dependabot-docker 0.351.0 → 0.353.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 405b8dafd15b02d08f65970db8b9e56ebc9507a460cf5c2ef49f2fb417a65a1d
-  data.tar.gz: 98e77720a22bccdf2ca134613d95320697c8a174b6d2e6042b2de7771c469628
+  metadata.gz: 02bcc5572fdaea1462c34ec6a42fb30a8dbe30beac223c618a048335fd17913f
+  data.tar.gz: afb4967b24253d6b0b6446fe787b096dc59f60ae58d6a60c0b58f793b2108c48
 SHA512:
-  metadata.gz: b3bf540c88d990ce82a4ae472dc6d94c874345d03763b8cddeae62a307eda0096aafbf723e0a85708fe415a4c313a90a31e91f944a5ad2dac986482b43538e5b
-  data.tar.gz: a54a1622d6cbaf5e93d01129f44275dd82956a34771720c2e20e0f512193cd6fd3bdab0f9033d6c4c4f4c80eda7d1cd79cd7776faeb72ebaa28ac8fbbffdb446
+  metadata.gz: 403f045eaaba1d2afcb87f864a10f8ac2eeaae1ebf25dfdd9fb301bbc02266ad572a5bcff32e86af539cb25ce79f0bf298e38ca02532693a9cf01673a0f3bd1c
+  data.tar.gz: c26697bf391a67b3d6633634a4da9bfb9771a3d78ede365054d7c7fa77ec3906a864c1a3b0ada6c773b0594dd1868333a433adc461593c6076173e1045b303c8

data/lib/dependabot/docker/update_checker.rb

@@ -101,12 +101,33 @@ module Dependabot
         comparable_version_from(latest_tag) <= comparable_version_from(version_tag)
       end
 
+      # Digest requirements come in two forms:
+      #
+      # - Tag + digest (e.g. `image:debug@sha256:<digest>`):
+      #   the tag is the source of truth, so the expected digest is the digest of the tag.
+      #
+      # - Digest-only (e.g. `image@sha256:<digest>`):
+      #   there is no tag to resolve, so the expected digest is `updated_digest`.
+      #
+      # A dependency may have multiple digest requirements (across multiple files), so
+      # we compute the expected digest per requirement rather than using a single
+      # global value.
       sig { returns(T::Boolean) }
       def digest_up_to_date?
-        digest_requirements.all? do |req|
-          next true unless updated_digest
+        return true unless updated_digest
 
-          req.fetch(:source).fetch(:digest) == updated_digest
+        digest_requirements.all? do |req|
+          source = req.fetch(:source)
+          source_digest = source.fetch(:digest)
+          source_tag = source[:tag]
+
+          expected_digest =
+            if source_tag
+              digest_of(source_tag)
+            else
+              updated_digest
+            end
+          source_digest == expected_digest
         end
       end
 
@@ -219,7 +240,7 @@ module Dependabot
           client.digest(docker_repo_name, tag.name)
         end
 
-        first_digest = digest_info.first&.fetch("digest")
+        first_digest = extract_digest_from_response(digest_info, tag)
         return nil unless first_digest
 
         blob_info = with_retries(max_attempts: 3, errors: transient_docker_errors) do
@@ -240,6 +261,34 @@ module Dependabot
         )
       end
 
+      sig do
+        params(
+          digest_info: T.untyped,
+          tag: Dependabot::Docker::Tag
+        ).returns(T.nilable(String))
+      end
+      def extract_digest_from_response(digest_info, tag)
+        # digest_info can be either a String or an Array depending on the registry response
+        case digest_info
+        when Array
+          if digest_info.empty?
+            Dependabot.logger.warn(
+              "Empty digest_info array for #{docker_repo_name}:#{tag.name}"
+            )
+            return nil
+          end
+          digest_info.first&.fetch("digest")
+        when String
+          digest_info
+        else
+          Dependabot.logger.warn(
+            "Unexpected digest_info type for #{docker_repo_name}:#{tag.name}: " \
+            "#{digest_info.class} (expected String or Array)"
+          )
+          nil
+        end
+      end
+
       sig do
         params(
           max_attempts: Integer,

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-docker
 version: !ruby/object:Gem::Version
-  version: 0.351.0
+  version: 0.353.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.351.0
+        version: 0.353.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.351.0
+        version: 0.353.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -261,7 +261,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.351.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.353.0
 rdoc_options: []
 require_paths:
 - lib