dependabot-docker 0.306.0 → 0.309.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1542dcfc93d68ebe05d07e758a04988ba3cc07fa9a61ad17555da5c2f18c3291
-  data.tar.gz: a5e56d32f9d7692035ff693a5d72197bb7b9939758daa0abe74dd1224fcce80d
+  metadata.gz: b5ace65f27d0e36a51171e52901faae1a9789e32c13b0c3706811919dc386d25
+  data.tar.gz: d5f5343ff0cef86c53ee7b36f4c5b1335f30022d2d8148cfcf64c8d17fee6010
 SHA512:
-  metadata.gz: 99dd835ac8187035f36b6f5d348b8bc095a221638b31a4dccb80e864c3c5584a4a1703812876be827bd5979a9db9fc4580ae341ac142cd5701139634655e8c2d
-  data.tar.gz: 8675326c09190974033b61f0abc0c7bfebf36618f128b26e21eb9057d898ed04aac9e2f4af9a1f23adec27508e10f85dc82030378152656b11b5d706f62d0db0
+  metadata.gz: fc21838afc4fc26997d7aa6ee3d4d74e17632512d81c3adbb784bb847cbefbff6ef0e6db47607fc9e24fa19fcf87b09cad218a384e70e81bb48e38ba112a4d87
+  data.tar.gz: f4b23db54586036756d46e25fadd8c34aa7826173f3b10882c6177c625977a2788f5aa0d53a91cff89a3b349f58c5c2be5fbd96a7b25e72500a86d2c99a81067

data/lib/dependabot/docker/file_parser.rb

@@ -155,7 +155,7 @@ module Dependabot
 
         image = "#{repo}:#{tag}"
         image.prepend("#{registry}/") if registry
-        image << "@sha256:#{digest}/" if digest
+        image << "@#{digest}/" if digest
         [image]
       end
 

data/lib/dependabot/docker/update_checker.rb

@@ -12,6 +12,8 @@ require "dependabot/docker/file_parser"
 require "dependabot/docker/version"
 require "dependabot/docker/requirement"
 require "dependabot/shared/utils/credentials_finder"
+require "dependabot/package/release_cooldown_options"
+require "dependabot/package/package_release"
 
 module Dependabot
   module Docker
@@ -135,6 +137,7 @@ module Dependabot
         candidate_tags = remove_prereleases(candidate_tags, version_tag)
         candidate_tags = filter_ignored(candidate_tags)
         candidate_tags = sort_tags(candidate_tags, version_tag)
+        candidate_tags = apply_cooldown(candidate_tags)
 
         latest_tag = candidate_tags.last
         return version_tag unless latest_tag
@@ -179,6 +182,90 @@ module Dependabot
         end
       end
 
+      sig do
+        params(candidate_tags: T::Array[Dependabot::Docker::Tag])
+          .returns(T::Array[Dependabot::Docker::Tag])
+      end
+      def apply_cooldown(candidate_tags)
+        return candidate_tags if should_skip_cooldown?
+
+        candidate_tags.reverse_each do |tag|
+          details = publication_detail(tag)
+
+          next if !details || !details.released_at
+
+          return [tag] unless cooldown_period?(details.released_at)
+
+          Dependabot.logger.info("Skipping tag #{tag.name} due to cooldown period")
+        end
+
+        []
+      end
+
+      sig { params(candidate_tag: Dependabot::Docker::Tag).returns(T.nilable(Dependabot::Package::PackageRelease)) }
+      def publication_detail(candidate_tag)
+        return publication_details[candidate_tag.name] if publication_details.key?(candidate_tag.name)
+
+        details = get_tag_publication_details(candidate_tag)
+        publication_details[candidate_tag.name] = T.cast(details, Dependabot::Package::PackageRelease)
+
+        details
+      end
+
+      sig { params(tag: Dependabot::Docker::Tag).returns(T.nilable(Dependabot::Package::PackageRelease)) }
+      def get_tag_publication_details(tag)
+        digest_info = with_retries(max_attempts: 3, errors: transient_docker_errors) do
+          client = docker_registry_client
+          client.digest(docker_repo_name, tag.name)
+        end
+
+        first_digest = digest_info.first&.fetch("digest")
+        return nil unless first_digest
+
+        blob_info = with_retries(max_attempts: 3, errors: transient_docker_errors) do
+          client = docker_registry_client
+          client.blob(docker_repo_name, first_digest)
+        end
+
+        last_modified = blob_info.headers[:last_modified]
+        published_date = last_modified ? Time.parse(last_modified) : nil
+
+        Dependabot::Package::PackageRelease.new(
+          version: Dependabot::Version.new(tag.name),
+          released_at: published_date,
+          latest: false,
+          yanked: false,
+          url: nil,
+          package_type: "docker"
+        )
+      end
+
+      sig do
+        params(
+          max_attempts: Integer,
+          errors: T::Array[T.class_of(StandardError)],
+          _blk: T.proc.returns(T.untyped)
+        ).returns(T.untyped)
+      end
+      def with_retries(max_attempts: 3, errors: [], &_blk)
+        attempt = 0
+        begin
+          attempt += 1
+          yield
+        rescue *errors
+          raise if attempt >= max_attempts
+
+          retry
+        end
+      end
+
+      sig { returns(T::Hash[String, T.nilable(Dependabot::Package::PackageRelease)]) }
+      def publication_details
+        @publication_details ||= T.let({}, T.nilable(
+                                             T::Hash[String, T.nilable(Dependabot::Package::PackageRelease)]
+                                           ))
+      end
+
       sig { params(tags: T::Array[Dependabot::Docker::Tag]).returns(T::Array[String]) }
       def identify_common_components(tags)
         tag_parts = tags.map do |tag|
@@ -340,7 +427,7 @@ module Dependabot
 
       sig { params(tag: String).returns(T.nilable(String)) }
       def fetch_digest_of(tag)
-        docker_registry_client.manifest_digest(docker_repo_name, tag)&.delete_prefix("sha256:")
+        docker_registry_client.manifest_digest(docker_repo_name, tag)
       rescue *transient_docker_errors => e
         attempt ||= 1
         attempt += 1
@@ -522,6 +609,31 @@ module Dependabot
           T.nilable(Dependabot::Docker::Tag)
         )
       end
+
+      sig { returns(T::Boolean) }
+      def should_skip_cooldown?
+        @update_cooldown.nil? || !cooldown_enabled? || !@update_cooldown.included?(dependency.name)
+      end
+
+      sig { returns(T::Boolean) }
+      def cooldown_enabled?
+        Dependabot::Experiments.enabled?(:enable_cooldown_for_docker)
+      end
+
+      sig do
+        returns(Integer)
+      end
+      def cooldown_days_for
+        cooldown = @update_cooldown
+
+        T.must(cooldown).default_days
+      end
+
+      sig { params(release_date: T.untyped).returns(T::Boolean) }
+      def cooldown_period?(release_date)
+        days = cooldown_days_for
+        (Time.now.to_i - release_date.to_i) < (days * 24 * 60 * 60)
+      end
     end
     # rubocop:enable Metrics/ClassLength
   end

data/lib/dependabot/shared/shared_file_parser.rb

@@ -33,7 +33,13 @@ module Dependabot
 
       sig { params(parsed_line: T::Hash[String, T.nilable(String)]).returns(T.nilable(String)) }
       def version_from(parsed_line)
-        parsed_line.fetch("tag") || parsed_line.fetch("digest")
+        return nil unless parsed_line.fetch("tag") || parsed_line.fetch("digest")
+
+        if parsed_line.fetch("tag") && parsed_line.fetch("digest")
+          "#{parsed_line.fetch('tag')}@sha256:#{parsed_line.fetch('digest')}"
+        else
+          parsed_line.fetch("tag") || "sha256:#{parsed_line.fetch('digest')}"
+        end
       end
 
       sig { params(parsed_line: T::Hash[String, T.nilable(String)]).returns(T::Hash[String, T.nilable(String)]) }
@@ -42,7 +48,7 @@ module Dependabot
 
         source[:registry] = parsed_line.fetch("registry") if parsed_line.fetch("registry")
         source[:tag] = parsed_line.fetch("tag") if parsed_line.fetch("tag")
-        source[:digest] = parsed_line.fetch("digest") if parsed_line.fetch("digest")
+        source[:digest] = "sha256:#{parsed_line.fetch('digest')}" if parsed_line.fetch("digest")
 
         source
       end

data/lib/dependabot/shared/shared_file_updater.rb

@@ -70,7 +70,7 @@ module Dependabot
         params(previous_content: String, old_source: T::Hash[Symbol, T.nilable(String)],
                new_source: T::Hash[Symbol, T.nilable(String)]).returns(String)
       end
-      def update_digest_and_tag(previous_content, old_source, new_source)
+      def update_digest_and_tag(previous_content, old_source, new_source) # rubocop:disable Metrics/PerceivedComplexity
         old_digest = old_source[:digest]
         new_digest = new_source[:digest]
 
