dependabot-docker 0.298.0 → 0.299.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ec6f718cb35e66a3d05aeb2b358f3119d6a7eb903caaab6fdab5c0986a0fe4ad
-  data.tar.gz: bc36d5f6cd3b3fcd9ea121f85dfcd69728b3986f9ad31b48bb1a1c6b43b2f7ac
+  metadata.gz: 134d154ffea190ddc9e90de9dac7bf4cb3975be84b448ba2951160d72a00d139
+  data.tar.gz: 9e65973dfee557bc73f4a16d8d2dcb03bf289317943c565a05628e363f213a72
 SHA512:
-  metadata.gz: b4eb32ebd6ab05aa29c5d6bd7d59508307557658e5d9c03051b8fc5894ee6032e697c7396df20344b09ee9332e34756348cf8101232062991c9477dc22136176
-  data.tar.gz: 30df940974d700495f43649a8240dc4f3c608d2605104981d0bec0c14cdeb70c2e8d5bfb891eca26944bbbbfb516aedb68b9c8177e6c169c032b77e4d17f918d
+  metadata.gz: 22516919d1d98b39fc46a8d2d9a5496bfaae1cf6be3ce9b1a1ae1884494f080563c5d66a97f6a0dc323675d005cbf7e5f817c2ba4eff17eb00232c80d0838ee3
+  data.tar.gz: bb88b420c92839866f9f9fef08af6106ef4d2631a36b14e09a24192cfdd3982ea6bd8682592775cac9aef2d6e7e0bd251c7a7d359fa83fa39a4733bc105d256c

data/lib/dependabot/docker/update_checker.rb

@@ -167,7 +167,65 @@ module Dependabot
 
       sig { params(original_tag: Dependabot::Docker::Tag).returns(T::Array[Dependabot::Docker::Tag]) }
       def comparable_tags_from_registry(original_tag)
+        unless Experiments.enabled?(:docker_tag_component_comparison)
+          return tags_from_registry.select { |tag| tag.comparable_to?(original_tag) }
+        end
+
+        common_components = identify_common_components(tags_from_registry)
+        original_components = extract_tag_components(original_tag.name, common_components)
+        Dependabot.logger.info("Original tag components: #{original_components.join(',')}")
+
         tags_from_registry.select { |tag| tag.comparable_to?(original_tag) }
+        tags_from_registry.select do |tag|
+          tag.comparable_to?(original_tag) &&
+            (original_components.empty? ||
+              compatible_components?(extract_tag_components(tag.name, common_components), original_components))
+        end
+      end
+
+      sig { params(tags: T::Array[Dependabot::Docker::Tag]).returns(T::Array[String]) }
+      def identify_common_components(tags)
+        tag_parts = tags.map do |tag|
+          # replace version parts with VERSION
+          processed_tag = tag.name.gsub(/\d+\.\d+\.\d+_\d+/, "VERSION")
+
+          parts = processed_tag.split(%r{[-\./]})
+          parts.reject(&:empty?)
+        end
+
+        part_counts = tag_parts.flatten.tally
+
+        part_counts.select do |part|
+          part.length > 1 &&
+            part != "VERSION" &&
+            !version_related_pattern?(part)
+        end.keys
+      end
+
+      sig { params(part: String).returns(T::Boolean) }
+      def version_related_pattern?(part)
+        patterns = {
+          number: /^\d+$/,
+          semver: /^\d+\.\d+$/,
+          v_prefix: /^v\d+/,
+          version_marker: /^(rc|jre)$/,
+          prerelease: /^(?=.*\d)(?=.*[a-z])[a-z\d]+$/i,
+          sha: /^g[0-9a-f]{5,}$/,
+          timestamp: /^\d{8,14}$/,
+          underscore_parts: /\d+_\d+/
+        }
+
+        patterns.values.any? { |pattern| part.match?(pattern) }
+      end
+
+      sig { params(tag_name: String, common_components: T::Array[String]).returns(T::Array[String]) }
+      def extract_tag_components(tag_name, common_components)
+        common_components.select { |component| tag_name.match?(/\b#{Regexp.escape(component)}\b/) }
+      end
+
+      sig { params(tag_components: T::Array[String], original_components: T::Array[String]).returns(T::Boolean) }
+      def compatible_components?(tag_components, original_components)
+        tag_components.sort == original_components.sort
       end
 
       sig do
@@ -379,7 +437,7 @@ module Dependabot
 
       # Defaults from https://github.com/deitch/docker_registry2/blob/bfde04144f0b7fd63c156a1aca83efe19ee78ffd/lib/registry/registry.rb#L26-L27
       DEFAULT_DOCKER_OPEN_TIMEOUT_IN_SECONDS = 2
-      DEFAULT_DOCKER_READ_TIMEOUT_IN_SECONDS = 5
+      DEFAULT_DOCKER_READ_TIMEOUT_IN_SECONDS = 60
 
       sig { returns(DockerRegistry2::Registry) }
       def docker_registry_client

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-docker
 version: !ruby/object:Gem::Version
-  version: 0.298.0
+  version: 0.299.0
 platform: ruby
 authors:
 - Dependabot
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-02-20 00:00:00.000000000 Z
+date: 2025-02-27 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.298.0
+        version: 0.299.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.298.0
+        version: 0.299.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -262,7 +262,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.298.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.299.0
 post_install_message:
 rdoc_options: []
 require_paths: