dependabot-docker 0.395.0 → 0.396.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 631a60bfcb79a600a89602befd184d8af5f3aff6e93ddcd636b0ba3a57092b67
-  data.tar.gz: 9c19a951e4fc1eeaa5448706eda907a35c15fd3ff3d8226a0b67531f437f8a08
+  metadata.gz: d4dfb9902bcedec29154319ac165b61f4919234b9e14a5bb52b43c942f51a1e5
+  data.tar.gz: 6c7e1b398f047fdf203ca9a21d8802eb999e573273e72c76576f8f028e89544a
 SHA512:
-  metadata.gz: 4f129aaf0c6612c022f276e4b84233c7d7f0276a2b393d603fdffa69a209c4f292eea55c7d7981ab365ee209d6f477a36f95c16cdcbbdf0d1515149e3f848320
-  data.tar.gz: 82d0113a5eb41bee3c43a0840c55a3b7738c2c1b45d24edc39a1bee41cd2af8a5d6d282a39154555a5862e42f21314583ec58fec6e52ceaf7265c149b43faf31
+  metadata.gz: af5fe84bcc77eab88b77e70e2f659159698f1bcec99cb6d114dccc3a5a3f325859a8b1bb8d9573eb20c46c3994d731805ef8f88083408ac882bb30fa2935f5db
+  data.tar.gz: 9f3ab430f720059323379a4900c9d27a782ee4c6d9ba1381a4eb801dc4c417a5858a820d427a955686e4d10d391f4f2e6901e4b1db9dbdf40ac36a06a515d026

data/lib/dependabot/docker/file_updater.rb

@@ -4,7 +4,6 @@
 require "sorbet-runtime"
 require "dependabot/file_fetchers"
 require "dependabot/file_fetchers/base"
-require "dependabot/notices"
 require "dependabot/shared/shared_file_updater"
 
 module Dependabot
@@ -29,21 +28,6 @@ module Dependabot
       def container_image_regex
         %r{^#{FROM_REGEX}\s+(docker\.io/)?}o
       end
-
-      sig { override.returns(T::Array[Dependabot::Notice]) }
-      def notices
-        return [] unless dependencies.any? { |dependency| dependency.metadata[:docker_cooldown_date_unavailable] }
-
-        [Dependabot::Notice.new(
-          mode: Dependabot::Notice::NoticeMode::WARN,
-          type: "docker_cooldown_date_unavailable",
-          package_manager_name: "docker",
-          title: "Docker cooldown was not applied",
-          description: "Cooldown could not be applied because no publication date was available from the registry.",
-          show_in_pr: true,
-          show_alert: false
-        )]
-      end
     end
   end
 end

data/lib/dependabot/docker/update_checker.rb

@@ -444,7 +444,10 @@ module Dependabot
           # If we can't determine publication details, skip cooldown for this tag and use it
           # rather than blocking the update when the registry doesn't support the required API calls
           if !details || !details.released_at
-            mark_cooldown_date_unavailable if cooldown_days_for(tag).positive?
+            Dependabot::UpdateCheckers::CooldownCalculation.mark_cooldown_date_unavailable(
+              dependency,
+              cooldown_days: cooldown_days_for(tag)
+            )
             return [tag]
           end
 
@@ -1068,11 +1071,6 @@ module Dependabot
         )
       end
 
-      sig { void }
-      def mark_cooldown_date_unavailable
-        dependency.metadata[:docker_cooldown_date_unavailable] = true
-      end
-
       # Builds the PackageRelease version for a tag. Non-comparable tags (e.g.
       # "alpine") have no semver, so Docker::Version.new would raise. The version
       # is only consumed by semver-aware version-tag cooldown; the digest cooldown
@@ -1101,7 +1099,10 @@ module Dependabot
 
         released_at = publication_detail(Tag.new(tag_name))&.released_at
         unless released_at
-          mark_cooldown_date_unavailable if cooldown.default_days.positive?
+          Dependabot::UpdateCheckers::CooldownCalculation.mark_cooldown_date_unavailable(
+            dependency,
+            cooldown_days: cooldown.default_days
+          )
           return false
         end
 

data/lib/dependabot/shared/shared_file_updater.rb

@@ -154,11 +154,12 @@ module Dependabot
         return if old_tags.empty?
 
         modified_content = content
+        replacement = new_helm_tag(file)
 
         old_tags.each do |old_tag|
-          old_tag_regex = /^\s*(?:-\s)?(?:tag|version):\s+["']?#{old_tag}["']?(?=\s|$)/
+          old_tag_regex = /^\s*(?:-\s)?(?:tag|version):\s+["']?#{Regexp.escape(old_tag)}["']?(?=\s|$)/
           modified_content = modified_content&.gsub(old_tag_regex) do |old_img_tag|
-            old_img_tag.gsub(old_tag.to_s, new_helm_tag(file).to_s)
+            old_img_tag.gsub(old_tag.to_s, replacement.to_s)
           end
         end
         modified_content
@@ -170,11 +171,12 @@ module Dependabot
         return if old_images.empty?
 
         modified_content = content
+        replacement = new_yaml_image(file)
 
         old_images.each do |old_image|
-          old_image_regex = /^\s*(?:-\s)?image:\s+#{old_image}(?=\s|$)/
+          old_image_regex = %r{^\s*(?:-\s)?image:\s+(?:docker\.io/)?#{Regexp.escape(old_image)}(?=\s|$)}
           modified_content = modified_content&.gsub(old_image_regex) do |old_img|
-            old_img.gsub(old_image.to_s, new_yaml_image(file).to_s)
+            old_img.gsub(old_image.to_s, replacement.to_s)
           end
         end
         modified_content
@@ -182,7 +184,7 @@ module Dependabot
 
       sig { params(file: Dependabot::DependencyFile).returns(String) }
       def new_yaml_image(file)
-        element = T.must(dependency).requirements.find { |r| r.file == file.name }
+        element = requirement_for_file(file)
         source = image_source(element)
         prefix = source[:registry] ? "#{source[:registry]}/" : ""
         digest = source[:digest] ? "@sha256:#{source[:digest]}" : ""
@@ -198,7 +200,7 @@ module Dependabot
           digest = source[:digest] ? "@sha256:#{source[:digest]}" : ""
           tag = source[:tag] ? ":#{source[:tag]}" : ""
           "#{prefix}#{T.must(dependency).name}#{tag}#{digest}"
-        end
+        end.uniq
       end
 
       sig { params(file: Dependabot::DependencyFile).returns(T::Array[String]) }
@@ -208,18 +210,23 @@ module Dependabot
           tag = source[:tag] || ""
           digest = source[:digest] ? "@sha256:#{source[:digest]}" : ""
           "#{tag}#{digest}"
-        end
+        end.uniq
       end
 
       sig { params(file: Dependabot::DependencyFile).returns(String) }
       def new_helm_tag(file)
-        element = T.must(dependency).requirements.find { |r| r.file == file.name }
+        element = requirement_for_file(file)
         source = image_source(element)
         tag = source[:tag] || ""
         digest = source[:digest] ? "@sha256:#{source[:digest]}" : ""
         "#{tag}#{digest}"
       end
 
+      sig { params(file: Dependabot::DependencyFile).returns(T.nilable(Dependabot::DependencyRequirement)) }
+      def requirement_for_file(file)
+        requirements(file).first
+      end
+
       protected
 
       sig { params(file: Dependabot::DependencyFile, dependency: Dependabot::Dependency).returns(T::Boolean) }

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-docker
 version: !ruby/object:Gem::Version
-  version: 0.395.0
+  version: 0.396.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.395.0
+        version: 0.396.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.395.0
+        version: 0.396.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -266,7 +266,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.395.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.396.0
 rdoc_options: []
 require_paths:
 - lib