dependabot-docker 0.310.0 → 0.311.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 48d5febf4a3d2a6baea6a2aa5be06b4761f6bb8adb7ea8bd494fe1f4952efb93
-  data.tar.gz: 74e03cca291a2bf993cd498c623b005a76210959aabd961605fd501093f60106
+  metadata.gz: 57070c1086b297af5847fa9c3851b5b9c6128b2f0cb0a21bcd817ed0c66c1bc1
+  data.tar.gz: 1e0ee5153a89687bf943e2fba153d89c5ab534f35ffe74027be9dc2e770763cb
 SHA512:
-  metadata.gz: ebeb48c76a0b1597f3c814732cef817c33e0b1cca0ede1f9e2d69d3cb8c887347f74c943764b57b030be1c4a61f34b1dd300f0862785dcbef100ba3a44745dc0
-  data.tar.gz: 4a13f579a96a53bc7aafb050c4fc301c648e59c0b612f9882752256f4d8c67e814380fccb69198f2589227a196725075fa332794b9e20573f4f6a780c2aa8593
+  metadata.gz: 7030f632d7fea1a2e2fcdf2ab85d96e199fbca0f1cd6b8eaa8ab81f3f2022779b5410c554eedf2262ef11bcbe2895d9f6ccbdf05a6983e663a8746e99a9854b0
+  data.tar.gz: 831318ce346686285096409a5a04db14c7bc192f368c3e86782aa37650959f1192b5c6a7b6ab9847ed04917da38379394daad57b7dd3dca66a5405bebd51ead8

data/lib/dependabot/docker/file_parser.rb

@@ -155,7 +155,7 @@ module Dependabot
 
         image = "#{repo}:#{tag}"
         image.prepend("#{registry}/") if registry
-        image << "@#{digest}/" if digest
+        image << "@sha256:#{digest}/" if digest
         [image]
       end
 

data/lib/dependabot/docker/update_checker.rb

@@ -427,7 +427,7 @@ module Dependabot
 
       sig { params(tag: String).returns(T.nilable(String)) }
       def fetch_digest_of(tag)
-        docker_registry_client.manifest_digest(docker_repo_name, tag)
+        docker_registry_client.manifest_digest(docker_repo_name, tag)&.delete_prefix("sha256:")
       rescue *transient_docker_errors => e
         attempt ||= 1
         attempt += 1

data/lib/dependabot/shared/shared_file_parser.rb

@@ -33,13 +33,7 @@ module Dependabot
 
       sig { params(parsed_line: T::Hash[String, T.nilable(String)]).returns(T.nilable(String)) }
       def version_from(parsed_line)
-        return nil unless parsed_line.fetch("tag") || parsed_line.fetch("digest")
-
-        if parsed_line.fetch("tag") && parsed_line.fetch("digest")
-          "#{parsed_line.fetch('tag')}@sha256:#{parsed_line.fetch('digest')}"
-        else
-          parsed_line.fetch("tag") || "sha256:#{parsed_line.fetch('digest')}"
-        end
+        parsed_line.fetch("tag") || parsed_line.fetch("digest")
       end
 
       sig { params(parsed_line: T::Hash[String, T.nilable(String)]).returns(T::Hash[String, T.nilable(String)]) }
@@ -48,7 +42,7 @@ module Dependabot
 
         source[:registry] = parsed_line.fetch("registry") if parsed_line.fetch("registry")
         source[:tag] = parsed_line.fetch("tag") if parsed_line.fetch("tag")
-        source[:digest] = "sha256:#{parsed_line.fetch('digest')}" if parsed_line.fetch("digest")
+        source[:digest] = parsed_line.fetch("digest") if parsed_line.fetch("digest")
 
         source
       end

data/lib/dependabot/shared/shared_file_updater.rb

@@ -66,6 +66,7 @@ module Dependabot
         updated_content
       end
 
+      # rubocop:disable Metrics/MethodLength
       sig do
         params(previous_content: String, old_source: T::Hash[Symbol, T.nilable(String)],
                new_source: T::Hash[Symbol, T.nilable(String)]).returns(String)
@@ -92,7 +93,7 @@ module Dependabot
           end
         old_declaration +=
           if specified_with_digest?(old_source)
-            "@#{old_digest}"
+            "@sha256:#{old_digest}"
           else
             ""
           end
@@ -112,8 +113,11 @@ module Dependabot
 
           old_dec = old_dec.gsub(":#{old_tag}", ":#{new_tag}") unless old_tag.to_s.empty?
           old_dec
+            .gsub("@sha256:#{old_digest}", "@sha256:#{new_digest}")
+            .gsub(":#{old_tag}", ":#{new_tag}")
         end
       end
+      # rubocop:enable Metrics/MethodLength
 
       sig { params(escaped_declaration: String).returns(Regexp) }
       def build_old_declaration_regex(escaped_declaration)
@@ -167,7 +171,7 @@ module Dependabot
       def new_yaml_image(file)
         element = T.must(dependency).requirements.find { |r| r[:file] == file.name }
         prefix = element&.dig(:source, :registry) ? "#{element.fetch(:source)[:registry]}/" : ""
-        digest = element&.dig(:source, :digest) ? "@#{element.fetch(:source)[:digest]}" : ""
+        digest = element&.dig(:source, :digest) ? "@sha256:#{element.fetch(:source)[:digest]}" : ""
         tag = element&.dig(:source, :tag) ? ":#{element.fetch(:source)[:tag]}" : ""
         "#{prefix}#{T.must(dependency).name}#{tag}#{digest}"
       end
@@ -176,7 +180,7 @@ module Dependabot
       def old_yaml_images(file)
         T.must(previous_requirements(file)).map do |r|
           prefix = r.fetch(:source)[:registry] ? "#{r.fetch(:source)[:registry]}/" : ""
-          digest = r.fetch(:source)[:digest] ? "@#{r.fetch(:source)[:digest]}" : ""
+          digest = r.fetch(:source)[:digest] ? "@sha256:#{r.fetch(:source)[:digest]}" : ""
           tag = r.fetch(:source)[:tag] ? ":#{r.fetch(:source)[:tag]}" : ""
           "#{prefix}#{T.must(dependency).name}#{tag}#{digest}"
         end
@@ -186,7 +190,7 @@ module Dependabot
       def old_helm_tags(file)
         T.must(previous_requirements(file)).map do |r|
           tag = r.fetch(:source)[:tag] || ""
-          digest = r.fetch(:source)[:digest] ? "@#{r.fetch(:source)[:digest]}" : ""
+          digest = r.fetch(:source)[:digest] ? "@sha256:#{r.fetch(:source)[:digest]}" : ""
           "#{tag}#{digest}"
         end
       end
@@ -195,7 +199,7 @@ module Dependabot
       def new_helm_tag(file)
         element = T.must(dependency).requirements.find { |r| r[:file] == file.name }
         tag = T.must(element).dig(:source, :tag) || ""
-        digest = T.must(element).dig(:source, :digest) ? "@#{T.must(element).dig(:source, :digest)}" : ""
+        digest = T.must(element).dig(:source, :digest) ? "@sha256:#{T.must(element).dig(:source, :digest)}" : ""
         "#{tag}#{digest}"
       end
 

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-docker
 version: !ruby/object:Gem::Version
-  version: 0.310.0
+  version: 0.311.0
 platform: ruby
 authors:
 - Dependabot
 bindir: bin
 cert_chain: []
-date: 2025-04-24 00:00:00.000000000 Z
+date: 2025-05-01 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.310.0
+        version: 0.311.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.310.0
+        version: 0.311.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -223,16 +223,16 @@ dependencies:
   name: webrick
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.7'
+        version: '1.9'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.7'
+        version: '1.9'
 description: Dependabot-Docker provides support for bumping Docker image tags via
   Dependabot. If you want support for multiple package managers, you probably want
   the meta-gem dependabot-omnibus.
@@ -261,7 +261,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.310.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.311.0
 rdoc_options: []
 require_paths:
 - lib