dependabot-docker 0.390.0 → 0.391.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5dab05a06765637bf76bff8f754c5139cf9652f0fd64794200b98cde43a05008
-  data.tar.gz: 750a5ecbaf42000e3aee5b91cf0e6563918c1e97f5bfd67c000a73cad2266d59
+  metadata.gz: 8f8970643afb19fb1fcb8400d78829bcd94dd9938a0b62bb8272117146d60756
+  data.tar.gz: 52de182a249408f725617f9a4e5bc1453c1ab630760340d47e7d52d862f9c6ba
 SHA512:
-  metadata.gz: f8f5801aa19d4e071b6d838e4c96a8ba395a1c4277fb0059201878df3808506997eab692964185f736dd232244a5f5d1d29882ce58cb6adda14e67575a7d42ca
-  data.tar.gz: e23963530ca9eedab7de6ffcfa2ecff538a502784d308c8b305645eb60e23ce4b2ce2328ce4c747daadd8a4730879f1e9c62b5aa46e028aebecb35b6439899cc
+  metadata.gz: 5d107f6d0903a0c7682866f5a754d3671505c9d515f903601d9cf7259c63f9a65cef54939c34672f77d35e18ca348176071d36702eb6fdd3ebcfd97ddaaee3b6
+  data.tar.gz: d5cdf57817917e7bab0042bb924d2f6645de1588dc630d2e14b345e889861821c4e95b0a1e0b7ea9319211dee93b74ed97c3bd46e0934b3201ba5d84ed78b117

data/lib/dependabot/docker/metadata_finder.rb

@@ -27,8 +27,11 @@ module Dependabot
       def look_up_source
         return if dependency.requirements.empty?
 
-        new_source = dependency.requirements.first&.fetch(:source)
-        return unless new_source && new_source[:registry] && (new_source[:tag] || new_source[:digest])
+        requirement = dependency.requirements.first
+        return unless requirement
+
+        new_source = docker_source(requirement)
+        return unless new_source[:registry] && (new_source[:tag] || new_source[:digest])
 
         details = image_details(new_source)
         image_source = image_label(details, "org.opencontainers.image.source")
@@ -44,6 +47,17 @@ module Dependabot
         nil
       end
 
+      sig { params(requirement: Dependabot::DependencyRequirement).returns(DockerSource) }
+      def docker_source(requirement)
+        raise TypeError, "Docker source must be a hash" if requirement.source_hash.nil?
+
+        {
+          registry: requirement.source_string("registry"),
+          tag: requirement.source_string("tag"),
+          digest: requirement.source_string("digest")
+        }
+      end
+
       sig do
         params(
           source: DockerSource

data/lib/dependabot/docker/update_checker.rb

@@ -52,24 +52,18 @@ module Dependabot
     class UpdateChecker < Dependabot::UpdateCheckers::Base
       extend T::Sig
 
-      MANIFEST_LIST_TYPES = T.let(
-        [
-          "application/vnd.docker.distribution.manifest.list.v2+json",
-          "application/vnd.oci.image.index.v1+json"
-        ].freeze,
-        T::Array[String]
-      )
+      MANIFEST_LIST_TYPES = [
+        "application/vnd.docker.distribution.manifest.list.v2+json",
+        "application/vnd.oci.image.index.v1+json"
+      ].freeze
 
       # Media types returned for single-platform (non manifest-list) images.
       # Used to cheaply rule out manifest-list comparison via a HEAD request's
       # negotiated Content-Type, avoiding a full manifest GET for these images.
-      SINGLE_PLATFORM_MANIFEST_TYPES = T.let(
-        [
-          "application/vnd.docker.distribution.manifest.v2+json",
-          "application/vnd.oci.image.manifest.v1+json"
-        ].freeze,
-        T::Array[String]
-      )
+      SINGLE_PLATFORM_MANIFEST_TYPES = [
+        "application/vnd.docker.distribution.manifest.v2+json",
+        "application/vnd.oci.image.manifest.v1+json"
+      ].freeze
 
       # Tolerance window for platform timestamp comparison.
       # Multi-arch CI builds may finish platforms at slightly different times.
@@ -78,7 +72,7 @@ module Dependabot
       # Maximum number of candidates to run platform timestamp validation against.
       # Each validation can require 1 + 1 + N*2 registry API calls for N platforms,
       # so we cap the attempts to avoid rate limiting or excessive latency.
-      MAX_PLATFORM_VALIDATION_ATTEMPTS = T.let(5, Integer)
+      MAX_PLATFORM_VALIDATION_ATTEMPTS = 5
 
       # Page size used when listing tags from a registry. Without an explicit page
       # size, registries such as Docker Hub try to return every tag in a single
@@ -86,7 +80,7 @@ module Dependabot
       # (e.g. hexpm/elixir has ~1M tags). Requesting a bounded page keeps each
       # request fast; the client then follows the registry's pagination links to
       # collect the remaining tags.
-      TAGS_PAGE_SIZE = T.let(100, Integer)
+      TAGS_PAGE_SIZE = 100
 
       DockerSource = T.type_alias do
         T::Hash[Symbol, T.nilable(String)]
@@ -163,23 +157,25 @@ module Dependabot
 
       sig { override.returns(T::Array[Dependabot::DependencyRequirement]) }
       def updated_requirements
-        updated = dependency.requirements.map do |req|
-          updated_source = req.fetch(:source).dup
-
-          tag = req[:source][:tag]
-          digest = req[:source][:digest]
+        dependency.requirements.map do |req|
+          updated_source = T.must(req.source_hash).dup
+          source = docker_source(req)
+          tag = source[:tag]
+          digest = source[:digest]
 
           if tag
             updated_tag = latest_version_from(tag)
-            updated_source[:tag] = updated_tag
-            updated_source[:digest] = resolved_digest_for(tag, updated_tag, digest) if digest || pin_digests?
+            set_source_string(updated_source, "tag", updated_tag)
+            if digest || pin_digests?
+              set_source_string(updated_source, "digest", resolved_digest_for(tag, updated_tag, digest))
+            end
           elsif digest
-            updated_source[:digest] = digest_within_cooldown?("latest") ? digest : digest_of("latest")
+            updated_digest = digest_within_cooldown?("latest") ? digest : digest_of("latest")
+            set_source_string(updated_source, "digest", updated_digest)
           end
 
-          req.merge(source: updated_source)
+          Dependabot::DependencyRequirement.create(req.merge(source: updated_source))
         end
-        wrap_requirements(updated)
       end
 
       private
@@ -242,8 +238,8 @@ module Dependabot
 
       sig { params(req: Dependabot::DependencyRequirement).returns(T::Boolean) }
       def digest_requirement_up_to_date?(req)
-        source = req.fetch(:source)
-        source_digest = source.fetch(:digest)
+        source = docker_source(req)
+        source_digest = T.must(source[:digest])
         source_tag = source[:tag]
 
         if source_tag
@@ -864,11 +860,7 @@ module Dependabot
 
       sig { returns(T.nilable(String)) }
       def registry_hostname
-        if dependency.requirements.first&.dig(:source, :registry)
-          return T.must(dependency.requirements.first).dig(:source, :registry)
-        end
-
-        credentials_finder.base_registry
+        dependency.requirements.first&.source_string("registry") || credentials_finder.base_registry
       end
 
       sig { returns(T::Boolean) }
@@ -1000,7 +992,35 @@ module Dependabot
       sig { returns(T::Array[Dependabot::DependencyRequirement]) }
       def digest_requirements
         dependency.requirements.select do |requirement|
-          requirement.dig(:source, :digest)
+          requirement.source_string("digest")
+        end
+      end
+
+      sig { params(requirement: Dependabot::DependencyRequirement).returns(DockerSource) }
+      def docker_source(requirement)
+        raise TypeError, "Docker source must be a hash" if requirement.source_hash.nil?
+
+        {
+          registry: requirement.source_string("registry"),
+          tag: requirement.source_string("tag"),
+          digest: requirement.source_string("digest"),
+          platform: requirement.source_string("platform")
+        }
+      end
+
+      sig do
+        params(
+          source: Dependabot::DependencyRequirement::ObjectHash,
+          key: String,
+          value: T.nilable(String)
+        ).void
+      end
+      def set_source_string(source, key, value)
+        symbol_key = key.to_sym
+        if source.key?(key) && !source.key?(symbol_key)
+          source[key] = value
+        else
+          source[symbol_key] = value
         end
       end
 

data/lib/dependabot/shared/shared_file_updater.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "dependabot/file_updaters"
@@ -17,9 +17,13 @@ module Dependabot
 
       FROM_REGEX = /FROM(\s+--platform\=\S+)?/i
 
+      ImageSource = T.type_alias do
+        T::Hash[Symbol, T.nilable(String)]
+      end
+
       sig { override.returns(T::Array[Dependabot::DependencyFile]) }
       def updated_dependency_files
-        updated_files = []
+        updated_files = T.let([], T::Array[Dependabot::DependencyFile])
         dependency_files.each do |file|
           next unless requirement_changed?(file, T.must(dependency))
 
@@ -72,8 +76,8 @@ module Dependabot
       sig do
         params(
           previous_content: String,
-          old_source: T::Hash[Symbol, T.nilable(String)],
-          new_source: T::Hash[Symbol, T.nilable(String)]
+          old_source: ImageSource,
+          new_source: ImageSource
         ).returns(String)
       end
       def update_digest_and_tag(previous_content, old_source, new_source)
@@ -178,19 +182,21 @@ module Dependabot
 
       sig { params(file: Dependabot::DependencyFile).returns(String) }
       def new_yaml_image(file)
-        element = T.must(dependency).requirements.find { |r| r[:file] == file.name }
-        prefix = element&.dig(:source, :registry) ? "#{element.fetch(:source)[:registry]}/" : ""
-        digest = element&.dig(:source, :digest) ? "@sha256:#{element.fetch(:source)[:digest]}" : ""
-        tag = element&.dig(:source, :tag) ? ":#{element.fetch(:source)[:tag]}" : ""
+        element = T.must(dependency).requirements.find { |r| r.file == file.name }
+        source = image_source(element)
+        prefix = source[:registry] ? "#{source[:registry]}/" : ""
+        digest = source[:digest] ? "@sha256:#{source[:digest]}" : ""
+        tag = source[:tag] ? ":#{source[:tag]}" : ""
         "#{prefix}#{T.must(dependency).name}#{tag}#{digest}"
       end
 
       sig { params(file: Dependabot::DependencyFile).returns(T::Array[String]) }
       def old_yaml_images(file)
         T.must(previous_requirements(file)).map do |r|
-          prefix = r.fetch(:source)[:registry] ? "#{r.fetch(:source)[:registry]}/" : ""
-          digest = r.fetch(:source)[:digest] ? "@sha256:#{r.fetch(:source)[:digest]}" : ""
-          tag = r.fetch(:source)[:tag] ? ":#{r.fetch(:source)[:tag]}" : ""
+          source = image_source(r)
+          prefix = source[:registry] ? "#{source[:registry]}/" : ""
+          digest = source[:digest] ? "@sha256:#{source[:digest]}" : ""
+          tag = source[:tag] ? ":#{source[:tag]}" : ""
           "#{prefix}#{T.must(dependency).name}#{tag}#{digest}"
         end
       end
@@ -198,17 +204,19 @@ module Dependabot
       sig { params(file: Dependabot::DependencyFile).returns(T::Array[String]) }
       def old_helm_tags(file)
         T.must(previous_requirements(file)).map do |r|
-          tag = r.fetch(:source)[:tag] || ""
-          digest = r.fetch(:source)[:digest] ? "@sha256:#{r.fetch(:source)[:digest]}" : ""
+          source = image_source(r)
+          tag = source[:tag] || ""
+          digest = source[:digest] ? "@sha256:#{source[:digest]}" : ""
           "#{tag}#{digest}"
         end
       end
 
       sig { params(file: Dependabot::DependencyFile).returns(String) }
       def new_helm_tag(file)
-        element = T.must(dependency).requirements.find { |r| r[:file] == file.name }
-        tag = T.must(element).dig(:source, :tag) || ""
-        digest = T.must(element).dig(:source, :digest) ? "@sha256:#{T.must(element).dig(:source, :digest)}" : ""
+        element = T.must(dependency).requirements.find { |r| r.file == file.name }
+        source = image_source(element)
+        tag = source[:tag] || ""
+        digest = source[:digest] ? "@sha256:#{source[:digest]}" : ""
         "#{tag}#{digest}"
       end
 
@@ -219,15 +227,15 @@ module Dependabot
         changed_requirements =
           dependency.requirements - T.must(dependency.previous_requirements)
 
-        changed_requirements.any? { |f| f[:file] == file.name }
+        changed_requirements.any? { |f| f.file == file.name }
       end
 
-      sig { params(source: T::Hash[Symbol, T.nilable(String)]).returns(T::Boolean) }
+      sig { params(source: ImageSource).returns(T::Boolean) }
       def specified_with_tag?(source)
         !source[:tag].nil?
       end
 
-      sig { params(source: T::Hash[Symbol, T.nilable(String)]).returns(T::Boolean) }
+      sig { params(source: ImageSource).returns(T::Boolean) }
       def specified_with_digest?(source)
         !source[:digest].nil?
       end
@@ -235,28 +243,41 @@ module Dependabot
       sig { params(file: Dependabot::DependencyFile).returns(T::Array[Dependabot::DependencyRequirement]) }
       def requirements(file)
         T.must(dependency).requirements
-         .select { |r| r[:file] == file.name }
+         .select { |r| r.file == file.name }
       end
 
       sig { params(file: Dependabot::DependencyFile).returns(T.nilable(T::Array[Dependabot::DependencyRequirement])) }
       def previous_requirements(file)
         T.must(dependency).previous_requirements
-         &.select { |r| r[:file] == file.name }
+         &.select { |r| r.file == file.name }
       end
 
-      sig { params(source: T::Hash[Symbol, T.nilable(String)]).returns(T.nilable(String)) }
+      sig { params(source: ImageSource).returns(T.nilable(String)) }
       def private_registry_url(source)
         source[:registry]
       end
 
-      sig { params(file: Dependabot::DependencyFile).returns(T::Array[T::Hash[Symbol, T.nilable(String)]]) }
+      sig { params(file: Dependabot::DependencyFile).returns(T::Array[ImageSource]) }
       def sources(file)
-        requirements(file).map { |r| r.fetch(:source) }
+        requirements(file).map { |r| image_source(r) }
       end
 
-      sig { params(file: Dependabot::DependencyFile).returns(T.nilable(T::Array[T::Hash[Symbol, T.nilable(String)]])) }
+      sig { params(file: Dependabot::DependencyFile).returns(T.nilable(T::Array[ImageSource])) }
       def previous_sources(file)
-        previous_requirements(file)&.map { |r| r.fetch(:source) }
+        previous_requirements(file)&.map { |r| image_source(r) }
+      end
+
+      sig { params(requirement: T.nilable(Dependabot::DependencyRequirement)).returns(ImageSource) }
+      def image_source(requirement)
+        return { registry: nil, tag: nil, digest: nil } if requirement.nil?
+
+        raise TypeError, "container source must be a hash" if requirement.source_hash.nil?
+
+        {
+          registry: requirement.source_string("registry"),
+          tag: requirement.source_string("tag"),
+          digest: requirement.source_string("digest")
+        }
       end
 
       sig { returns(T.nilable(Dependabot::Dependency)) }

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-docker
 version: !ruby/object:Gem::Version
-  version: 0.390.0
+  version: 0.391.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.390.0
+        version: 0.391.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.390.0
+        version: 0.391.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -266,7 +266,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.390.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.391.0
 rdoc_options: []
 require_paths:
 - lib