@@ -92,7 +92,7 @@ module Dependabot
           end
         old_declaration +=
           if specified_with_digest?(old_source)
-            "@sha256:#{old_digest}"
+            "@#{old_digest}"
           else
             ""
           end
@@ -102,9 +102,16 @@ module Dependabot
         old_declaration_regex = build_old_declaration_regex(escaped_declaration)
 
         previous_content.gsub(old_declaration_regex) do |old_dec|
+          old_digest = old_digest.sub("sha256:", "") if old_digest&.start_with?("sha256:")
+          new_digest = new_digest.sub("sha256:", "") if new_digest&.start_with?("sha256:")
+
+          unless old_digest.to_s.empty?
+            old_dec = old_dec.gsub("@sha256:#{old_digest}", "@sha256:#{new_digest}")
+            old_dec = old_dec.gsub("@#{old_digest}", "@#{new_digest}")
+          end
+
+          old_dec = old_dec.gsub(":#{old_tag}", ":#{new_tag}") unless old_tag.to_s.empty?
           old_dec
-            .gsub("@sha256:#{old_digest}", "@sha256:#{new_digest}")
-            .gsub(":#{old_tag}", ":#{new_tag}")
         end
       end
 
@@ -160,7 +167,7 @@ module Dependabot
       def new_yaml_image(file)
         element = T.must(dependency).requirements.find { |r| r[:file] == file.name }
         prefix = element&.dig(:source, :registry) ? "#{element.fetch(:source)[:registry]}/" : ""
-        digest = element&.dig(:source, :digest) ? "@sha256:#{element.fetch(:source)[:digest]}" : ""
+        digest = element&.dig(:source, :digest) ? "@#{element.fetch(:source)[:digest]}" : ""
         tag = element&.dig(:source, :tag) ? ":#{element.fetch(:source)[:tag]}" : ""
         "#{prefix}#{T.must(dependency).name}#{tag}#{digest}"
       end
@@ -169,7 +176,7 @@ module Dependabot
       def old_yaml_images(file)
         T.must(previous_requirements(file)).map do |r|
           prefix = r.fetch(:source)[:registry] ? "#{r.fetch(:source)[:registry]}/" : ""
-          digest = r.fetch(:source)[:digest] ? "@sha256:#{r.fetch(:source)[:digest]}" : ""
+          digest = r.fetch(:source)[:digest] ? "@#{r.fetch(:source)[:digest]}" : ""
           tag = r.fetch(:source)[:tag] ? ":#{r.fetch(:source)[:tag]}" : ""
           "#{prefix}#{T.must(dependency).name}#{tag}#{digest}"
         end
@@ -179,7 +186,7 @@ module Dependabot
       def old_helm_tags(file)
         T.must(previous_requirements(file)).map do |r|
           tag = r.fetch(:source)[:tag] || ""
-          digest = r.fetch(:source)[:digest] ? "@sha256:#{r.fetch(:source)[:digest]}" : ""
+          digest = r.fetch(:source)[:digest] ? "@#{r.fetch(:source)[:digest]}" : ""
           "#{tag}#{digest}"
         end
       end
@@ -188,7 +195,7 @@ module Dependabot
       def new_helm_tag(file)
         element = T.must(dependency).requirements.find { |r| r[:file] == file.name }
         tag = T.must(element).dig(:source, :tag) || ""
-        digest = T.must(element).dig(:source, :digest) ? "@sha256:#{T.must(element).dig(:source, :digest)}" : ""
+        digest = T.must(element).dig(:source, :digest) ? "@#{T.must(element).dig(:source, :digest)}" : ""
         "#{tag}#{digest}"
       end
 

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-docker
 version: !ruby/object:Gem::Version
-  version: 0.306.0
+  version: 0.309.0
 platform: ruby
 authors:
 - Dependabot
-autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-04-10 00:00:00.000000000 Z
+date: 2025-04-17 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.306.0
+        version: 0.309.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.306.0
+        version: 0.309.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -262,8 +261,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.306.0
-post_install_message:
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.309.0
 rdoc_options: []
 require_paths:
 - lib
@@ -278,8 +276,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: 3.1.0
 requirements: []
-rubygems_version: 3.5.22
-signing_key:
+rubygems_version: 3.6.3
 specification_version: 4
 summary: Provides Dependabot support for Docker
 test_files: []