dependabot-github_actions 0.112.9 → 0.112.10

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3e3359e9aa356ec1b765548a63ada2343bc662707e021b7b64511cf2151c7885
-  data.tar.gz: d688b32081069b8a07c6e442db52dd77f666e692fc52e3e8d9a90cf6918a49de
+  metadata.gz: bd802eec01e7fb3b79b785b35ebe85c47afca182003e6d02de2a46afc1eab05b
+  data.tar.gz: 42419c95b244858e55af5021ea27087df8c9afe99bc2b184998019316dc14f8c
 SHA512:
-  metadata.gz: 33aaea210f379f892377cead271631b5880503418451bc6fad71ea9a9c88b095cd3b8c2247f026852c42f1cbe0394a1fd5d1c5705e68606a6baea1d999f79aee
-  data.tar.gz: 426dd9c9dff2d3ab618fe160a783e4a826d8531080da7b007a921ba802eb9d7d0e93361a04f478e0e9f593bff81184503eb5ec4b3da8d919dc8a64f564bb8cee
+  metadata.gz: 3abe1c916fca6d4f7d2a5580a3692849f9ccfd958ce221c9a9e605ef18bb5ceea890ba62cb19011b93b6bd0f293ea7919bf96ae42c974303ca3bfafd1f109328
+  data.tar.gz: 89463e1a79e362b6c23ea1697ffd63c6a7ca8b8704e82653cd1ecdfb11aa038381839b026cc62335a73fb0608d44788bd0de4439f99621bfb7ca19eaa2c81a7c

data/lib/dependabot/github_actions/file_parser.rb

@@ -9,6 +9,7 @@ require "dependabot/errors"
 
 # For docs, see
 # https://help.github.com/en/articles/configuring-a-workflow#referencing-actions-in-your-workflow
+# https://help.github.com/en/articles/workflow-syntax-for-github-actions#example-using-versioned-actions
 module Dependabot
   module GithubActions
     class FileParser < Dependabot::FileParsers::Base

data/lib/dependabot/github_actions/metadata_finder.rb

@@ -11,7 +11,12 @@ module Dependabot
       def look_up_source
         info = dependency.requirements.map { |r| r[:source] }.compact.first
 
-        url = info[:url] || info.fetch("url")
+        url =
+          if info.nil?
+            "https://github.com/#{dependency.name}"
+          else
+            info[:url] || info.fetch("url")
+          end
         Source.from_url(url)
       end
     end

data/lib/dependabot/github_actions/update_checker.rb

@@ -63,13 +63,23 @@ module Dependabot
           return latest_tag.fetch(:commit_sha)
         end
 
+        # If the dependency is pinned to a commit SHA and the latest
+        # version-like tag includes that commit then we want to update to that
+        # version-like tag. We return a version (not a commit SHA) so that we
+        # get nice behaviour in PullRequestCreator::MessageBuilder
+        if git_commit_checker.pinned_ref_looks_like_commit_sha? &&
+           (latest_tag = git_commit_checker.local_tag_for_latest_version) &&
+           git_commit_checker.branch_or_ref_in_release?(latest_tag[:version])
+          return latest_tag.fetch(:version)
+        end
+
         # If the dependency is pinned to a tag that doesn't look like a
-        # version then there's nothing we can do.
-        #
-        # TODO: Treat refs that look like SHAs differently
+        # version or a commit SHA then there's nothing we can do.
         dependency.version
       end
 
+      # rubocop:disable Metrics/CyclomaticComplexity
+      # rubocop:disable Metrics/PerceivedComplexity
       def updated_source
         # TODO: Support Docker sources
         return dependency_source_details unless git_dependency?
@@ -81,9 +91,18 @@ module Dependabot
           return dependency_source_details.merge(ref: new_tag.fetch(:tag))
         end
 
+        # Update the git tag if updating a pinned commit
+        if git_commit_checker.pinned_ref_looks_like_commit_sha? &&
+           (latest_tag = git_commit_checker.local_tag_for_latest_version) &&
+           git_commit_checker.branch_or_ref_in_release?(latest_tag[:version])
+          return dependency_source_details.merge(ref: latest_tag.fetch(:tag))
+        end
+
         # Otherwise return the original source
         dependency_source_details
       end
+      # rubocop:enable Metrics/CyclomaticComplexity
+      # rubocop:enable Metrics/PerceivedComplexity
 
       def dependency_source_details
         sources =

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-github_actions
 version: !ruby/object:Gem::Version
-  version: 0.112.9
+  version: 0.112.10
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-08-21 00:00:00.000000000 Z
+date: 2019-08-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.112.9
+        version: 0.112.10
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.112.9
+        version: 0.112.10
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement