dependabot-docker 0.259.0 → 0.260.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ded4ed623fee8809efe189b637e261bc4ffb2b3e9673432489c42ba318830011
-  data.tar.gz: a87f37b18e0eb8fdcc186a46e41ef28fe6097c21cd1f1d3fc871a7386f47b745
+  metadata.gz: c2b8bc30ebbc60146a41cb00193a87642254cea63e48d63a6ceb5f0bd3305e63
+  data.tar.gz: 8085d1d31692622d6ee57bbdc0466e388257275fb7aaa3841a6a426192f9f5ea
 SHA512:
-  metadata.gz: cb30e7ca42d906f02639c6d92d9ced36a9d1139fbda59456332c2718c70c9b2a439aa9e2f3b8d8bcc46fa718326820006c7d24ce884979846027ae4e9457d012
-  data.tar.gz: 40bddffd6d37c1e33cb4b0d7ad130da57a3246bffa02e2e5b9321a85da9b6ac441c5749bf8a19995302cab44d3e939b27a32b1f894c0d1144a766ef525789234
+  metadata.gz: 95e886db37f7981efa16b2c00569b3eb37cb5dc5ebcb4824d34cb2d776d25276c982597088451d8cbdf2816fddf19418c0979c699e80529d5c63b5fef34dcbd2
+  data.tar.gz: c9034900857a4f7714769f3639da527f8cfdc2d70ab2591b54718e33844c70c76364c6cc8e808523988bbd7f78bb6a6c7c97fcacec14ed15b8b4ecd7290ace09

data/lib/dependabot/docker/file_fetcher.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "sorbet-runtime"
@@ -15,11 +15,13 @@ module Dependabot
       YAML_REGEXP = /^[^\.].*\.ya?ml$/i
       DOCKER_REGEXP = /dockerfile/i
 
+      sig { override.params(filenames: T::Array[String]).returns(T::Boolean) }
       def self.required_files_in?(filenames)
         filenames.any? { |f| f.match?(DOCKER_REGEXP) } or
           filenames.any? { |f| f.match?(YAML_REGEXP) }
       end
 
+      sig { override.returns(String) }
       def self.required_files_message
         "Repo must contain a Dockerfile or Kubernetes YAML files."
       end
@@ -40,54 +42,66 @@ module Dependabot
         elsif incorrectly_encoded_dockerfiles.none?
           raise(
             Dependabot::DependencyFileNotParseable,
-            incorrectly_encoded_yamlfiles.first.path
+            T.must(incorrectly_encoded_yamlfiles.first).path
           )
         else
           raise(
             Dependabot::DependencyFileNotParseable,
-            incorrectly_encoded_dockerfiles.first.path
+            T.must(incorrectly_encoded_dockerfiles.first).path
           )
         end
       end
 
       private
 
+      sig { returns(T::Array[DependencyFile]) }
       def dockerfiles
-        @dockerfiles ||=
-          repo_contents(raise_errors: false)
+        @dockerfiles ||= T.let(fetch_dockerfiles, T.nilable(T::Array[DependencyFile]))
+      end
+
+      sig { returns(T::Array[Dependabot::DependencyFile]) }
+      def fetch_dockerfiles
+        repo_contents(raise_errors: false)
           .select { |f| f.type == "file" && f.name.match?(DOCKER_REGEXP) }
           .map { |f| fetch_file_from_host(f.name) }
       end
 
+      sig { returns(T::Array[DependencyFile]) }
       def correctly_encoded_dockerfiles
-        dockerfiles.select { |f| f.content.valid_encoding? }
+        dockerfiles.select { |f| f.content&.valid_encoding? }
       end
 
+      sig { returns(T::Array[DependencyFile]) }
       def incorrectly_encoded_dockerfiles
-        dockerfiles.reject { |f| f.content.valid_encoding? }
+        dockerfiles.reject { |f| f.content&.valid_encoding? }
       end
 
+      sig { returns(T::Array[DependencyFile]) }
       def yamlfiles
-        @yamlfiles ||=
+        @yamlfiles ||= T.let(
           repo_contents(raise_errors: false)
-          .select { |f| f.type == "file" && f.name.match?(YAML_REGEXP) }
-          .map { |f| fetch_file_from_host(f.name) }
+                  .select { |f| f.type == "file" && f.name.match?(YAML_REGEXP) }
+                  .map { |f| fetch_file_from_host(f.name) },
+          T.nilable(T::Array[DependencyFile])
+        )
       end
 
+      sig { params(resource: Object).returns(T.nilable(T::Boolean)) }
       def likely_kubernetes_resource?(resource)
         # Heuristic for being a Kubernetes resource. We could make this tighter but this probably works well.
         resource.is_a?(::Hash) && resource.key?("apiVersion") && resource.key?("kind")
       end
 
+      sig { returns(T::Array[Dependabot::DependencyFile]) }
       def correctly_encoded_yamlfiles
-        candidate_files = yamlfiles.select { |f| f.content.valid_encoding? }
+        candidate_files = yamlfiles.select { |f| f.content&.valid_encoding? }
         candidate_files.select do |f|
           if f.type == "file" && Utils.likely_helm_chart?(f)
             true
           else
             # This doesn't handle multi-resource files, but it shouldn't matter, since the first resource
             # in a multi-resource file had better be a valid k8s resource
-            content = ::YAML.safe_load(f.content, aliases: true)
+            content = ::YAML.safe_load(T.must(f.content), aliases: true)
             likely_kubernetes_resource?(content)
           end
         rescue ::Psych::Exception
@@ -95,8 +109,9 @@ module Dependabot
         end
       end
 
+      sig { returns(T::Array[Dependabot::DependencyFile]) }
       def incorrectly_encoded_yamlfiles
-        yamlfiles.reject { |f| f.content.valid_encoding? }
+        yamlfiles.reject { |f| f.content&.valid_encoding? }
       end
     end
   end

data/lib/dependabot/docker/file_parser.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "docker_registry2"
@@ -7,10 +7,13 @@ require "dependabot/dependency"
 require "dependabot/file_parsers"
 require "dependabot/file_parsers/base"
 require "dependabot/errors"
+require "sorbet-runtime"
 
 module Dependabot
   module Docker
     class FileParser < Dependabot::FileParsers::Base
+      extend T::Sig
+
       require "dependabot/file_parsers/base/dependency_set"
 
       YAML_REGEXP = /^[^\.].*\.ya?ml$/i
@@ -39,11 +42,12 @@ module Dependabot
 
       IMAGE_SPEC = %r{^(#{REGISTRY}/)?#{IMAGE}#{TAG}?(?:@sha256:#{DIGEST})?#{NAME}?}x
 
+      sig { override.returns(T::Array[Dependabot::Dependency]) }
       def parse
         dependency_set = DependencySet.new
 
         dockerfiles.each do |dockerfile|
-          dockerfile.content.each_line do |line|
+          T.must(dockerfile.content).each_line do |line|
             next unless FROM_LINE.match?(line)
 
             parsed_from_line = T.must(FROM_LINE.match(line)).named_captures
@@ -75,15 +79,18 @@ module Dependabot
 
       private
 
+      sig { returns(T::Array[Dependabot::DependencyFile]) }
       def dockerfiles
         # The Docker file fetcher fetches Dockerfiles and yaml files. Reject yaml files.
         dependency_files.reject { |f| f.type == "file" && f.name.match?(YAML_REGEXP) }
       end
 
+      sig { params(parsed_from_line: T::Hash[String, T.nilable(String)]).returns(T.nilable(String)) }
       def version_from(parsed_from_line)
         parsed_from_line.fetch("tag") || parsed_from_line.fetch("digest")
       end
 
+      sig { params(parsed_from_line: T::Hash[String, T.nilable(String)]).returns(T::Hash[String, T.nilable(String)]) }
       def source_from(parsed_from_line)
         source = {}
 
@@ -96,6 +103,7 @@ module Dependabot
         source
       end
 
+      sig { override.void }
       def check_required_files
         # Just check if there are any files at all.
         return if dependency_files.any?
@@ -103,6 +111,7 @@ module Dependabot
         raise "No Dockerfile!"
       end
 
+      sig { params(file: T.untyped).returns(Dependabot::FileParsers::Base::DependencySet) }
       def workfile_file_dependencies(file)
         dependency_set = DependencySet.new
 
@@ -130,6 +139,10 @@ module Dependabot
         raise Dependabot::DependencyFileNotParseable, file.path
       end
 
+      sig do
+        params(file: T.untyped, details: T.untyped,
+               version: T.nilable(T.any(String, Dependabot::Version))).returns(Dependabot::Dependency)
+      end
       def build_image_dependency(file, details, version)
         Dependency.new(
           name: details.fetch("image"),
@@ -144,6 +157,7 @@ module Dependabot
         )
       end
 
+      sig { params(json_obj: T.anything).returns(T.untyped) }
       def deep_fetch_images(json_obj)
         case json_obj
         when Hash then deep_fetch_images_from_hash(json_obj)
@@ -152,6 +166,7 @@ module Dependabot
         end
       end
 
+      sig { params(json_object: T.untyped).returns(T::Array[T.untyped]) }
       def deep_fetch_images_from_hash(json_object)
         img = json_object.fetch("image", nil)
 
@@ -167,11 +182,13 @@ module Dependabot
         images + json_object.values.flat_map { |obj| deep_fetch_images(obj) }
       end
 
+      sig { returns(T::Array[Dependabot::DependencyFile]) }
       def manifest_files
         # Dependencies include both Dockerfiles and yaml, select yaml.
         dependency_files.select { |f| f.type == "file" && f.name.match?(YAML_REGEXP) }
       end
 
+      sig { params(img_hash: T::Hash[String, T.nilable(String)]).returns(T::Array[String]) }
       def parse_helm(img_hash)
         tag_value = img_hash.key?("tag") ? img_hash.fetch("tag", nil) : img_hash.fetch("version", nil)
         return [] unless tag_value
@@ -179,7 +196,7 @@ module Dependabot
         repo = img_hash.fetch("repository", nil)
         return [] unless repo
 
-        tag_details = tag_value.to_s.match(TAG_WITH_DIGEST).named_captures
+        tag_details = T.must(tag_value.to_s.match(TAG_WITH_DIGEST)).named_captures
         tag = tag_details["tag"]
         return [repo] unless tag
 

data/lib/dependabot/docker/file_updater.rb

@@ -1,19 +1,23 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "dependabot/docker/utils/helpers"
 require "dependabot/file_updaters"
 require "dependabot/file_updaters/base"
 require "dependabot/errors"
+require "sorbet-runtime"
 
 module Dependabot
   module Docker
     class FileUpdater < Dependabot::FileUpdaters::Base
+      extend T::Sig
+
       FROM_REGEX = /FROM(\s+--platform\=\S+)?/i
 
       YAML_REGEXP = /^[^\.].*\.ya?ml$/i
       DOCKER_REGEXP = /dockerfile/i
 
+      sig { override.returns(T::Array[Regexp]) }
       def self.updated_files_regex
         [
           DOCKER_REGEXP,
@@ -21,15 +25,16 @@ module Dependabot
         ]
       end
 
+      sig { override.returns(T::Array[Dependabot::DependencyFile]) }
       def updated_dependency_files
         updated_files = []
         dependency_files.each do |file|
-          next unless requirement_changed?(file, dependency)
+          next unless requirement_changed?(file, T.must(dependency))
 
           updated_files << if file.name.match?(YAML_REGEXP)
                              updated_file(
                                file: file,
-                               content: updated_yaml_content(file)
+                               content: T.must(updated_yaml_content(file))
                              )
                            else
                              updated_file(
@@ -47,11 +52,13 @@ module Dependabot
 
       private
 
+      sig { returns T.nilable(Dependabot::Dependency) }
       def dependency
         # Dockerfiles will only ever be updating a single dependency
         dependencies.first
       end
 
+      sig { override.void }
       def check_required_files
         # Just check if there are any files at all.
         return if dependency_files.any?
@@ -59,14 +66,15 @@ module Dependabot
         raise "No Dockerfile!"
       end
 
+      sig { params(file: Dependabot::DependencyFile).returns(String) }
       def updated_dockerfile_content(file)
         old_sources = previous_sources(file)
         new_sources = sources(file)
 
-        updated_content = file.content
+        updated_content = T.let(file.content, T.untyped)
 
-        old_sources.zip(new_sources).each do |old_source, new_source|
-          updated_content = update_digest_and_tag(updated_content, old_source, new_source)
+        T.must(old_sources).zip(new_sources).each do |old_source, new_source|
+          updated_content = update_digest_and_tag(updated_content, old_source, T.must(new_source))
         end
 
         raise "Expected content to change!" if updated_content == file.content
@@ -74,6 +82,10 @@ module Dependabot
         updated_content
       end
 
+      sig do
+        params(previous_content: String, old_source: T::Hash[Symbol, T.nilable(String)],
+               new_source: T::Hash[Symbol, T.nilable(String)]).returns(String)
+      end
       def update_digest_and_tag(previous_content, old_source, new_source)
         old_digest = old_source[:digest]
         new_digest = new_source[:digest]
@@ -86,7 +98,7 @@ module Dependabot
           else
             ""
           end
-        old_declaration += dependency.name
+        old_declaration += T.must(dependency).name
         old_declaration +=
           if specified_with_tag?(old_source) then ":#{old_tag}"
           else
@@ -109,36 +121,44 @@ module Dependabot
         end
       end
 
+      sig { params(source: T::Hash[Symbol, T.nilable(String)]).returns(T.nilable(String)) }
       def specified_with_tag?(source)
         source[:tag]
       end
 
+      sig { params(source: T::Hash[Symbol, T.nilable(String)]).returns(T.nilable(String)) }
       def specified_with_digest?(source)
         source[:digest]
       end
 
+      sig { params(file: Dependabot::DependencyFile).returns(T.nilable(T::Array[String])) }
       def new_tags(file)
         requirements(file)
           .map { |r| r.fetch(:source)[:tag] }
       end
 
+      sig { params(file: Dependabot::DependencyFile).returns(T.nilable(T::Array[String])) }
       def old_tags(file)
         previous_requirements(file)
-          .map { |r| r.fetch(:source)[:tag] }
+          &.map { |r| r.fetch(:source)[:tag] }
       end
 
+      sig { params(source: T::Hash[Symbol, T.nilable(String)]).returns(T.nilable(String)) }
       def private_registry_url(source)
         source[:registry]
       end
 
+      sig { params(file: Dependabot::DependencyFile).returns(T::Array[T::Hash[Symbol, T.nilable(String)]]) }
       def sources(file)
         requirements(file).map { |r| r.fetch(:source) }
       end
 
+      sig { params(file: Dependabot::DependencyFile).returns(T.nilable(T::Array[T::Hash[Symbol, T.nilable(String)]])) }
       def previous_sources(file)
-        previous_requirements(file).map { |r| r.fetch(:source) }
+        previous_requirements(file)&.map { |r| r.fetch(:source) }
       end
 
+      sig { params(file: Dependabot::DependencyFile).returns(T.nilable(String)) }
       def updated_yaml_content(file)
         updated_content = file.content
         updated_content = update_helm(file, updated_content) if Utils.likely_helm_chart?(file)
@@ -149,6 +169,7 @@ module Dependabot
         updated_content
       end
 
+      sig { params(file: Dependabot::DependencyFile, content: T.nilable(String)).returns(T.nilable(String)) }
       def update_helm(file, content)
         # TODO: this won't work if two images have the same tag version
         old_tags = old_helm_tags(file)
@@ -158,13 +179,14 @@ module Dependabot
 
         old_tags.each do |old_tag|
           old_tag_regex = /^\s+(?:-\s)?(?:tag|version):\s+["']?#{old_tag}["']?(?=\s|$)/
-          modified_content = modified_content.gsub(old_tag_regex) do |old_img_tag|
+          modified_content = modified_content&.gsub(old_tag_regex) do |old_img_tag|
             old_img_tag.gsub(old_tag.to_s, new_helm_tag(file).to_s)
           end
         end
         modified_content
       end
 
+      sig { params(file: Dependabot::DependencyFile, content: T.nilable(String)).returns(T.nilable(String)) }
       def update_image(file, content)
         old_images = old_yaml_images(file)
         return if old_images.empty?
@@ -173,53 +195,59 @@ module Dependabot
 
         old_images.each do |old_image|
           old_image_regex = /^\s*(?:-\s)?image:\s+#{old_image}(?=\s|$)/
-          modified_content = modified_content.gsub(old_image_regex) do |old_img|
+          modified_content = modified_content&.gsub(old_image_regex) do |old_img|
             old_img.gsub(old_image.to_s, new_yaml_image(file).to_s)
           end
         end
         modified_content
       end
 
+      sig { params(file: Dependabot::DependencyFile).returns(String) }
       def new_yaml_image(file)
-        element = dependency.requirements.find { |r| r[:file] == file.name }
-        prefix = element.fetch(:source)[:registry] ? "#{element.fetch(:source)[:registry]}/" : ""
-        digest = element.fetch(:source)[:digest] ? "@sha256:#{element.fetch(:source)[:digest]}" : ""
-        tag = element.fetch(:source)[:tag] ? ":#{element.fetch(:source)[:tag]}" : ""
-        "#{prefix}#{dependency.name}#{tag}#{digest}"
+        element = T.must(dependency).requirements.find { |r| r[:file] == file.name }
+        prefix = element&.dig(:source, :registry) ? "#{element.fetch(:source)[:registry]}/" : ""
+        digest = element&.dig(:source, :digest) ? "@sha256:#{element.fetch(:source)[:digest]}" : ""
+        tag = element&.dig(:source, :tag) ? ":#{element.fetch(:source)[:tag]}" : ""
+        "#{prefix}#{T.must(dependency).name}#{tag}#{digest}"
       end
 
+      sig { params(file: Dependabot::DependencyFile).returns(T::Array[String]) }
       def old_yaml_images(file)
-        previous_requirements(file).map do |r|
+        T.must(previous_requirements(file)).map do |r|
           prefix = r.fetch(:source)[:registry] ? "#{r.fetch(:source)[:registry]}/" : ""
           digest = r.fetch(:source)[:digest] ? "@sha256:#{r.fetch(:source)[:digest]}" : ""
           tag = r.fetch(:source)[:tag] ? ":#{r.fetch(:source)[:tag]}" : ""
-          "#{prefix}#{dependency.name}#{tag}#{digest}"
+          "#{prefix}#{T.must(dependency).name}#{tag}#{digest}"
         end
       end
 
+      sig { params(file: Dependabot::DependencyFile).returns(T::Array[String]) }
       def old_helm_tags(file)
-        previous_requirements(file).map do |r|
+        T.must(previous_requirements(file)).map do |r|
           tag = r.fetch(:source)[:tag] || ""
           digest = r.fetch(:source)[:digest] ? "@sha256:#{r.fetch(:source)[:digest]}" : ""
           "#{tag}#{digest}"
         end
       end
 
+      sig { params(file: Dependabot::DependencyFile).returns(String) }
       def new_helm_tag(file)
-        element = dependency.requirements.find { |r| r[:file] == file.name }
-        tag = element.fetch(:source)[:tag] || ""
-        digest = element.fetch(:source)[:digest] ? "@sha256:#{element.fetch(:source)[:digest]}" : ""
+        element = T.must(dependency).requirements.find { |r| r[:file] == file.name }
+        tag = T.must(element).dig(:source, :tag) || ""
+        digest = T.must(element).dig(:source, :digest) ? "@sha256:#{T.must(element).dig(:source, :digest)}" : ""
         "#{tag}#{digest}"
       end
 
+      sig { params(file: Dependabot::DependencyFile).returns(T::Array[T::Hash[Symbol, T.untyped]]) }
       def requirements(file)
-        dependency.requirements
-                  .select { |r| r[:file] == file.name }
+        T.must(dependency).requirements
+         .select { |r| r[:file] == file.name }
       end
 
+      sig { params(file: Dependabot::DependencyFile).returns T.nilable(T::Array[T::Hash[Symbol, T.untyped]]) }
       def previous_requirements(file)
-        dependency.previous_requirements
-                  .select { |r| r[:file] == file.name }
+        T.must(dependency).previous_requirements
+         &.select { |r| r[:file] == file.name }
       end
     end
   end

data/lib/dependabot/docker/metadata_finder.rb

@@ -1,15 +1,19 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "dependabot/metadata_finders"
 require "dependabot/metadata_finders/base"
 require "dependabot/shared_helpers"
+require "sorbet-runtime"
 
 module Dependabot
   module Docker
     class MetadataFinder < Dependabot::MetadataFinders::Base
+      extend T::Sig
+
       private
 
+      sig { override.returns(T.nilable(Dependabot::Source)) }
       def look_up_source
         return if dependency.requirements.empty?
 

data/lib/dependabot/docker/requirement.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "sorbet-runtime"
@@ -17,15 +17,17 @@ module Dependabot
       # contains a single element.
       sig { override.params(requirement_string: T.nilable(String)).returns(T::Array[Requirement]) }
       def self.requirements_array(requirement_string)
-        [new(requirement_string)]
+        [new(T.must(requirement_string))]
       end
 
+      sig { override.params(version: Version).returns(T::Boolean) }
       def satisfied_by?(version)
         super(version.release_part)
       end
 
       # Patches Gem::Requirement to make it accept requirement strings like
       # "~> 4.2.5, >= 4.2.5.1" without first needing to split them.
+      sig { params(requirements: String).void }
       def initialize(*requirements)
         requirements = requirements.flatten.flat_map do |req_string|
           req_string.split(",").map(&:strip)

data/lib/dependabot/docker/tag.rb

@@ -1,11 +1,13 @@
-# typed: true
+# typed: strong
 # frozen_string_literal: true
 
 require "dependabot/docker/file_parser"
+require "sorbet-runtime"
 
 module Dependabot
   module Docker
     class Tag
+      extend T::Sig
       WORDS_WITH_BUILD = /(?:(?:-[a-z]+)+-[0-9]+)+/
       VERSION_REGEX = /v?(?<version>[0-9]+(?:\.[0-9]+)*(?:_[0-9]+|\.[a-z0-9]+|#{WORDS_WITH_BUILD}|-(?:kb)?[0-9]+)*)/i
       VERSION_WITH_SFX = /^#{VERSION_REGEX}(?<suffix>-[a-z][a-z0-9.\-]*)?$/i
@@ -17,25 +19,30 @@ module Dependabot
           #{VERSION_WITH_SFX}|
           #{VERSION_WITH_PFX_AND_SFX}
       /x
-
+      sig { returns(String) }
       attr_reader :name
 
+      sig { params(name: String).void }
       def initialize(name)
         @name = name
       end
 
+      sig { returns(String) }
       def to_s
         name
       end
 
+      sig { returns(T::Boolean) }
       def digest?
         name.match?(FileParser::DIGEST)
       end
 
+      sig { returns(T.nilable(T::Boolean)) }
       def looks_like_prerelease?
-        numeric_version.match?(/[a-zA-Z]/)
+        numeric_version&.match?(/[a-zA-Z]/)
       end
 
+      sig { params(other: Tag).returns(T::Boolean) }
       def comparable_to?(other)
         return false unless comparable?
 
@@ -51,47 +58,55 @@ module Dependabot
         equal_prefix && equal_format && equal_suffix
       end
 
+      sig { returns(T::Boolean) }
       def comparable?
         name.match?(NAME_WITH_VERSION)
       end
 
+      sig { params(other: Tag).returns(T::Boolean) }
       def same_precision?(other)
         other.precision == precision
       end
 
+      sig { params(other: Tag).returns(T::Boolean) }
       def same_but_less_precise?(other)
         other.segments.zip(segments).all? do |segment, other_segment|
           segment == other_segment || other_segment.nil?
         end
       end
 
+      sig { returns(T.nilable(T::Boolean)) }
       def canonical?
         return false unless numeric_version
         return true if name == numeric_version
 
         # .NET tags are suffixed with -sdk
-        return true if name == numeric_version + "-sdk"
+        return true if numeric_version && name == numeric_version.to_s + "-sdk"
 
-        name == "jdk-" + numeric_version
+        numeric_version && name == "jdk-" + T.must(numeric_version)
       end
 
+      sig { returns T.nilable(String) }
       def prefix
-        name.match(NAME_WITH_VERSION).named_captures.fetch("prefix")
+        name.match(NAME_WITH_VERSION)&.named_captures&.fetch("prefix")
       end
 
+      sig { returns T.nilable(String) }
       def suffix
-        name.match(NAME_WITH_VERSION).named_captures.fetch("suffix")
+        name.match(NAME_WITH_VERSION)&.named_captures&.fetch("suffix")
       end
 
+      sig { returns T.nilable(String) }
       def version
-        name.match(NAME_WITH_VERSION).named_captures.fetch("version")
+        name.match(NAME_WITH_VERSION)&.named_captures&.fetch("version")
       end
 
+      sig { returns(Symbol) }
       def format
         return :sha_suffixed if name.match?(/(^|\-g?)[0-9a-f]{7,}$/)
-        return :year_month if version.match?(/^[12]\d{3}(?:[.\-]|$)/)
-        return :year_month_day if version.match?(/^[12](?:\d{5}|\d{7})(?:[.\-]|$)/)
-        return :build_num if version.match?(/^\d+$/)
+        return :year_month if version&.match?(/^[12]\d{3}(?:[.\-]|$)/)
+        return :year_month_day if version&.match?(/^[12](?:\d{5}|\d{7})(?:[.\-]|$)/)
+        return :build_num if version&.match?(/^\d+$/)
 
         # As an example, "21-ea-32", "22-ea-7", and "22-ea-jdk-nanoserver-1809"
         # are mapped to "<version>-ea-<build_num>", "<version>-ea-<build_num>",
@@ -100,25 +115,28 @@ module Dependabot
         # That means only "22-ea-7" will be considered as a viable update
         # candidate for "21-ea-32", since it's the only one that respects that
         # format.
-        if version.match?(WORDS_WITH_BUILD)
-          return :"<version>#{version.match(WORDS_WITH_BUILD).to_s.gsub(/-[0-9]+/, '-<build_num>')}"
+        if version&.match?(WORDS_WITH_BUILD)
+          return :"<version>#{T.must(version).match(WORDS_WITH_BUILD).to_s.gsub(/-[0-9]+/, '-<build_num>')}"
         end
 
         :normal
       end
 
+      sig { returns(T.nilable(String)) }
       def numeric_version
         return unless comparable?
 
-        version.gsub(/kb/i, "").gsub(/-[a-z]+/, "").downcase
+        version&.gsub(/kb/i, "")&.gsub(/-[a-z]+/, "")&.downcase
       end
 
+      sig { returns(Integer) }
       def precision
         segments.length
       end
 
+      sig { returns(T::Array[String]) }
       def segments
-        numeric_version.split(/[.-]/)
+        T.must(numeric_version).split(/[.-]/)
       end
     end
   end

data/lib/dependabot/docker/update_checker.rb

@@ -357,7 +357,7 @@ module Dependabot
       end
 
       def version_tag
-        @version_tag ||= Tag.new(dependency.version)
+        @version_tag ||= Tag.new(T.must(dependency.version))
       end
     end
   end

data/lib/dependabot/docker/utils/credentials_finder.rb

@@ -1,8 +1,9 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "aws-sdk-ecr"
 require "base64"
+require "sorbet-runtime"
 
 require "dependabot/credential"
 require "dependabot/errors"
@@ -16,6 +17,7 @@ module Dependabot
         AWS_ECR_URL = /dkr\.ecr\.(?<region>[^.]+)\.amazonaws\.com/
         DEFAULT_DOCKER_HUB_REGISTRY = "registry.hub.docker.com"
 
+        sig { params(credentials: T::Array[Dependabot::Credential]).void }
         def initialize(credentials)
           @credentials = credentials
         end
@@ -32,14 +34,20 @@ module Dependabot
           build_aws_credentials(registry_details)
         end
 
+        sig { returns(T.nilable(String)) }
         def base_registry
-          @base_registry ||= credentials.find do |cred|
-            cred["type"] == "docker_registry" && cred.replaces_base?
-          end
-          @base_registry ||= { "registry" => DEFAULT_DOCKER_HUB_REGISTRY, "credentials" => nil }
+          @base_registry ||= T.let(
+            credentials.find do |cred|
+              cred["type"] == "docker_registry" && cred.replaces_base?
+            end,
+            T.nilable(Dependabot::Credential)
+          )
+          @base_registry ||= Dependabot::Credential.new({ "registry" => DEFAULT_DOCKER_HUB_REGISTRY,
+                                                          "credentials" => nil })
           @base_registry["registry"]
         end
 
+        sig { params(registry: String).returns(T::Boolean) }
         def using_dockerhub?(registry)
           registry == DEFAULT_DOCKER_HUB_REGISTRY
         end
@@ -76,11 +84,11 @@ module Dependabot
 
           # Otherwise, we need to use the provided Access Key ID and secret to
           # generate a temporary username and password
-          @authorization_tokens ||= {}
+          @authorization_tokens ||= T.let({}, T.nilable(T::Hash[String, String]))
           @authorization_tokens[registry_hostname] ||=
             ecr_client.get_authorization_token.authorization_data.first.authorization_token
           username, password =
-            Base64.decode64(@authorization_tokens[registry_hostname]).split(":")
+            Base64.decode64(T.must(@authorization_tokens[registry_hostname])).split(":")
           registry_details.merge(Dependabot::Credential.new({ "username" => username, "password" => password }))
         rescue Aws::Errors::MissingCredentialsError,
                Aws::ECR::Errors::UnrecognizedClientException,

data/lib/dependabot/docker/utils/helpers.rb

@@ -1,11 +1,16 @@
-# typed: true
+# typed: strong
 # frozen_string_literal: true
 
+require "sorbet-runtime"
+
 module Dependabot
   module Docker
     module Utils
       HELM_REGEXP = /values[\-a-zA-Z_0-9]*\.ya?ml$/i
 
+      extend T::Sig
+
+      sig { params(file: Dependabot::DependencyFile).returns(T::Boolean) }
       def self.likely_helm_chart?(file)
         file.name.match?(HELM_REGEXP)
       end

data/lib/dependabot/docker/version.rb

@@ -1,9 +1,10 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "dependabot/version"
 require "dependabot/utils"
 require "dependabot/docker/tag"
+require "sorbet-runtime"
 
 module Dependabot
   module Docker
@@ -13,54 +14,65 @@ module Dependabot
     # for a description of Java versions.
     #
     class Version < Dependabot::Version
+      extend T::Sig
       # The regex has limits for the 0,255 and 1,255 repetitions to avoid infinite limits which makes codeql angry.
       # A docker image cannot be longer than 255 characters anyways.
       DOCKER_VERSION_REGEX = /^(?<prefix>[a-z._\-]{0,255})[_\-v]?(?<version>.{1,255})$/
 
+      sig { override.params(version: VersionParameter).void }
       def initialize(version)
-        parsed_version = version.match(DOCKER_VERSION_REGEX)
-        release_part, update_part = parsed_version[:version].split("_", 2)
+        parsed_version = version.to_s.match(DOCKER_VERSION_REGEX)
+        release_part, update_part = T.must(T.must(parsed_version)[:version]).split("_", 2)
 
         # The numeric_version is needed here to validate the version string (ex: 20.9.0-alpine3.18)
         # when the call is made via Depenedabot Api to convert the image version to semver.
-        release_part = Tag.new(release_part.chomp(".").chomp("-").chomp("_")).numeric_version
+        release_part = Tag.new(T.must(release_part).chomp(".").chomp("-").chomp("_")).numeric_version
 
-        @release_part = Dependabot::Version.new(release_part.tr("-", "."))
-        @update_part = Dependabot::Version.new(update_part&.start_with?(/[0-9]/) ? update_part : 0)
+        @release_part = T.let(Dependabot::Version.new(T.must(release_part).tr("-", ".")), Dependabot::Version)
+        @update_part = T.let(
+          Dependabot::Version.new(update_part&.start_with?(/[0-9]/) ? update_part : 0),
+          Dependabot::Version
+        )
 
         super(@release_part)
       end
 
+      sig { override.params(version: VersionParameter).returns(T::Boolean) }
       def self.correct?(version)
         return true if version.is_a?(Gem::Version)
 
         # We can't call new here because Gem::Version calls self.correct? in its initialize method
         # causing an infinite loop, so instead we check if the release_part of the version is correct
-        parsed_version = version.match(DOCKER_VERSION_REGEX)
+        parsed_version = version.to_s.match(DOCKER_VERSION_REGEX)
         return false if parsed_version.nil?
 
-        release_part, = parsed_version[:version].split("_", 2)
-        release_part = Tag.new(release_part.chomp(".").chomp("-").chomp("_")).numeric_version || parsed_version
+        release_part, = T.must(parsed_version[:version]).split("_", 2)
+        release_part = Tag.new(T.must(release_part).chomp(".").chomp("-").chomp("_")).numeric_version || parsed_version
         super(release_part.to_s)
       rescue ArgumentError
         # if we can't instantiate a version, it can't be correct
         false
       end
 
+      sig { override.returns(String) }
       def to_semver
         @release_part.to_semver
       end
 
+      sig { returns(T::Array[String]) }
       def segments
         @release_part.segments
       end
 
+      sig { returns(Dependabot::Version) }
       attr_reader :release_part
 
+      sig { params(other: Dependabot::Docker::Version).returns(T.nilable(Integer)) }
       def <=>(other)
         sort_criteria <=> other.sort_criteria
       end
 
+      sig { returns(T::Array[Dependabot::Version]) }
       def sort_criteria
         [@release_part, @update_part]
       end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-docker
 version: !ruby/object:Gem::Version
-  version: 0.259.0
+  version: 0.260.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-05-30 00:00:00.000000000 Z
+date: 2024-06-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.259.0
+        version: 0.260.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.259.0
+        version: 0.260.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -258,7 +258,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.259.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.260.0
 post_install_message: 
 rdoc_options: []
 require_paths: