dependabot-docker 0.359.0 → 0.360.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6ecfdad27b87474faf0ea1f6d1a4395f39e3631b6b3e21654172f51f4f1ce4c9
-  data.tar.gz: 51ddd06f0d81281929a636c781493d69bd082af3853862d2e9916388b7f56ed4
+  metadata.gz: 6e3a281a81f5f7329c01110ef4ac731e61702fca5fb3161706350b1e13b21952
+  data.tar.gz: 817cf36ec492541cea959cff1e23d44b3fbb953de067391ea8427b27b6f8f1a0
 SHA512:
-  metadata.gz: 7c57a3a5c4dbdad5e8e0dd99d23948077fd4c489d569637c53f3002eab8ff13a59601d63aa85297f739e23c979cccb0a16b9990024087cebc742a1778a9583a1
-  data.tar.gz: b22d67a41edd6f4a8ee35b9b8a9254e533659000615b185840d46827669220ed5b091b9cd212ff9563f3755379fd57c82cd5d48aa68cbe214691e4a8abbcb919
+  metadata.gz: e9b40addec253cbca79fc8faad20af986046f3e07c13c6c6e6b81b065e10aad5e49172a2a6155a767d0db4e0e683872f0c9343922c4746bc3d76e394212efb97
+  data.tar.gz: d6d11c276cac70ff79262cacd5a76e215388d793b3001f7db77232aa226634aad4dc896e442f4bd53144824d1c0fb2a7fd00a456c571180ce951dbfca03268a2

data/lib/dependabot/docker/metadata_finder.rb

@@ -13,24 +13,89 @@ module Dependabot
 
       private
 
+      # Finds the repository for the Docker image using OCI annotations.
+      # @see https://specs.opencontainers.org/image-spec/annotations/
       sig { override.returns(T.nilable(Dependabot::Source)) }
       def look_up_source
         return if dependency.requirements.empty?
 
         new_source = dependency.requirements.first&.fetch(:source)
-        return unless new_source && new_source[:registry] && new_source[:tag]
+        return unless new_source && new_source[:registry] && (new_source[:tag] || new_source[:digest])
 
-        image_ref = "#{new_source[:registry]}/#{dependency.name}:#{new_source[:tag]}"
-        image_details_output = SharedHelpers.run_shell_command("regctl image inspect #{image_ref}")
-        image_details = JSON.parse(image_details_output)
-        image_source = image_details.dig("config", "Labels", "org.opencontainers.image.source")
+        details = image_details(new_source)
+        image_source = details.dig("config", "Labels", "org.opencontainers.image.source")
+        # Return early if the org.opencontainers.image.source label is not present
         return unless image_source
 
-        Dependabot::Source.from_url(image_source)
+        # If we have a tag, return the source directly without additional version metadata
+        return Dependabot::Source.from_url(image_source) if new_source[:tag]
+
+        # If we only have a digest, we need to look for the version label to build the source
+        build_source_from_image_version(image_source, details)
       rescue StandardError => e
         Dependabot.logger.warn("Error looking up Docker source: #{e.message}")
         nil
       end
+
+      sig do
+        params(
+          source: T::Hash[Symbol, T.untyped]
+        ).returns(
+          T::Hash[String, T.untyped]
+        )
+      end
+      def image_details(source)
+        registry = source[:registry]
+        tag = source[:tag]
+        digest = source[:digest]
+
+        image_ref =
+          # If both tag and digest are present, use the digest as docker ignores the tag when a digest is present
+          if digest
+            "#{registry}/#{dependency.name}@sha256:#{digest}"
+          else
+            "#{registry}/#{dependency.name}:#{tag}"
+          end
+
+        Dependabot.logger.info("Looking up Docker source #{image_ref}")
+        output = SharedHelpers.run_shell_command("regctl image inspect #{image_ref}")
+        JSON.parse(output)
+      end
+
+      # Builds a Dependabot::Source object using the OCI image version label.
+      #
+      # This is used as a fallback when an image is referenced by digest rather than a tag
+      sig do
+        params(
+          image_source: String,
+          details: T::Hash[String, T.untyped]
+        ).returns(T.nilable(Dependabot::Source))
+      end
+      def build_source_from_image_version(image_source, details)
+        image_version = details.dig("config", "Labels", "org.opencontainers.image.version")
+        revision = details.dig("config", "Labels", "org.opencontainers.image.revision")
+        # Sometimes the versions are not tags (e.g., "24.04")
+        # We only want to build a source if the version looks like a tag (starts with "v")
+        # This is a safeguard for a first iteration. We may adjust this later based on user feedback.
+        tag_like = image_version&.start_with?("v")
+
+        return unless tag_like || revision
+
+        parsed_source = Dependabot::Source.from_url(image_source)
+        return unless parsed_source
+
+        branch_info = image_version ? "image version '#{image_version}'" : "unknown image version"
+        commit_info = revision ? "revision '#{revision}'" : "no commit"
+        Dependabot.logger.info "Building source with #{branch_info} and #{commit_info}"
+
+        Dependabot::Source.new(
+          provider: parsed_source.provider,
+          repo: parsed_source.repo,
+          directory: parsed_source.directory,
+          branch: image_version,
+          commit: revision
+        )
+      end
     end
   end
 end

data/lib/dependabot/docker/update_checker.rb

@@ -14,6 +14,7 @@ require "dependabot/docker/requirement"
 require "dependabot/shared/utils/credentials_finder"
 require "dependabot/package/release_cooldown_options"
 require "dependabot/package/package_release"
+require "dependabot/experiments"
 
 module Dependabot
   module Docker
@@ -49,7 +50,7 @@ module Dependabot
           if tag
             updated_tag = latest_version_from(tag)
             updated_source[:tag] = updated_tag
-            updated_source[:digest] = digest_of(updated_tag) if digest
+            updated_source[:digest] = digest_of(updated_tag) if digest || pin_digests?
           elsif digest
             updated_source[:digest] = digest_of("latest")
           end
@@ -665,6 +666,11 @@ module Dependabot
         true
       end
 
+      sig { returns(T::Boolean) }
+      def pin_digests?
+        Dependabot::Experiments.enabled?(:docker_pin_digests)
+      end
+
       sig do
         returns(Integer)
       end

data/lib/dependabot/shared/shared_file_updater.rb

@@ -66,6 +66,9 @@ module Dependabot
         updated_content
       end
 
+      # rubocop:disable Metrics/AbcSize
+      # rubocop:disable Metrics/PerceivedComplexity
+      # rubocop:disable Metrics/MethodLength
       sig do
         params(
           previous_content: String,
@@ -73,7 +76,7 @@ module Dependabot
           new_source: T::Hash[Symbol, T.nilable(String)]
         ).returns(String)
       end
-      def update_digest_and_tag(previous_content, old_source, new_source) # rubocop:disable Metrics/PerceivedComplexity
+      def update_digest_and_tag(previous_content, old_source, new_source)
         old_digest = old_source[:digest]
         new_digest = new_source[:digest]
 
@@ -115,9 +118,16 @@ module Dependabot
 
           old_dec = old_dec.gsub(":#{old_tag}", ":#{new_tag}") unless old_tag.to_s.empty?
 
+          # Adding a digest to a tag-only image (digest pinning)
+          old_dec = "#{old_dec}@sha256:#{new_digest}" if old_digest.to_s.empty? && !new_digest.to_s.empty?
+
           old_dec
         end
       end
+      # rubocop:enable Metrics/MethodLength
+      # rubocop:enable Metrics/PerceivedComplexity
+      # rubocop:enable Metrics/AbcSize
+
       sig { params(escaped_declaration: String).returns(Regexp) }
       def build_old_declaration_regex(escaped_declaration)
         %r{^#{FROM_REGEX}\s+(docker\.io/)?#{escaped_declaration}(?=\s|$)}

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-docker
 version: !ruby/object:Gem::Version
-  version: 0.359.0
+  version: 0.360.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.359.0
+        version: 0.360.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.359.0
+        version: 0.360.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -261,7 +261,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.359.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.360.0
 rdoc_options: []
 require_paths:
 - lib