dependabot-docker 0.297.0 → 0.297.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6d070a8c350a116ad04884cf6cbbe9b57c391ca1bf7b2ac98de5aaa207d8a530
-  data.tar.gz: 9648e19e64e9a9b93fbe16aaa013a7211753209cd868a04d59b94636e75e6131
+  metadata.gz: cccf6c10f85241bf26410b82522a328174d17dcbb8d1a98bb9d840ab135660b2
+  data.tar.gz: 6796c6ab266df1313ee063ddb6c7c0b983b5297e3b5a0f30145604ae6cde9c9c
 SHA512:
-  metadata.gz: 36a53dc44f6dce85bd127a67411cdde5307970168c29d923c44c1aa746063140e885b4df66d03136ffdc841883987361b037cf29215ca7b04007a2e4867467a4
-  data.tar.gz: 93974ab9675312d56b135f9d99731f0d8f4b368718118e467d8025171cdbd8277ac848ad706edcc3193d906031a6c337086d348afcf380636b6d0003fa7817d8
+  metadata.gz: 4a501a6453057650b26929251686eda18440fd30aec093cfcd7c84a8fa908ed0a1893fea3a3f6cb7078c1dad93d0ebe096c9fde3c8de06205627299567aadada
+  data.tar.gz: 823c1834d1723c2b970424acdd8f1ecd5ef02aa0013230a46fd6457eb74dc115c50e2b10d70117147fe3e425d4d128ecf8a0939d686f4d1124ff0e85f5fbae59

data/lib/dependabot/docker/file_fetcher.rb

@@ -1,68 +1,63 @@
 # typed: strict
 # frozen_string_literal: true
 
-require "sorbet-runtime"
-require "dependabot/docker/utils/helpers"
-require "dependabot/file_fetchers"
-require "dependabot/file_fetchers/base"
+require "dependabot/shared/utils/helpers"
+require "dependabot/shared/shared_file_fetcher"
 
 module Dependabot
   module Docker
-    class FileFetcher < Dependabot::FileFetchers::Base
+    class FileFetcher < Dependabot::Shared::SharedFileFetcher
       extend T::Sig
-      extend T::Helpers
 
-      YAML_REGEXP = /^[^\.].*\.ya?ml$/i
       DOCKER_REGEXP = /dockerfile|containerfile/i
 
+      sig { override.returns(Regexp) }
+      def self.filename_regex
+        DOCKER_REGEXP
+      end
+
+      sig { override.returns(String) }
+      def self.required_files_message
+        "Repo must contain a Dockerfile, Containerfile, or Kubernetes YAML files."
+      end
+
       sig { override.params(filenames: T::Array[String]).returns(T::Boolean) }
       def self.required_files_in?(filenames)
         filenames.any? { |f| f.match?(DOCKER_REGEXP) } or
           filenames.any? { |f| f.match?(YAML_REGEXP) }
       end
 
+      private
+
       sig { override.returns(String) }
-      def self.required_files_message
-        "Repo must contain a Dockerfile, Containerfile, or Kubernetes YAML files."
+      def default_file_name
+        "Dockerfile"
+      end
+
+      sig { override.returns(String) }
+      def file_type
+        "Docker"
       end
 
       sig { override.returns(T::Array[DependencyFile]) }
       def fetch_files
-        fetched_files = []
-        fetched_files += correctly_encoded_dockerfiles
-        fetched_files += correctly_encoded_yamlfiles
+        fetched_files = correctly_encoded_dockerfiles
+        fetched_files += super
 
         return fetched_files if fetched_files.any?
 
-        if incorrectly_encoded_dockerfiles.none? && incorrectly_encoded_yamlfiles.none?
-          raise Dependabot::DependencyFileNotFound.new(
-            File.join(directory, "Dockerfile"),
-            "No Dockerfiles nor Kubernetes YAML found in #{directory}"
-          )
-        elsif incorrectly_encoded_dockerfiles.none?
-          raise(
-            Dependabot::DependencyFileNotParseable,
-            T.must(incorrectly_encoded_yamlfiles.first).path
-          )
-        else
-          raise(
-            Dependabot::DependencyFileNotParseable,
-            T.must(incorrectly_encoded_dockerfiles.first).path
-          )
-        end
+        raise_appropriate_error(incorrectly_encoded_dockerfiles)
       end
 
-      private
-
       sig { returns(T::Array[DependencyFile]) }
       def dockerfiles
-        @dockerfiles ||= T.let(fetch_dockerfiles, T.nilable(T::Array[DependencyFile]))
+        @dockerfiles ||= T.let(fetch_candidate_dockerfiles, T.nilable(T::Array[DependencyFile]))
       end
 
-      sig { returns(T::Array[Dependabot::DependencyFile]) }
-      def fetch_dockerfiles
+      sig { returns(T::Array[DependencyFile]) }
+      def fetch_candidate_dockerfiles
         repo_contents(raise_errors: false)
-          .select { |f| f.type == "file" && f.name.match?(DOCKER_REGEXP) }
+          .select { |f| f.type == "file" && f.name.match?(self.class.filename_regex) }
           .map { |f| fetch_file_from_host(f.name) }
       end
 
@@ -75,44 +70,6 @@ module Dependabot
       def incorrectly_encoded_dockerfiles
         dockerfiles.reject { |f| f.content&.valid_encoding? }
       end
-
-      sig { returns(T::Array[DependencyFile]) }
-      def yamlfiles
-        @yamlfiles ||= T.let(
-          repo_contents(raise_errors: false)
-                  .select { |f| f.type == "file" && f.name.match?(YAML_REGEXP) }
-                  .map { |f| fetch_file_from_host(f.name) },
-          T.nilable(T::Array[DependencyFile])
-        )
-      end
-
-      sig { params(resource: Object).returns(T.nilable(T::Boolean)) }
-      def likely_kubernetes_resource?(resource)
-        # Heuristic for being a Kubernetes resource. We could make this tighter but this probably works well.
-        resource.is_a?(::Hash) && resource.key?("apiVersion") && resource.key?("kind")
-      end
-
-      sig { returns(T::Array[Dependabot::DependencyFile]) }
-      def correctly_encoded_yamlfiles
-        candidate_files = yamlfiles.select { |f| f.content&.valid_encoding? }
-        candidate_files.select do |f|
-          if f.type == "file" && Utils.likely_helm_chart?(f)
-            true
-          else
-            # This doesn't handle multi-resource files, but it shouldn't matter, since the first resource
-            # in a multi-resource file had better be a valid k8s resource
-            content = ::YAML.safe_load(T.must(f.content), aliases: true)
-            likely_kubernetes_resource?(content)
-          end
-        rescue ::Psych::Exception
-          false
-        end
-      end
-
-      sig { returns(T::Array[Dependabot::DependencyFile]) }
-      def incorrectly_encoded_yamlfiles
-        yamlfiles.reject { |f| f.content&.valid_encoding? }
-      end
     end
   end
 end

data/lib/dependabot/docker/file_parser.rb

@@ -1,47 +1,27 @@
 # typed: strict
 # frozen_string_literal: true
 
-require "docker_registry2"
-
-require "dependabot/dependency"
-require "dependabot/file_parsers"
-require "dependabot/file_parsers/base"
-require "dependabot/errors"
-require "sorbet-runtime"
+require "dependabot/shared/shared_file_parser"
 require "dependabot/docker/package_manager"
 
 module Dependabot
   module Docker
-    class FileParser < Dependabot::FileParsers::Base
+    class FileParser < Dependabot::Shared::SharedFileParser
       extend T::Sig
 
-      require "dependabot/file_parsers/base/dependency_set"
-
       YAML_REGEXP = /^[^\.].*\.ya?ml$/i
-
-      # Details of Docker regular expressions is at
-      # https://github.com/docker/distribution/blob/master/reference/regexp.go
-      DOMAIN_COMPONENT = /(?:[[:alnum:]]|[[:alnum:]][[[:alnum:]]-]*[[:alnum:]])/
-      DOMAIN = /(?:#{DOMAIN_COMPONENT}(?:\.#{DOMAIN_COMPONENT})+)/
-      REGISTRY = /(?<registry>#{DOMAIN}(?::\d+)?)/
-
-      NAME_COMPONENT = /(?:[a-z\d]+(?:(?:[._]|__|[-]*)[a-z\d]+)*)/
-      IMAGE = %r{(?<image>#{NAME_COMPONENT}(?:/#{NAME_COMPONENT})*)}
-
       FROM = /FROM/i
       PLATFORM = /--platform\=(?<platform>\S+)/
       TAG_NO_PREFIX = /(?<tag>[\w][\w.-]{0,127})/
       TAG = /:#{TAG_NO_PREFIX}/
       DIGEST = /(?<digest>[0-9a-f]{64})/
-      NAME = /\s+AS\s+(?<name>[\w-]+)/
+
       FROM_LINE =
         %r{^#{FROM}\s+(#{PLATFORM}\s+)?(#{REGISTRY}/)?
           #{IMAGE}#{TAG}?(?:@sha256:#{DIGEST})?#{NAME}?}x
-      TAG_WITH_DIGEST = /^#{TAG_NO_PREFIX}(?:@sha256:#{DIGEST})?/x
-
-      AWS_ECR_URL = /dkr\.ecr\.(?<region>[^.]+)\.amazonaws\.com/
 
       IMAGE_SPEC = %r{^(#{REGISTRY}/)?#{IMAGE}#{TAG}?(?:@sha256:#{DIGEST})?#{NAME}?}x
+      TAG_WITH_DIGEST = /^#{TAG_NO_PREFIX}(?:@sha256:#{DIGEST})?/x
 
       sig { returns(Ecosystem) }
       def ecosystem
@@ -54,7 +34,6 @@ module Dependabot
         )
       end
 
-      # rubocop:disable Metrics/AbcSize
       sig { override.returns(T::Array[Dependabot::Dependency]) }
       def parse
         dependency_set = DependencySet.new
@@ -69,75 +48,55 @@ module Dependabot
             version = version_from(parsed_from_line)
             next unless version
 
-            dependency_set << Dependency.new(
-              name: T.must(parsed_from_line.fetch("image")),
-              version: version,
-              package_manager: "docker",
-              requirements: [
-                requirement: nil,
-                groups: [],
-                file: dockerfile.name,
-                source: source_from(parsed_from_line)
-              ]
-            )
+            dependency_set << build_dependency(dockerfile, parsed_from_line, version)
           end
         end
 
         manifest_files.each do |file|
-          if file.content && T.must(file.content).start_with?("\uFEFF")
-            # 0xFEFF is the encoding for the byte order mark (BOM).  If a YAML file is loaded with a BOM it will parse
-            # successfully, but will only load the first line.  To prevent this nearly empty object from being returned,
-            # the BOM is manually detected and reported as a parse error.
-            file_path = Pathname.new(file.directory).join(file.name).cleanpath.to_path
-            msg = "The file appears to have been saved with a byte order mark (BOM).  This will prevent proper parsing."
-            raise Dependabot::DependencyFileNotParseable.new(file_path, msg)
-          end
+          check_manifest_file_encoding(file)
           dependency_set += workfile_file_dependencies(file)
         end
 
         dependency_set.dependencies
       end
-      # rubocop:enable Metrics/AbcSize
 
       private
 
+      sig { override.returns(String) }
+      def package_manager
+        "docker"
+      end
+
+      sig { override.returns(String) }
+      def file_type
+        "Dockerfile"
+      end
+
       sig { returns(T::Array[Dependabot::DependencyFile]) }
       def dockerfiles
         # The Docker file fetcher fetches Dockerfiles and yaml files. Reject yaml files.
         dependency_files.reject { |f| f.type == "file" && f.name.match?(YAML_REGEXP) }
       end
 
-      sig { params(parsed_from_line: T::Hash[String, T.nilable(String)]).returns(T.nilable(String)) }
-      def version_from(parsed_from_line)
-        parsed_from_line.fetch("tag") || parsed_from_line.fetch("digest")
-      end
-
-      sig { params(parsed_from_line: T::Hash[String, T.nilable(String)]).returns(T::Hash[String, T.nilable(String)]) }
-      def source_from(parsed_from_line)
-        source = {}
-
-        source[:registry] = parsed_from_line.fetch("registry") if parsed_from_line.fetch("registry")
-
-        source[:tag] = parsed_from_line.fetch("tag") if parsed_from_line.fetch("tag")
-
-        source[:digest] = parsed_from_line.fetch("digest") if parsed_from_line.fetch("digest")
-
-        source
+      sig { returns(T::Array[Dependabot::DependencyFile]) }
+      def manifest_files
+        dependency_files.select { |f| f.type == "file" && f.name.match?(YAML_REGEXP) }
       end
 
-      sig { override.void }
-      def check_required_files
-        # Just check if there are any files at all.
-        return if dependency_files.any?
+      sig { params(file: Dependabot::DependencyFile).void }
+      def check_manifest_file_encoding(file)
+        return unless file.content&.start_with?("\uFEFF")
 
-        raise "No Dockerfile!"
+        file_path = Pathname.new(file.directory).join(file.name).cleanpath.to_path
+        msg = "The file appears to have been saved with a byte order mark (BOM). This will prevent proper parsing."
+        raise Dependabot::DependencyFileNotParseable.new(file_path, msg)
       end
 
-      sig { params(file: T.untyped).returns(Dependabot::FileParsers::Base::DependencySet) }
+      sig { params(file: Dependabot::DependencyFile).returns(DependencySet) }
       def workfile_file_dependencies(file)
         dependency_set = DependencySet.new
 
-        resources = file.content.split(/^---$/).map(&:strip).reject(&:empty?) # assuming a yaml file
+        resources = T.must(file.content).split(/^---$/).map(&:strip).reject(&:empty?)
         resources.flat_map do |resource|
           json = YAML.safe_load(resource, aliases: true)
           images = deep_fetch_images(json).uniq
@@ -152,7 +111,7 @@ module Dependabot
             version = version_from(details)
             next unless version
 
-            dependency_set << build_image_dependency(file, details, version)
+            dependency_set << build_dependency(file, details, version)
           end
         end
 
@@ -161,25 +120,7 @@ module Dependabot
         raise Dependabot::DependencyFileNotParseable, file.path
       end
 
-      sig do
-        params(file: T.untyped, details: T.untyped,
-               version: T.nilable(T.any(String, Dependabot::Version))).returns(Dependabot::Dependency)
-      end
-      def build_image_dependency(file, details, version)
-        Dependency.new(
-          name: details.fetch("image"),
-          version: version,
-          package_manager: "docker",
-          requirements: [
-            requirement: nil,
-            groups: [],
-            file: file.name,
-            source: source_from(details)
-          ]
-        )
-      end
-
-      sig { params(json_obj: T.anything).returns(T.untyped) }
+      sig { params(json_obj: T.anything).returns(T::Array[String]) }
       def deep_fetch_images(json_obj)
         case json_obj
         when Hash then deep_fetch_images_from_hash(json_obj)
@@ -188,7 +129,7 @@ module Dependabot
         end
       end
 
-      sig { params(json_object: T.untyped).returns(T::Array[T.untyped]) }
+      sig { params(json_object: T::Hash[T.untyped, T.untyped]).returns(T::Array[String]) }
       def deep_fetch_images_from_hash(json_object)
         img = json_object.fetch("image", nil)
 
@@ -204,12 +145,6 @@ module Dependabot
         images + json_object.values.flat_map { |obj| deep_fetch_images(obj) }
       end
 
-      sig { returns(T::Array[Dependabot::DependencyFile]) }
-      def manifest_files
-        # Dependencies include both Dockerfiles and yaml, select yaml.
-        dependency_files.select { |f| f.type == "file" && f.name.match?(YAML_REGEXP) }
-      end
-
       sig { params(img_hash: T::Hash[String, T.nilable(String)]).returns(T::Array[String]) }
       def parse_helm(img_hash)
         tag_value = img_hash.key?("tag") ? img_hash.fetch("tag", nil) : img_hash.fetch("version", nil)
@@ -230,6 +165,13 @@ module Dependabot
         image << "@sha256:#{digest}/" if digest
         [image]
       end
+
+      sig { override.void }
+      def check_required_files
+        return if dependency_files.any?
+
+        raise "No #{file_type}!"
+      end
     end
   end
 end

data/lib/dependabot/docker/file_updater.rb

@@ -1,253 +1,38 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
-require "dependabot/docker/utils/helpers"
-require "dependabot/file_updaters"
-require "dependabot/file_updaters/base"
-require "dependabot/errors"
 require "sorbet-runtime"
+require "dependabot/file_fetchers"
+require "dependabot/file_fetchers/base"
+require "dependabot/shared/shared_file_updater"
 
 module Dependabot
   module Docker
-    class FileUpdater < Dependabot::FileUpdaters::Base
+    class FileUpdater < Dependabot::Shared::SharedFileUpdater
       extend T::Sig
 
-      FROM_REGEX = /FROM(\s+--platform\=\S+)?/i
-
       YAML_REGEXP = /^[^\.].*\.ya?ml$/i
       DOCKER_REGEXP = /(docker|container)file/i
+      FROM_REGEX = /FROM(\s+--platform\=\S+)?/i
 
       sig { override.returns(T::Array[Regexp]) }
       def self.updated_files_regex
-        [
-          DOCKER_REGEXP,
-          YAML_REGEXP
-        ]
-      end
-
-      sig { override.returns(T::Array[Dependabot::DependencyFile]) }
-      def updated_dependency_files
-        updated_files = []
-        dependency_files.each do |file|
-          next unless requirement_changed?(file, T.must(dependency))
-
-          updated_files << if file.name.match?(YAML_REGEXP)
-                             updated_file(
-                               file: file,
-                               content: T.must(updated_yaml_content(file))
-                             )
-                           else
-                             updated_file(
-                               file: file,
-                               content: updated_dockerfile_content(file)
-                             )
-                           end
-        end
-
-        updated_files.reject! { |f| dependency_files.include?(f) }
-        raise "No files changed!" if updated_files.none?
-
-        updated_files
-      end
-
-      private
-
-      sig { returns T.nilable(Dependabot::Dependency) }
-      def dependency
-        # Dockerfiles will only ever be updating a single dependency
-        dependencies.first
-      end
-
-      sig { override.void }
-      def check_required_files
-        # Just check if there are any files at all.
-        return if dependency_files.any?
-
-        raise "No Dockerfile or Containerfile!"
-      end
-
-      sig { params(file: Dependabot::DependencyFile).returns(String) }
-      def updated_dockerfile_content(file)
-        old_sources = previous_sources(file)
-        new_sources = sources(file)
-
-        updated_content = T.let(file.content, T.untyped)
-
-        T.must(old_sources).zip(new_sources).each do |old_source, new_source|
-          updated_content = update_digest_and_tag(updated_content, old_source, T.must(new_source))
-        end
-
-        raise "Expected content to change!" if updated_content == file.content
-
-        updated_content
-      end
-
-      sig do
-        params(previous_content: String, old_source: T::Hash[Symbol, T.nilable(String)],
-               new_source: T::Hash[Symbol, T.nilable(String)]).returns(String)
-      end
-      def update_digest_and_tag(previous_content, old_source, new_source)
-        old_digest = old_source[:digest]
-        new_digest = new_source[:digest]
-
-        old_tag = old_source[:tag]
-        new_tag = new_source[:tag]
-
-        old_declaration =
-          if private_registry_url(old_source) then "#{private_registry_url(old_source)}/"
-          else
-            ""
-          end
-        old_declaration += T.must(dependency).name
-        old_declaration +=
-          if specified_with_tag?(old_source) then ":#{old_tag}"
-          else
-            ""
-          end
-        old_declaration +=
-          if specified_with_digest?(old_source) then "@sha256:#{old_digest}"
-          else
-            ""
-          end
-        escaped_declaration = Regexp.escape(old_declaration)
-
-        old_declaration_regex =
-          %r{^#{FROM_REGEX}\s+(docker\.io/)?#{escaped_declaration}(?=\s|$)}
-
-        previous_content.gsub(old_declaration_regex) do |old_dec|
-          old_dec
-            .gsub("@sha256:#{old_digest}", "@sha256:#{new_digest}")
-            .gsub(":#{old_tag}", ":#{new_tag}")
-        end
-      end
-
-      sig { params(source: T::Hash[Symbol, T.nilable(String)]).returns(T.nilable(String)) }
-      def specified_with_tag?(source)
-        source[:tag]
-      end
-
-      sig { params(source: T::Hash[Symbol, T.nilable(String)]).returns(T.nilable(String)) }
-      def specified_with_digest?(source)
-        source[:digest]
-      end
-
-      sig { params(file: Dependabot::DependencyFile).returns(T.nilable(T::Array[String])) }
-      def new_tags(file)
-        requirements(file)
-          .map { |r| r.fetch(:source)[:tag] }
-      end
-
-      sig { params(file: Dependabot::DependencyFile).returns(T.nilable(T::Array[String])) }
-      def old_tags(file)
-        previous_requirements(file)
-          &.map { |r| r.fetch(:source)[:tag] }
-      end
-
-      sig { params(source: T::Hash[Symbol, T.nilable(String)]).returns(T.nilable(String)) }
-      def private_registry_url(source)
-        source[:registry]
-      end
-
-      sig { params(file: Dependabot::DependencyFile).returns(T::Array[T::Hash[Symbol, T.nilable(String)]]) }
-      def sources(file)
-        requirements(file).map { |r| r.fetch(:source) }
-      end
-
-      sig { params(file: Dependabot::DependencyFile).returns(T.nilable(T::Array[T::Hash[Symbol, T.nilable(String)]])) }
-      def previous_sources(file)
-        previous_requirements(file)&.map { |r| r.fetch(:source) }
-      end
-
-      sig { params(file: Dependabot::DependencyFile).returns(T.nilable(String)) }
-      def updated_yaml_content(file)
-        updated_content = file.content
-        updated_content = update_helm(file, updated_content) if Utils.likely_helm_chart?(file)
-        updated_content = update_image(file, updated_content)
-
-        raise "Expected content to change!" if updated_content == file.content
-
-        updated_content
-      end
-
-      sig { params(file: Dependabot::DependencyFile, content: T.nilable(String)).returns(T.nilable(String)) }
-      def update_helm(file, content)
-        # TODO: this won't work if two images have the same tag version
-        old_tags = old_helm_tags(file)
-        return if old_tags.empty?
-
-        modified_content = content
-
-        old_tags.each do |old_tag|
-          old_tag_regex = /^\s+(?:-\s)?(?:tag|version):\s+["']?#{old_tag}["']?(?=\s|$)/
-          modified_content = modified_content&.gsub(old_tag_regex) do |old_img_tag|
-            old_img_tag.gsub(old_tag.to_s, new_helm_tag(file).to_s)
-          end
-        end
-        modified_content
-      end
-
-      sig { params(file: Dependabot::DependencyFile, content: T.nilable(String)).returns(T.nilable(String)) }
-      def update_image(file, content)
-        old_images = old_yaml_images(file)
-        return if old_images.empty?
-
-        modified_content = content
-
-        old_images.each do |old_image|
-          old_image_regex = /^\s*(?:-\s)?image:\s+#{old_image}(?=\s|$)/
-          modified_content = modified_content&.gsub(old_image_regex) do |old_img|
-            old_img.gsub(old_image.to_s, new_yaml_image(file).to_s)
-          end
-        end
-        modified_content
-      end
-
-      sig { params(file: Dependabot::DependencyFile).returns(String) }
-      def new_yaml_image(file)
-        element = T.must(dependency).requirements.find { |r| r[:file] == file.name }
-        prefix = element&.dig(:source, :registry) ? "#{element.fetch(:source)[:registry]}/" : ""
-        digest = element&.dig(:source, :digest) ? "@sha256:#{element.fetch(:source)[:digest]}" : ""
-        tag = element&.dig(:source, :tag) ? ":#{element.fetch(:source)[:tag]}" : ""
-        "#{prefix}#{T.must(dependency).name}#{tag}#{digest}"
-      end
-
-      sig { params(file: Dependabot::DependencyFile).returns(T::Array[String]) }
-      def old_yaml_images(file)
-        T.must(previous_requirements(file)).map do |r|
-          prefix = r.fetch(:source)[:registry] ? "#{r.fetch(:source)[:registry]}/" : ""
-          digest = r.fetch(:source)[:digest] ? "@sha256:#{r.fetch(:source)[:digest]}" : ""
-          tag = r.fetch(:source)[:tag] ? ":#{r.fetch(:source)[:tag]}" : ""
-          "#{prefix}#{T.must(dependency).name}#{tag}#{digest}"
-        end
-      end
-
-      sig { params(file: Dependabot::DependencyFile).returns(T::Array[String]) }
-      def old_helm_tags(file)
-        T.must(previous_requirements(file)).map do |r|
-          tag = r.fetch(:source)[:tag] || ""
-          digest = r.fetch(:source)[:digest] ? "@sha256:#{r.fetch(:source)[:digest]}" : ""
-          "#{tag}#{digest}"
-        end
+        [DOCKER_REGEXP, YAML_REGEXP]
       end
 
-      sig { params(file: Dependabot::DependencyFile).returns(String) }
-      def new_helm_tag(file)
-        element = T.must(dependency).requirements.find { |r| r[:file] == file.name }
-        tag = T.must(element).dig(:source, :tag) || ""
-        digest = T.must(element).dig(:source, :digest) ? "@sha256:#{T.must(element).dig(:source, :digest)}" : ""
-        "#{tag}#{digest}"
+      sig { override.returns(String) }
+      def file_type
+        "Dockerfile or Containerfile"
       end
 
-      sig { params(file: Dependabot::DependencyFile).returns(T::Array[T::Hash[Symbol, T.untyped]]) }
-      def requirements(file)
-        T.must(dependency).requirements
-         .select { |r| r[:file] == file.name }
+      sig { override.returns(Regexp) }
+      def yaml_file_pattern
+        YAML_REGEXP
       end
 
-      sig { params(file: Dependabot::DependencyFile).returns T.nilable(T::Array[T::Hash[Symbol, T.untyped]]) }
-      def previous_requirements(file)
-        T.must(dependency).previous_requirements
-         &.select { |r| r[:file] == file.name }
+      sig { override.returns(Regexp) }
+      def container_image_regex
+        %r{^#{FROM_REGEX}\s+(docker\.io/)?}o
       end
     end
   end

data/lib/dependabot/docker/update_checker.rb

@@ -11,7 +11,7 @@ require "dependabot/docker/tag"
 require "dependabot/docker/file_parser"
 require "dependabot/docker/version"
 require "dependabot/docker/requirement"
-require "dependabot/docker/utils/credentials_finder"
+require "dependabot/shared/utils/credentials_finder"
 
 module Dependabot
   module Docker
@@ -261,6 +261,12 @@ module Dependabot
       rescue RestClient::ServerBrokeConnection,
              RestClient::TooManyRequests
         raise PrivateSourceBadResponse, registry_hostname
+      rescue JSON::ParserError => e
+        if e.message.include?("unexpected token")
+          raise DependencyFileNotResolvable, "Error while accessing docker image at #{registry_hostname}"
+        end
+
+        raise
       end
 
       sig { returns(T.nilable(String)) }
@@ -355,11 +361,11 @@ module Dependabot
         credentials_finder.credentials_for_registry(registry_hostname)
       end
 
-      sig { returns(Dependabot::Docker::Utils::CredentialsFinder) }
+      sig { returns(Dependabot::Shared::Utils::CredentialsFinder) }
       def credentials_finder
         @credentials_finder ||= T.let(
-          Utils::CredentialsFinder.new(credentials),
-          T.nilable(Dependabot::Docker::Utils::CredentialsFinder)
+          Dependabot::Shared::Utils::CredentialsFinder.new(credentials),
+          T.nilable(Dependabot::Shared::Utils::CredentialsFinder)
         )
       end
 

data/lib/dependabot/shared/shared_file_fetcher.rb

@@ -0,0 +1,99 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+require "dependabot/file_fetchers"
+require "dependabot/file_fetchers/base"
+require "dependabot/shared/utils/helpers"
+
+module Dependabot
+  module Shared
+    class SharedFileFetcher < Dependabot::FileFetchers::Base
+      extend T::Sig
+      extend T::Helpers
+
+      abstract!
+
+      YAML_REGEXP = /^[^\.].*\.ya?ml$/i
+
+      sig { abstract.returns(Regexp) }
+      def self.filename_regex; end
+
+      sig { override.params(filenames: T::Array[String]).returns(T::Boolean) }
+      def self.required_files_in?(filenames)
+        filenames.any? { |f| f.match?(filename_regex) }
+      end
+
+      sig { override.returns(T::Array[DependencyFile]) }
+      def fetch_files
+        fetched_files = []
+        fetched_files + correctly_encoded_yamlfiles
+      end
+
+      sig { returns(T::Array[Dependabot::DependencyFile]) }
+      def correctly_encoded_yamlfiles
+        candidate_files = yamlfiles.select { |f| f.content&.valid_encoding? }
+        candidate_files.select do |f|
+          if f.type == "file" && Utils.likely_helm_chart?(f)
+            true
+          else
+            # This doesn't handle multi-resource files, but it shouldn't matter, since the first resource
+            # in a multi-resource file had better be a valid k8s resource
+            content = YAML.safe_load(T.must(f.content), aliases: true)
+            likely_kubernetes_resource?(content)
+          end
+        rescue ::Psych::Exception
+          false
+        end
+      end
+
+      sig { returns(T::Array[Dependabot::DependencyFile]) }
+      def incorrectly_encoded_yamlfiles
+        yamlfiles.reject { |f| f.content&.valid_encoding? }
+      end
+
+      sig do
+        params(
+          incorrectly_encoded_files: T::Array[Dependabot::DependencyFile]
+        ).returns(T.noreturn)
+      end
+      def raise_appropriate_error(
+        incorrectly_encoded_files = []
+      )
+        if incorrectly_encoded_files.none? && incorrectly_encoded_yamlfiles.none?
+          raise Dependabot::DependencyFileNotFound.new(
+            File.join(directory, "Dockerfile"),
+            "No Dockerfiles nor Kubernetes YAML found in #{directory}"
+          )
+        end
+
+        invalid_files = incorrectly_encoded_files.any? ? incorrectly_encoded_files : incorrectly_encoded_yamlfiles
+        raise Dependabot::DependencyFileNotParseable, T.must(invalid_files.first).path
+      end
+
+      sig { returns(T::Array[DependencyFile]) }
+      def yamlfiles
+        @yamlfiles ||= T.let(
+          repo_contents(raise_errors: false)
+            .select { |f| f.type == "file" && f.name.match?(YAML_REGEXP) }
+            .map { |f| fetch_file_from_host(f.name) },
+          T.nilable(T::Array[DependencyFile])
+        )
+      end
+
+      private
+
+      sig { params(resource: Object).returns(T.nilable(T::Boolean)) }
+      def likely_kubernetes_resource?(resource)
+        # Heuristic for being a Kubernetes resource. We could make this tighter but this probably works well.
+        resource.is_a?(::Hash) && resource.key?("apiVersion") && resource.key?("kind")
+      end
+
+      sig { abstract.returns(String) }
+      def default_file_name; end
+
+      sig { abstract.returns(String) }
+      def file_type; end
+    end
+  end
+end

data/lib/dependabot/shared/shared_file_parser.rb

@@ -0,0 +1,80 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "dependabot/dependency"
+require "dependabot/file_parsers"
+require "dependabot/file_parsers/base"
+require "sorbet-runtime"
+
+module Dependabot
+  module Shared
+    class SharedFileParser < Dependabot::FileParsers::Base
+      extend T::Sig
+      extend T::Helpers
+
+      abstract!
+
+      require "dependabot/file_parsers/base/dependency_set"
+
+      # Details of Docker regular expressions is at
+      # https://github.com/docker/distribution/blob/master/reference/regexp.go
+      DOMAIN_COMPONENT = /(?:[[:alnum:]]|[[:alnum:]][[[:alnum:]]-]*[[:alnum:]])/
+      DOMAIN = /(?:#{DOMAIN_COMPONENT}(?:\.#{DOMAIN_COMPONENT})+)/
+      REGISTRY = /(?<registry>#{DOMAIN}(?::\d+)?)/
+
+      NAME_COMPONENT = /(?:[a-z\d]+(?:(?:[._]|__|[-]*)[a-z\d]+)*)/
+      IMAGE = %r{(?<image>#{NAME_COMPONENT}(?:/#{NAME_COMPONENT})*)}
+
+      TAG = /:(?<tag>[\w][\w.-]{0,127})/
+      DIGEST = /@(?<digest>[^\s]+)/
+      NAME = /\s+AS\s+(?<name>[\w-]+)/
+
+      protected
+
+      sig { params(parsed_line: T::Hash[String, T.nilable(String)]).returns(T.nilable(String)) }
+      def version_from(parsed_line)
+        parsed_line.fetch("tag") || parsed_line.fetch("digest")
+      end
+
+      sig { params(parsed_line: T::Hash[String, T.nilable(String)]).returns(T::Hash[String, T.nilable(String)]) }
+      def source_from(parsed_line)
+        source = {}
+
+        source[:registry] = parsed_line.fetch("registry") if parsed_line.fetch("registry")
+        source[:tag] = parsed_line.fetch("tag") if parsed_line.fetch("tag")
+        source[:digest] = parsed_line.fetch("digest") if parsed_line.fetch("digest")
+
+        source
+      end
+
+      sig do
+        params(file: Dependabot::DependencyFile, details: T::Hash[String, T.nilable(String)],
+               version: String).returns(Dependabot::Dependency)
+      end
+      def build_dependency(file, details, version)
+        Dependency.new(
+          name: T.must(details.fetch("image")),
+          version: version,
+          package_manager: package_manager,
+          requirements: [
+            requirement: nil,
+            groups: [],
+            file: file.name,
+            source: source_from(details)
+          ]
+        )
+      end
+
+      private
+
+      sig { override.void }
+      def check_required_files; end
+
+      sig { abstract.returns(String) }
+      def package_manager; end
+
+      sig { abstract.returns(String) }
+      def file_type; end
+    end
+  end
+end

data/lib/dependabot/shared/shared_file_updater.rb

@@ -0,0 +1,261 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "dependabot/file_updaters"
+require "dependabot/file_updaters/base"
+require "dependabot/errors"
+require "sorbet-runtime"
+require "dependabot/shared/utils/helpers"
+
+module Dependabot
+  module Shared
+    class SharedFileUpdater < Dependabot::FileUpdaters::Base
+      extend T::Sig
+      extend T::Helpers
+
+      abstract!
+
+      FROM_REGEX = /FROM(\s+--platform\=\S+)?/i
+
+      sig { override.returns(T::Array[Dependabot::DependencyFile]) }
+      def updated_dependency_files
+        updated_files = []
+        dependency_files.each do |file|
+          next unless requirement_changed?(file, T.must(dependency))
+
+          updated_files << if file.name.match?(T.must(yaml_file_pattern))
+                             updated_file(
+                               file: file,
+                               content: T.must(updated_yaml_content(file))
+                             )
+                           else
+                             updated_file(
+                               file: file,
+                               content: T.must(updated_dockerfile_content(file))
+                             )
+                           end
+        end
+
+        updated_files.reject! { |f| dependency_files.include?(f) }
+        raise "No files changed!" if updated_files.none?
+
+        updated_files
+      end
+
+      sig { abstract.returns(T.nilable(Regexp)) }
+      def yaml_file_pattern; end
+
+      sig { abstract.returns(T.nilable(Regexp)) }
+      def container_image_regex; end
+
+      private
+
+      sig { params(file: Dependabot::DependencyFile).returns(T.nilable(String)) }
+      def updated_dockerfile_content(file)
+        old_sources = previous_sources(file)
+        new_sources = sources(file)
+
+        updated_content = T.let(file.content, T.untyped)
+
+        T.must(old_sources).zip(new_sources).each do |old_source, new_source|
+          updated_content = update_digest_and_tag(updated_content, old_source, T.must(new_source))
+        end
+
+        raise "Expected content to change!" if updated_content == file.content
+
+        updated_content
+      end
+
+      sig do
+        params(previous_content: String, old_source: T::Hash[Symbol, T.nilable(String)],
+               new_source: T::Hash[Symbol, T.nilable(String)]).returns(String)
+      end
+      def update_digest_and_tag(previous_content, old_source, new_source)
+        old_digest = old_source[:digest]
+        new_digest = new_source[:digest]
+
+        old_tag = old_source[:tag]
+        new_tag = new_source[:tag]
+
+        old_declaration =
+          if private_registry_url(old_source)
+            "#{private_registry_url(old_source)}/"
+          else
+            ""
+          end
+        old_declaration += T.must(dependency).name
+        old_declaration +=
+          if specified_with_tag?(old_source)
+            ":#{old_tag}"
+          else
+            ""
+          end
+        old_declaration +=
+          if specified_with_digest?(old_source)
+            "@sha256:#{old_digest}"
+          else
+            ""
+          end
+
+        escaped_declaration = Regexp.escape(old_declaration)
+
+        old_declaration_regex = build_old_declaration_regex(escaped_declaration)
+
+        previous_content.gsub(old_declaration_regex) do |old_dec|
+          old_dec
+            .gsub("@sha256:#{old_digest}", "@sha256:#{new_digest}")
+            .gsub(":#{old_tag}", ":#{new_tag}")
+        end
+      end
+
+      sig { params(escaped_declaration: String).returns(Regexp) }
+      def build_old_declaration_regex(escaped_declaration)
+        %r{^#{FROM_REGEX}\s+(docker\.io/)?#{escaped_declaration}(?=\s|$)}
+      end
+
+      sig { params(file: Dependabot::DependencyFile).returns(T.nilable(String)) }
+      def updated_yaml_content(file)
+        updated_content = file.content
+        updated_content = update_helm(file, updated_content) if Shared::Utils.likely_helm_chart?(file)
+        updated_content = update_image(file, updated_content)
+
+        raise "Expected content to change!" if updated_content == file.content
+
+        updated_content
+      end
+
+      sig { params(file: Dependabot::DependencyFile, content: T.nilable(String)).returns(T.nilable(String)) }
+      def update_helm(file, content)
+        old_tags = old_helm_tags(file)
+        return if old_tags.empty?
+
+        modified_content = content
+
+        old_tags.each do |old_tag|
+          old_tag_regex = /^\s*(?:-\s)?(?:tag|version):\s+["']?#{old_tag}["']?(?=\s|$)/
+          modified_content = modified_content&.gsub(old_tag_regex) do |old_img_tag|
+            old_img_tag.gsub(old_tag.to_s, new_helm_tag(file).to_s)
+          end
+        end
+        modified_content
+      end
+
+      sig { params(file: Dependabot::DependencyFile, content: T.nilable(String)).returns(T.nilable(String)) }
+      def update_image(file, content)
+        old_images = old_yaml_images(file)
+        return if old_images.empty?
+
+        modified_content = content
+
+        old_images.each do |old_image|
+          old_image_regex = /^\s*(?:-\s)?image:\s+#{old_image}(?=\s|$)/
+          modified_content = modified_content&.gsub(old_image_regex) do |old_img|
+            old_img.gsub(old_image.to_s, new_yaml_image(file).to_s)
+          end
+        end
+        modified_content
+      end
+
+      sig { params(file: Dependabot::DependencyFile).returns(String) }
+      def new_yaml_image(file)
+        element = T.must(dependency).requirements.find { |r| r[:file] == file.name }
+        prefix = element&.dig(:source, :registry) ? "#{element.fetch(:source)[:registry]}/" : ""
+        digest = element&.dig(:source, :digest) ? "@sha256:#{element.fetch(:source)[:digest]}" : ""
+        tag = element&.dig(:source, :tag) ? ":#{element.fetch(:source)[:tag]}" : ""
+        "#{prefix}#{T.must(dependency).name}#{tag}#{digest}"
+      end
+
+      sig { params(file: Dependabot::DependencyFile).returns(T::Array[String]) }
+      def old_yaml_images(file)
+        T.must(previous_requirements(file)).map do |r|
+          prefix = r.fetch(:source)[:registry] ? "#{r.fetch(:source)[:registry]}/" : ""
+          digest = r.fetch(:source)[:digest] ? "@sha256:#{r.fetch(:source)[:digest]}" : ""
+          tag = r.fetch(:source)[:tag] ? ":#{r.fetch(:source)[:tag]}" : ""
+          "#{prefix}#{T.must(dependency).name}#{tag}#{digest}"
+        end
+      end
+
+      sig { params(file: Dependabot::DependencyFile).returns(T::Array[String]) }
+      def old_helm_tags(file)
+        T.must(previous_requirements(file)).map do |r|
+          tag = r.fetch(:source)[:tag] || ""
+          digest = r.fetch(:source)[:digest] ? "@sha256:#{r.fetch(:source)[:digest]}" : ""
+          "#{tag}#{digest}"
+        end
+      end
+
+      sig { params(file: Dependabot::DependencyFile).returns(String) }
+      def new_helm_tag(file)
+        element = T.must(dependency).requirements.find { |r| r[:file] == file.name }
+        tag = T.must(element).dig(:source, :tag) || ""
+        digest = T.must(element).dig(:source, :digest) ? "@sha256:#{T.must(element).dig(:source, :digest)}" : ""
+        "#{tag}#{digest}"
+      end
+
+      protected
+
+      sig { params(file: Dependabot::DependencyFile, dependency: Dependabot::Dependency).returns(T::Boolean) }
+      def requirement_changed?(file, dependency)
+        changed_requirements =
+          dependency.requirements - T.must(dependency.previous_requirements)
+
+        changed_requirements.any? { |f| f[:file] == file.name }
+      end
+
+      sig { params(source: T::Hash[Symbol, T.nilable(String)]).returns(T::Boolean) }
+      def specified_with_tag?(source)
+        !source[:tag].nil?
+      end
+
+      sig { params(source: T::Hash[Symbol, T.nilable(String)]).returns(T::Boolean) }
+      def specified_with_digest?(source)
+        !source[:digest].nil?
+      end
+
+      sig { params(file: Dependabot::DependencyFile).returns(T::Array[T::Hash[Symbol, T.untyped]]) }
+      def requirements(file)
+        T.must(dependency).requirements
+         .select { |r| r[:file] == file.name }
+      end
+
+      sig { params(file: Dependabot::DependencyFile).returns(T.nilable(T::Array[T::Hash[Symbol, T.untyped]])) }
+      def previous_requirements(file)
+        T.must(dependency).previous_requirements
+         &.select { |r| r[:file] == file.name }
+      end
+
+      sig { params(source: T::Hash[Symbol, T.nilable(String)]).returns(T.nilable(String)) }
+      def private_registry_url(source)
+        source[:registry]
+      end
+
+      sig { params(file: Dependabot::DependencyFile).returns(T::Array[T::Hash[Symbol, T.nilable(String)]]) }
+      def sources(file)
+        requirements(file).map { |r| r.fetch(:source) }
+      end
+
+      sig { params(file: Dependabot::DependencyFile).returns(T.nilable(T::Array[T::Hash[Symbol, T.nilable(String)]])) }
+      def previous_sources(file)
+        previous_requirements(file)&.map { |r| r.fetch(:source) }
+      end
+
+      sig { returns(T.nilable(Dependabot::Dependency)) }
+      def dependency
+        # Files will only ever be updating a single dependency
+        dependencies.first
+      end
+
+      sig { override.void }
+      def check_required_files
+        return if dependency_files.any?
+
+        raise "No #{file_type}!"
+      end
+
+      private
+
+      sig { abstract.returns(String) }
+      def file_type; end
+    end
+  end
+end

