dependabot-docker 0.143.3 → 0.145.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2f7d1cf0c8873ffb9b4bfeeff09b3d752c29bb06e17c8d16f965cbac1ff79328
-  data.tar.gz: c98216eb5341e23d4c91612b86c8cfd6617336a6daed87ec13dc522dad72ce17
+  metadata.gz: f6b7a48ac114347d82205cca6ea2341e372b6c7b15439da10ee6af9d09446ded
+  data.tar.gz: 174a489e1af90eac015c0efe24ccd62c7c5b65fdbc49b57dd76f39c7f16c19cb
 SHA512:
-  metadata.gz: 1878a080417097d4b4553d7cd09312a13ed45e8f36a34035542f01bc3a57bc3d8495c4a963b25940be10a6cc31227b0d1b458e7f7f9b5f66a9e8192231ce6dab
-  data.tar.gz: 125ec08afd8d7bee0ab93199abe4670a07d2900105fb8f28b98fcdd9338f9abedf3fb2dd6819456d4aaf5dec9edf17994b484d3969b3a885417a681db968ee98
+  metadata.gz: a78b56114978d7601e38c2f057ba547355a6eb5c78ef4e62ecaed69b17da4e9e8e3d97c011aa79c35631e1b3b8ed9c930690bbe04ba448ca82f42625ba3725cf
+  data.tar.gz: 31e23a52f5ac3afa3c97aaab4b3dc2bd91703cd6047da6814d25f5b7798a982fdf7c11d2fa28ff7261252564666576ba09eb7098c73bcbd7ac668281bcbad15c

data/lib/dependabot/docker/file_parser.rb

@@ -7,6 +7,7 @@ require "dependabot/file_parsers"
 require "dependabot/file_parsers/base"
 require "dependabot/errors"
 require "dependabot/docker/utils/credentials_finder"
+require "dependabot/docker/update_checker"
 
 module Dependabot
   module Docker
@@ -35,7 +36,7 @@ module Dependabot
       AWS_ECR_URL = /dkr\.ecr\.(?<region>[^.]+).amazonaws\.com/.freeze
 
       def parse
-        dependency_set = DependencySet.new
+        dependencies = {}
 
         dockerfiles.each do |dockerfile|
           dockerfile.content.each_line do |line|
@@ -47,21 +48,29 @@ module Dependabot
             version = version_from(parsed_from_line)
             next unless version
 
-            dependency_set << Dependency.new(
-              name: parsed_from_line.fetch("image"),
-              version: version,
-              package_manager: "docker",
-              requirements: [
-                requirement: nil,
-                groups: [],
-                file: dockerfile.name,
-                source: source_from(parsed_from_line)
-              ]
-            )
+            name = parsed_from_line.fetch("image")
+            dep_uniq_key = dep_key(name, version)
+
+            requirement = {
+              requirement: nil,
+              groups: [],
+              file: dockerfile.name,
+              source: source_from(parsed_from_line)
+            }
+            if (existing = dependencies[dep_uniq_key])
+              existing.requirements.push(requirement) unless existing.requirements.any? { |r| r == requirement }
+            else
+              dependencies[dep_uniq_key] = Dependency.new(
+                name: name,
+                version: version,
+                package_manager: "docker",
+                requirements: [requirement]
+              )
+            end
           end
         end
 
-        dependency_set.dependencies
+        dependencies.values
       end
 
       private
@@ -154,6 +163,14 @@ module Dependabot
 
         raise "No Dockerfile!"
       end
+
+      def dep_key(name, version)
+        m = version.match(Dependabot::Docker::UpdateChecker::NAME_WITH_VERSION)
+        return name unless m
+
+        captures = m.named_captures
+        [name, captures.fetch("prefix"), captures.fetch("suffix")].compact.join(":")
+      end
     end
   end
 end

data/lib/dependabot/docker/update_checker.rb

@@ -173,9 +173,8 @@ module Dependabot
         tags_from_registry.
           select { |tag| tag.match?(NAME_WITH_VERSION) }.
           select { |tag| prefix_of(tag) == original_prefix }.
-          select { |tag| suffix_of(tag) == original_suffix }.
-          select { |tag| format_of(tag) == original_format }.
-          reject { |tag| commit_sha_suffix?(tag) }
+          select { |tag| suffix_of(tag) == original_suffix || commit_sha_suffix?(tag) }.
+          select { |tag| format_of(tag) == original_format }
       end
 
       def remove_version_downgrades(candidate_tags, version)
@@ -190,7 +189,7 @@ module Dependabot
         # can't order on those but will try to, so instead we should exclude
         # them (unless there's a `latest` version pushed to the registry, in
         # which case we'll use that to find the latest version)
-        return false unless tag.match?(/(^|\-)[0-9a-f]{7,}$/)
+        return false unless tag.match?(/(^|\-g?)[0-9a-f]{7,}$/)
 
         !tag.match?(/(^|\-)\d+$/)
       end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-docker
 version: !ruby/object:Gem::Version
-  version: 0.143.3
+  version: 0.145.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-04-23 00:00:00.000000000 Z
+date: 2021-05-05 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.143.3
+        version: 0.145.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.143.3
+        version: 0.145.0
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement