dependabot-docker 0.395.0 → 0.397.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 631a60bfcb79a600a89602befd184d8af5f3aff6e93ddcd636b0ba3a57092b67
-  data.tar.gz: 9c19a951e4fc1eeaa5448706eda907a35c15fd3ff3d8226a0b67531f437f8a08
+  metadata.gz: b43ff0be6b23394fc47285dce19edb7b8e90bcc6a859243315758559dbd5fac4
+  data.tar.gz: 0b12ca42143a2d08547b575d4b4373ce4cf0490f22fc41f8c2fb2ff4a944ef4f
 SHA512:
-  metadata.gz: 4f129aaf0c6612c022f276e4b84233c7d7f0276a2b393d603fdffa69a209c4f292eea55c7d7981ab365ee209d6f477a36f95c16cdcbbdf0d1515149e3f848320
-  data.tar.gz: 82d0113a5eb41bee3c43a0840c55a3b7738c2c1b45d24edc39a1bee41cd2af8a5d6d282a39154555a5862e42f21314583ec58fec6e52ceaf7265c149b43faf31
+  metadata.gz: 338d342f4d99ee355295af0581139e6a121c580bcc636d54cd8bde653b4169b569e80b5371ab1b0bd321e421df07fb13f4275eea8e4aebe2384a55afc014e18d
+  data.tar.gz: a7feda400c5b1fc35e0ac60b36d37c7bfa57295416ff1e230fe656311700573b4fae9d0ac0097702e8325d94a2f245ba56f668ddca145c2df3f63c8f49ef8bee

data/lib/dependabot/docker/file_parser.rb

@@ -145,7 +145,11 @@ module Dependabot
         repo = img_hash.fetch("repository", nil)
         return [] unless repo.is_a?(String)
 
-        match = tag_value.to_s.match(TAG_WITH_DIGEST)
+        tag = tag_value.to_s
+        # Helm template expressions cannot be resolved without rendering the chart.
+        return [] if tag.include?("{{")
+
+        match = tag.match(TAG_WITH_DIGEST)
         return [] unless match
 
         tag_details = match.named_captures

data/lib/dependabot/docker/file_updater.rb

@@ -4,7 +4,6 @@
 require "sorbet-runtime"
 require "dependabot/file_fetchers"
 require "dependabot/file_fetchers/base"
-require "dependabot/notices"
 require "dependabot/shared/shared_file_updater"
 
 module Dependabot
@@ -29,21 +28,6 @@ module Dependabot
       def container_image_regex
         %r{^#{FROM_REGEX}\s+(docker\.io/)?}o
       end
-
-      sig { override.returns(T::Array[Dependabot::Notice]) }
-      def notices
-        return [] unless dependencies.any? { |dependency| dependency.metadata[:docker_cooldown_date_unavailable] }
-
-        [Dependabot::Notice.new(
-          mode: Dependabot::Notice::NoticeMode::WARN,
-          type: "docker_cooldown_date_unavailable",
-          package_manager_name: "docker",
-          title: "Docker cooldown was not applied",
-          description: "Cooldown could not be applied because no publication date was available from the registry.",
-          show_in_pr: true,
-          show_alert: false
-        )]
-      end
     end
   end
 end

data/lib/dependabot/docker/update_checker.rb

@@ -2,7 +2,10 @@
 # frozen_string_literal: true
 
 require "docker_registry2"
+require "excon"
+require "json"
 require "sorbet-runtime"
+require "uri"
 
 begin
   require "rest-client"
@@ -36,6 +39,7 @@ end
 require "dependabot/update_checkers"
 require "dependabot/update_checkers/base"
 require "dependabot/update_checkers/cooldown_calculation"
+require "dependabot/registry_client"
 require "dependabot/errors"
 require "dependabot/docker/tag"
 require "dependabot/docker/file_parser"
@@ -444,7 +448,10 @@ module Dependabot
           # If we can't determine publication details, skip cooldown for this tag and use it
           # rather than blocking the update when the registry doesn't support the required API calls
           if !details || !details.released_at
-            mark_cooldown_date_unavailable if cooldown_days_for(tag).positive?
+            Dependabot::UpdateCheckers::CooldownCalculation.mark_cooldown_date_unavailable(
+              dependency,
+              cooldown_days: cooldown_days_for(tag)
+            )
             return [tag]
           end
 
@@ -468,25 +475,8 @@ module Dependabot
 
       sig { params(tag: Dependabot::Docker::Tag).returns(T.nilable(Dependabot::Package::PackageRelease)) }
       def get_tag_publication_details(tag)
-        digest_info = with_retries(max_attempts: 3, errors: transient_docker_errors) do
-          client = docker_registry_client
-          client.digest(docker_repo_name, tag.name)
-        end
-
-        first_digest = extract_digest_from_response(digest_info, tag)
-        return nil unless first_digest
-
-        # When digest_info is an Array the registry returned a manifest list
-        # (OCI image index) and the extracted digest points at a platform-
-        # specific *manifest*, not a blob.  Use the correct endpoint so the
-        # HEAD request succeeds on registries like ghcr.io.
-        endpoint = digest_info.is_a?(Array) ? "manifests" : "blobs"
-        head_response = with_retries(max_attempts: 3, errors: transient_docker_errors) do
-          client = docker_registry_client
-          client.dohead "v2/#{docker_repo_name}/#{endpoint}/#{first_digest}"
-        end
-
-        published_date = published_date_from_response_headers(head_response.headers, tag.name)
+        published_date = registry_tag_release_date(tag)
+        return nil unless published_date
 
         Dependabot::Package::PackageRelease.new(
           version: release_version_for(tag),
@@ -496,58 +486,75 @@ module Dependabot
           url: nil,
           package_type: "docker"
         )
-      rescue *transient_docker_errors,
+      end
+
+      sig { params(tag: Dependabot::Docker::Tag).returns(T.nilable(Time)) }
+      def registry_tag_release_date(tag)
+        return docker_hub_tag_release_date(tag) if using_dockerhub?
+
+        Dependabot.logger.info(
+          "No verified registry publication date source for #{registry_hostname}; " \
+          "skipping cooldown for #{docker_repo_name}:#{tag.name}"
+        )
+        nil
+      rescue JSON::ParserError, ArgumentError, TypeError, Excon::Error::Socket, Excon::Error::Timeout,
+             RegistryError, PrivateSourceBadResponse, PrivateSourceAuthenticationFailure,
+             *transient_docker_errors,
              DockerRegistry2::RegistryAuthenticationException,
              DockerRegistry2::RegistryAuthorizationException,
              RestClient::Forbidden,
              RestClient::TooManyRequests => e
-        Dependabot.logger.warn(
-          "Failed to fetch publication details for #{docker_repo_name}:#{tag.name}, " \
-          "skipping cooldown: #{e.class} - #{e.message}"
+        Dependabot.logger.info(
+          "Failed to fetch registry tag metadata for #{docker_repo_name}:#{tag.name}: #{e.message}"
         )
         nil
       end
 
-      sig { params(headers: T::Hash[Symbol, String], tag_name: String).returns(T.nilable(Time)) }
-      def published_date_from_response_headers(headers, tag_name)
-        last_modified = headers[:last_modified]
-        return nil unless last_modified
+      sig { params(tag: Dependabot::Docker::Tag).returns(T.nilable(Time)) }
+      def docker_hub_tag_release_date(tag)
+        namespace, repository = docker_repo_name.split("/", 2)
+        return unless namespace && repository
 
-        Time.parse(last_modified)
-      rescue ArgumentError, TypeError => e
-        Dependabot.logger.info(
-          "Invalid Last-Modified header for #{docker_repo_name}:#{tag_name}: #{e.message}"
+        digest = digest_of(tag.name)
+        return unless digest
+
+        response = Dependabot::RegistryClient.get(
+          url: docker_hub_tag_url(namespace, repository, tag.name),
+          headers: { "Accept" => "application/json" },
+          options: {
+            connect_timeout: docker_open_timeout_in_seconds,
+            read_timeout: docker_read_timeout_in_seconds,
+            write_timeout: docker_read_timeout_in_seconds
+          }
         )
-        nil
+        return unless response.status == 200
+
+        metadata = JSON.parse(response.body)
+        return unless metadata.is_a?(Hash)
+        return unless docker_hub_digest_matches_update?(metadata["digest"], digest)
+
+        timestamp = metadata["tag_last_pushed"]
+        Time.iso8601(timestamp) if timestamp.is_a?(String)
       end
 
-      sig do
-        params(
-          digest_info: Object,
-          tag: Dependabot::Docker::Tag
-        ).returns(T.nilable(String))
+      sig { params(metadata_digest: Object, digest: String).returns(T::Boolean) }
+      def docker_hub_digest_matches_update?(metadata_digest, digest)
+        return digest_requirements.empty? && !pin_digests? if metadata_digest.nil?
+
+        matching_digest?(metadata_digest, digest)
       end
-      def extract_digest_from_response(digest_info, tag)
-        # digest_info can be either a String or an Array depending on the registry response
-        case digest_info
-        when Array
-          if digest_info.empty?
-            Dependabot.logger.warn(
-              "Empty digest_info array for #{docker_repo_name}:#{tag.name}"
-            )
-            return nil
-          end
-          digest = digest_info.first&.fetch("digest")
-          digest if digest.is_a?(String)
-        when String
-          digest_info
-        else
-          Dependabot.logger.warn(
-            "Unexpected digest_info type for #{docker_repo_name}:#{tag.name}: " \
-            "#{digest_info.class} (expected String or Array)"
-          )
-          nil
-        end
+
+      sig { params(namespace: String, repository: String, tag: String).returns(String) }
+      def docker_hub_tag_url(namespace, repository, tag)
+        escaped = [namespace, repository, tag].map { |value| URI.encode_www_form_component(value) }
+        "https://hub.docker.com/v2/namespaces/#{escaped[0]}/repositories/#{escaped[1]}/tags/#{escaped[2]}"
+      end
+
+      sig { params(first: Object, second: Object).returns(T::Boolean) }
+      def matching_digest?(first, second)
+        return false unless first.is_a?(String) && second.is_a?(String)
+
+        first.delete_prefix("sha256:").casecmp?(second.delete_prefix("sha256:")) || false
       end
 
       sig do
@@ -1068,11 +1075,6 @@ module Dependabot
         )
       end
 
-      sig { void }
-      def mark_cooldown_date_unavailable
-        dependency.metadata[:docker_cooldown_date_unavailable] = true
-      end
-
       # Builds the PackageRelease version for a tag. Non-comparable tags (e.g.
       # "alpine") have no semver, so Docker::Version.new would raise. The version
       # is only consumed by semver-aware version-tag cooldown; the digest cooldown
@@ -1090,8 +1092,7 @@ module Dependabot
       # don't change the version string, so the default cooldown window applies
       # (semver-specific windows require a version delta, and the tag may be
       # non-comparable like "alpine"). Fails open (returns false) when the
-      # publication date can't be determined, so a missing Last-Modified header
-      # never permanently blocks an update.
+      # publication date can't be determined and records an unavailable-date warning.
       sig { params(tag_name: String).returns(T::Boolean) }
       def digest_within_cooldown?(tag_name)
         return false if should_skip_cooldown?
@@ -1101,7 +1102,10 @@ module Dependabot
 
         released_at = publication_detail(Tag.new(tag_name))&.released_at
         unless released_at
-          mark_cooldown_date_unavailable if cooldown.default_days.positive?
+          Dependabot::UpdateCheckers::CooldownCalculation.mark_cooldown_date_unavailable(
+            dependency,
+            cooldown_days: cooldown.default_days
+          )
           return false
         end
 

data/lib/dependabot/shared/shared_file_updater.rb

@@ -154,11 +154,12 @@ module Dependabot
         return if old_tags.empty?
 
         modified_content = content
+        replacement = new_helm_tag(file)
 
         old_tags.each do |old_tag|
-          old_tag_regex = /^\s*(?:-\s)?(?:tag|version):\s+["']?#{old_tag}["']?(?=\s|$)/
+          old_tag_regex = /^\s*(?:-\s)?(?:tag|version):\s+["']?#{Regexp.escape(old_tag)}["']?(?=\s|$)/
           modified_content = modified_content&.gsub(old_tag_regex) do |old_img_tag|
-            old_img_tag.gsub(old_tag.to_s, new_helm_tag(file).to_s)
+            old_img_tag.gsub(old_tag.to_s, replacement.to_s)
           end
         end
         modified_content
@@ -170,11 +171,12 @@ module Dependabot
         return if old_images.empty?
 
         modified_content = content
+        replacement = new_yaml_image(file)
 
         old_images.each do |old_image|
-          old_image_regex = /^\s*(?:-\s)?image:\s+#{old_image}(?=\s|$)/
+          old_image_regex = %r{^\s*(?:-\s)?image:\s+(?:docker\.io/)?#{Regexp.escape(old_image)}(?=\s|$)}
           modified_content = modified_content&.gsub(old_image_regex) do |old_img|
-            old_img.gsub(old_image.to_s, new_yaml_image(file).to_s)
+            old_img.gsub(old_image.to_s, replacement.to_s)
           end
         end
         modified_content
@@ -182,7 +184,7 @@ module Dependabot
 
       sig { params(file: Dependabot::DependencyFile).returns(String) }
       def new_yaml_image(file)
-        element = T.must(dependency).requirements.find { |r| r.file == file.name }
+        element = requirement_for_file(file)
         source = image_source(element)
         prefix = source[:registry] ? "#{source[:registry]}/" : ""
         digest = source[:digest] ? "@sha256:#{source[:digest]}" : ""
@@ -198,7 +200,7 @@ module Dependabot
           digest = source[:digest] ? "@sha256:#{source[:digest]}" : ""
           tag = source[:tag] ? ":#{source[:tag]}" : ""
           "#{prefix}#{T.must(dependency).name}#{tag}#{digest}"
-        end
+        end.uniq
       end
 
       sig { params(file: Dependabot::DependencyFile).returns(T::Array[String]) }
@@ -208,18 +210,23 @@ module Dependabot
           tag = source[:tag] || ""
           digest = source[:digest] ? "@sha256:#{source[:digest]}" : ""
           "#{tag}#{digest}"
-        end
+        end.uniq
       end
 
       sig { params(file: Dependabot::DependencyFile).returns(String) }
       def new_helm_tag(file)
-        element = T.must(dependency).requirements.find { |r| r.file == file.name }
+        element = requirement_for_file(file)
         source = image_source(element)
         tag = source[:tag] || ""
         digest = source[:digest] ? "@sha256:#{source[:digest]}" : ""
         "#{tag}#{digest}"
       end
 
+      sig { params(file: Dependabot::DependencyFile).returns(T.nilable(Dependabot::DependencyRequirement)) }
+      def requirement_for_file(file)
+        requirements(file).first
+      end
+
       protected
 
       sig { params(file: Dependabot::DependencyFile, dependency: Dependabot::Dependency).returns(T::Boolean) }

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-docker
 version: !ruby/object:Gem::Version
-  version: 0.395.0
+  version: 0.397.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.395.0
+        version: 0.397.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.395.0
+        version: 0.397.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -266,7 +266,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.395.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.397.0
 rdoc_options: []
 require_paths:
 - lib