dependabot-git_submodules 0.316.0 → 0.317.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9667cdfa37aaa6e90bba941f1b653fb5f8f158e6ca251728fedb387134a4d5f8
-  data.tar.gz: 49c4e869e2baad8f0e7af43eb19cab762abcce32581d1eaf4cb55058039e1838
+  metadata.gz: 1099ab7191ce79866f178d1718f9e543f052f1f332601775dc7c4fcd3fe2908f
+  data.tar.gz: c0e7fcac933fd87b126bc51461a2c00cd2ad83a623a316701226cd303b10b221
 SHA512:
-  metadata.gz: e800f9531b77938d70e90e2acb9b9c41caaea92ec0f362d6b500c37298c0213fcf8ccd0d1302a935e919a2dc5420fcb4ee36942f8c15daee07c293ecb6cbf49c
-  data.tar.gz: 266c229f93ef4d8cfe09542d1b85151d3b76e1c89f6f8bb7c6f3c8aaa652ccdd4517690c5866656eea7b05dda2aaaf06ab6907fb6d2c7eb76b6c19a844be1b43
+  metadata.gz: df5a16f36e7e909500429bc779c6c13d65447a4a9aefe2a136c1c1bfa9dc292acd5c251fe2c216a29f82dd6084a0b98c4c268b6fa908fa2238566e05ed47c5c9
+  data.tar.gz: db0e34225b6c31d5017d0ad32e8114c263d5eda8e798e3342eb43e649644cce93fdfacf1e5691b5790ad9160a3a74f7320ed4706403939de9a895f1fd30b94d9

data/lib/dependabot/git_submodules/package/package_details_fetcher.rb

@@ -28,17 +28,9 @@ module Dependabot
           @dependency = dependency
           @credentials = credentials
 
-          @ref = T.let(ref, String)
           @url = T.let(url, String)
         end
 
-        # as git submodules do not have versions (refs/tags are used instead), we use a pseudo version as placeholder
-        VERSION = "1.0.0"
-
-        # we use a default release date in case we reply on fallback logic of
-        # getting refs/tags to prevent filtering out head release (greater than max cooldown period)
-        DEFAULT_RELEASE_DATE = T.let(Time.now.utc - (60 * 60 * 24 * 91), Time)
-
         sig { returns(Dependabot::Dependency) }
         attr_reader :dependency
 
@@ -49,6 +41,9 @@ module Dependabot
         def available_versions
           versions_metadata = T.let(fetch_tags_and_release_date, T.nilable(T::Array[GitTagWithDetail]))
 
+          # as git submodules do not have versions (refs/tags are used instead), we use a pseudo version as placeholder
+          pseudo_version = 1.0
+
           # we fallback to the git based tag info if no versions metadata is available
           if versions_metadata&.empty?
             versions_metadata = T.let(fetch_latest_tag_info,
@@ -57,9 +52,9 @@ module Dependabot
 
           releases = T.must(versions_metadata).map do |version_details|
             Dependabot::Package::PackageRelease.new(
-              version: GitSubmodules::Version.new(VERSION),
+              version: GitSubmodules::Version.new((pseudo_version += 1).to_s),
               tag: version_details.tag,
-              released_at: Time.parse(version_details.release_date)
+              released_at: version_details.release_date ? Time.parse(T.must(version_details.release_date)) : nil
             )
           end
 
@@ -79,8 +74,7 @@ module Dependabot
 
           parsed_results <<
             GitTagWithDetail.new(
-              tag: T.must(git_commit_checker.head_commit_for_current_branch),
-              release_date: DEFAULT_RELEASE_DATE.to_s
+              tag: T.must(git_commit_checker.head_commit_for_current_branch)
             )
 
           parsed_results
@@ -93,11 +87,16 @@ module Dependabot
           begin
             Dependabot.logger.info("Fetching release info for Git Submodules: #{dependency.name}")
 
-            response = Excon.get(provider_url)
+            client = Dependabot::GitCommitChecker.new(
+              dependency: dependency,
+              credentials: credentials
+            )
+
+            response = client.ref_details_for_pinned_ref
 
             unless response.status == 200
-              Dependabot.logger.error("Error while fetching details for #{dependency.name}" \
-                                      " Detail : #{response.body}")
+              Dependabot.logger.error("Error while fetching details for #{dependency.name} " \
+                                      "Detail : #{response.body}")
             end
 
             return parsed_results unless response.status == 200
@@ -113,28 +112,11 @@ module Dependabot
 
             parsed_results
           rescue StandardError => e
-            Dependabot.logger.error("Error while fetching package info for Git Submodules: #{e.message}")
+            Dependabot.logger.error("Error while fetching package info for git submodule: #{e.message}")
             parsed_results
           end
         end
 
-        sig { returns(String) }
-        def provider_url
-          provider_url = @url.gsub(/\.git$/, "")
-
-          api_url = {
-            github: provider_url.gsub("github.com", "api.github.com/repos")
-          }.freeze
-
-          "#{api_url[:github]}/commits?sha=#{@ref}"
-        end
-
-        sig { returns(String) }
-        def ref
-          dependency.source_details&.fetch(:ref, nil) ||
-            dependency.source_details&.fetch(:branch, nil) || "HEAD"
-        end
-
         sig { returns(String) }
         def url
           dependency.source_details&.fetch(:url, nil)

data/lib/dependabot/git_submodules/update_checker/latest_version_finder.rb

@@ -15,24 +15,32 @@ require "dependabot/git_submodules/package/package_details_fetcher"
 module Dependabot
   module GitSubmodules
     class UpdateChecker
-      class LatestVersionFinder
+      class LatestVersionFinder < Dependabot::Package::PackageLatestVersionFinder
         extend T::Sig
 
         sig do
           params(
             dependency: Dependabot::Dependency,
-            credentials: T::Array[Dependabot::Credential]
+            credentials: T::Array[Dependabot::Credential],
+            cooldown_options: T.nilable(Dependabot::Package::ReleaseCooldownOptions)
           ).void
         end
-        def initialize(dependency:, credentials:)
+        def initialize(dependency:, credentials:, cooldown_options:)
           @dependency = dependency
           @credentials = credentials
+          @cooldown_options = cooldown_options
         end
 
-        sig { returns(Dependabot::Dependency) }
-        attr_reader :dependency
-        sig { returns(T::Array[Dependabot::Credential]) }
-        attr_reader :credentials
+        sig { returns(T.nilable(String)) }
+        def latest_tag
+          releases = version_list
+
+          releases = filter_by_cooldown(T.must(releases))
+
+          # if there are no releases after applying filters, we fallback to the current tag to avoid empty results
+          releases = apply_post_fetch_latest_versions_filter(releases)
+          releases.first&.tag
+        end
 
         sig { returns(T.nilable(T::Array[Dependabot::Package::PackageRelease])) }
         def version_list
@@ -43,12 +51,74 @@ module Dependabot
             ).available_versions, T.nilable(T::Array[Dependabot::Package::PackageRelease]))
         end
 
-        sig { returns(T.nilable(String)) }
-        def latest_version
-          latest_version = version_list
-          latest_version = latest_version&.first&.tag.to_s
-          latest_version
+        sig { params(release: Dependabot::Package::PackageRelease).returns(T::Boolean) }
+        def in_cooldown_period?(release)
+          unless release.released_at
+            Dependabot.logger.info("Release date not available for ref tag #{release.tag}")
+            return false
+          end
+
+          days = cooldown_days
+          passed_seconds = Time.now.to_i - release.released_at.to_i
+          passed_days = passed_seconds / DAY_IN_SECONDS
+
+          if passed_days < days
+            Dependabot.logger.info("Filtered #{release.tag}, Released on: " \
+                                   "#{T.must(release.released_at).strftime('%Y-%m-%d')} " \
+                                   "(#{passed_days}/#{days} cooldown days)")
+          end
+
+          passed_seconds < days * DAY_IN_SECONDS
         end
+
+        sig do
+          returns(Integer)
+        end
+        def cooldown_days
+          cooldown = @cooldown_options
+          return 0 if cooldown.nil?
+          return 0 unless cooldown_enabled?
+          return 0 unless cooldown.included?(dependency.name)
+
+          return cooldown.default_days if cooldown.default_days.positive?
+          return cooldown.semver_major_days if cooldown.semver_major_days.positive?
+          return cooldown.semver_minor_days if cooldown.semver_minor_days.positive?
+          return cooldown.semver_patch_days if cooldown.semver_patch_days.positive?
+
+          cooldown.default_days
+        end
+
+        sig { returns(T::Boolean) }
+        def cooldown_enabled?
+          Dependabot::Experiments.enabled?(:enable_cooldown_for_gitsubmodules)
+        end
+
+        sig do
+          params(releases: T::Array[Dependabot::Package::PackageRelease])
+            .returns(T::Array[Dependabot::Package::PackageRelease])
+        end
+        def apply_post_fetch_latest_versions_filter(releases)
+          if releases.empty?
+            Dependabot.logger.info("No releases found for #{dependency.name} after applying filters.")
+            return releases
+          end
+
+          releases << Dependabot::Package::PackageRelease.new(
+            version: GitSubmodules::Version.new("1.0.0"),
+            tag: dependency.version
+          )
+
+          releases
+        end
+
+        sig { returns(Dependabot::Dependency) }
+        attr_reader :dependency
+        sig { returns(T::Array[Dependabot::Credential]) }
+        attr_reader :credentials
+        sig { returns(T.nilable(Dependabot::Package::ReleaseCooldownOptions)) }
+        attr_reader :cooldown_options
+        sig { override.returns(T.nilable(Dependabot::Package::PackageDetails)) }
+        def package_details; end
       end
     end
   end

data/lib/dependabot/git_submodules/update_checker.rb

@@ -60,8 +60,9 @@ module Dependabot
       def fetch_latest_version
         T.let(LatestVersionFinder.new(
           dependency: dependency,
-          credentials: credentials
-        ).latest_version, T.nilable(String))
+          credentials: credentials,
+          cooldown_options: update_cooldown
+        ).latest_tag, T.nilable(String))
       end
     end
   end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-git_submodules
 version: !ruby/object:Gem::Version
-  version: 0.316.0
+  version: 0.317.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.316.0
+        version: 0.317.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.316.0
+        version: 0.317.0
 - !ruby/object:Gem::Dependency
   name: parseconfig
   requirement: !ruby/object:Gem::Requirement
@@ -277,7 +277,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.316.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.317.0
 rdoc_options: []
 require_paths:
 - lib