dependabot-github_actions 0.236.0 → 0.238.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 01da475f18da7673192a1e563c21dda76604fced7ad602af4d0bb7e65b1d1631
-  data.tar.gz: 5b4a93873ab7bb6adbfe9cceaa22de7f61ba362ce44e50c73c18a7fd0c5512f5
+  metadata.gz: 417a5dc780b5653b184e1b85bf500acba5f75527d0c6533b2d18a137aad5a1a6
+  data.tar.gz: d6162c2c02bf9c61ece051e9cc9c7df0af9037b0c0b10499fce246a685b00407
 SHA512:
-  metadata.gz: 0ba93e333392de5c3ca2cab8f4b0a9d546a5936e84de5de882b88ee8810152323793f1317f3d655db0b6dfd807ae716cc57c3f746a0565fe3fdb7624393bfd74
-  data.tar.gz: a3aced79001e54320e0a3f037c3d38501c7d128dd51d5f5cff1f8d8f76fd8aba302cc2f23784900e7049fab1431102ebbdee9b18e50bcec4a0bbcc0e73b404ee
+  metadata.gz: 11f0acafb4b769b2e808b5447de805cbc5c62a4bbfc57b3ca869886c83fdd1124607d1406b5071a85e36953734186f5596cf6997cb96d3a3adc020dd11a112c2
+  data.tar.gz: 3cfdc22db82f2c0317709ed293fbb8f7ce941f3e5b38b58ea43f7e23cd59ac8db462fe154e7802924071483801e72c7a0b63433b21f594c7fdd38fbf6970b9e8

data/lib/dependabot/github_actions/file_fetcher.rb

@@ -1,12 +1,16 @@
 # typed: true
 # frozen_string_literal: true
 
+require "sorbet-runtime"
 require "dependabot/file_fetchers"
 require "dependabot/file_fetchers/base"
 
 module Dependabot
   module GithubActions
     class FileFetcher < Dependabot::FileFetchers::Base
+      extend T::Sig
+      extend T::Helpers
+
       FILENAME_PATTERN = /^(\.github|action.ya?ml)$/
 
       def self.required_files_in?(filenames)
@@ -17,8 +21,7 @@ module Dependabot
         "Repo must contain a .github/workflows directory with YAML files or an action.yml file"
       end
 
-      private
-
+      sig { override.returns(T::Array[DependencyFile]) }
       def fetch_files
         fetched_files = []
         fetched_files += correctly_encoded_workflow_files
@@ -45,6 +48,8 @@ module Dependabot
         end
       end
 
+      private
+
       def workflow_files
         return @workflow_files if defined? @workflow_files
 

data/lib/dependabot/github_actions/file_parser.rb

@@ -55,19 +55,21 @@ module Dependabot
             credentials: credentials,
             consider_version_branches_pinned: true
           )
-          next unless git_checker.pinned?
-
-          # If dep does not have an assigned (semver) version, look for a commit that references a semver tag
-          unless dep.version
-            resolved = git_checker.local_tag_for_pinned_sha
-
-            if resolved && version_class.correct?(resolved)
-              dep = Dependency.new(
-                name: dep.name,
-                version: version_class.new(resolved).to_s,
-                requirements: dep.requirements,
-                package_manager: dep.package_manager
-              )
+          if git_checker.git_repo_reachable?
+            next unless git_checker.pinned?
+
+            # If dep does not have an assigned (semver) version, look for a commit that references a semver tag
+            unless dep.version
+              resolved = git_checker.version_for_pinned_sha
+
+              if resolved
+                dep = Dependency.new(
+                  name: dep.name,
+                  version: resolved.to_s,
+                  requirements: dep.requirements,
+                  package_manager: dep.package_manager
+                )
+              end
             end
           end
 

data/lib/dependabot/github_actions/update_checker.rb

@@ -1,6 +1,7 @@
 # typed: true
 # frozen_string_literal: true
 
+require "sorbet-runtime"
 require "dependabot/update_checkers"
 require "dependabot/update_checkers/base"
 require "dependabot/update_checkers/version_filters"
@@ -11,6 +12,8 @@ require "dependabot/github_actions/requirement"
 module Dependabot
   module GithubActions
     class UpdateChecker < Dependabot::UpdateCheckers::Base
+      extend T::Sig
+
       def latest_version
         @latest_version ||= fetch_latest_version
       end
@@ -141,7 +144,7 @@ module Dependabot
             head_commit_for_ref_sha
           else
             url = git_commit_checker.dependency_source_details[:url]
-            source = Source.from_url(url)
+            source = T.must(Source.from_url(url))
 
             SharedHelpers.in_a_temporary_directory(File.dirname(source.repo)) do |temp_dir|
               repo_contents_path = File.join(temp_dir, File.basename(source.repo))
@@ -150,8 +153,7 @@ module Dependabot
 
               Dir.chdir(repo_contents_path) do
                 ref_branch = find_container_branch(git_commit_checker.dependency_source_details[:ref])
-
-                git_commit_checker.head_commit_for_local_branch(ref_branch)
+                git_commit_checker.head_commit_for_local_branch(ref_branch) if ref_branch
               end
             end
           end
@@ -251,6 +253,7 @@ module Dependabot
           "git branch --remotes --contains #{sha}",
           fingerprint: "git branch --remotes --contains <sha>"
         ).split("\n").map { |branch| branch.strip.gsub("origin/", "") }
+        return if branches_including_ref.empty?
 
         current_branch = branches_including_ref.find { |branch| branch.start_with?("HEAD -> ") }
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-github_actions
 version: !ruby/object:Gem::Version
-  version: 0.236.0
+  version: 0.238.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2023-10-26 00:00:00.000000000 Z
+date: 2023-12-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.236.0
+        version: 0.238.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.236.0
+        version: 0.238.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -94,20 +94,34 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '1.3'
+- !ruby/object:Gem::Dependency
+  name: rspec-sorbet
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 1.9.2
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 1.9.2
 - !ruby/object:Gem::Dependency
   name: rubocop
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.56.0
+        version: 1.57.2
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.56.0
+        version: 1.57.2
 - !ruby/object:Gem::Dependency
   name: rubocop-performance
   requirement: !ruby/object:Gem::Requirement
@@ -213,7 +227,7 @@ licenses:
 - Nonstandard
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.236.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.238.0
 post_install_message: 
 rdoc_options: []
 require_paths: