dependabot-git_submodules 0.361.1 → 0.361.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8343e8da01058a31c9dab63f11ec355d1d4d9d14ec0034aa48973ccafce2d677
-  data.tar.gz: 4bae29c894a9d8e9e785281de1f86be31616a6a27c7562ba583e1a3a0916b5fb
+  metadata.gz: 75a02824539aee4dc3114760cb13750df7b0682d881d768ef985cd2f2007ac5a
+  data.tar.gz: 1c8cb74244655a987d8e19d1c3d366b3bd8488bc930bbd3b2f288d1cb21b9918
 SHA512:
-  metadata.gz: f75c4093d8be080c1e7ffc1b45c84252eb8dcdde85e4e8630e53f5f2c27b0f9f094c8c30c47b58646172a06fe1b7f907ce62ea3eeeba006fd65695e0b3f88726
-  data.tar.gz: e4f62b6f7cda06a91a31dc85768d56750f20c414e24c9d1cc1ed119cb185e8fba63db40d7a48003ea5cc51e269283d59afc3532433455fcfe25d3c6e3291eafc
+  metadata.gz: 748d7b166256bdf2fdef580eea4bb5226e17c3e282e2c852d95437a0a0b3e97956c59afa1e87c96e55c001b1006009e7135df0cb0308e2fefcefa181f5bee42d
+  data.tar.gz: d95c8bfcd8fb61e120cf76746ef561403fb23689e8a466992039a473187191e63d1d0324d52df0ee3ec6cde7d3b8b0066c7a4ab1c9a9edcd307f7bedfc1baca3

data/lib/dependabot/git_submodules/package/package_details_fetcher.rb

@@ -39,11 +39,9 @@ module Dependabot
 
         sig { returns(T.nilable(T::Array[Dependabot::Package::PackageRelease])) }
         def available_versions
+          sha_to_tags = build_sha_to_tags
           versions_metadata = T.let(fetch_tags_and_release_date, T.nilable(T::Array[GitTagWithDetail]))
 
-          # as git submodules do not have versions (refs/tags are used instead), we use a pseudo version as placeholder
-          pseudo_version = 1.0
-
           # we fallback to the git based tag info if no versions metadata is available
           if versions_metadata&.empty?
             versions_metadata = T.let(
@@ -52,15 +50,12 @@ module Dependabot
             )
           end
 
-          releases = T.must(versions_metadata).map do |version_details|
-            Dependabot::Package::PackageRelease.new(
-              version: GitSubmodules::Version.new((pseudo_version += 1).to_s),
-              tag: version_details.tag,
-              released_at: version_details.release_date ? Time.parse(T.must(version_details.release_date)) : nil
-            )
-          end
+          # as git submodules do not have versions (refs/tags are used instead), we use a pseudo version as placeholder
+          pseudo_version = T.must(versions_metadata).length + 1
 
-          releases
+          T.must(versions_metadata).flat_map do |version_details|
+            process_metadata(version_details, sha_to_tags, pseudo_version -= 1)
+          end
         end
 
         private
@@ -69,10 +64,7 @@ module Dependabot
         def fetch_latest_tag_info
           parsed_results = T.let([], T::Array[GitTagWithDetail])
 
-          git_commit_checker = Dependabot::GitCommitChecker.new(
-            dependency: dependency,
-            credentials: credentials
-          )
+          git_commit_checker = build_client
 
           parsed_results <<
             GitTagWithDetail.new(
@@ -82,38 +74,36 @@ module Dependabot
           parsed_results
         end
 
+        TARGET_COMMITS_TO_FETCH = 500
+        private_constant :TARGET_COMMITS_TO_FETCH
+
         sig { returns(T::Array[GitTagWithDetail]) }
         def fetch_tags_and_release_date
           parsed_results = T.let([], T::Array[GitTagWithDetail])
 
           begin
             Dependabot.logger.info("Fetching release info for Git Submodules: #{dependency.name}")
-
-            client = Dependabot::GitCommitChecker.new(
-              dependency: dependency,
-              credentials: credentials
-            )
-
-            response = client.ref_details_for_pinned_ref
-
-            unless response.status == 200
-              Dependabot.logger.error(
-                "Error while fetching details for #{dependency.name} " \
-                "Detail : #{response.body}"
-              )
+            client = build_client
+
+            sha = T.let(nil, T.nilable(String))
+            catch :found do
+              while parsed_results.length < TARGET_COMMITS_TO_FETCH
+                max_len = Dependabot::GitMetadataFetcher::MAX_COMMITS_PER_PAGE
+                max_len -= 1 unless sha.nil?
+                commits = get_commits(client, sha)
+                break if commits.empty?
+
+                commits.each do |commit|
+                  sha = commit["sha"]
+                  parsed_results << GitTagWithDetail.new(
+                    tag: sha,
+                    release_date: commit["commit"]["committer"]["date"]
+                  )
+                  throw :found if sha == dependency.version
+                end
+                break if commits.length < max_len
+              end
             end
-
-            return parsed_results unless response.status == 200
-
-            releases = JSON.parse(response.body)
-
-            parsed_results = releases.map do |release|
-              GitTagWithDetail.new(
-                tag: release["sha"],
-                release_date: release["commit"]["committer"]["date"]
-              )
-            end
-
             parsed_results
           rescue StandardError => e
             Dependabot.logger.error("Error while fetching package info for git submodule: #{e.message}")
@@ -121,10 +111,95 @@ module Dependabot
           end
         end
 
+        sig { returns(Dependabot::GitCommitChecker) }
+        def build_client
+          Dependabot::GitCommitChecker.new(
+            dependency: dependency,
+            credentials: credentials
+          )
+        end
+
         sig { returns(String) }
         def url
           dependency.source_details&.fetch(:url, nil)
         end
+
+        sig { returns(T::Hash[String, T::Array[String]]) }
+        def build_sha_to_tags
+          build_client.tags.each_with_object({}) do |tag, sha_to_tags|
+            (sha_to_tags[tag.commit_sha] ||= []) << tag.name
+          end
+        end
+
+        sig do
+          params(
+            client: Dependabot::GitCommitChecker,
+            sha: T.nilable(String)
+          ).returns(T::Array[T::Hash[String, T.untyped]])
+        end
+        def get_commits(client, sha)
+          response = sha.nil? ? client.ref_details_for_pinned_ref : client.ref_details(sha)
+
+          unless response.status == 200
+            Dependabot.logger.error(
+              "Error while fetching details for #{dependency.name} " \
+              "Detail : #{response.body}"
+            )
+          end
+
+          return [] unless response.status == 200
+
+          commits = JSON.parse(response.body)
+          sha.nil? || commits.empty? ? commits : commits[1..]
+        end
+
+        sig do
+          params(
+            version_details: GitTagWithDetail,
+            sha_to_tags: T::Hash[String, T::Array[String]],
+            pseudo_version: Integer
+          ).returns(T::Array[Dependabot::Package::PackageRelease])
+        end
+        def process_metadata(version_details, sha_to_tags, pseudo_version)
+          released_at = version_details.release_date ? Time.parse(T.must(version_details.release_date)) : nil
+          sha = version_details.tag
+
+          normalized_versions(sha, sha_to_tags, pseudo_version).map do |version|
+            Dependabot::Package::PackageRelease.new(
+              version: version,
+              tag: sha,
+              released_at: released_at
+            )
+          end
+        end
+
+        sig do
+          params(
+            sha: String,
+            sha_to_tags: T::Hash[String, T::Array[String]],
+            pseudo_version: Integer
+          ).returns(T::Array[Dependabot::Version])
+        end
+        def normalized_versions(sha, sha_to_tags, pseudo_version)
+          versions = Array(sha_to_tags[sha]).map do |tag_name|
+            normalized_version(tag_name, pseudo_version)
+          end
+
+          versions << normalized_version(sha, pseudo_version)
+
+          versions.uniq
+        end
+
+        sig { params(tag: String, pseudo_version: Integer).returns(Dependabot::Version) }
+        def normalized_version(tag, pseudo_version)
+          if Dependabot::Version.valid_semver?(tag)
+            Dependabot::Version.new(tag)
+          elsif tag.start_with?("v") && GitSubmodules::Version.valid_semver?(T.must(tag[1..]))
+            Dependabot::Version.new(tag[1..])
+          else
+            Dependabot::Version.new("0.0.0-0.#{pseudo_version}")
+          end
+        end
       end
     end
   end

data/lib/dependabot/git_submodules/update_checker/latest_version_finder.rb

@@ -39,7 +39,7 @@ module Dependabot
 
           # if there are no releases after applying filters, we fallback to the current tag to avoid empty results
           releases = apply_post_fetch_latest_versions_filter(releases)
-          releases.first&.tag
+          releases.max_by(&:version)&.tag
         end
 
         sig { returns(T.nilable(T::Array[Dependabot::Package::PackageRelease])) }
@@ -109,7 +109,7 @@ module Dependabot
           end
 
           releases << Dependabot::Package::PackageRelease.new(
-            version: GitSubmodules::Version.new("1.0.0"),
+            version: GitSubmodules::Version.new("0.0.0-0.0"), # Lower than versions from package_details_fetcher
             tag: dependency.version
           )
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-git_submodules
 version: !ruby/object:Gem::Version
-  version: 0.361.1
+  version: 0.361.2
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.361.1
+        version: 0.361.2
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.361.1
+        version: 0.361.2
 - !ruby/object:Gem::Dependency
   name: parseconfig
   requirement: !ruby/object:Gem::Requirement
@@ -277,7 +277,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.361.1
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.361.2
 rdoc_options: []
 require_paths:
 - lib