dependabot-docker 0.242.1 → 0.244.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 55e0e366e2041988964d81687f1c659e3b45ee59f8bf9c05c6d50ffbdb42b8e4
-  data.tar.gz: '05380a2162f0da1cb71436ce2fc8e8feaefbfdafd6e3e9ecd128609dfa887072'
+  metadata.gz: c52ccd7109a9ba52a4721caab52dee265b8fbac58b014ef41f1764254d5b4ba6
+  data.tar.gz: a1c7eacd01a34f18f018dc6e2f35b3709986bf32d304c22bf0325a31dafd9791
 SHA512:
-  metadata.gz: c18c3bbe12ba33cec530d94d9b0aac7d020cb4def819290a5dcd28b6c5670c74484f694f11eb288eb4cda06724ef015aceb7128e90f0067e40a830a2296d65a5
-  data.tar.gz: 75b41e1eb6e0ab152feafedc61ea0a7f48d343f0c6271fbdf3ebc967f9e47da8c2d2d2d5589e14f71087461de2eea329db4f8002a032d20862a371e288232b6c
+  metadata.gz: 644b13f04cafb8cde3fafc549221b48acd25a536f9605a7762affa9ba6ce53c50f0151cc0aa1bb5293d4913ecc66dd074641179a4199bf60d45d45c605beeab8
+  data.tar.gz: '0085584c58c0162fa0532362f6bcf9d0d0e076a11e4fee1c8c28422a7bad80fa363b006d3498f7f83d226c75e7238530a6be3db2e0ca0eee48b8366def1750db'

data/lib/dependabot/docker/file_parser.rb

@@ -13,6 +13,8 @@ module Dependabot
     class FileParser < Dependabot::FileParsers::Base
       require "dependabot/file_parsers/base/dependency_set"
 
+      YAML_REGEXP = /^[^\.].*\.ya?ml$/i
+
       # Details of Docker regular expressions is at
       # https://github.com/docker/distribution/blob/master/reference/regexp.go
       DOMAIN_COMPONENT = /(?:[[:alnum:]]|[[:alnum:]][[[:alnum:]]-]*[[:alnum:]])/
@@ -75,7 +77,7 @@ module Dependabot
 
       def dockerfiles
         # The Docker file fetcher fetches Dockerfiles and yaml files. Reject yaml files.
-        dependency_files.reject { |f| f.type == "file" && f.name.match?(/^[^\.]+\.ya?ml/i) }
+        dependency_files.reject { |f| f.type == "file" && f.name.match?(YAML_REGEXP) }
       end
 
       def version_from(parsed_from_line)
@@ -167,7 +169,7 @@ module Dependabot
 
       def manifest_files
         # Dependencies include both Dockerfiles and yaml, select yaml.
-        dependency_files.select { |f| f.type == "file" && f.name.match?(/^[^\.]+\.ya?ml/i) }
+        dependency_files.select { |f| f.type == "file" && f.name.match?(YAML_REGEXP) }
       end
 
       def parse_helm(img_hash)

data/lib/dependabot/docker/file_updater.rb

@@ -11,10 +11,13 @@ module Dependabot
     class FileUpdater < Dependabot::FileUpdaters::Base
       FROM_REGEX = /FROM(\s+--platform\=\S+)?/i
 
+      YAML_REGEXP = /^[^\.].*\.ya?ml$/i
+      DOCKER_REGEXP = /dockerfile/i
+
       def self.updated_files_regex
         [
-          /dockerfile/i,
-          /^[^\.]+\.ya?ml/i
+          DOCKER_REGEXP,
+          YAML_REGEXP
         ]
       end
 
@@ -23,7 +26,7 @@ module Dependabot
         dependency_files.each do |file|
           next unless requirement_changed?(file, dependency)
 
-          updated_files << if file.name.match?(/^[^\.]+\.ya?ml/i)
+          updated_files << if file.name.match?(YAML_REGEXP)
                              updated_file(
                                file: file,
                                content: updated_yaml_content(file)
@@ -63,12 +66,7 @@ module Dependabot
         updated_content = file.content
 
         old_sources.zip(new_sources).each do |old_source, new_source|
-          updated_content =
-            if specified_with_digest?(old_source)
-              update_digest_and_tag(updated_content, old_source, new_source)
-            else
-              update_tag(updated_content, old_source, new_source)
-            end
+          updated_content = update_digest_and_tag(updated_content, old_source, new_source)
         end
 
         raise "Expected content to change!" if updated_content == file.content
@@ -83,35 +81,38 @@ module Dependabot
         old_tag = old_source[:tag]
         new_tag = new_source[:tag]
 
-        old_declaration_regex = /^#{FROM_REGEX}\s+.*@sha256:#{old_digest}/
-
-        previous_content.gsub(old_declaration_regex) do |old_dec|
-          old_dec
-            .gsub("@sha256:#{old_digest}", "@sha256:#{new_digest}")
-            .gsub(":#{old_tag}", ":#{new_tag}")
-        end
-      end
-
-      def update_tag(previous_content, old_source, new_source)
-        old_tag = old_source[:tag]
-        new_tag = new_source[:tag]
-
         old_declaration =
           if private_registry_url(old_source) then "#{private_registry_url(old_source)}/"
           else
             ""
           end
-        old_declaration += "#{dependency.name}:#{old_tag}"
+        old_declaration += dependency.name
+        old_declaration +=
+          if specified_with_tag?(old_source) then ":#{old_tag}"
+          else
+            ""
+          end
+        old_declaration +=
+          if specified_with_digest?(old_source) then "@sha256:#{old_digest}"
+          else
+            ""
+          end
         escaped_declaration = Regexp.escape(old_declaration)
 
         old_declaration_regex =
           %r{^#{FROM_REGEX}\s+(docker\.io/)?#{escaped_declaration}(?=\s|$)}
 
         previous_content.gsub(old_declaration_regex) do |old_dec|
-          old_dec.gsub(":#{old_tag}", ":#{new_tag}")
+          old_dec
+            .gsub("@sha256:#{old_digest}", "@sha256:#{new_digest}")
+            .gsub(":#{old_tag}", ":#{new_tag}")
         end
       end
 
+      def specified_with_tag?(source)
+        source[:tag]
+      end
+
       def specified_with_digest?(source)
         source[:digest]
       end

data/lib/dependabot/docker/update_checker.rb

@@ -108,7 +108,7 @@ module Dependabot
       # NOTE: It's important that this *always* returns a tag (even if
       # it's the existing one) as it is what we later check the digest of.
       def fetch_latest_tag(version_tag)
-        return Tag.new(latest_digest) if version_tag.digest?
+        return Tag.new(latest_digest) if version_tag.digest? && latest_digest
         return version_tag unless version_tag.comparable?
 
         # Prune out any downgrade tags before checking for pre-releases

data/lib/dependabot/docker/utils/credentials_finder.rb

@@ -30,7 +30,7 @@ module Dependabot
 
         def base_registry
           @base_registry ||= credentials.find do |cred|
-            cred["type"] == "docker_registry" && cred["replaces-base"] == true
+            cred["type"] == "docker_registry" && cred.replaces_base?
           end
           @base_registry ||= { "registry" => DEFAULT_DOCKER_HUB_REGISTRY, "credentials" => nil }
           @base_registry["registry"]

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-docker
 version: !ruby/object:Gem::Version
-  version: 0.242.1
+  version: 0.244.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-01-23 00:00:00.000000000 Z
+date: 2024-02-15 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.242.1
+        version: 0.244.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.242.1
+        version: 0.244.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -244,7 +244,7 @@ licenses:
 - Nonstandard
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.242.1
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.244.0
 post_install_message: 
 rdoc_options: []
 require_paths: