dependabot-github_actions 0.206.0 → 0.209.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 96291b44fd0565e6880a331fa79e02673ce68839bb8fe12f3c5b07407c38c3d0
-  data.tar.gz: 36b2c1d6f4db798c5f7cbef2410c0f604ddd58082b7c5b4fc2a69135910a587b
+  metadata.gz: 95383a0b46d57e16120c3f9ca4b15b77d860fa6c24da4060e432fd9a268314fd
+  data.tar.gz: bad06cf26e78be9c5f35cad2533968bd427132d49a964bd83f05463ebd3c91fd
 SHA512:
-  metadata.gz: 6c3ce5269cc237109573f91247af29c45f854e9d6706fea5b7081b0cba6669f86d72a5a800c58df2252e2a2b6cb212f3f863a5ff030a2b115deb0841feb4a7c8
-  data.tar.gz: 33d427a50819f4cf6fd7fa7a3895fd779203caf691ba58ead06848ed26037b5afb526055194fe5ffc3f3e33222e18dcc5b047a1dc857f512ef41b1c20bab61b2
+  metadata.gz: 15ebf9cabe2fab309c9de7713941971acde38167c61f470cfd36b28de965039f43f97cea06d21638fe2bd118681ca8705ad61d3f650ce52469848e68dd5ee611
+  data.tar.gz: d310c382ed24f57f1bce4e75a8fafa94bd8eaf0207ecd55f9fe89a61cb735279db3ffb75fdb86c1ca27d6b72b880ded7cf7499879cbdcfd2a33c984a1561376c

data/lib/dependabot/github_actions/update_checker.rb

@@ -70,13 +70,10 @@ module Dependabot
           return latest_version
         end
 
-        # If the dependency is pinned to a commit SHA and the latest
-        # version-like tag includes that commit then we want to update to that
-        # version-like tag. We return a version (not a commit SHA) so that we
-        # get nice behaviour in PullRequestCreator::MessageBuilder
-        if git_commit_checker.pinned_ref_looks_like_commit_sha? &&
-           (latest_tag = git_commit_checker.local_tag_for_latest_version) &&
-           git_commit_checker.branch_or_ref_in_release?(latest_tag[:version])
+        # If the dependency is pinned to a commit SHA, we return a *version* so
+        # that we get nice behaviour in PullRequestCreator::MessageBuilder
+        if git_commit_checker.pinned_ref_looks_like_commit_sha?
+          latest_tag = git_commit_checker.local_tag_for_latest_version
           return latest_tag.fetch(:version)
         end
 
@@ -122,12 +119,12 @@ module Dependabot
           return dependency_source_details.merge(ref: new_tag.fetch(:tag))
         end
 
-        # Update the git commit if updating a pinned commit
+        latest_tag = git_commit_checker.local_tag_for_latest_version
+
+        # Update the pinned git commit if one is available
         if git_commit_checker.pinned_ref_looks_like_commit_sha? &&
-           (latest_tag = git_commit_checker.local_tag_for_latest_version) &&
-           git_commit_checker.branch_or_ref_in_release?(latest_tag[:version]) &&
-           (latest_commit = latest_tag.fetch(:commit_sha)) != current_commit
-          return dependency_source_details.merge(ref: latest_commit)
+           latest_tag.fetch(:commit_sha) != current_commit
+          return dependency_source_details.merge(ref: latest_tag.fetch(:commit_sha))
         end
 
         # Otherwise return the original source

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-github_actions
 version: !ruby/object:Gem::Version
-  version: 0.206.0
+  version: 0.209.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-08-10 00:00:00.000000000 Z
+date: 2022-08-17 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.206.0
+        version: 0.209.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.206.0
+        version: 0.209.0
 - !ruby/object:Gem::Dependency
   name: debase
   requirement: !ruby/object:Gem::Requirement