dependabot-git_submodules 0.315.0 → 0.316.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 061a65be9f5152d7fdbdc084f50143d064ddc313b61e1d96f7e20fb7ecaf7e37
-  data.tar.gz: 69178ae09d092411bea3cabe86c4a651a3eaf74046c006c8f3c73a0b1f253ca2
+  metadata.gz: 9667cdfa37aaa6e90bba941f1b653fb5f8f158e6ca251728fedb387134a4d5f8
+  data.tar.gz: 49c4e869e2baad8f0e7af43eb19cab762abcce32581d1eaf4cb55058039e1838
 SHA512:
-  metadata.gz: 62b3f7068a62211541273e8a565e70b13becd1f41c6669e9bee906ebda294f021ab4f0ddbc8d425e339228a8d794e7b49520cde4790c2c6b5cad054fec6d5fc5
-  data.tar.gz: 843deb240361b0012238ba15d7b8bfe932c4de6e73a3fb660535b105383c01a52c2770cde65bdacc0575dbae8215725d21ca8510192579979e9809179ad2ba17
+  metadata.gz: e800f9531b77938d70e90e2acb9b9c41caaea92ec0f362d6b500c37298c0213fcf8ccd0d1302a935e919a2dc5420fcb4ee36942f8c15daee07c293ecb6cbf49c
+  data.tar.gz: 266c229f93ef4d8cfe09542d1b85151d3b76e1c89f6f8bb7c6f3c8aaa652ccdd4517690c5866656eea7b05dda2aaaf06ab6907fb6d2c7eb76b6c19a844be1b43

data/lib/dependabot/git_submodules/package/package_details_fetcher.rb

@@ -1,4 +1,4 @@
-# typed: strong
+# typed: strict
 # frozen_string_literal: true
 
 require "json"
@@ -27,21 +27,117 @@ module Dependabot
         def initialize(dependency:, credentials:)
           @dependency = dependency
           @credentials = credentials
+
+          @ref = T.let(ref, String)
+          @url = T.let(url, String)
         end
 
+        # as git submodules do not have versions (refs/tags are used instead), we use a pseudo version as placeholder
+        VERSION = "1.0.0"
+
+        # we use a default release date in case we reply on fallback logic of
+        # getting refs/tags to prevent filtering out head release (greater than max cooldown period)
+        DEFAULT_RELEASE_DATE = T.let(Time.now.utc - (60 * 60 * 24 * 91), Time)
+
         sig { returns(Dependabot::Dependency) }
         attr_reader :dependency
 
         sig { returns(T::Array[T.untyped]) }
         attr_reader :credentials
 
-        sig { returns(T.nilable(String)) }
+        sig { returns(T.nilable(T::Array[Dependabot::Package::PackageRelease])) }
         def available_versions
+          versions_metadata = T.let(fetch_tags_and_release_date, T.nilable(T::Array[GitTagWithDetail]))
+
+          # we fallback to the git based tag info if no versions metadata is available
+          if versions_metadata&.empty?
+            versions_metadata = T.let(fetch_latest_tag_info,
+                                      T.nilable(T::Array[GitTagWithDetail]))
+          end
+
+          releases = T.must(versions_metadata).map do |version_details|
+            Dependabot::Package::PackageRelease.new(
+              version: GitSubmodules::Version.new(VERSION),
+              tag: version_details.tag,
+              released_at: Time.parse(version_details.release_date)
+            )
+          end
+
+          releases
+        end
+
+        private
+
+        sig { returns(T::Array[GitTagWithDetail]) }
+        def fetch_latest_tag_info
+          parsed_results = T.let([], T::Array[GitTagWithDetail])
+
           git_commit_checker = Dependabot::GitCommitChecker.new(
             dependency: dependency,
             credentials: credentials
           )
-          git_commit_checker.head_commit_for_current_branch
+
+          parsed_results <<
+            GitTagWithDetail.new(
+              tag: T.must(git_commit_checker.head_commit_for_current_branch),
+              release_date: DEFAULT_RELEASE_DATE.to_s
+            )
+
+          parsed_results
+        end
+
+        sig { returns(T::Array[GitTagWithDetail]) }
+        def fetch_tags_and_release_date
+          parsed_results = T.let([], T::Array[GitTagWithDetail])
+
+          begin
+            Dependabot.logger.info("Fetching release info for Git Submodules: #{dependency.name}")
+
+            response = Excon.get(provider_url)
+
+            unless response.status == 200
+              Dependabot.logger.error("Error while fetching details for #{dependency.name}" \
+                                      " Detail : #{response.body}")
+            end
+
+            return parsed_results unless response.status == 200
+
+            releases = JSON.parse(response.body)
+
+            parsed_results = releases.map do |release|
+              GitTagWithDetail.new(
+                tag: release["sha"],
+                release_date: release["commit"]["committer"]["date"]
+              )
+            end
+
+            parsed_results
+          rescue StandardError => e
+            Dependabot.logger.error("Error while fetching package info for Git Submodules: #{e.message}")
+            parsed_results
+          end
+        end
+
+        sig { returns(String) }
+        def provider_url
+          provider_url = @url.gsub(/\.git$/, "")
+
+          api_url = {
+            github: provider_url.gsub("github.com", "api.github.com/repos")
+          }.freeze
+
+          "#{api_url[:github]}/commits?sha=#{@ref}"
+        end
+
+        sig { returns(String) }
+        def ref
+          dependency.source_details&.fetch(:ref, nil) ||
+            dependency.source_details&.fetch(:branch, nil) || "HEAD"
+        end
+
+        sig { returns(String) }
+        def url
+          dependency.source_details&.fetch(:url, nil)
         end
       end
     end

data/lib/dependabot/git_submodules/update_checker/latest_version_finder.rb

@@ -34,18 +34,20 @@ module Dependabot
         sig { returns(T::Array[Dependabot::Credential]) }
         attr_reader :credentials
 
-        sig { returns(T.nilable(String)) }
+        sig { returns(T.nilable(T::Array[Dependabot::Package::PackageRelease])) }
         def version_list
           @version_list ||=
             T.let(Package::PackageDetailsFetcher.new(
               dependency: dependency,
               credentials: credentials
-            ).available_versions, T.nilable(String))
+            ).available_versions, T.nilable(T::Array[Dependabot::Package::PackageRelease]))
         end
 
-        sig { returns(T.nilable(T.any(String, Dependabot::Version))) }
+        sig { returns(T.nilable(String)) }
         def latest_version
-          @latest_version ||= T.let(version_list, T.nilable(String))
+          latest_version = version_list
+          latest_version = latest_version&.first&.tag.to_s
+          latest_version
         end
       end
     end

data/lib/dependabot/git_submodules/update_checker.rb

@@ -58,10 +58,10 @@ module Dependabot
 
       sig { returns(T.nilable(String)) }
       def fetch_latest_version
-        LatestVersionFinder.new(
+        T.let(LatestVersionFinder.new(
           dependency: dependency,
           credentials: credentials
-        ).version_list
+        ).latest_version, T.nilable(String))
       end
     end
   end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-git_submodules
 version: !ruby/object:Gem::Version
-  version: 0.315.0
+  version: 0.316.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.315.0
+        version: 0.316.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.315.0
+        version: 0.316.0
 - !ruby/object:Gem::Dependency
   name: parseconfig
   requirement: !ruby/object:Gem::Requirement
@@ -277,7 +277,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.315.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.316.0
 rdoc_options: []
 require_paths:
 - lib