dependabot-github_actions 0.390.0 → 0.392.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 915f664971e3665b0f6ee89557dc064b19fac2a49600250d2762a286fca20da7
-  data.tar.gz: a02dc5897d62ee777fac539862d8e0cd728695d43f31ad531e1dc8c5a65db287
+  metadata.gz: 6a530d98ee5deaf59ae4a5fae27332419200128915c4586da2be88280572b200
+  data.tar.gz: 1a0809f4f2a0c74c16ffe96834d05f89a27ade9e2da665e7548f52b5d842d044
 SHA512:
-  metadata.gz: b1d0fe90498dbae54af7ee1105a98c20a56128633d1ab72e11530e890726130f009fb581d616bda816985aa39a6dd1f7605ca94999e10e05a468d8f1ffecf752
-  data.tar.gz: 76a7272475cb1ffcf7964f74f08ac3cfa80efe4612932f8d520b456c3fead93bfa195770420e494d7e1265b2bf0d2237e6b85e9143ed52bf02d52ed985db5ecb
+  metadata.gz: 1aced24aa66cc77c90d02bd74cf45daa7f06b471e1dd9c711ad1895a35d0ddc717d8448e37287b9306bbd0f6c0b6db761dfc88b930452b931311907a0537d641
+  data.tar.gz: 1d05ded519f6eedcef7d9dee3192b0fca26d47f8b9c0c83f5fe0848489741ff55be0c806f603f56e05a27e62fa54f0d38a3367685d12b4dad98a381fcc1be81a

data/lib/dependabot/github_actions/constants.rb

@@ -4,47 +4,44 @@
 module Dependabot
   module GithubActions
     # Reference to the GitHub.com domain
-    GITHUB_COM = T.let("github.com", String)
+    GITHUB_COM = "github.com"
 
     # Regular expression to match a GitHub repository reference
-    GITHUB_REPO_REFERENCE = T.let(
-      %r{
+    GITHUB_REPO_REFERENCE = %r{
             ^(?<owner>[\w.-]+)/
             (?<repo>[\w.-]+)
             (?<path>/[^\@]+)?
             @(?<ref>.+)
-          }x,
-      Regexp
-    )
+          }x
 
     # The ecosystem name for GitHub Actions
-    ECOSYSTEM = T.let("github_actions", String)
+    ECOSYSTEM = "github_actions"
 
     # The pattern to match manifest files
     MANIFEST_FILE_PATTERN = /\.ya?ml$/
     # The name of the manifest file
-    MANIFEST_FILE_YML = T.let("action.yml", String)
+    MANIFEST_FILE_YML = "action.yml"
     # The name of the manifest file
-    MANIFEST_FILE_YAML = T.let("action.yaml", String)
+    MANIFEST_FILE_YAML = "action.yaml"
     # The pattern to match any .yml or .yaml file
-    ANYTHING_YML = T.let("<anything>.yml", String)
+    ANYTHING_YML = "<anything>.yml"
     # The path to the workflow directory
-    WORKFLOW_DIRECTORY = T.let(".github/workflows", String)
+    WORKFLOW_DIRECTORY = ".github/workflows"
     # The path to the config .yml file
     CONFIG_YMLS = T.let("#{WORKFLOW_DIRECTORY}/#{ANYTHING_YML}".freeze, String)
 
     # The basename of the per-repo Actions lockfile generated by gh-actions-lock
-    LOCKFILE_NAME = T.let("actions.lock", String)
+    LOCKFILE_NAME = "actions.lock"
     # The repo-relative path to the Actions lockfile
     LOCKFILE_PATH = T.let("#{WORKFLOW_DIRECTORY}/#{LOCKFILE_NAME}".freeze, String)
     # The only lockfile schema version this ecosystem understands.
-    SUPPORTED_LOCKFILE_VERSION = T.let("v0.0.2", String)
+    SUPPORTED_LOCKFILE_VERSION = "v0.0.2"
 
-    OWNER_KEY = T.let("owner", String)
-    REPO_KEY = T.let("repo", String)
-    PATH_KEY = T.let("path", String)
-    REF_KEY = T.let("ref", String)
-    USES_KEY = T.let("uses", String)
-    STEPS_KEY = T.let("steps", String)
+    OWNER_KEY = "owner"
+    REPO_KEY = "repo"
+    PATH_KEY = "path"
+    REF_KEY = "ref"
+    USES_KEY = "uses"
+    STEPS_KEY = "steps"
   end
 end

data/lib/dependabot/github_actions/containing_branch_finder.rb

@@ -12,10 +12,7 @@ module Dependabot
 
       # A missing commit has no containing branch, so callers can handle it like
       # an empty branch lookup without masking unrelated subprocess failures.
-      COMMIT_NOT_FOUND_REGEX = T.let(
-        /no such commit|malformed object name|bad object|not a valid object name/i,
-        Regexp
-      )
+      COMMIT_NOT_FOUND_REGEX = /no such commit|malformed object name|bad object|not a valid object name/i
 
       sig { params(sha: String).returns(T.nilable(String)) }
       def self.find(sha)

data/lib/dependabot/github_actions/file_updater.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"
@@ -144,21 +144,21 @@ module Dependabot
         updated_requirement_pairs =
           dependency.requirements.zip(T.must(dependency.previous_requirements))
                     .reject do |new_req, old_req|
-            next true if new_req[:file] != file.name
+            next true if new_req.file != file.name
 
-            new_req[:source] == T.must(old_req)[:source]
+            new_req.source == T.must(old_req).source
           end
 
         updated_content = T.must(file.content)
 
         updated_requirement_pairs.each do |new_req, old_req|
           # TODO: Support updating Docker sources
-          next unless new_req.fetch(:source).fetch(:type) == "git"
+          next unless new_req.source_string("type") == "git"
 
-          old_ref = T.must(old_req).fetch(:source).fetch(:ref)
-          new_ref = new_req.fetch(:source).fetch(:ref)
+          old_ref = T.must(T.must(old_req).source_string("ref"))
+          new_ref = T.must(new_req.source_string("ref"))
 
-          old_declaration = T.must(old_req).fetch(:metadata).fetch(:declaration_string)
+          old_declaration = T.must(T.must(old_req).metadata_string("declaration_string"))
           new_declaration =
             old_declaration
             .gsub(/@.*+/, "@#{new_ref}")

data/lib/dependabot/github_actions/lockfile/cli_engine.rb

@@ -24,8 +24,8 @@ module Dependabot
         extend T::Sig
 
         JsonObject = T.type_alias { T::Hash[String, Object] }
-        FIXED_FINDING_CATEGORIES = T.let(%w(onboarding-required ref-changed stale).freeze, T::Array[String])
-        UNRESOLVABLE_CATEGORIES = T.let(%w(impostor-commit lockfile-forgery).freeze, T::Array[String])
+        FIXED_FINDING_CATEGORIES = %w(onboarding-required ref-changed stale).freeze
+        UNRESOLVABLE_CATEGORIES = %w(impostor-commit lockfile-forgery).freeze
 
         sig { params(credentials: T::Array[Dependabot::Credential]).void }
         def initialize(credentials)

data/lib/dependabot/github_actions/lockfile/env.rb

@@ -17,7 +17,7 @@ module Dependabot
 
         # Placeholder satisfies go-gh's "token must be present" check in hosted mode
         # where the proxy supplies real auth. Mirrors git's installation-token username.
-        DUMMY_TOKEN = T.let("x-access-token", String)
+        DUMMY_TOKEN = "x-access-token"
 
         sig do
           params(credentials: T::Array[Dependabot::Credential])

data/lib/dependabot/github_actions/lockfile/reader.rb

@@ -21,16 +21,16 @@ module Dependabot
         ParsedObject = T.type_alias { T::Hash[String, Object] }
 
         # Every commit must carry an explicit hash-algorithm prefix.
-        ALGO_PREFIXES = T.let(%w(sha1- sha256-).freeze, T::Array[String])
+        ALGO_PREFIXES = %w(sha1- sha256-).freeze
 
         # Keys gh-actions-lock requires on every `dependencies` entry. A missing key
         # makes the engine silently discard the whole lockfile in memory and report
         # every workflow as un-onboarded.
-        REQUIRED_DEPENDENCY_KEYS = T.let(%w(ref commit owner_id repo_id).freeze, T::Array[String])
+        REQUIRED_DEPENDENCY_KEYS = %w(ref commit owner_id repo_id).freeze
 
         sig { params(content: String).void }
         def initialize(content)
-          @content = T.let(content, String)
+          @content = content
           @data = T.let(parse, ParsedObject)
         end
 

data/lib/dependabot/github_actions/metadata_finder.rb

@@ -15,14 +15,9 @@ module Dependabot
 
       sig { override.returns(T.nilable(Dependabot::Source)) }
       def look_up_source
-        info = dependency.requirements.filter_map { |r| r[:source] }.first
-
-        url =
-          if info.nil?
-            "https://#{source_hostname}/#{dependency.name}"
-          else
-            info[:url] || info.fetch("url")
-          end
+        requirement = dependency.requirements.find(&:source_hash)
+        url = requirement&.source_string("url") ||
+              "https://#{source_hostname}/#{dependency.name}"
         Source.from_url(url)
       end
 

data/lib/dependabot/github_actions/package_manager.rb

@@ -13,10 +13,10 @@ module Dependabot
       extend T::Sig
 
       # The package manager name for GitHub Actions
-      NAME = T.let("github_actions", String)
+      NAME = "github_actions"
 
       # The version of the package manager
-      VERSION = T.let("1.0.0", String)
+      VERSION = "1.0.0"
 
       sig { void }
       def initialize

data/lib/dependabot/github_actions/update_checker/latest_version_finder.rb

@@ -131,9 +131,7 @@ module Dependabot
                 if latest_tag&.fetch(:version) == selected_release
                   latest_tag
                 else
-                  T.must(package_details_fetcher)
-                   .allowed_version_tags_with_release_dates
-                   .find { |tag_hash| tag_hash.fetch(:version) == selected_release }
+                  tag_for_version(selected_release)
                 end
               end
             end,
@@ -224,14 +222,23 @@ module Dependabot
           tags_in_cooldown = Set.new(select_version_tags_in_cooldown_period(allowed_versions_with_dates))
           return release if tags_in_cooldown.empty?
 
-          # Walk through all allowed version tags in descending order (newest first)
+          # Only consider tags with the same precision as the pinned ref, so a `v1` style
+          # pin falls back to another major-only tag rather than being rewritten to a fully
+          # qualified version such as `v1.5.5`.
+          candidates = tags_matching_pinned_precision(allowed_versions_with_dates)
+
+          # Walk through the candidate version tags in descending order (newest first)
           # and return the first one NOT in cooldown
-          allowed_versions_with_dates.each do |tag_info|
+          candidates.each do |tag_info|
             tag_name = tag_info.fetch(:tag)
             next if tags_in_cooldown.include?(tag_name)
 
-            # Found a version not in cooldown, return it
             version = tag_info.fetch(:version)
+            # Candidates are sorted descending, so once we drop below the pinned version
+            # every remaining candidate would be a downgrade.
+            break if pinned_version && version < pinned_version
+
+            # Found a version not in cooldown, return it
             Dependabot.logger.info("Found acceptable version outside cooldown: #{version}")
             return version
           end
@@ -241,6 +248,46 @@ module Dependabot
           nil
         end
 
+        # Tags whose version has the same number of segments as the currently pinned
+        # version. Returns every tag when the pin isn't a version we can reason about
+        # (e.g. a commit SHA), since precision has no meaning in that case.
+        sig do
+          params(tags: T::Array[T::Hash[Symbol, T.untyped]])
+            .returns(T::Array[T::Hash[Symbol, T.untyped]])
+        end
+        def tags_matching_pinned_precision(tags)
+          pinned = pinned_version
+          return tags unless pinned
+
+          pinned_precision = precision(pinned.to_s)
+          tags.select { |tag_info| precision(tag_info.fetch(:version).to_s) == pinned_precision }
+        end
+
+        # Resolves a version back to its tag. Versions compare equal across precisions
+        # (`2` == `2.0.0`), so tags matching the pinned precision are preferred to avoid
+        # rewriting e.g. a `v2` pin to `v2.0.0`.
+        sig { params(version: Dependabot::Version).returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+        def tag_for_version(version)
+          all_tags = T.must(package_details_fetcher).allowed_version_tags_with_release_dates
+          matching_precision = tags_matching_pinned_precision(all_tags)
+
+          matching_precision.find { |tag_hash| tag_hash.fetch(:version) == version } ||
+            all_tags.find { |tag_hash| tag_hash.fetch(:version) == version }
+        end
+
+        sig { returns(T.nilable(Dependabot::Version)) }
+        def pinned_version
+          version = dependency.version
+          return nil unless version && Dependabot::GithubActions::Version.correct?(version)
+
+          Dependabot::GithubActions::Version.new(version)
+        end
+
+        sig { params(version: String).returns(Integer) }
+        def precision(version)
+          version.split(".").length
+        end
+
         sig do
           params(
             tags_with_dates: T.nilable(

data/lib/dependabot/github_actions/update_checker.rb

@@ -65,24 +65,14 @@ module Dependabot
       sig { override.returns(T::Array[Dependabot::DependencyRequirement]) }
       def updated_requirements
         updated_reqs = dependency.requirements.map do |req|
-          source = T.cast(req.source, GitSource)
+          source = req.source_hash
           updated = updated_ref(source, onboarded: onboarded_requirement?(req))
           next req unless updated
 
-          current = source[:ref]
-
-          # Maintain a short git hash only if it matches the latest
-          if req[:type] == "git" &&
-             git_commit_checker.ref_looks_like_commit_sha?(updated) &&
-             git_commit_checker.ref_looks_like_commit_sha?(T.must(current)) &&
-             updated.start_with?(T.must(current))
-            next req
-          end
-
-          new_source = source.merge(ref: updated)
-          req.merge(source: new_source)
+          new_source = source_with_ref(T.must(source), updated)
+          Dependabot::DependencyRequirement.create(req.merge(source: new_source))
         end
-        wrap_requirements(updated_reqs)
+        updated_reqs
       end
 
       private
@@ -171,9 +161,7 @@ module Dependabot
         @git_metadata_fetcher ||= T.let(
           Dependabot::GitMetadataFetcher.new(
             url: T.must(
-              dependency.requirements.filter_map do |requirement|
-                T.cast(requirement.source, T.nilable(GitSource))&.fetch(:url, nil)
-              end.first
+              dependency.requirements.filter_map { |requirement| requirement.source_string("url") }.first
             ),
             credentials: credentials
           ),
@@ -248,20 +236,24 @@ module Dependabot
       end
 
       sig do
-        params(source: T.nilable(GitSource), onboarded: T::Boolean)
+        params(
+          source: T.nilable(Dependabot::DependencyRequirement::ObjectHash),
+          onboarded: T::Boolean
+        )
           .returns(T.nilable(String))
       end
       def updated_ref(source, onboarded: false)
         # TODO: Support Docker sources
         return unless git_commit_checker.git_dependency?
 
-        finder = onboarded ? latest_version_finder_for(source) : T.must(latest_version_finder)
+        git_source = source && symbolize_source(source)
+        finder = onboarded ? latest_version_finder_for(git_source) : T.must(latest_version_finder)
 
         if vulnerable? && (new_tag = finder.lowest_security_fix_release)
           return new_tag.fetch(:tag)
         end
 
-        source_git_commit_checker = git_helper.git_commit_checker_for(source)
+        source_git_commit_checker = git_helper.git_commit_checker_for(git_source)
 
         # Return the git tag if updating a pinned version
         if source_git_commit_checker.pinned_ref_looks_like_version? &&
@@ -279,6 +271,35 @@ module Dependabot
         nil
       end
 
+      sig do
+        params(source: Dependabot::DependencyRequirement::ObjectHash)
+          .returns(GitSource)
+      end
+      def symbolize_source(source)
+        T.cast(source.to_h { |key, value| [key.to_sym, value] }, GitSource)
+      end
+
+      sig do
+        params(
+          source: Dependabot::DependencyRequirement::ObjectHash,
+          ref: String
+        ).returns(Dependabot::DependencyRequirement::ObjectHash)
+      end
+      def source_with_ref(source, ref)
+        updated = source.dup
+        key = if source.key?(:ref)
+                :ref
+              elsif source.key?("ref")
+                "ref"
+              elsif source.keys.any?(Symbol)
+                :ref
+              else
+                "ref"
+              end
+        updated[key] = ref
+        updated
+      end
+
       sig do
         params(source_checker: Dependabot::GitCommitChecker, finder: LatestVersionFinder)
           .returns(T.nilable(String))

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-github_actions
 version: !ruby/object:Gem::Version
-  version: 0.390.0
+  version: 0.392.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.390.0
+        version: 0.392.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.390.0
+        version: 0.392.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -266,7 +266,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.390.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.392.0
 rdoc_options: []
 require_paths:
 - lib