dependabot-docker 0.295.0 → 0.296.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 65df80cd815545e79e5a1fd377eeb5a6d6d96e8624378233d33662b638e32459
-  data.tar.gz: 7ffe73358a0560061b2a87b7ffc1c1bac17dd3dbcbfbe5e5011708db3485882a
+  metadata.gz: 8143dd1e38323ca8d27cb0e0e229af3ae6d7291a945860fe495efb7c68707649
+  data.tar.gz: 37a0909536317744ba22fb800752fe4bc80565571a4f73dcbab7dede3e087d16
 SHA512:
-  metadata.gz: 8ff3a199e2797341f91e1a4fd3fea47e33dee60bbbf6c766cc2f702ac3760ce651495e402de08201dffb33e3b918910ffb1d96fe3a3df13201832d8038a082c7
-  data.tar.gz: 45027cd10b10efc6e71fb461a0aa7e73f6b369fbb4caf29993b91c4701ea989bb60395e22afe709ca272274ba414a9c2eccc3f89286fc472108e26b75b9b90b9
+  metadata.gz: 9543d1404fafc293c74e4c6ca95e957ca5a44a1c2a4c6926be8247e3b9f263794afb1ad782793017d801f0e0c1e6b18990e16d841f2e9b64ea432ce21aad4a6b
+  data.tar.gz: 6abbd8372171744ddf1d4317091ca43f9b09262ccb6e0e33777b996dfa90b0fabd42c9565881a990f11a795a1f2a73e8fb84f97a33026cc8cc92cac557034223

data/lib/dependabot/docker/update_checker.rb

@@ -1,7 +1,8 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "docker_registry2"
+require "sorbet-runtime"
 
 require "dependabot/update_checkers"
 require "dependabot/update_checkers/base"
@@ -14,21 +15,28 @@ require "dependabot/docker/utils/credentials_finder"
 
 module Dependabot
   module Docker
+    # rubocop:disable Metrics/ClassLength
     class UpdateChecker < Dependabot::UpdateCheckers::Base
+      extend T::Sig
+
+      sig { override.returns(T.nilable(T.any(String, Gem::Version))) }
       def latest_version
-        latest_version_from(dependency.version)
+        latest_version_from(T.must(dependency.version))
       end
 
+      sig { override.returns(T.nilable(T.any(String, Gem::Version))) }
       def latest_resolvable_version
         # Resolvability isn't an issue for Docker containers.
         latest_version
       end
 
+      sig { override.returns(T.nilable(String)) }
       def latest_resolvable_version_with_no_unlock
         # No concept of "unlocking" for Docker containers
         dependency.version
       end
 
+      sig { override.returns(T::Array[T::Hash[Symbol, T.untyped]]) }
       def updated_requirements
         dependency.requirements.map do |req|
           updated_source = req.fetch(:source).dup
@@ -50,16 +58,19 @@ module Dependabot
 
       private
 
+      sig { override.returns(T::Boolean) }
       def latest_version_resolvable_with_full_unlock?
         # Full unlock checks aren't relevant for Dockerfiles
         false
       end
 
+      sig { override.returns(T::Array[Dependabot::Dependency]) }
       def updated_dependencies_after_full_unlock
         raise NotImplementedError
       end
 
-      def version_can_update?(*)
+      sig { params(requirements_to_unlock: T.nilable(Symbol)).returns(T::Boolean) }
+      def version_can_update?(requirements_to_unlock:) # rubocop:disable Lint/UnusedMethodArgument
         if digest_requirements.any?
           !digest_up_to_date?
         else
@@ -67,6 +78,7 @@ module Dependabot
         end
       end
 
+      sig { returns(T::Boolean) }
       def version_up_to_date?
         if digest_requirements.any?
           version_tag_up_to_date? && digest_up_to_date?
@@ -75,6 +87,7 @@ module Dependabot
         end
       end
 
+      sig { returns(T::Boolean) }
       def version_tag_up_to_date?
         version = dependency.version
         return false unless version
@@ -86,6 +99,7 @@ module Dependabot
         comparable_version_from(latest_tag) <= comparable_version_from(version_tag)
       end
 
+      sig { returns(T::Boolean) }
       def digest_up_to_date?
         digest_requirements.all? do |req|
           next true unless updated_digest
@@ -94,21 +108,24 @@ module Dependabot
         end
       end
 
+      sig { params(version: String).returns(String) }
       def latest_version_from(version)
         latest_tag_from(version).name
       end
 
+      sig { params(version: String).returns(Dependabot::Docker::Tag) }
       def latest_tag_from(version)
-        @tags ||= {}
-        return @tags[version] if @tags.key?(version)
+        @tags ||= T.let({}, T.nilable(T::Hash[String, Dependabot::Docker::Tag]))
+        return T.must(@tags[version]) if @tags.key?(version)
 
         @tags[version] = fetch_latest_tag(Tag.new(version))
       end
 
       # NOTE: It's important that this *always* returns a tag (even if
       # it's the existing one) as it is what we later check the digest of.
+      sig { params(version_tag: Dependabot::Docker::Tag).returns(Dependabot::Docker::Tag) }
       def fetch_latest_tag(version_tag)
-        return Tag.new(latest_digest) if version_tag.digest? && latest_digest
+        return Tag.new(T.must(latest_digest)) if version_tag.digest? && latest_digest
         return version_tag unless version_tag.comparable?
 
         # Prune out any downgrade tags before checking for pre-releases
@@ -148,10 +165,18 @@ module Dependabot
         end
       end
 
+      sig { params(original_tag: Dependabot::Docker::Tag).returns(T::Array[Dependabot::Docker::Tag]) }
       def comparable_tags_from_registry(original_tag)
         tags_from_registry.select { |tag| tag.comparable_to?(original_tag) }
       end
 
+      sig do
+        params(
+          candidate_tags: T::Array[Dependabot::Docker::Tag],
+          version_tag: Dependabot::Docker::Tag
+        )
+          .returns(T::Array[Dependabot::Docker::Tag])
+      end
       def remove_version_downgrades(candidate_tags, version_tag)
         current_version = comparable_version_from(version_tag)
 
@@ -160,18 +185,33 @@ module Dependabot
         end
       end
 
+      sig do
+        params(
+          candidate_tags: T::Array[Dependabot::Docker::Tag],
+          version_tag: Dependabot::Docker::Tag
+        )
+          .returns(T::Array[Dependabot::Docker::Tag])
+      end
       def remove_prereleases(candidate_tags, version_tag)
         return candidate_tags if prerelease?(version_tag)
 
         candidate_tags.reject { |tag| prerelease?(tag) }
       end
 
+      sig do
+        params(
+          candidate_tags: T::Array[Dependabot::Docker::Tag],
+          version_tag: Dependabot::Docker::Tag
+        )
+          .returns(T::Array[Dependabot::Docker::Tag])
+      end
       def remove_precision_changes(candidate_tags, version_tag)
         candidate_tags.select do |tag|
           tag.same_precision?(version_tag)
         end
       end
 
+      sig { returns(T.nilable(Dependabot::Docker::Tag)) }
       def latest_tag
         return unless latest_digest
 
@@ -182,16 +222,21 @@ module Dependabot
           .find { |t| digest_of(t.name) == latest_digest }
       end
 
+      sig { returns(T.nilable(String)) }
       def updated_digest
-        @updated_digest ||= if latest_tag_from(dependency.version).digest?
-                              latest_digest
-                            else
-                              digest_of(latest_version)
-                            end
+        @updated_digest ||= T.let(
+          if latest_tag_from(T.must(dependency.version)).digest?
+            latest_digest
+          else
+            digest_of(T.cast(latest_version, String))
+          end,
+          T.nilable(String)
+        )
       end
 
+      sig { returns(T::Array[Dependabot::Docker::Tag]) }
       def tags_from_registry
-        @tags_from_registry ||=
+        @tags_from_registry ||= T.let(
           begin
             client = docker_registry_client
 
@@ -202,7 +247,9 @@ module Dependabot
             raise if attempt > 3
 
             retry
-          end
+          end,
+          T.nilable(T::Array[Dependabot::Docker::Tag])
+        )
       rescue DockerRegistry2::RegistryAuthenticationException,
              RestClient::Forbidden
         raise PrivateSourceAuthenticationFailure, registry_hostname
@@ -210,36 +257,46 @@ module Dependabot
              RestClient::Exceptions::ReadTimeout
         raise if using_dockerhub?
 
-        raise PrivateSourceTimedOut, registry_hostname
+        raise PrivateSourceTimedOut, T.must(registry_hostname)
+      rescue RestClient::ServerBrokeConnection,
+             RestClient::TooManyRequests
+        raise PrivateSourceBadResponse, registry_hostname
       end
 
+      sig { returns(T.nilable(String)) }
       def latest_digest
         return unless tags_from_registry.map(&:name).include?("latest")
 
         digest_of("latest")
       end
 
+      sig { params(tag: String).returns(T.nilable(String)) }
       def digest_of(tag)
-        @digests ||= {}
+        @digests ||= T.let({}, T.nilable(T::Hash[String, T.nilable(String)]))
         return @digests[tag] if @digests.key?(tag)
 
         @digests[tag] = fetch_digest_of(tag)
       end
 
+      sig { params(tag: String).returns(T.nilable(String)) }
       def fetch_digest_of(tag)
         docker_registry_client.manifest_digest(docker_repo_name, tag)&.delete_prefix("sha256:")
       rescue *transient_docker_errors => e
         attempt ||= 1
         attempt += 1
         return if attempt > 3 && e.is_a?(DockerRegistry2::NotFound)
-        raise if attempt > 3
+        raise PrivateSourceBadResponse, registry_hostname if attempt > 3
 
         retry
       rescue DockerRegistry2::RegistryAuthenticationException,
              RestClient::Forbidden
         raise PrivateSourceAuthenticationFailure, registry_hostname
+      rescue RestClient::ServerBrokeConnection,
+             RestClient::TooManyRequests
+        raise PrivateSourceBadResponse, registry_hostname
       end
 
+      sig { returns(T::Array[T.class_of(StandardError)]) }
       def transient_docker_errors
         [
           RestClient::Exceptions::Timeout,
@@ -251,15 +308,16 @@ module Dependabot
         ]
       end
 
+      sig { params(tag: Dependabot::Docker::Tag).returns(T::Boolean) }
       def prerelease?(tag)
         return true if tag.looks_like_prerelease?
 
         # Compare the numeric version against the version of the `latest` tag.
         return false unless latest_tag
 
-        if comparable_version_from(tag) > comparable_version_from(latest_tag)
+        if comparable_version_from(tag) > comparable_version_from(T.must(latest_tag))
           Dependabot.logger.info \
-            "The `latest` tag points to the same image as the `#{latest_tag.name}` image, " \
+            "The `latest` tag points to the same image as the `#{T.must(latest_tag).name}` image, " \
             "so dependabot is treating `#{tag.name}` as a pre-release. " \
             "The `latest` tag needs to point to `#{tag.name}` for Dependabot to consider it."
 
@@ -269,10 +327,12 @@ module Dependabot
         end
       end
 
+      sig { params(tag: Dependabot::Docker::Tag).returns(Dependabot::Version) }
       def comparable_version_from(tag)
         version_class.new(tag.numeric_version)
       end
 
+      sig { returns(T.nilable(String)) }
       def registry_hostname
         if dependency.requirements.first&.dig(:source, :registry)
           return T.must(dependency.requirements.first).dig(:source, :registry)
@@ -281,18 +341,25 @@ module Dependabot
         credentials_finder.base_registry
       end
 
+      sig { returns(T::Boolean) }
       def using_dockerhub?
         registry_hostname == "registry.hub.docker.com"
       end
 
+      sig { returns(T.nilable(Dependabot::Credential)) }
       def registry_credentials
         credentials_finder.credentials_for_registry(registry_hostname)
       end
 
+      sig { returns(Dependabot::Docker::Utils::CredentialsFinder) }
       def credentials_finder
-        @credentials_finder ||= Utils::CredentialsFinder.new(credentials)
+        @credentials_finder ||= T.let(
+          Utils::CredentialsFinder.new(credentials),
+          T.nilable(Dependabot::Docker::Utils::CredentialsFinder)
+        )
       end
 
+      sig { returns(String) }
       def docker_repo_name
         return dependency.name unless using_dockerhub?
         return dependency.name unless dependency.name.split("/").count < 2
@@ -304,8 +371,9 @@ module Dependabot
       DEFAULT_DOCKER_OPEN_TIMEOUT_IN_SECONDS = 2
       DEFAULT_DOCKER_READ_TIMEOUT_IN_SECONDS = 5
 
+      sig { returns(DockerRegistry2::Registry) }
       def docker_registry_client
-        @docker_registry_client ||=
+        @docker_registry_client ||= T.let(
           DockerRegistry2::Registry.new(
             "https://#{registry_hostname}",
             user: registry_credentials&.fetch("username", nil),
@@ -313,17 +381,28 @@ module Dependabot
             read_timeout: docker_read_timeout_in_seconds,
             open_timeout: docker_open_timeout_in_seconds,
             http_options: { proxy: ENV.fetch("HTTPS_PROXY", nil) }
-          )
+          ),
+          T.nilable(DockerRegistry2::Registry)
+        )
       end
 
+      sig { returns(Integer) }
       def docker_open_timeout_in_seconds
         ENV.fetch("DEPENDABOT_DOCKER_OPEN_TIMEOUT_IN_SECONDS", DEFAULT_DOCKER_OPEN_TIMEOUT_IN_SECONDS).to_i
       end
 
+      sig { returns(Integer) }
       def docker_read_timeout_in_seconds
         ENV.fetch("DEPENDABOT_DOCKER_READ_TIMEOUT_IN_SECONDS", DEFAULT_DOCKER_READ_TIMEOUT_IN_SECONDS).to_i
       end
 
+      sig do
+        params(
+          candidate_tags: T::Array[Dependabot::Docker::Tag],
+          version_tag: Dependabot::Docker::Tag
+        )
+          .returns(T::Array[Dependabot::Docker::Tag])
+      end
       def sort_tags(candidate_tags, version_tag)
         candidate_tags.sort do |tag_a, tag_b|
           if comparable_version_from(tag_a) > comparable_version_from(tag_b)
@@ -340,6 +419,7 @@ module Dependabot
         end
       end
 
+      sig { params(candidate_tags: T::Array[Dependabot::Docker::Tag]).returns(T::Array[Dependabot::Docker::Tag]) }
       def filter_ignored(candidate_tags)
         filtered =
           candidate_tags
@@ -357,22 +437,29 @@ module Dependabot
         filtered
       end
 
+      sig { params(tags: T::Array[Dependabot::Docker::Tag]).returns(T::Array[Dependabot::Docker::Tag]) }
       def filter_lower_versions(tags)
         tags.select do |tag|
           comparable_version_from(tag) > comparable_version_from(version_tag)
         end
       end
 
+      sig { returns(T::Array[T::Hash[Symbol, T.untyped]]) }
       def digest_requirements
         dependency.requirements.select do |requirement|
           requirement.dig(:source, :digest)
         end
       end
 
+      sig { returns(Dependabot::Docker::Tag) }
       def version_tag
-        @version_tag ||= Tag.new(T.must(dependency.version))
+        @version_tag ||= T.let(
+          Tag.new(T.must(dependency.version)),
+          T.nilable(Dependabot::Docker::Tag)
+        )
       end
     end
+    # rubocop:enable Metrics/ClassLength
   end
 end
 

data/lib/dependabot/docker/utils/credentials_finder.rb

@@ -22,14 +22,14 @@ module Dependabot
           @credentials = credentials
         end
 
-        sig { params(registry_hostname: String).returns(T.nilable(Dependabot::Credential)) }
+        sig { params(registry_hostname: T.nilable(String)).returns(T.nilable(Dependabot::Credential)) }
         def credentials_for_registry(registry_hostname)
           registry_details =
             credentials
             .select { |cred| cred["type"] == "docker_registry" }
             .find { |cred| cred.fetch("registry") == registry_hostname }
           return unless registry_details
-          return registry_details unless registry_hostname.match?(AWS_ECR_URL)
+          return registry_details unless registry_hostname&.match?(AWS_ECR_URL)
 
           build_aws_credentials(registry_details)
         end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-docker
 version: !ruby/object:Gem::Version
-  version: 0.295.0
+  version: 0.296.1
 platform: ruby
 authors:
 - Dependabot
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-01-30 00:00:00.000000000 Z
+date: 2025-02-11 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.295.0
+        version: 0.296.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.295.0
+        version: 0.296.1
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -259,7 +259,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.295.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.296.1
 post_install_message:
 rdoc_options: []
 require_paths: