dependabot-github_actions 0.145.1 → 0.146.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 281c9c5e2f5db5f8329431348cd5fb705cd35718ea09f087c4f020f5ba49f2e7
-  data.tar.gz: feafd76ecf09b06a0ef7069a0150a031d14cad97c4ea929c02ea7f61257bef55
+  metadata.gz: f18094461826b65eab69b655ca90e8cc7e143d3d2ac9cf15f2256bf0a6d47a29
+  data.tar.gz: 6bad99dfc7ffcb8a06eace7894fda46a7ceb4ab94980e2a8b656f5a281bcd324
 SHA512:
-  metadata.gz: 1387de72e92b4ead8a65f8540b2bf0327897f100e27e3b5ca0c8243df6fb0314c0d3598a631c4cbae481b0ddfaf2256b4440f63609b037109c40d487d44af031
-  data.tar.gz: 9f5e0ad0a6a0556b73b349c016d008cd349a8864530c30658ca9f23ea8900bea2149ac4b573dbaf31cf4b28831fdedb906f6d5e0dd3eb40007f23778e091ac9b
+  metadata.gz: f1d187ecbeafaa181f64b90d2371c6f16fe308910bb129a708087021b3cf9ba58ea9f4622608421a3ea163e16d5ef8ce56b8edef913512d936240380d9cd28bf
+  data.tar.gz: 1f6a313a85b15056d563f0edfb08aedf6bcc9c507dccf2ebdd9bf18aba64c279983f3bd7121e7f86941cb53a7de0dc6b8ef11534da2630eb128fb059cbb8314a

data/lib/dependabot/github_actions/file_parser.rb

@@ -30,6 +30,7 @@ module Dependabot
           dependency_set += workfile_file_dependencies(file)
         end
 
+        resolve_git_tags(dependency_set)
         dependency_set.dependencies
       end
 
@@ -56,16 +57,18 @@ module Dependabot
         name = "#{details.fetch('owner')}/#{details.fetch('repo')}"
         url = "https://github.com/#{name}"
 
+        ref = details.fetch("ref")
+        version = version_class.new(ref).to_s if version_class.correct?(ref)
         Dependency.new(
           name: name,
-          version: nil,
+          version: version,
           requirements: [{
             requirement: nil,
             groups: [],
             source: {
               type: "git",
               url: url,
-              ref: details.fetch("ref"),
+              ref: ref,
               branch: nil
             },
             file: file.name,
@@ -83,6 +86,25 @@ module Dependabot
         end
       end
 
+      def resolve_git_tags(dependency_set)
+        # Find deps that do not have an assigned (semver) version, but pin a commit that references a semver tag
+        resolved = dependency_set.dependencies.map do |dep|
+          next unless dep.version.nil?
+
+          git_checker = Dependabot::GitCommitChecker.new(dependency: dep, credentials: credentials)
+          next unless git_checker.pinned_ref_looks_like_commit_sha?
+
+          resolved = git_checker.local_tag_for_pinned_version
+          next if resolved.nil? || !version_class.correct?(resolved)
+
+          # Build a Dependency with the resolved version, and rely on DependencySet's merge
+          Dependency.new(name: dep.name, version: version_class.new(resolved).to_s,
+                         package_manager: dep.package_manager, requirements: [])
+        end
+
+        resolved.compact.each { |dep| dependency_set << dep }
+      end
+
       def deep_fetch_uses_from_hash(json_object)
         steps = json_object.fetch("steps", [])
 
@@ -111,6 +133,10 @@ module Dependabot
 
         raise "No workflow files!"
       end
+
+      def version_class
+        GithubActions::Version
+      end
     end
   end
 end

data/lib/dependabot/github_actions/update_checker.rb

@@ -62,12 +62,14 @@ module Dependabot
         return git_commit_checker.head_commit_for_current_branch unless git_commit_checker.pinned?
 
         # If the dependency is pinned to a tag that looks like a version then
-        # we want to update that tag. The latest version will then be the SHA
-        # of the latest tag that looks like a version.
+        # we want to update that tag.
         if git_commit_checker.pinned_ref_looks_like_version? &&
            git_commit_checker.local_tag_for_latest_version
           latest_tag = git_commit_checker.local_tag_for_latest_version
-          return latest_tag.fetch(:commit_sha)
+          latest_version = latest_tag.fetch(:version)
+          return version_class.new(dependency.version) if shortened_semver_eq?(dependency.version, latest_version.to_s)
+
+          return latest_version
         end
 
         # If the dependency is pinned to a commit SHA and the latest
@@ -140,6 +142,16 @@ module Dependabot
           raise_on_ignored: raise_on_ignored
         )
       end
+
+      def shortened_semver_eq?(base, other)
+        return false unless base
+
+        base_split = base.split(".")
+        other_split = other.split(".")
+        return false unless base_split.length <= other_split.length
+
+        other_split[0..base_split.length - 1] == base_split
+      end
     end
   end
 end

data/lib/dependabot/github_actions/version.rb

@@ -5,6 +5,21 @@ require "dependabot/utils"
 module Dependabot
   module GithubActions
     class Version < Gem::Version
+      def initialize(version)
+        version = Version.remove_leading_v(version)
+        super
+      end
+
+      def self.remove_leading_v(version)
+        return version unless version.to_s.match?(/\Av([0-9])/)
+
+        version.to_s.gsub(/\Av/, "")
+      end
+
+      def self.correct?(version)
+        version = Version.remove_leading_v(version)
+        super
+      end
     end
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-github_actions
 version: !ruby/object:Gem::Version
-  version: 0.145.1
+  version: 0.146.1
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-05-06 00:00:00.000000000 Z
+date: 2021-05-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.145.1
+        version: 0.146.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.145.1
+        version: 0.146.1
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement
@@ -100,14 +100,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.13.0
+        version: 1.14.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.13.0
+        version: 1.14.0
 - !ruby/object:Gem::Dependency
   name: simplecov
   requirement: !ruby/object:Gem::Requirement