dependabot-git_submodules 0.315.0 → 0.317.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 061a65be9f5152d7fdbdc084f50143d064ddc313b61e1d96f7e20fb7ecaf7e37
-  data.tar.gz: 69178ae09d092411bea3cabe86c4a651a3eaf74046c006c8f3c73a0b1f253ca2
+  metadata.gz: 1099ab7191ce79866f178d1718f9e543f052f1f332601775dc7c4fcd3fe2908f
+  data.tar.gz: c0e7fcac933fd87b126bc51461a2c00cd2ad83a623a316701226cd303b10b221
 SHA512:
-  metadata.gz: 62b3f7068a62211541273e8a565e70b13becd1f41c6669e9bee906ebda294f021ab4f0ddbc8d425e339228a8d794e7b49520cde4790c2c6b5cad054fec6d5fc5
-  data.tar.gz: 843deb240361b0012238ba15d7b8bfe932c4de6e73a3fb660535b105383c01a52c2770cde65bdacc0575dbae8215725d21ca8510192579979e9809179ad2ba17
+  metadata.gz: df5a16f36e7e909500429bc779c6c13d65447a4a9aefe2a136c1c1bfa9dc292acd5c251fe2c216a29f82dd6084a0b98c4c268b6fa908fa2238566e05ed47c5c9
+  data.tar.gz: db0e34225b6c31d5017d0ad32e8114c263d5eda8e798e3342eb43e649644cce93fdfacf1e5691b5790ad9160a3a74f7320ed4706403939de9a895f1fd30b94d9

data/lib/dependabot/git_submodules/package/package_details_fetcher.rb

@@ -1,4 +1,4 @@
-# typed: strong
+# typed: strict
 # frozen_string_literal: true
 
 require "json"
@@ -27,6 +27,8 @@ module Dependabot
         def initialize(dependency:, credentials:)
           @dependency = dependency
           @credentials = credentials
+
+          @url = T.let(url, String)
         end
 
         sig { returns(Dependabot::Dependency) }
@@ -35,13 +37,89 @@ module Dependabot
         sig { returns(T::Array[T.untyped]) }
         attr_reader :credentials
 
-        sig { returns(T.nilable(String)) }
+        sig { returns(T.nilable(T::Array[Dependabot::Package::PackageRelease])) }
         def available_versions
+          versions_metadata = T.let(fetch_tags_and_release_date, T.nilable(T::Array[GitTagWithDetail]))
+
+          # as git submodules do not have versions (refs/tags are used instead), we use a pseudo version as placeholder
+          pseudo_version = 1.0
+
+          # we fallback to the git based tag info if no versions metadata is available
+          if versions_metadata&.empty?
+            versions_metadata = T.let(fetch_latest_tag_info,
+                                      T.nilable(T::Array[GitTagWithDetail]))
+          end
+
+          releases = T.must(versions_metadata).map do |version_details|
+            Dependabot::Package::PackageRelease.new(
+              version: GitSubmodules::Version.new((pseudo_version += 1).to_s),
+              tag: version_details.tag,
+              released_at: version_details.release_date ? Time.parse(T.must(version_details.release_date)) : nil
+            )
+          end
+
+          releases
+        end
+
+        private
+
+        sig { returns(T::Array[GitTagWithDetail]) }
+        def fetch_latest_tag_info
+          parsed_results = T.let([], T::Array[GitTagWithDetail])
+
           git_commit_checker = Dependabot::GitCommitChecker.new(
             dependency: dependency,
             credentials: credentials
           )
-          git_commit_checker.head_commit_for_current_branch
+
+          parsed_results <<
+            GitTagWithDetail.new(
+              tag: T.must(git_commit_checker.head_commit_for_current_branch)
+            )
+
+          parsed_results
+        end
+
+        sig { returns(T::Array[GitTagWithDetail]) }
+        def fetch_tags_and_release_date
+          parsed_results = T.let([], T::Array[GitTagWithDetail])
+
+          begin
+            Dependabot.logger.info("Fetching release info for Git Submodules: #{dependency.name}")
+
+            client = Dependabot::GitCommitChecker.new(
+              dependency: dependency,
+              credentials: credentials
+            )
+
+            response = client.ref_details_for_pinned_ref
+
+            unless response.status == 200
+              Dependabot.logger.error("Error while fetching details for #{dependency.name} " \
+                                      "Detail : #{response.body}")
+            end
+
+            return parsed_results unless response.status == 200
+
+            releases = JSON.parse(response.body)
+
+            parsed_results = releases.map do |release|
+              GitTagWithDetail.new(
+                tag: release["sha"],
+                release_date: release["commit"]["committer"]["date"]
+              )
+            end
+
+            parsed_results
+          rescue StandardError => e
+            Dependabot.logger.error("Error while fetching package info for git submodule: #{e.message}")
+            parsed_results
+          end
+        end
+
+        sig { returns(String) }
+        def url
+          dependency.source_details&.fetch(:url, nil)
         end
       end
     end

data/lib/dependabot/git_submodules/update_checker/latest_version_finder.rb

@@ -15,38 +15,110 @@ require "dependabot/git_submodules/package/package_details_fetcher"
 module Dependabot
   module GitSubmodules
     class UpdateChecker
-      class LatestVersionFinder
+      class LatestVersionFinder < Dependabot::Package::PackageLatestVersionFinder
         extend T::Sig
 
         sig do
           params(
             dependency: Dependabot::Dependency,
-            credentials: T::Array[Dependabot::Credential]
+            credentials: T::Array[Dependabot::Credential],
+            cooldown_options: T.nilable(Dependabot::Package::ReleaseCooldownOptions)
           ).void
         end
-        def initialize(dependency:, credentials:)
+        def initialize(dependency:, credentials:, cooldown_options:)
           @dependency = dependency
           @credentials = credentials
+          @cooldown_options = cooldown_options
         end
 
-        sig { returns(Dependabot::Dependency) }
-        attr_reader :dependency
-        sig { returns(T::Array[Dependabot::Credential]) }
-        attr_reader :credentials
-
         sig { returns(T.nilable(String)) }
+        def latest_tag
+          releases = version_list
+
+          releases = filter_by_cooldown(T.must(releases))
+
+          # if there are no releases after applying filters, we fallback to the current tag to avoid empty results
+          releases = apply_post_fetch_latest_versions_filter(releases)
+          releases.first&.tag
+        end
+
+        sig { returns(T.nilable(T::Array[Dependabot::Package::PackageRelease])) }
         def version_list
           @version_list ||=
             T.let(Package::PackageDetailsFetcher.new(
               dependency: dependency,
               credentials: credentials
-            ).available_versions, T.nilable(String))
+            ).available_versions, T.nilable(T::Array[Dependabot::Package::PackageRelease]))
+        end
+
+        sig { params(release: Dependabot::Package::PackageRelease).returns(T::Boolean) }
+        def in_cooldown_period?(release)
+          unless release.released_at
+            Dependabot.logger.info("Release date not available for ref tag #{release.tag}")
+            return false
+          end
+
+          days = cooldown_days
+          passed_seconds = Time.now.to_i - release.released_at.to_i
+          passed_days = passed_seconds / DAY_IN_SECONDS
+
+          if passed_days < days
+            Dependabot.logger.info("Filtered #{release.tag}, Released on: " \
+                                   "#{T.must(release.released_at).strftime('%Y-%m-%d')} " \
+                                   "(#{passed_days}/#{days} cooldown days)")
+          end
+
+          passed_seconds < days * DAY_IN_SECONDS
         end
 
-        sig { returns(T.nilable(T.any(String, Dependabot::Version))) }
-        def latest_version
-          @latest_version ||= T.let(version_list, T.nilable(String))
+        sig do
+          returns(Integer)
         end
+        def cooldown_days
+          cooldown = @cooldown_options
+          return 0 if cooldown.nil?
+          return 0 unless cooldown_enabled?
+          return 0 unless cooldown.included?(dependency.name)
+
+          return cooldown.default_days if cooldown.default_days.positive?
+          return cooldown.semver_major_days if cooldown.semver_major_days.positive?
+          return cooldown.semver_minor_days if cooldown.semver_minor_days.positive?
+          return cooldown.semver_patch_days if cooldown.semver_patch_days.positive?
+
+          cooldown.default_days
+        end
+
+        sig { returns(T::Boolean) }
+        def cooldown_enabled?
+          Dependabot::Experiments.enabled?(:enable_cooldown_for_gitsubmodules)
+        end
+
+        sig do
+          params(releases: T::Array[Dependabot::Package::PackageRelease])
+            .returns(T::Array[Dependabot::Package::PackageRelease])
+        end
+        def apply_post_fetch_latest_versions_filter(releases)
+          if releases.empty?
+            Dependabot.logger.info("No releases found for #{dependency.name} after applying filters.")
+            return releases
+          end
+
+          releases << Dependabot::Package::PackageRelease.new(
+            version: GitSubmodules::Version.new("1.0.0"),
+            tag: dependency.version
+          )
+
+          releases
+        end
+
+        sig { returns(Dependabot::Dependency) }
+        attr_reader :dependency
+        sig { returns(T::Array[Dependabot::Credential]) }
+        attr_reader :credentials
+        sig { returns(T.nilable(Dependabot::Package::ReleaseCooldownOptions)) }
+        attr_reader :cooldown_options
+        sig { override.returns(T.nilable(Dependabot::Package::PackageDetails)) }
+        def package_details; end
       end
     end
   end

data/lib/dependabot/git_submodules/update_checker.rb

@@ -58,10 +58,11 @@ module Dependabot
 
       sig { returns(T.nilable(String)) }
       def fetch_latest_version
-        LatestVersionFinder.new(
+        T.let(LatestVersionFinder.new(
           dependency: dependency,
-          credentials: credentials
-        ).version_list
+          credentials: credentials,
+          cooldown_options: update_cooldown
+        ).latest_tag, T.nilable(String))
       end
     end
   end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-git_submodules
 version: !ruby/object:Gem::Version
-  version: 0.315.0
+  version: 0.317.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.315.0
+        version: 0.317.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.315.0
+        version: 0.317.0
 - !ruby/object:Gem::Dependency
   name: parseconfig
   requirement: !ruby/object:Gem::Requirement
@@ -277,7 +277,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.315.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.317.0
 rdoc_options: []
 require_paths:
 - lib