dependabot-docker 0.235.0 → 0.237.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cc10540cbe05aa8ec73184817977c47789525a705c85e3a1421b7486cacb466e
-  data.tar.gz: 710fc716cce86257288bdff6b25aa7b958a50d6358d2e398adb69ee4be73e7ba
+  metadata.gz: 2ee0f465e1956f66ab257358ae18109b4c99ffcc6d0cc898b0bcf63a233be756
+  data.tar.gz: a2d1202209b70f51a04327460e5bb8b1a0053f40d3aa2cfa0ce2219170a8a467
 SHA512:
-  metadata.gz: c5b8dd25e211dd926402f3461c3712eace28f149f6ced2f9d7558906dd50529f3138eaa5e841efea98d6ff5a1ea53df0a082d15a5c09c4a1f198a56e3beb747c
-  data.tar.gz: ebe2385c66bf98f3a92e9b3f554f049e11109713c68db034738f2767349b545b52ddd81d34ca8bd02441c579a4fd5c112323537e0d36c82947de2351b02dbaff
+  metadata.gz: 28eb1c0b65e43ed4ff71952c8d77c70319e7127cee827052a1e2b02d537153d5af2ec1698d89f0554073fbebf0e64711780d04a87c6dde77ed0626cfb42165f3
+  data.tar.gz: bf928c4fb9e5a3de42d953630b72f186eccf083d18b54ba921d038ee6d8aabb383b4e9ba396616190d9d8ca7ba759a3545e2dcc6bfd058c762c10127d62f72f5

data/lib/dependabot/docker/file_fetcher.rb

@@ -1,6 +1,7 @@
 # typed: false
 # frozen_string_literal: true
 
+require "sorbet-runtime"
 require "dependabot/docker/utils/helpers"
 require "dependabot/file_fetchers"
 require "dependabot/file_fetchers/base"
@@ -8,6 +9,9 @@ require "dependabot/file_fetchers/base"
 module Dependabot
   module Docker
     class FileFetcher < Dependabot::FileFetchers::Base
+      extend T::Sig
+      extend T::Helpers
+
       YAML_REGEXP = /^[^\.]+\.ya?ml$/i
       DOCKER_REGEXP = /dockerfile/i
 
@@ -20,8 +24,7 @@ module Dependabot
         "Repo must contain a Dockerfile or Kubernetes YAML files."
       end
 
-      private
-
+      sig { override.returns(T::Array[DependencyFile]) }
       def fetch_files
         fetched_files = []
         fetched_files += correctly_encoded_dockerfiles
@@ -48,6 +51,8 @@ module Dependabot
         end
       end
 
+      private
+
       def dockerfiles
         @dockerfiles ||=
           repo_contents(raise_errors: false)

data/lib/dependabot/docker/tag.rb

@@ -33,7 +33,7 @@ module Dependabot
       end
 
       def looks_like_prerelease?
-        numeric_version.gsub(/kb/i, "").match?(/[a-zA-Z]/)
+        numeric_version.match?(/[a-zA-Z]/)
       end
 
       def comparable_to?(other)
@@ -110,7 +110,7 @@ module Dependabot
       def numeric_version
         return unless comparable?
 
-        version.gsub(/-[a-z]+/, "").downcase
+        version.gsub(/kb/i, "").gsub(/-[a-z]+/, "").downcase
       end
 
       def precision

data/lib/dependabot/docker/update_checker.rb

@@ -258,8 +258,10 @@ module Dependabot
         return false unless latest_tag
 
         if comparable_version_from(tag) > comparable_version_from(latest_tag)
-          Dependabot.logger.info "Tag with non-prerelease version name #{tag.name} detected as prerelease, " \
-                                 "because it sorts higher than #{latest_tag.name}."
+          Dependabot.logger.info \
+            "The `latest` tag points to the same image as the `#{latest_tag.name}` image, " \
+            "so dependabot is treating `#{tag.name}` as a pre-release. " \
+            "The `latest` tag needs to point to `#{tag.name}` for Dependabot to consider it."
 
           true
         else

data/lib/dependabot/docker/version.rb

@@ -3,6 +3,7 @@
 
 require "dependabot/version"
 require "dependabot/utils"
+require "dependabot/docker/tag"
 
 module Dependabot
   module Docker
@@ -14,9 +15,13 @@ module Dependabot
     class Version < Dependabot::Version
       def initialize(version)
         release_part, update_part = version.split("_", 2)
+        release_part = release_part.sub("v", "")
 
-        @release_part = Dependabot::Version.new(release_part.sub("v", "").tr("-", "."))
+        # The numeric_version is needed here to validate the version string (ex: 20.9.0-alpine3.18)
+        # when the call is made via Depenedabot Api to convert the image version to semver.
+        release_part = Tag.new(release_part).numeric_version
 
+        @release_part = Dependabot::Version.new(release_part.tr("-", "."))
         @update_part = Dependabot::Version.new(update_part&.start_with?(/[0-9]/) ? update_part : 0)
 
         super(@release_part)

data/lib/dependabot/docker.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: strong
 # frozen_string_literal: true
 
 # These all need to be required so the various classes can be registered in a

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-docker
 version: !ruby/object:Gem::Version
-  version: 0.235.0
+  version: 0.237.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2023-10-19 00:00:00.000000000 Z
+date: 2023-11-21 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.235.0
+        version: 0.237.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.235.0
+        version: 0.237.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -94,20 +94,34 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '1.3'
+- !ruby/object:Gem::Dependency
+  name: rspec-sorbet
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 1.9.2
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 1.9.2
 - !ruby/object:Gem::Dependency
   name: rubocop
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.56.0
+        version: 1.57.2
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.56.0
+        version: 1.57.2
 - !ruby/object:Gem::Dependency
   name: rubocop-performance
   requirement: !ruby/object:Gem::Requirement
@@ -216,7 +230,7 @@ licenses:
 - Nonstandard
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.235.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.237.0
 post_install_message: 
 rdoc_options: []
 require_paths: