dependabot-docker 0.236.0 → 0.238.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 14dfe9723b349957deb92328ceda9aea1c423ce8b972b174d8b82cc9cfe53912
-  data.tar.gz: f8bf32939133c7f4605762ac5a54158aeaeb45089883f109b2bad71ebcc5d95b
+  metadata.gz: 69bb77e9d2f9e7ba40fcb0e22d511c145a476f3f63552cf6eead115d6a65a752
+  data.tar.gz: 775a23cba49f525d5093629661c161d4deae5354daf52c8a5444f4cd6f3cdd09
 SHA512:
-  metadata.gz: f47a610571debc9558dfb8779f5ff2e63f13215c7f12e301a4521012b67622ada14f43c83d07abd7b12aecb4458c39a1ad35eb871af4a2554fa4aca25ae7fd9e
-  data.tar.gz: 97db2c3295de4f2b448c001ad44d964e7049d2c5186135438a21924109f5e8c4488e3870288bba126eac21c2b04b94f891854ff96e32b6a516f26cccbc334cd7
+  metadata.gz: 96b9846927942ae465ab404247ad68f2cab7eaaa7e9301daec8153971154bb8a92f7be966f31ceb6e71dd0ca5a8685fcc032871257303ba35d11bef00833ce5a
+  data.tar.gz: 72c9b25b755bef30169f6428a66df7be98a02e35cc77e60d3a99e8cbf8c1d2a3ea4ba00d7bccdfe367d147f8287045f106a18267c76b80806fd18dcfbe88a155

data/lib/dependabot/docker/file_fetcher.rb

@@ -1,6 +1,7 @@
 # typed: false
 # frozen_string_literal: true
 
+require "sorbet-runtime"
 require "dependabot/docker/utils/helpers"
 require "dependabot/file_fetchers"
 require "dependabot/file_fetchers/base"
@@ -8,6 +9,9 @@ require "dependabot/file_fetchers/base"
 module Dependabot
   module Docker
     class FileFetcher < Dependabot::FileFetchers::Base
+      extend T::Sig
+      extend T::Helpers
+
       YAML_REGEXP = /^[^\.]+\.ya?ml$/i
       DOCKER_REGEXP = /dockerfile/i
 
@@ -20,8 +24,7 @@ module Dependabot
         "Repo must contain a Dockerfile or Kubernetes YAML files."
       end
 
-      private
-
+      sig { override.returns(T::Array[DependencyFile]) }
       def fetch_files
         fetched_files = []
         fetched_files += correctly_encoded_dockerfiles
@@ -48,6 +51,8 @@ module Dependabot
         end
       end
 
+      private
+
       def dockerfiles
         @dockerfiles ||=
           repo_contents(raise_errors: false)

data/lib/dependabot/docker/file_parser.rb

@@ -24,12 +24,14 @@ module Dependabot
 
       FROM = /FROM/i
       PLATFORM = /--platform\=(?<platform>\S+)/
-      TAG = /:(?<tag>[\w][\w.-]{0,127})/
+      TAG_NO_PREFIX = /(?<tag>[\w][\w.-]{0,127})/
+      TAG = /:#{TAG_NO_PREFIX}/
       DIGEST = /(?<digest>[0-9a-f]{64})/
       NAME = /\s+AS\s+(?<name>[\w-]+)/
       FROM_LINE =
         %r{^#{FROM}\s+(#{PLATFORM}\s+)?(#{REGISTRY}/)?
           #{IMAGE}#{TAG}?(?:@sha256:#{DIGEST})?#{NAME}?}x
+      TAG_WITH_DIGEST = /^#{TAG_NO_PREFIX}(?:@sha256:#{DIGEST})?/x
 
       AWS_ECR_URL = /dkr\.ecr\.(?<region>[^.]+)\.amazonaws\.com/
 
@@ -50,7 +52,7 @@ module Dependabot
 
             dependency_set << Dependency.new(
               name: parsed_from_line.fetch("image"),
-              version: version.sub(/^v/, ""),
+              version: version,
               package_manager: "docker",
               requirements: [
                 requirement: nil,
@@ -127,7 +129,7 @@ module Dependabot
       def build_image_dependency(file, details, version)
         Dependency.new(
           name: details.fetch("image"),
-          version: version.sub(/^v/, ""),
+          version: version,
           package_manager: "docker",
           requirements: [
             requirement: nil,
@@ -168,18 +170,20 @@ module Dependabot
 
       def parse_helm(img_hash)
         repo = img_hash.fetch("repository", nil)
-        tag = img_hash.key?("tag") ? img_hash.fetch("tag", nil) : img_hash.fetch("version", nil)
+        tag_value = img_hash.key?("tag") ? img_hash.fetch("tag", nil) : img_hash.fetch("version", nil)
         registry = img_hash.fetch("registry", nil)
 
-        if !repo.nil? && !registry.nil? && !tag.nil?
-          ["#{registry}/#{repo}:#{tag}"]
-        elsif !repo.nil? && !tag.nil?
-          ["#{repo}:#{tag}"]
-        elsif !repo.nil?
-          [repo]
-        else
-          []
-        end
+        tag_details = tag_value.to_s.match(TAG_WITH_DIGEST).named_captures
+        tag = tag_details["tag"]
+        digest = tag_details["digest"]
+
+        return [] unless repo
+        return [repo] unless tag
+
+        image = "#{repo}:#{tag}"
+        image.prepend("#{registry}/") if registry
+        image.append("@sha256:#{digest}/") if digest
+        [image]
       end
     end
   end

data/lib/dependabot/docker/file_updater.rb

@@ -158,7 +158,7 @@ module Dependabot
         old_tags.each do |old_tag|
           old_tag_regex = /^\s+(?:-\s)?(?:tag|version):\s+["']?#{old_tag}["']?(?=\s|$)/
           modified_content = modified_content.gsub(old_tag_regex) do |old_img_tag|
-            old_img_tag.gsub(old_tag.to_s, new_yaml_tag(file).to_s)
+            old_img_tag.gsub(old_tag.to_s, new_helm_tag(file).to_s)
           end
         end
         modified_content
@@ -187,11 +187,6 @@ module Dependabot
         "#{prefix}#{dependency.name}#{tag}#{digest}"
       end
 
-      def new_yaml_tag(file)
-        element = dependency.requirements.find { |r| r[:file] == file.name }
-        element.fetch(:source)[:tag] || ""
-      end
-
       def old_yaml_images(file)
         previous_requirements(file).map do |r|
           prefix = r.fetch(:source)[:registry] ? "#{r.fetch(:source)[:registry]}/" : ""
@@ -203,10 +198,19 @@ module Dependabot
 
       def old_helm_tags(file)
         previous_requirements(file).map do |r|
-          r.fetch(:source)[:tag] || ""
+          tag = r.fetch(:source)[:tag] || ""
+          digest = r.fetch(:source)[:digest] ? "@sha256:#{r.fetch(:source)[:digest]}" : ""
+          "#{tag}#{digest}"
         end
       end
 
+      def new_helm_tag(file)
+        element = dependency.requirements.find { |r| r[:file] == file.name }
+        tag = element.fetch(:source)[:tag] || ""
+        digest = element.fetch(:source)[:digest] ? "@sha256:#{element.fetch(:source)[:digest]}" : ""
+        "#{tag}#{digest}"
+      end
+
       def requirements(file)
         dependency.requirements
                   .select { |r| r[:file] == file.name }

data/lib/dependabot/docker/tag.rb

@@ -9,8 +9,8 @@ module Dependabot
       WORDS_WITH_BUILD = /(?:(?:-[a-z]+)+-[0-9]+)+/
       VERSION_REGEX = /v?(?<version>[0-9]+(?:\.[0-9]+)*(?:_[0-9]+|\.[a-z0-9]+|#{WORDS_WITH_BUILD}|-(?:kb)?[0-9]+)*)/i
       VERSION_WITH_SFX = /^#{VERSION_REGEX}(?<suffix>-[a-z][a-z0-9.\-]*)?$/i
-      VERSION_WITH_PFX = /^(?<prefix>[a-z][a-z0-9.\-]*-)?#{VERSION_REGEX}$/i
-      VERSION_WITH_PFX_AND_SFX = /^(?<prefix>[a-z\-]+-)?#{VERSION_REGEX}(?<suffix>-[a-z\-]+)?$/i
+      VERSION_WITH_PFX = /^(?<prefix>[a-z][a-z0-9.\-_]*-)?#{VERSION_REGEX}$/i
+      VERSION_WITH_PFX_AND_SFX = /^(?<prefix>[a-z\-_]+-)?#{VERSION_REGEX}(?<suffix>-[a-z\-]+)?$/i
       NAME_WITH_VERSION =
         /
           #{VERSION_WITH_PFX}|
@@ -33,7 +33,7 @@ module Dependabot
       end
 
       def looks_like_prerelease?
-        numeric_version.gsub(/kb/i, "").match?(/[a-zA-Z]/)
+        numeric_version.match?(/[a-zA-Z]/)
       end
 
       def comparable_to?(other)
@@ -88,9 +88,9 @@ module Dependabot
       end
 
       def format
-        return :year_month if version.match?(/^[12]\d{3}(?:[.\-]|$)/)
-        return :year_month_day if version.match?(/^[12]\d{5}(?:[.\-]|$)/)
         return :sha_suffixed if name.match?(/(^|\-g?)[0-9a-f]{7,}$/)
+        return :year_month if version.match?(/^[12]\d{3}(?:[.\-]|$)/)
+        return :year_month_day if version.match?(/^[12](?:\d{5}|\d{7})(?:[.\-]|$)/)
         return :build_num if version.match?(/^\d+$/)
 
         # As an example, "21-ea-32", "22-ea-7", and "22-ea-jdk-nanoserver-1809"
@@ -110,7 +110,7 @@ module Dependabot
       def numeric_version
         return unless comparable?
 
-        version.gsub(/-[a-z]+/, "").downcase
+        version.gsub(/kb/i, "").gsub(/-[a-z]+/, "").downcase
       end
 
       def precision

data/lib/dependabot/docker/version.rb

@@ -3,6 +3,7 @@
 
 require "dependabot/version"
 require "dependabot/utils"
+require "dependabot/docker/tag"
 
 module Dependabot
   module Docker
@@ -12,11 +13,19 @@ module Dependabot
     # for a description of Java versions.
     #
     class Version < Dependabot::Version
+      # The regex has limits for the 0,255 and 1,255 repetitions to avoid infinite limits which makes codeql angry.
+      # A docker image cannot be longer than 255 characters anyways.
+      DOCKER_VERSION_REGEX = /^(?<prefix>[a-z._\-]{0,255})[_\-v]?(?<version>.{1,255})$/
+
       def initialize(version)
-        release_part, update_part = version.split("_", 2)
+        parsed_version = version.match(DOCKER_VERSION_REGEX)
+        release_part, update_part = parsed_version[:version].split("_", 2)
 
-        @release_part = Dependabot::Version.new(release_part.sub("v", "").tr("-", "."))
+        # The numeric_version is needed here to validate the version string (ex: 20.9.0-alpine3.18)
+        # when the call is made via Depenedabot Api to convert the image version to semver.
+        release_part = Tag.new(release_part.chomp(".").chomp("-").chomp("_")).numeric_version
 
+        @release_part = Dependabot::Version.new(release_part.tr("-", "."))
         @update_part = Dependabot::Version.new(update_part&.start_with?(/[0-9]/) ? update_part : 0)
 
         super(@release_part)
@@ -27,8 +36,11 @@ module Dependabot
 
         # We can't call new here because Gem::Version calls self.correct? in its initialize method
         # causing an infinite loop, so instead we check if the release_part of the version is correct
-        release_part, = version.split("_", 2)
-        release_part = release_part.sub("v", "").tr("-", ".")
+        parsed_version = version.match(DOCKER_VERSION_REGEX)
+        return false if parsed_version.nil?
+
+        release_part, = parsed_version[:version].split("_", 2)
+        release_part = Tag.new(release_part.chomp(".").chomp("-").chomp("_")).numeric_version || parsed_version
         super(release_part)
       rescue ArgumentError
         # if we can't instantiate a version, it can't be correct

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-docker
 version: !ruby/object:Gem::Version
-  version: 0.236.0
+  version: 0.238.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2023-10-26 00:00:00.000000000 Z
+date: 2023-12-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.236.0
+        version: 0.238.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.236.0
+        version: 0.238.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -94,20 +94,34 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '1.3'
+- !ruby/object:Gem::Dependency
+  name: rspec-sorbet
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 1.9.2
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 1.9.2
 - !ruby/object:Gem::Dependency
   name: rubocop
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.56.0
+        version: 1.57.2
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.56.0
+        version: 1.57.2
 - !ruby/object:Gem::Dependency
   name: rubocop-performance
   requirement: !ruby/object:Gem::Requirement
@@ -216,7 +230,7 @@ licenses:
 - Nonstandard
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.236.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.238.0
 post_install_message: 
 rdoc_options: []
 require_paths: