dependabot-github_actions 0.264.0 → 0.266.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d249bc3a1cdb17071267d9955afcb5ead3098960ab832d00bc777f2b20f1e865
-  data.tar.gz: e5e0b1da46bee2936bd0bb912e8948e8196f22e9bbbf64225b7c90fbab6f5a50
+  metadata.gz: 0a90e2dbbacd5205886d15e3d15500e6800873046d6dbe81fa706ce4d7221b6b
+  data.tar.gz: 611a3c952475926a6310b11eb3d2f44766df9bb796380d9711b1acf328340d16
 SHA512:
-  metadata.gz: 215afef1a922c94b069f3eba02c2475061313c018495308be317437dd5741df4cbfc68a4cf886cb3e69512226e77b0a2d29c4f0abdb44a9fbb78f19d93ffa344
-  data.tar.gz: d059a0aae57aad5668f99d15a27291babab73708eb92d0a75e700c26e98735fc3f416a2c70658dddbcb592bcfa1a3ed17333df33738b4e517c6be2bfe6855b99
+  metadata.gz: 7d95be8c4815b3c9654eac88835e17e2722c97e53e32cd82f7f9298154fac4cc7a42b3387be9b3f15cdb8ee93e94e2a61f2d059fa75ff86085fc19f13eca9681
+  data.tar.gz: 82a578d6a91db5c4aa3690d2f4355e34195732548d427a456591b17ca81b16f092ce00969a13a0dfb0d79b1a946c09cd9787fc5eea4b6d01c4e50deaf7c615fd

data/lib/dependabot/github_actions/file_fetcher.rb

@@ -36,7 +36,7 @@ module Dependabot
       end
       def initialize(source:, credentials:, repo_contents_path: nil, options: {})
         @workflow_files = T.let([], T::Array[DependencyFile])
-        super(source: source, credentials: credentials, repo_contents_path: repo_contents_path, options: options)
+        super
       end
 
       sig { override.returns(T::Array[DependencyFile]) }

data/lib/dependabot/github_actions/update_checker.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "sorbet-runtime"
@@ -15,29 +15,41 @@ module Dependabot
     class UpdateChecker < Dependabot::UpdateCheckers::Base
       extend T::Sig
 
+      sig { override.returns(T.nilable(T.any(String, Gem::Version))) }
       def latest_version
-        @latest_version ||= fetch_latest_version
+        @latest_version ||= T.let(
+          fetch_latest_version,
+          T.nilable(T.any(String, Gem::Version))
+        )
       end
 
+      sig { override.returns(T.nilable(T.any(String, Gem::Version))) }
       def latest_resolvable_version
         # Resolvability isn't an issue for GitHub Actions.
         latest_version
       end
 
+      sig { override.returns(T.nilable(T.any(String, Dependabot::Version))) }
       def latest_resolvable_version_with_no_unlock
         # No concept of "unlocking" for GitHub Actions (since no lockfile)
         dependency.version
       end
 
+      sig { override.returns(T.nilable(Dependabot::Version)) }
       def lowest_security_fix_version
-        @lowest_security_fix_version ||= fetch_lowest_security_fix_version
+        @lowest_security_fix_version ||= T.let(
+          fetch_lowest_security_fix_version,
+          T.nilable(Dependabot::Version)
+        )
       end
 
+      sig { override.returns(T.nilable(Dependabot::Version)) }
       def lowest_resolvable_security_fix_version
         # Resolvability isn't an issue for GitHub Actions.
         lowest_security_fix_version
       end
 
+      sig { override.returns(T::Array[T::Hash[Symbol, T.untyped]]) }
       def updated_requirements
         dependency.requirements.map do |req|
           source = req[:source]
@@ -61,21 +73,25 @@ module Dependabot
 
       private
 
+      sig { returns(T::Array[Dependabot::SecurityAdvisory]) }
       def active_advisories
         security_advisories.select do |advisory|
           advisory.vulnerable?(version_class.new(git_commit_checker.most_specific_tag_equivalent_to_pinned_ref))
         end
       end
 
+      sig { override.returns(T::Boolean) }
       def latest_version_resolvable_with_full_unlock?
         # Full unlock checks aren't relevant for GitHub Actions
         false
       end
 
+      sig { override.returns(T::Array[Dependabot::Dependency]) }
       def updated_dependencies_after_full_unlock
         raise NotImplementedError
       end
 
+      sig { returns(T.nilable(T.any(Dependabot::Version, String))) }
       def fetch_latest_version
         # TODO: Support Docker sources
         return unless git_dependency?
@@ -83,20 +99,21 @@ module Dependabot
         fetch_latest_version_for_git_dependency
       end
 
+      sig { returns(T.nilable(T.any(Dependabot::Version, String))) }
       def fetch_latest_version_for_git_dependency
         return current_commit unless git_commit_checker.pinned?
 
         # If the dependency is pinned to a tag that looks like a version then
         # we want to update that tag.
         if git_commit_checker.pinned_ref_looks_like_version? && latest_version_tag
-          latest_version = latest_version_tag.fetch(:version)
+          latest_version = latest_version_tag&.fetch(:version)
           return current_version if shortened_semver_eq?(dependency.version, latest_version.to_s)
 
           return latest_version
         end
 
         if git_commit_checker.pinned_ref_looks_like_commit_sha? && latest_version_tag
-          latest_version = latest_version_tag.fetch(:version)
+          latest_version = latest_version_tag&.fetch(:version)
           return latest_commit_for_pinned_ref unless git_commit_checker.local_tag_for_pinned_sha
 
           return latest_version
@@ -107,6 +124,7 @@ module Dependabot
         nil
       end
 
+      sig { returns(T.nilable(Dependabot::Version)) }
       def fetch_lowest_security_fix_version
         # TODO: Support Docker sources
         return unless git_dependency?
@@ -114,23 +132,34 @@ module Dependabot
         fetch_lowest_security_fix_version_for_git_dependency
       end
 
+      sig { returns(T.nilable(Dependabot::Version)) }
       def fetch_lowest_security_fix_version_for_git_dependency
-        lowest_security_fix_version_tag.fetch(:version)
+        lowest_security_fix_version_tag&.fetch(:version)
       end
 
+      sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
       def lowest_security_fix_version_tag
-        @lowest_security_fix_version_tag ||= begin
-          tags_matching_precision = git_commit_checker.local_tags_for_allowed_versions_matching_existing_precision
-          lowest_fixed_version = find_lowest_secure_version(tags_matching_precision)
-          if lowest_fixed_version
-            lowest_fixed_version
-          else
-            tags = git_commit_checker.local_tags_for_allowed_versions
-            find_lowest_secure_version(tags)
-          end
-        end
+        @lowest_security_fix_version_tag ||= T.let(
+          begin
+            tags_matching_precision = git_commit_checker.local_tags_for_allowed_versions_matching_existing_precision
+            lowest_fixed_version = find_lowest_secure_version(tags_matching_precision)
+            if lowest_fixed_version
+              lowest_fixed_version
+            else
+              tags = git_commit_checker.local_tags_for_allowed_versions
+              find_lowest_secure_version(tags)
+            end
+          end,
+          T.nilable(T::Hash[Symbol, String])
+        )
       end
 
+      sig do
+        params(
+          tags: T::Array[T::Hash[Symbol, T.untyped]]
+        )
+          .returns(T.nilable(T::Hash[Symbol, T.untyped]))
+      end
       def find_lowest_secure_version(tags)
         relevant_tags = Dependabot::UpdateCheckers::VersionFilters.filter_vulnerable_versions(tags, security_advisories)
         relevant_tags = filter_lower_tags(relevant_tags)
@@ -138,40 +167,54 @@ module Dependabot
         relevant_tags.min_by { |tag| tag.fetch(:version) }
       end
 
+      sig { returns(T.nilable(String)) }
       def latest_commit_for_pinned_ref
-        @latest_commit_for_pinned_ref ||= begin
-          head_commit_for_ref_sha = git_commit_checker.head_commit_for_pinned_ref
-          if head_commit_for_ref_sha
-            head_commit_for_ref_sha
-          else
-            url = git_commit_checker.dependency_source_details[:url]
-            source = T.must(Source.from_url(url))
-
-            SharedHelpers.in_a_temporary_directory(File.dirname(source.repo)) do |temp_dir|
-              repo_contents_path = File.join(temp_dir, File.basename(source.repo))
-
-              SharedHelpers.run_shell_command("git clone --no-recurse-submodules #{url} #{repo_contents_path}")
-
-              Dir.chdir(repo_contents_path) do
-                ref_branch = find_container_branch(git_commit_checker.dependency_source_details[:ref])
-                git_commit_checker.head_commit_for_local_branch(ref_branch) if ref_branch
+        @latest_commit_for_pinned_ref ||= T.let(
+          begin
+            head_commit_for_ref_sha = git_commit_checker.head_commit_for_pinned_ref
+            if head_commit_for_ref_sha
+              head_commit_for_ref_sha
+            else
+              url = git_commit_checker.dependency_source_details&.fetch(:url)
+              source = T.must(Source.from_url(url))
+
+              SharedHelpers.in_a_temporary_directory(File.dirname(source.repo)) do |temp_dir|
+                repo_contents_path = File.join(temp_dir, File.basename(source.repo))
+
+                SharedHelpers.run_shell_command("git clone --no-recurse-submodules #{url} #{repo_contents_path}")
+
+                Dir.chdir(repo_contents_path) do
+                  ref_branch = find_container_branch(git_commit_checker.dependency_source_details&.fetch(:ref))
+                  git_commit_checker.head_commit_for_local_branch(ref_branch) if ref_branch
+                end
               end
             end
-          end
-        end
+          end,
+          T.nilable(String)
+        )
       end
 
+      sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
       def latest_version_tag
-        @latest_version_tag ||= begin
-          return git_commit_checker.local_tag_for_latest_version if dependency.version.nil?
+        @latest_version_tag ||= T.let(
+          begin
+            return git_commit_checker.local_tag_for_latest_version if dependency.version.nil?
 
-          ref = git_commit_checker.local_ref_for_latest_version_matching_existing_precision
-          return ref if ref && ref.fetch(:version) > current_version
+            ref = git_commit_checker.local_ref_for_latest_version_matching_existing_precision
+            return ref if ref && ref.fetch(:version) > current_version
 
-          git_commit_checker.local_ref_for_latest_version_lower_precision
-        end
+            git_commit_checker.local_ref_for_latest_version_lower_precision
+          end,
+          T.nilable(T::Hash[Symbol, T.untyped])
+        )
       end
 
+      sig do
+        params(
+          tags_array: T::Array[T::Hash[Symbol, T.untyped]]
+        )
+          .returns(T::Array[T::Hash[Symbol, T.untyped]])
+      end
       def filter_lower_tags(tags_array)
         return tags_array unless current_version
 
@@ -179,6 +222,7 @@ module Dependabot
           .select { |tag| tag.fetch(:version) > current_version }
       end
 
+      sig { params(source: T.nilable(T::Hash[Symbol, String])).returns(T.nilable(String)) }
       def updated_ref(source)
         # TODO: Support Docker sources
         return unless git_dependency?
@@ -206,6 +250,7 @@ module Dependabot
         nil
       end
 
+      sig { returns(T.nilable(String)) }
       def latest_commit_sha
         new_tag = latest_version_tag
         return unless new_tag
@@ -217,20 +262,30 @@ module Dependabot
         end
       end
 
+      sig { returns(T.nilable(String)) }
       def current_commit
         git_commit_checker.head_commit_for_current_branch
       end
 
+      sig { returns(T::Boolean) }
       def git_dependency?
         git_commit_checker.git_dependency?
       end
 
+      sig { returns(Dependabot::GitCommitChecker) }
       def git_commit_checker
-        @git_commit_checker ||= git_commit_checker_for(nil)
+        @git_commit_checker ||= T.let(
+          git_commit_checker_for(nil),
+          T.nilable(Dependabot::GitCommitChecker)
+        )
       end
 
+      sig { params(source: T.nilable(T::Hash[Symbol, String])).returns(Dependabot::GitCommitChecker) }
       def git_commit_checker_for(source)
-        @git_commit_checkers ||= {}
+        @git_commit_checkers ||= T.let(
+          {},
+          T.nilable(T::Hash[T.nilable(T::Hash[Symbol, String]), Dependabot::GitCommitChecker])
+        )
 
         @git_commit_checkers[source] ||= Dependabot::GitCommitChecker.new(
           dependency: dependency,
@@ -242,6 +297,7 @@ module Dependabot
         )
       end
 
+      sig { params(base: T.nilable(String), other: String).returns(T::Boolean) }
       def shortened_semver_eq?(base, other)
         return false unless base
 
@@ -252,6 +308,7 @@ module Dependabot
         other_split[0..base_split.length - 1] == base_split
       end
 
+      sig { params(sha: String).returns(T.nilable(String)) }
       def find_container_branch(sha)
         branches_including_ref = SharedHelpers.run_shell_command(
           "git branch --remotes --contains #{sha}",

data/lib/dependabot/github_actions/version.rb

@@ -31,6 +31,8 @@ module Dependabot
 
       sig { override.params(version: VersionParameter).returns(T::Boolean) }
       def self.correct?(version)
+        return false if version.to_s.strip.empty?
+
         version = Version.remove_leading_v(version)
         super
       end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-github_actions
 version: !ruby/object:Gem::Version
-  version: 0.264.0
+  version: 0.266.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-07-05 00:00:00.000000000 Z
+date: 2024-07-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.264.0
+        version: 0.266.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.264.0
+        version: 0.266.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -114,14 +114,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.63.2
+        version: 1.65.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.63.2
+        version: 1.65.0
 - !ruby/object:Gem::Dependency
   name: rubocop-performance
   requirement: !ruby/object:Gem::Requirement
@@ -255,7 +255,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.264.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.266.0
 post_install_message: 
 rdoc_options: []
 require_paths: