dependabot-docker 0.377.0 → 0.378.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3ef1dc5166936b5d6aada4bf0f859a424d1a60f5b22a4050acc6ca09bc968ad7
-  data.tar.gz: 9c0961430097c367900629b3e67c5bbfa633a3f49a1ff69500b77c2530f53322
+  metadata.gz: 17718cb0ff191b125f27342d3f6ac8ecc789aa7fbd1756b07f4169f72e7cdb1b
+  data.tar.gz: fe95510540508bb9aaab679699bed285909e3ca5252be80f6fe7d21bc77221d8
 SHA512:
-  metadata.gz: 4c1844c652bddc83266a3045535d364f7469cbb5245d327f1ff70debe9d648f11bdde27f607d7de70bdfc938dc5544417b4794fd871dba357c3de03c2066c272
-  data.tar.gz: e6c9ec06ac35771d9408cce9b544729cd59ac0d122995db9fbf6463c4724a48025a825ce148614908758a361c4e737131162b01f2c1e8d6cdda35f5efadd5ba2
+  metadata.gz: 72ec96db68fa95f61911fcaddb98601eb79f124357d17a4c0748c223bf1be60e4aa09089bcf4a5e0206201ec5fd1df2e7bcb2657fd3d362d9fd5001249402801
+  data.tar.gz: a04bc6ba3d922b2d5a28d62fbd06282d087db8b5c0e7dfe2acee5c057034a0c887ada15f5e04c7d64c34c49426b35b481b0fda843aefac7c5b96379ac3f8456f

data/lib/dependabot/docker/update_checker.rb

@@ -374,7 +374,9 @@ module Dependabot
         candidate_tags.reverse_each do |tag|
           details = publication_detail(tag)
 
-          next if !details || !details.released_at
+          # If we can't determine publication details, skip cooldown for this tag and use it
+          # rather than blocking the update when the registry doesn't support the required API calls
+          return [tag] if !details || !details.released_at
 
           return [tag] unless cooldown_period?(T.must(details.released_at), tag)
 
@@ -389,7 +391,7 @@ module Dependabot
         return publication_details[candidate_tag.name] if publication_details.key?(candidate_tag.name)
 
         details = get_tag_publication_details(candidate_tag)
-        publication_details[candidate_tag.name] = T.cast(details, Dependabot::Package::PackageRelease)
+        publication_details[candidate_tag.name] = details
 
         details
       end
@@ -404,12 +406,17 @@ module Dependabot
         first_digest = extract_digest_from_response(digest_info, tag)
         return nil unless first_digest
 
-        blob_info = with_retries(max_attempts: 3, errors: transient_docker_errors) do
+        # When digest_info is an Array the registry returned a manifest list
+        # (OCI image index) and the extracted digest points at a platform-
+        # specific *manifest*, not a blob.  Use the correct endpoint so the
+        # HEAD request succeeds on registries like ghcr.io.
+        endpoint = digest_info.is_a?(Array) ? "manifests" : "blobs"
+        head_response = with_retries(max_attempts: 3, errors: transient_docker_errors) do
           client = docker_registry_client
-          client.dohead "v2/#{docker_repo_name}/blobs/#{first_digest}"
+          client.dohead "v2/#{docker_repo_name}/#{endpoint}/#{first_digest}"
         end
 
-        last_modified = blob_info.headers[:last_modified]
+        last_modified = head_response.headers[:last_modified]
         published_date = last_modified ? Time.parse(last_modified) : nil
 
         Dependabot::Package::PackageRelease.new(
@@ -420,6 +427,15 @@ module Dependabot
           url: nil,
           package_type: "docker"
         )
+      rescue *transient_docker_errors,
+             DockerRegistry2::RegistryAuthenticationException,
+             RestClient::Forbidden,
+             RestClient::TooManyRequests => e
+        Dependabot.logger.warn(
+          "Failed to fetch publication details for #{docker_repo_name}:#{tag.name}, " \
+          "skipping cooldown: #{e.class} - #{e.message}"
+        )
+        nil
       end
 
       sig do

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-docker
 version: !ruby/object:Gem::Version
-  version: 0.377.0
+  version: 0.378.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.377.0
+        version: 0.378.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.377.0
+        version: 0.378.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -266,7 +266,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.377.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.378.0
 rdoc_options: []
 require_paths:
 - lib