data/lib/dependabot/{docker → shared}/utils/credentials_finder.rb

@@ -9,7 +9,7 @@ require "dependabot/credential"
 require "dependabot/errors"
 
 module Dependabot
-  module Docker
+  module Shared
     module Utils
       class CredentialsFinder
         extend T::Sig

data/lib/dependabot/{docker → shared}/utils/helpers.rb

@@ -4,7 +4,7 @@
 require "sorbet-runtime"
 
 module Dependabot
-  module Docker
+  module Shared
     module Utils
       HELM_REGEXP = /values[\-a-zA-Z_0-9]*\.ya?ml$/i
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-docker
 version: !ruby/object:Gem::Version
-  version: 0.297.0
+  version: 0.297.1
 platform: ruby
 authors:
 - Dependabot
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-02-13 00:00:00.000000000 Z
+date: 2025-02-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.297.0
+        version: 0.297.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.297.0
+        version: 0.297.1
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -251,15 +251,18 @@ files:
 - lib/dependabot/docker/requirement.rb
 - lib/dependabot/docker/tag.rb
 - lib/dependabot/docker/update_checker.rb
-- lib/dependabot/docker/utils/credentials_finder.rb
-- lib/dependabot/docker/utils/helpers.rb
 - lib/dependabot/docker/version.rb
+- lib/dependabot/shared/shared_file_fetcher.rb
+- lib/dependabot/shared/shared_file_parser.rb
+- lib/dependabot/shared/shared_file_updater.rb
+- lib/dependabot/shared/utils/credentials_finder.rb
+- lib/dependabot/shared/utils/helpers.rb
 homepage: https://github.com/dependabot/dependabot-core
 licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.297.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.297.1
 post_install_message:
 rdoc_options: []
 require_paths: