dependabot-docker 0.303.0 → 0.304.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3f7d29f40330524ac7ff3842a6205e969642d27422480b025e0a2e40eff01e23
-  data.tar.gz: 42ab3f760f16f0716db05fb6a83ffa2d1202b5950cccef6062081bce68da2c5e
+  metadata.gz: 92752c2e2066e8ac2104cd03a3c0a7764421a45711e9154b51cec34c69bed534
+  data.tar.gz: d7c5b9394efdcacb8c6c1aa72a48d440c75afe7a0f4118ad178d1f00916ee087
 SHA512:
-  metadata.gz: 7d04b4d02ee896797538544016d4e67a655fccf9b0afa8b5fcc4821d9c5a8aec23168ff4dcc9088644bb95c4afd203347dc3669c2c0edd60bfa9a8c389c6e22e
-  data.tar.gz: 1ce798be2203de4a89347ebec7f40f428966011957a191bda61ccb90d9a8dc1c82c1a58e78e4a29b993356c51041dfb50a191ab25397164861428bacac096d68
+  metadata.gz: '049f98cf2117b1784f61a556c7f5bf734379b48fbef7babea093c121b6f051e3c3eb8156234c1a8ec4b7fc457b7a896792b035c9ae4d59de073959bccdebcd0f'
+  data.tar.gz: feaa4f23cf416cf20ecf0e993fb6ad3f3a4d836b5c52315bce2a4f780b5bbe30af8365de7daa97416083e84bfc5871e700ff6a795014315edc26ffa95fcbaa3d

data/lib/dependabot/docker/update_checker.rb

@@ -167,10 +167,6 @@ module Dependabot
 
       sig { params(original_tag: Dependabot::Docker::Tag).returns(T::Array[Dependabot::Docker::Tag]) }
       def comparable_tags_from_registry(original_tag)
-        unless Experiments.enabled?(:docker_tag_component_comparison)
-          return tags_from_registry.select { |tag| tag.comparable_to?(original_tag) }
-        end
-
         common_components = identify_common_components(tags_from_registry)
         original_components = extract_tag_components(original_tag.name, common_components)
         Dependabot.logger.info("Original tag components: #{original_components.join(',')}")

data/lib/dependabot/shared/shared_file_parser.rb

@@ -33,7 +33,13 @@ module Dependabot
 
       sig { params(parsed_line: T::Hash[String, T.nilable(String)]).returns(T.nilable(String)) }
       def version_from(parsed_line)
-        parsed_line.fetch("tag") || parsed_line.fetch("digest")
+        return nil unless parsed_line.fetch("tag") || parsed_line.fetch("digest")
+
+        if parsed_line.fetch("tag") && parsed_line.fetch("digest")
+          "#{parsed_line.fetch('tag')}@sha256:#{parsed_line.fetch('digest')}"
+        else
+          parsed_line.fetch("tag") || "sha256:#{parsed_line.fetch('digest')}"
+        end
       end
 
       sig { params(parsed_line: T::Hash[String, T.nilable(String)]).returns(T::Hash[String, T.nilable(String)]) }
@@ -42,7 +48,7 @@ module Dependabot
 
         source[:registry] = parsed_line.fetch("registry") if parsed_line.fetch("registry")
         source[:tag] = parsed_line.fetch("tag") if parsed_line.fetch("tag")
-        source[:digest] = parsed_line.fetch("digest") if parsed_line.fetch("digest")
+        source[:digest] = "sha256:#{parsed_line.fetch('digest')}" if parsed_line.fetch("digest")
 
         source
       end

data/lib/dependabot/shared/utils/credentials_finder.rb

@@ -17,16 +17,17 @@ module Dependabot
         AWS_ECR_URL = /dkr\.ecr\.(?<region>[^.]+)\.amazonaws\.com/
         DEFAULT_DOCKER_HUB_REGISTRY = "registry.hub.docker.com"
 
-        sig { params(credentials: T::Array[Dependabot::Credential]).void }
-        def initialize(credentials)
+        sig { params(credentials: T::Array[Dependabot::Credential], private_repository_type: String).void }
+        def initialize(credentials, private_repository_type: "docker_registry")
           @credentials = credentials
+          @private_repository_type = private_repository_type
         end
 
         sig { params(registry_hostname: T.nilable(String)).returns(T.nilable(Dependabot::Credential)) }
         def credentials_for_registry(registry_hostname)
           registry_details =
             credentials
-            .select { |cred| cred["type"] == "docker_registry" }
+            .select { |cred| cred["type"] == private_repository_type }
             .find { |cred| cred.fetch("registry") == registry_hostname }
           return unless registry_details
           return registry_details unless registry_hostname&.match?(AWS_ECR_URL)
@@ -38,7 +39,7 @@ module Dependabot
         def base_registry
           @base_registry ||= T.let(
             credentials.find do |cred|
-              cred["type"] == "docker_registry" && cred.replaces_base?
+              cred["type"] == private_repository_type && cred.replaces_base?
             end,
             T.nilable(Dependabot::Credential)
           )
@@ -57,6 +58,9 @@ module Dependabot
         sig { returns(T::Array[Dependabot::Credential]) }
         attr_reader :credentials
 
+        sig { returns(String) }
+        attr_reader :private_repository_type
+
         sig { params(registry_details: Dependabot::Credential).returns(Dependabot::Credential) }
         def build_aws_credentials(registry_details)
           # If credentials have been generated from AWS we can just return them

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-docker
 version: !ruby/object:Gem::Version
-  version: 0.303.0
+  version: 0.304.0
 platform: ruby
 authors:
 - Dependabot
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-03-27 00:00:00.000000000 Z
+date: 2025-04-03 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.303.0
+        version: 0.304.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.303.0
+        version: 0.304.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -262,7 +262,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.303.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.304.0
 post_install_message:
 rdoc_options: []
 require_paths: