot.logger.info("Running command: `#{cmd}`")
+
+            output = SharedHelpers.run_shell_command(cmd, stderr_to_stdout: false)
+            package_metadata = JSON.parse(output).fetch("publishedTags")
+
+            package_metadata.each do |release|
+              next unless version_class.correct?(release) &&
+                          T.cast(version_class.new(release), Dependabot::Devcontainers::Version)
+
+              releases << Dependabot::Package::PackageRelease.new(
+                version: Devcontainers::Version.new(release),
+                released_at: nil
+              )
+            end
+
+            releases.sort_by!(&:version)
+          rescue StandardError => e
+            Dependabot.logger.error("Error while fetching package info for dev container packages: #{e.message}")
+            releases
+          end
+        end
+
+        sig do
+          params(release: Dependabot::Package::PackageRelease).returns(Dependabot::Package::PackageRelease)
+        end
+        def fetch_release_metadata(release:)
+          Dependabot.logger.info("Fetching release metadata (Dev Containers) for #{dependency.name}:#{release.version}")
+
+          response = fetch_response(release: release)
+          return release unless response.status == 200
+
+          metadata_json = JSON.parse(response.body)["layers"][0]
+          released_at = metadata_json["annotations"]["org.opencontainers.image.created"]
+
+          release.instance_variable_set(:@tag, metadata_json["digest"])
+
+          # Annotations properties are optional, So getting a release date is not guaranteed.
+          # https://specs.opencontainers.org/image-spec/annotations/#annotations
+          release.instance_variable_set(:@released_at,
+                                        released_at ? Time.parse(released_at) : nil)
+
+          release
+        rescue StandardError => e
+          Dependabot.logger.error("Error while fetching metadata (Dev Container) " \
+                                  "for #{dependency.name}: #{e.message}")
+          release
+        end
+
+        private
+
+        sig { params(release: Dependabot::Package::PackageRelease).returns(Excon::Response) }
+        def fetch_response(release:)
+          url = "https://#{ref_registry}/v2/#{ref_namespace}/#{ref_id}/manifests/#{release.version}"
+
+          Dependabot::RegistryClient.get(url: url,
+                                         headers: { "Accept" => "application/vnd.oci.image.manifest.v1+json",
+                                                    "user-agent": "devcontainer",
+                                                    "Authorization" => "Bearer #{auth_token}" })
+        end
+
+        sig { returns(T.class_of(Dependabot::Version)) }
+        def version_class
+          dependency.version_class
+        end
+
+        sig { returns(String) }
+        def ref_registry
+          T.must(dependency.name.split("/")[0])
+        end
+
+        sig { returns(String) }
+        def ref_namespace
+          T.must(dependency.name.split("/")[1...-1]).join("/")
+        end
+
+        sig { returns(String) }
+        def ref_id
+          T.must(dependency.name.split("/")[-1])
+        end
+
+        # ghcr.io needs a auth token to access the package metadata, We use following
+        # token system to fetch on the fly auth token for authentication.
+        # https://docs.docker.com/registry/spec/auth/token/#how-to-authenticate
+        # the idea was borrowed from https://github.com/devcontainers/cli project
+        sig { returns(T.nilable(String)) }
+        def auth_token
+          token_url = "https://#{ref_registry}/token?service=ghcr.io&scope=repository:#{ref_namespace}/#{ref_id}:pull"
+
+          response = Excon.get(token_url, headers: { "Accept" => "application/json" })
+          JSON.parse(response.body)["token"]
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/devcontainers/update_checker/latest_version_finder.rb

@@ -0,0 +1,177 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "excon"
+require "json"
+require "sorbet-runtime"
+
+require "open3"
+require "shellwords"
+require "dependabot/errors"
+require "dependabot/package/package_latest_version_finder"
+require "dependabot/shared_helpers"
+require "dependabot/update_checkers/version_filters"
+require "dependabot/devcontainers/file_parser"
+require "dependabot/devcontainers/package/package_details_fetcher"
+require "dependabot/devcontainers/requirement"
+require "dependabot/devcontainers/update_checker"
+
+module Dependabot
+  module Devcontainers
+    class UpdateChecker
+      class LatestVersionFinder < Dependabot::Package::PackageLatestVersionFinder
+        extend T::Sig
+
+        sig do
+          params(
+            dependency: Dependabot::Dependency,
+            dependency_files: T::Array[Dependabot::DependencyFile],
+            credentials: T::Array[Dependabot::Credential],
+            ignored_versions: T::Array[String],
+            security_advisories: T::Array[Dependabot::SecurityAdvisory],
+            raise_on_ignored: T::Boolean,
+            options: T::Hash[Symbol, T.untyped],
+            cooldown_options: T.nilable(Dependabot::Package::ReleaseCooldownOptions)
+          ).void
+        end
+        def initialize(
+          dependency:,
+          dependency_files:,
+          credentials:,
+          ignored_versions:,
+          security_advisories:,
+          raise_on_ignored:,
+          options: {},
+          cooldown_options: nil
+        )
+          @dependency          = dependency
+          @dependency_files    = dependency_files
+          @credentials         = credentials
+          @ignored_versions    = ignored_versions
+          @security_advisories = security_advisories
+          @raise_on_ignored    = raise_on_ignored
+          @options             = options
+          @cooldown_options = cooldown_options
+          super
+        end
+
+        sig { returns(Dependabot::Dependency) }
+        attr_reader :dependency
+        sig { returns(T::Array[Dependabot::Credential]) }
+        attr_reader :credentials
+        sig { returns(T.nilable(Dependabot::Package::ReleaseCooldownOptions)) }
+        attr_reader :cooldown_options
+        sig { returns(T::Array[String]) }
+        attr_reader :ignored_versions
+        sig { returns(T::Array[Dependabot::SecurityAdvisory]) }
+        attr_reader :security_advisories
+        sig { override.returns(T.nilable(Dependabot::Package::PackageDetails)) }
+        def package_details; end
+
+        sig { returns(T.nilable(T::Array[Dependabot::Version])) }
+        def release_versions
+          releases = package_releases
+
+          releases = filter_ignored_versions(T.must(releases))
+          releases = filter_lower_versions(releases)
+          releases = lazy_filter_cooldown_versions(releases)
+
+          releases = releases.sort_by(&:version)
+
+          if releases.empty?
+            Dependabot.logger.info("No release candidates found for #{dependency.name}, returning current version")
+            return Array(current_version)
+          end
+
+          releases.map(&:version)
+        end
+
+        private
+
+        sig { returns(T.nilable(T::Array[Dependabot::Package::PackageRelease])) }
+        def package_releases
+          @package_releases = T.let(Dependabot::Devcontainers::Package::PackageDetailsFetcher
+            .new(dependency: dependency)
+            .fetch_package_releases, T.nilable(T::Array[Dependabot::Package::PackageRelease]))
+        end
+
+        sig { override.returns(T::Boolean) }
+        def cooldown_enabled?
+          Dependabot::Experiments.enabled?(:enable_cooldown_for_devcontainers)
+        end
+
+        sig { returns(T.nilable(Dependabot::Version)) }
+        def current_version
+          @current_version ||=
+            T.let(
+              dependency.numeric_version,
+              T.nilable(Dependabot::Version)
+            )
+        end
+
+        sig do
+          params(releases: T::Array[Dependabot::Package::PackageRelease])
+            .returns(T::Array[Dependabot::Package::PackageRelease])
+        end
+        def lazy_filter_cooldown_versions(releases)
+          return releases unless cooldown_enabled?
+          return releases unless cooldown_options
+
+          Dependabot.logger.info("Initializing cooldown filter")
+
+          unless releases.any?
+            Dependabot.logger.info("No releases found, skipping cooldown filtering")
+            return releases
+          end
+
+          sorted_releases = releases.sort_by(&:version).reverse
+          filtered_versions = []
+          cooldown_filtered_versions = 0
+
+          sorted_releases.each do |release|
+            if in_cooldown_period?(release)
+              Dependabot.logger.info("Filtered out (cooldown) : #{release}")
+              cooldown_filtered_versions += 1
+              next
+            end
+
+            filtered_versions << release
+            break
+          end
+          Dependabot.logger.info("Filtered out #{cooldown_filtered_versions} version(s) due to cooldown")
+
+          filtered_versions
+        end
+
+        # rubocop:disable Metrics/AbcSize
+        sig { params(release: Dependabot::Package::PackageRelease).returns(T::Boolean) }
+        def in_cooldown_period?(release)
+          release = T.let(Dependabot::Devcontainers::Package::PackageDetailsFetcher
+          .new(dependency: dependency)
+          .fetch_release_metadata(release: release), T.nilable(Dependabot::Package::PackageRelease))
+
+          unless T.must(release).released_at
+            Dependabot.logger.info(
+              "Release date unavailable for #{T.must(release).version}. Cooldown filtering not possible"
+            )
+            return false
+          end
+
+          current_version = version_class.correct?(dependency.version) ? version_class.new(dependency.version) : nil
+
+          days = cooldown_days_for(current_version, T.must(release).version)
+          passed_seconds = Time.now.to_i - T.must(release).released_at.to_i
+          passed_days = passed_seconds / DAY_IN_SECONDS
+
+          if passed_days < days
+            Dependabot.logger.info("Version #{T.must(release).version}, Release date: #{T.must(release).released_at}." \
+                                   " Days since release: #{passed_days} (cooldown days: #{days})")
+          end
+
+          passed_seconds < days * DAY_IN_SECONDS
+        end
+        # rubocop:enable Metrics/AbcSize
+      end
+    end
+  end
+end

data/lib/dependabot/devcontainers/update_checker.rb

@@ -14,9 +14,11 @@ module Dependabot
     class UpdateChecker < Dependabot::UpdateCheckers::Base
       extend T::Sig
 
+      require_relative "update_checker/latest_version_finder"
+
       sig { override.returns(T.nilable(T.any(String, Gem::Version))) }
       def latest_version
-        @latest_version ||= T.let(fetch_latest_version, T.nilable(Gem::Version))
+        @latest_version ||= T.let(T.must(release_versions).last, T.nilable(Gem::Version))
       end
 
       sig { override.returns(T.nilable(T.any(String, Gem::Version))) }
@@ -24,12 +26,19 @@ module Dependabot
         latest_version # TODO
       end
 
+      sig { override.returns(T.nilable(Dependabot::Version)) }
+      def latest_resolvable_version_with_no_unlock
+        raise NotImplementedError
+      end
+
       sig { override.returns(T::Array[T::Hash[Symbol, T.untyped]]) }
       def updated_requirements
         dependency.requirements.map do |requirement|
           required_version = T.cast(version_class.new(requirement[:requirement]), Dependabot::Devcontainers::Version)
-          updated_requirement = remove_precision_changes(viable_candidates, required_version).last
-
+          updated_requirement = remove_precision_changes(
+            T.cast(release_versions, T::Array[Dependabot::Devcontainers::Version]),
+            required_version
+          ).last
           {
             file: requirement[:file],
             requirement: updated_requirement,
@@ -39,35 +48,30 @@ module Dependabot
         end
       end
 
-      sig { override.returns(T.nilable(Dependabot::Version)) }
-      def latest_resolvable_version_with_no_unlock
-        raise NotImplementedError
-      end
-
       private
 
-      sig { returns(T::Array[Dependabot::Devcontainers::Version]) }
-      def viable_candidates
-        @viable_candidates ||= T.let(
-          fetch_viable_candidates,
-          T.nilable(T::Array[Dependabot::Devcontainers::Version])
+      sig { returns(T.nilable(Dependabot::Devcontainers::UpdateChecker::LatestVersionFinder)) }
+      def latest_version_finder
+        @latest_version_finder ||= T.let(LatestVersionFinder.new(
+                                           dependency: dependency,
+                                           credentials: credentials,
+                                           dependency_files: dependency_files,
+                                           security_advisories: security_advisories,
+                                           ignored_versions: ignored_versions,
+                                           raise_on_ignored: raise_on_ignored,
+                                           cooldown_options: update_cooldown
+                                         ),
+                                         T.nilable(Dependabot::Devcontainers::UpdateChecker::LatestVersionFinder))
+      end
+
+      sig { returns(T.nilable(T::Array[Dependabot::Version])) }
+      def release_versions
+        @release_versions ||= T.let(
+          T.must(T.must(latest_version_finder).release_versions),
+          T.nilable(T::Array[Dependabot::Version])
         )
       end
 
-      sig { returns(T::Array[Dependabot::Devcontainers::Version]) }
-      def fetch_viable_candidates
-        candidates = comparable_versions_from_registry
-        candidates = filter_ignored(candidates)
-        candidates.sort
-      end
-
-      sig { returns(Dependabot::Devcontainers::Version) }
-      def fetch_latest_version
-        return T.cast(current_version, Dependabot::Devcontainers::Version) unless viable_candidates.any?
-
-        T.must(viable_candidates.last)
-      end
-
       sig do
         params(
           versions: T::Array[Dependabot::Devcontainers::Version],
@@ -81,57 +85,6 @@ module Dependabot
         end
       end
 
-      sig do
-        params(
-          versions: T::Array[Dependabot::Devcontainers::Version]
-        )
-          .returns(T::Array[Dependabot::Devcontainers::Version])
-      end
-      def filter_ignored(versions)
-        filtered =
-          versions.reject do |version|
-            ignore_requirements.any? { |r| version.satisfies?(r) }
-          end
-
-        if raise_on_ignored &&
-           filter_lower_versions(filtered).empty? &&
-           filter_lower_versions(versions).any?
-          raise AllVersionsIgnored
-        end
-
-        filtered
-      end
-
-      sig { returns(T::Array[Dependabot::Devcontainers::Version]) }
-      def comparable_versions_from_registry
-        tags_from_registry.filter_map do |tag|
-          version_class.correct?(tag) && T.cast(version_class.new(tag), Dependabot::Devcontainers::Version)
-        end
-      end
-
-      sig { returns(T::Array[String]) }
-      def tags_from_registry
-        @tags_from_registry ||= T.let(fetch_tags_from_registry, T.nilable(T::Array[String]))
-      end
-
-      sig { returns(T::Array[String]) }
-      def fetch_tags_from_registry
-        cmd = "devcontainer features info tags #{dependency.name} --output-format json"
-
-        Dependabot.logger.info("Running command: `#{cmd}`")
-
-        output = SharedHelpers.run_shell_command(cmd, stderr_to_stdout: false)
-
-        JSON.parse(output).fetch("publishedTags")
-      end
-
-      sig { params(versions: T::Array[Gem::Version]).returns(T::Array[Gem::Version]) }
-      def filter_lower_versions(versions)
-        versions.select do |version|
-          version > current_version
-        end
-      end
-
       sig { override.returns(T::Boolean) }
       def latest_version_resolvable_with_full_unlock?
         false # TODO

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-devcontainers
 version: !ruby/object:Gem::Version
-  version: 0.317.0
+  version: 0.318.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.317.0
+        version: 0.318.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.317.0
+        version: 0.318.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -248,9 +248,11 @@ files:
 - lib/dependabot/devcontainers/file_updater/config_updater.rb
 - lib/dependabot/devcontainers/language.rb
 - lib/dependabot/devcontainers/metadata_finder.rb
+- lib/dependabot/devcontainers/package/package_details_fetcher.rb
 - lib/dependabot/devcontainers/package_manager.rb
 - lib/dependabot/devcontainers/requirement.rb
 - lib/dependabot/devcontainers/update_checker.rb
+- lib/dependabot/devcontainers/update_checker/latest_version_finder.rb
 - lib/dependabot/devcontainers/utils.rb
 - lib/dependabot/devcontainers/version.rb
 homepage: https://github.com/dependabot/dependabot-core
@@ -258,7 +260,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.317.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.318.0
 rdoc_options: []
 require_paths:
 - lib