dependabot-docker 0.393.0 → 0.394.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c2d6cd04e431779b85e8b8c29f061d80e84113a49adfab465d176e187108fbd9
-  data.tar.gz: 9d9e028be2dcf976e6c1228aa0d982e52fedc621c5eaf7f381871a851dcfbd9c
+  metadata.gz: 40871e6fa5bfd72e639398d41c618a392600f4083a884fa5fe9312729978b325
+  data.tar.gz: b8aa69d5e13805c63e7355f3161c72b30c8220b369ea099d5bdb7cc05c61664e
 SHA512:
-  metadata.gz: 8e8de0cdec3e34bcd3eb9beeed2eaf1294312dcf08a07e87ea8fb678be93296ffe028df5dd84055444e34d5f1031ffc11b85a1e050df300823bc7663f6c91155
-  data.tar.gz: c4cae276224bf2a2b994f29f34f77babea8dc2562c3779006168b6200dff27d95a34ed34eef53810901d7084bb298aed9fca1daab741c3d957c34ed69b3081de
+  metadata.gz: 30654c530493ff9ff60f7fa6599e4018b35b984c75020648aa5a8e8c486c46f7fbf7745a8c73382a9cacd1f746281150d99a46274875e04229b60fbb5f68a158
+  data.tar.gz: 59667acd511aaef2640934fccbf22513c75a18e28e43db50eb28ae12039dc7349207905021cc1fa1accd95121680fb4d361a44eaa950e7df1477f0d4333ca42d

data/lib/dependabot/docker/file_parser.rb

@@ -54,6 +54,8 @@ module Dependabot
 
         manifest_files.each do |file|
           dependency_set += workfile_file_dependencies(file)
+        rescue Dependabot::DependencyFileNotParseable => e
+          Dependabot.logger.warn("Failed to parse YAML file #{file.path}: #{e.message}")
         end
 
         dependency_set.dependencies
@@ -107,7 +109,6 @@ module Dependabot
 
         dependency_set
       rescue Psych::SyntaxError, Psych::DisallowedClass, Psych::BadAlias => e
-        Dependabot.logger.error("Failed to parse file #{file.path}: #{e.message}")
         raise Dependabot::DependencyFileNotParseable.new(file.path, e.message)
       end
 

data/lib/dependabot/docker/file_updater.rb

@@ -4,6 +4,7 @@
 require "sorbet-runtime"
 require "dependabot/file_fetchers"
 require "dependabot/file_fetchers/base"
+require "dependabot/notices"
 require "dependabot/shared/shared_file_updater"
 
 module Dependabot
@@ -28,6 +29,21 @@ module Dependabot
       def container_image_regex
         %r{^#{FROM_REGEX}\s+(docker\.io/)?}o
       end
+
+      sig { override.returns(T::Array[Dependabot::Notice]) }
+      def notices
+        return [] unless dependencies.any? { |dependency| dependency.metadata[:docker_cooldown_date_unavailable] }
+
+        [Dependabot::Notice.new(
+          mode: Dependabot::Notice::NoticeMode::WARN,
+          type: "docker_cooldown_date_unavailable",
+          package_manager_name: "docker",
+          title: "Docker cooldown was not applied",
+          description: "Cooldown could not be applied because no publication date was available from the registry.",
+          show_in_pr: true,
+          show_alert: false
+        )]
+      end
     end
   end
 end

data/lib/dependabot/docker/update_checker.rb

@@ -443,7 +443,10 @@ module Dependabot
 
           # If we can't determine publication details, skip cooldown for this tag and use it
           # rather than blocking the update when the registry doesn't support the required API calls
-          return [tag] if !details || !details.released_at
+          if !details || !details.released_at
+            mark_cooldown_date_unavailable if cooldown_days_for(tag).positive?
+            return [tag]
+          end
 
           return [tag] unless cooldown_period?(T.must(details.released_at), tag)
 
@@ -508,17 +511,14 @@ module Dependabot
       sig { params(headers: T::Hash[Symbol, String], tag_name: String).returns(T.nilable(Time)) }
       def published_date_from_response_headers(headers, tag_name)
         last_modified = headers[:last_modified]
-        published_date = begin
-          Time.parse(last_modified) if last_modified
-        rescue ArgumentError, TypeError => e
-          Dependabot.logger.info(
-            "Invalid Last-Modified header for #{docker_repo_name}:#{tag_name}: #{e.message}"
-          )
-          nil
-        end
-        # Fall back to the image config blob's "created" timestamp when Last-Modified
-        # is absent (e.g., Docker Hub multi-arch manifest lists).
-        published_date || fetch_image_config_created(tag_name)
+        return nil unless last_modified
+
+        Time.parse(last_modified)
+      rescue ArgumentError, TypeError => e
+        Dependabot.logger.info(
+          "Invalid Last-Modified header for #{docker_repo_name}:#{tag_name}: #{e.message}"
+        )
+        nil
       end
 
       sig do
@@ -1051,15 +1051,26 @@ module Dependabot
 
       sig { params(release_date: Time, candidate_tag: Dependabot::Docker::Tag).returns(T::Boolean) }
       def cooldown_period?(release_date, candidate_tag)
+        Dependabot::UpdateCheckers::CooldownCalculation.within_cooldown_window?(
+          release_date, cooldown_days_for(candidate_tag)
+        )
+      end
+
+      sig { params(candidate_tag: Dependabot::Docker::Tag).returns(Integer) }
+      def cooldown_days_for(candidate_tag)
         cooldown = @update_cooldown
-        return false unless cooldown
+        return 0 unless cooldown
 
         current_version = dependency.version ? comparable_version_from(version_tag) : nil
         new_version = comparable_version_from(candidate_tag)
-        days = Dependabot::UpdateCheckers::CooldownCalculation.cooldown_days_for(
+        Dependabot::UpdateCheckers::CooldownCalculation.cooldown_days_for(
           cooldown, current_version, new_version
         )
-        Dependabot::UpdateCheckers::CooldownCalculation.within_cooldown_window?(release_date, days)
+      end
+
+      sig { void }
+      def mark_cooldown_date_unavailable
+        dependency.metadata[:docker_cooldown_date_unavailable] = true
       end
 
       # Builds the PackageRelease version for a tag. Non-comparable tags (e.g.
@@ -1089,7 +1100,10 @@ module Dependabot
         return false unless cooldown
 
         released_at = publication_detail(Tag.new(tag_name))&.released_at
-        return false unless released_at
+        unless released_at
+          mark_cooldown_date_unavailable if cooldown.default_days.positive?
+          return false
+        end
 
         Dependabot::UpdateCheckers::CooldownCalculation.within_cooldown_window?(
           released_at, cooldown.default_days

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-docker
 version: !ruby/object:Gem::Version
-  version: 0.393.0
+  version: 0.394.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.393.0
+        version: 0.394.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.393.0
+        version: 0.394.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -169,14 +169,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.22'
+        version: '1.1'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.22'
+        version: '1.1'
 - !ruby/object:Gem::Dependency
   name: turbo_tests
   requirement: !ruby/object:Gem::Requirement
@@ -266,7 +266,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.393.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.394.0
 rdoc_options: []
 require_paths:
 - lib