dependabot-github_actions 0.237.0 → 0.239.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9f21866075019c5a142acbc0f0c620a6bbfba50eb16a1bb59e37cd0474c0d88f
-  data.tar.gz: 70fec17d129dff3814b61e810d6238985ac08ed59e2aa99319cb6ae3c5eba4b3
+  metadata.gz: ff3ec4fa8f1b132227c557b6fa76217241bec1a0a75f53628f985a824a2be1f3
+  data.tar.gz: a02e8693737f12942663d1e4c5b7ffcb5f3955792a07b0f5fa0b4a829d925cbe
 SHA512:
-  metadata.gz: c5eb1345d8690120321f69856e735d0aea769705105dc4168b2f007ea1ad97ed71b2c1c3e2df0ad1179d1c88327326b272e07ffe4e2fb55c305f70c14ee6957c
-  data.tar.gz: bb5ea0c6225529c1c07f6c2ca88d11a7b038d852084450b097fa46df1331e2ad3addc890b0189039445882ee7639e553f6598e9c95db5624646ac6f0b11177f4
+  metadata.gz: 1022e0293ced804a75245f3b1dd81c20393eb112ca7837f73426c88b37f4b9b182473ecc0f1f5a5f935e5119b914de3c17a269d43c1f98ece4198585f41630ab
+  data.tar.gz: 45f493d1f78fe2e01a3227d1e07b50ae53f5bf1ff345264a2e17745b8aa42f9490817e05d85d9cdbb5f83f7c942fd0fc2826dd5af59fd602b9a202a86aae680e

data/lib/dependabot/github_actions/file_parser.rb

@@ -55,19 +55,21 @@ module Dependabot
             credentials: credentials,
             consider_version_branches_pinned: true
           )
-          next unless git_checker.pinned?
-
-          # If dep does not have an assigned (semver) version, look for a commit that references a semver tag
-          unless dep.version
-            resolved = git_checker.local_tag_for_pinned_sha
-
-            if resolved && version_class.correct?(resolved)
-              dep = Dependency.new(
-                name: dep.name,
-                version: version_class.new(resolved).to_s,
-                requirements: dep.requirements,
-                package_manager: dep.package_manager
-              )
+          if git_checker.git_repo_reachable?
+            next unless git_checker.pinned?
+
+            # If dep does not have an assigned (semver) version, look for a commit that references a semver tag
+            unless dep.version
+              resolved = git_checker.version_for_pinned_sha
+
+              if resolved
+                dep = Dependency.new(
+                  name: dep.name,
+                  version: resolved.to_s,
+                  requirements: dep.requirements,
+                  package_manager: dep.package_manager
+                )
+              end
             end
           end
 

data/lib/dependabot/github_actions/file_updater.rb

@@ -100,6 +100,8 @@ module Dependabot
         return unless git_checker.ref_looks_like_commit_sha?(old_ref)
 
         previous_version_tag = git_checker.most_specific_version_tag_for_sha(old_ref)
+        return unless previous_version_tag # There's no tag for this commit
+
         previous_version = version_class.new(previous_version_tag).to_s
         return unless comment.end_with? previous_version
 

data/lib/dependabot/github_actions/requirement.rb

@@ -1,16 +1,20 @@
 # typed: true
 # frozen_string_literal: true
 
+require "sorbet-runtime"
+
+require "dependabot/requirement"
 require "dependabot/utils"
 require "dependabot/github_actions/version"
 
 module Dependabot
   module GithubActions
     # Lifted from the bundler package manager
-    class Requirement < Gem::Requirement
+    class Requirement < Dependabot::Requirement
       # For consistency with other languages, we define a requirements array.
       # Ruby doesn't have an `OR` separator for requirements, so it always
       # contains a single element.
+      sig { override.params(requirement_string: T.nilable(String)).returns(T::Array[Requirement]) }
       def self.requirements_array(requirement_string)
         [new(requirement_string)]
       end

data/lib/dependabot/github_actions/update_checker.rb

@@ -153,8 +153,7 @@ module Dependabot
 
               Dir.chdir(repo_contents_path) do
                 ref_branch = find_container_branch(git_commit_checker.dependency_source_details[:ref])
-
-                git_commit_checker.head_commit_for_local_branch(ref_branch)
+                git_commit_checker.head_commit_for_local_branch(ref_branch) if ref_branch
               end
             end
           end
@@ -254,6 +253,7 @@ module Dependabot
           "git branch --remotes --contains #{sha}",
           fingerprint: "git branch --remotes --contains <sha>"
         ).split("\n").map { |branch| branch.strip.gsub("origin/", "") }
+        return if branches_including_ref.empty?
 
         current_branch = branches_including_ref.find { |branch| branch.start_with?("HEAD -> ") }
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-github_actions
 version: !ruby/object:Gem::Version
-  version: 0.237.0
+  version: 0.239.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2023-11-21 00:00:00.000000000 Z
+date: 2023-12-28 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.237.0
+        version: 0.239.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.237.0
+        version: 0.239.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -114,14 +114,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.57.2
+        version: 1.58.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.57.2
+        version: 1.58.0
 - !ruby/object:Gem::Dependency
   name: rubocop-performance
   requirement: !ruby/object:Gem::Requirement
@@ -227,7 +227,7 @@ licenses:
 - Nonstandard
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.237.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.239.0
 post_install_message: 
 rdoc_options: []
 require_paths: