dependabot-github_actions 0.368.0 → 0.369.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c59110bd42e5d58e4d6fd940fd0f8ddac05a9d36b39b5d1779c8a553ced351df
-  data.tar.gz: e8066a26b1906c57079e55304ec9bb9ad62de8ffccd496e2f702a532d6bfca60
+  metadata.gz: 2c6e673a88e40431d523e83cede3408e17fb7a31a283700e03db8298647cd5e6
+  data.tar.gz: 7728581d335018578ecad6c8e5cfc3a3fb9f3c9713a47496a89ddd8ff96c9261
 SHA512:
-  metadata.gz: ac177e54d519f3840ec1d4c67b4204f63ce7571b3be25d6f783dae2ba7be5b5418b8014c1c7e849107878a28eaf47be3e75c972c66590b108da78bc3cbf96259
-  data.tar.gz: aca5381969a8cef12cef9f76301ed3633d2fed643c256086cb48b45d5942e8546baf84bee01e20cb53f38ff3ee89f481f4f7877a5fc43a34bd7bc2aa7a1cb427
+  metadata.gz: 2bf2a6c8f67cf959f136d51e51acf805148cbaaa2e7534d6976976694ed3de6cb8725bc57f9bd497b079de6537a7602b71cbdf64b47e95f7625efc21d765b7fe
+  data.tar.gz: cc646daed9e46c070bafb8367e44b9f82a7c8f1c4c2190ea91b4eb680686370f375b1a374e4f193d6f43404facb7867e6f6b861741a6efb675725df786c99fb8

data/lib/dependabot/github_actions/package/package_details_fetcher.rb

@@ -8,6 +8,7 @@ require "sorbet-runtime"
 require "time"
 
 require "dependabot/errors"
+require "dependabot/git_tag_with_detail"
 require "dependabot/github_actions/helpers"
 require "dependabot/github_actions/requirement"
 require "dependabot/github_actions/update_checker"
@@ -16,6 +17,7 @@ require "dependabot/package/package_details"
 require "dependabot/package/package_release"
 require "dependabot/registry_client"
 require "dependabot/shared_helpers"
+require "dependabot/source"
 
 module Dependabot
   module GithubActions
@@ -127,6 +129,54 @@ module Dependabot
           )
         end
 
+        sig { returns(T::Array[Dependabot::GitTagWithDetail]) }
+        def fetch_tag_and_release_date
+          allowed_version_tags = git_commit_checker.allowed_version_tags
+          allowed_tag_names = Set.new(allowed_version_tags.map(&:name))
+
+          # Use the shared GitCommitChecker#refs_for_tag_with_detail to fetch all tags
+          # with release dates in a single clone (instead of one clone per tag)
+          all_refs_with_detail = git_commit_checker.refs_for_tag_with_detail
+
+          result = all_refs_with_detail.select do |ref|
+            allowed_tag_names.include?(ref.tag)
+          end
+
+          # Log an error if we couldn't fetch any release dates
+          if result.empty? && allowed_version_tags.any?
+            Dependabot.logger.error("Error fetching tag and release date: unable to fetch for allowed tags")
+          end
+
+          result
+        rescue StandardError => e
+          Dependabot.logger.error("Error fetching tag and release date: #{e.message}")
+          []
+        end
+
+        sig do
+          returns(T::Array[T::Hash[Symbol, T.untyped]])
+        end
+        def allowed_version_tags_with_release_dates
+          allowed_version_tags_hashes = git_commit_checker.local_tags_for_allowed_versions
+          tag_to_release_date = T.let({}, T::Hash[String, T.nilable(String)])
+
+          # Build a map of tag names to release dates for quick lookup
+          fetch_tag_and_release_date.each do |git_tag_with_detail|
+            tag_to_release_date[git_tag_with_detail.tag] = git_tag_with_detail.release_date
+          end
+
+          # Combine version info with release dates and sort by version descending
+          result = allowed_version_tags_hashes.map do |tag_hash|
+            tag_name = tag_hash.fetch(:tag)
+            tag_hash.merge(
+              release_date: tag_to_release_date[tag_name]
+            )
+          end
+
+          # Sort by version descending (newest first)
+          result.sort_by { |tag_hash| tag_hash.fetch(:version) }.reverse
+        end
+
         private
 
         sig { returns(Dependabot::GitCommitChecker) }

data/lib/dependabot/github_actions/update_checker/latest_version_finder.rb

@@ -1,7 +1,6 @@
 # typed: strict
 # frozen_string_literal: true
 
-require "excon"
 require "sorbet-runtime"
 
 require "dependabot/errors"
@@ -12,6 +11,7 @@ require "dependabot/github_actions/update_checker"
 require "dependabot/github_actions/helpers"
 require "dependabot/package/package_latest_version_finder"
 require "dependabot/shared_helpers"
+require "dependabot/update_checkers/cooldown_calculation"
 require "dependabot/update_checkers/version_filters"
 
 module Dependabot
@@ -106,7 +106,7 @@ module Dependabot
 
         sig { returns(T.nilable(Dependabot::GithubActions::Package::PackageDetailsFetcher)) }
         def package_details_fetcher
-          @package_details_fetcher = T.let(
+          @package_details_fetcher ||= T.let(
             Dependabot::GithubActions::Package::PackageDetailsFetcher
                         .new(
                           dependency: dependency,
@@ -157,19 +157,58 @@ module Dependabot
           return release unless cooldown_options
 
           Dependabot.logger.info("Initializing cooldown filter")
-          release_date = commit_metadata_details
 
-          unless release_date
-            Dependabot.logger.info("No release date found, skipping cooldown filtering")
-            return release
-          end
+          # If the proposed release is a commit SHA (String), check its date against cooldown
+          if release.is_a?(String)
+            Dependabot.logger.info("Checking cooldown for commit SHA: #{release}")
+            return release unless check_if_version_in_cooldown_period?(commit_metadata_details)
 
-          if release_in_cooldown_period?(Time.parse(release_date))
-            Dependabot.logger.info("Filtered out (cooldown) #{dependency.name}, #{release}")
+            # Proposed SHA is in cooldown; for a SHA-based proposal, return nil (don't fall back to tags)
+            Dependabot.logger.info("Proposed commit SHA is in cooldown, returning nil")
             return nil
           end
 
-          release
+          # For version tag proposals, fetch all allowed versions with release dates (single clone)
+          # This reuses a single GitCommitChecker instance within package_details_fetcher
+          allowed_versions_with_dates = T.must(package_details_fetcher).allowed_version_tags_with_release_dates
+          tags_in_cooldown = Set.new(select_version_tags_in_cooldown_period(allowed_versions_with_dates))
+          return release if tags_in_cooldown.empty?
+
+          # Walk through all allowed version tags in descending order (newest first)
+          # and return the first one NOT in cooldown
+          allowed_versions_with_dates.each do |tag_info|
+            tag_name = tag_info.fetch(:tag)
+            next if tags_in_cooldown.include?(tag_name)
+
+            # Found a version not in cooldown, return it
+            version = tag_info.fetch(:version)
+            Dependabot.logger.info("Found acceptable version outside cooldown: #{version}")
+            return version
+          end
+
+          # All versions are in cooldown, return nil to fallback to current version
+          Dependabot.logger.info("All versions are in cooldown period, returning current version")
+          nil
+        end
+
+        sig do
+          params(
+            tags_with_dates: T.nilable(
+              T.any(T::Array[Dependabot::GitTagWithDetail], T::Array[T::Hash[Symbol, T.untyped]])
+            )
+          ).returns(T::Array[String])
+        end
+        def select_version_tags_in_cooldown_period(tags_with_dates = nil)
+          tags_to_check = tags_with_dates || T.must(package_details_fetcher).fetch_tag_and_release_date
+          # Handle both GitTagWithDetail objects and hashes with release_date
+          in_cooldown = tags_to_check.select do |tag|
+            release_date = tag.is_a?(Hash) ? tag.fetch(:release_date, nil) : tag.release_date
+            check_if_version_in_cooldown_period?(release_date)
+          end
+          in_cooldown.map { |tag| tag.is_a?(Hash) ? tag.fetch(:tag) : tag.tag }
+        rescue StandardError => e
+          Dependabot.logger.error("Error checking if version is in cooldown (using empty filter): #{e.message}")
+          []
         end
 
         sig { returns(T.nilable(String)) }
@@ -193,8 +232,8 @@ module Dependabot
                 end
               end
             rescue StandardError => e
-              Dependabot.logger.error("Error (github actions) while checking release date for #{dependency.name}")
-              Dependabot.logger.error(e.message)
+              msg = "Error (github actions) while checking release date for #{dependency.name}: #{e.message}"
+              Dependabot.logger.warn(msg)
 
               nil
             end,
@@ -202,21 +241,30 @@ module Dependabot
           )
         end
 
-        sig { params(release_date: Time).returns(T::Boolean) }
-        def release_in_cooldown_period?(release_date)
-          cooldown = @cooldown_options
+        sig { params(release_date: T.nilable(String)).returns(T::Boolean) }
+        def check_if_version_in_cooldown_period?(release_date)
+          return false unless release_date&.length&.positive?
+          return false unless cooldown_options
+          return false unless T.must(cooldown_options).included?(dependency.name)
 
-          return false unless T.must(cooldown).included?(dependency.name)
+          release_time = Time.parse(T.must(release_date))
+          cooldown_days = T.must(cooldown_options).default_days
 
-          days = T.must(cooldown).default_days
-          passed_seconds = Time.now.to_i - release_date.to_i
+          is_in_cooldown = Dependabot::UpdateCheckers::CooldownCalculation.within_cooldown_window?(
+            release_time,
+            cooldown_days
+          )
 
+          passed_seconds = Time.now.to_i - release_time.to_i
+          days_since = passed_seconds / Dependabot::UpdateCheckers::CooldownCalculation::DAY_IN_SECONDS
           Dependabot.logger.info(
-            "Days since release : #{passed_seconds / (3600 * 24)} " \
-            "(cooldown days #{T.must(cooldown_options).default_days})"
+            "Days since release : #{days_since} (cooldown days #{cooldown_days})"
           )
 
-          passed_seconds < days * DAY_IN_SECONDS
+          is_in_cooldown
+        rescue StandardError => e
+          Dependabot.logger.debug("Error parsing release date: #{e.message}")
+          false
         end
 
         sig { returns(String) }

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-github_actions
 version: !ruby/object:Gem::Version
-  version: 0.368.0
+  version: 0.369.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.368.0
+        version: 0.369.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.368.0
+        version: 0.369.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -259,7 +259,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.368.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.369.0
 rdoc_options: []
 require_paths:
 - lib