dependabot-github_actions 0.391.0 → 0.393.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8704994a565cd7f061c709f5a5ffae85264f537835a88fe992cee829dd56bae4
-  data.tar.gz: 6d7d0b3320cf3d64137ab662f3806aa415a2d05e2f5c16c36d09db1bc0b90545
+  metadata.gz: 4209eb988f4acc1fdb05b3f95694cfba5e7972ea3cd29020a5a32aca407b64ab
+  data.tar.gz: 5638cd93a7068ed55e5eb77c5f8a85d3f5a0b01c7d3591dc3ef77c5f634498ff
 SHA512:
-  metadata.gz: e17b3f0d4c5a8b4715f91741cfa199ff1112ba092e64542f6d7aed56ebae3fe5d04c5cfc4f2752a9fe0febaca5192518288c3a18535122129aaa9c118de5e543
-  data.tar.gz: d0f90146d2d2f4e2c512892c834afefdf81a02da7e4d21b477a130264eead6a8f28e3d27f5f3cb2f20d97a36c031a37f0c153d93b4c245abc4674069b29530ce
+  metadata.gz: 93a1ad33067ffe60ffa89d0963fe22df5b949677e00184a798aa27f00cf71d6d86c513248c960459269097e89610cb4128565adb356ee9478053cd141ee7a799
+  data.tar.gz: 8ee8ecae42b4e24b50ac8ae56482553479564564f04842326baf4ecb40557edecf6adc641667f75087184fa1ecda30533df78e591404efc37a13a2c06dd90583

data/lib/dependabot/github_actions/file_fetcher.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"

data/lib/dependabot/github_actions/file_updater.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"
@@ -144,21 +144,21 @@ module Dependabot
         updated_requirement_pairs =
           dependency.requirements.zip(T.must(dependency.previous_requirements))
                     .reject do |new_req, old_req|
-            next true if new_req[:file] != file.name
+            next true if new_req.file != file.name
 
-            new_req[:source] == T.must(old_req)[:source]
+            new_req.source == T.must(old_req).source
           end
 
         updated_content = T.must(file.content)
 
         updated_requirement_pairs.each do |new_req, old_req|
           # TODO: Support updating Docker sources
-          next unless new_req.fetch(:source).fetch(:type) == "git"
+          next unless new_req.source_string("type") == "git"
 
-          old_ref = T.must(old_req).fetch(:source).fetch(:ref)
-          new_ref = new_req.fetch(:source).fetch(:ref)
+          old_ref = T.must(T.must(old_req).source_string("ref"))
+          new_ref = T.must(new_req.source_string("ref"))
 
-          old_declaration = T.must(old_req).fetch(:metadata).fetch(:declaration_string)
+          old_declaration = T.must(T.must(old_req).metadata_string("declaration_string"))
           new_declaration =
             old_declaration
             .gsub(/@.*+/, "@#{new_ref}")

data/lib/dependabot/github_actions/metadata_finder.rb

@@ -15,14 +15,9 @@ module Dependabot
 
       sig { override.returns(T.nilable(Dependabot::Source)) }
       def look_up_source
-        info = dependency.requirements.filter_map { |r| r[:source] }.first
-
-        url =
-          if info.nil?
-            "https://#{source_hostname}/#{dependency.name}"
-          else
-            info[:url] || info.fetch("url")
-          end
+        requirement = dependency.requirements.find(&:source_hash)
+        url = requirement&.source_string("url") ||
+              "https://#{source_hostname}/#{dependency.name}"
         Source.from_url(url)
       end
 

data/lib/dependabot/github_actions/package/package_details_fetcher.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "json"
@@ -78,14 +78,16 @@ module Dependabot
           # If the dependency is pinned to a tag that looks like a version then
           # we want to update that tag.
           if git_commit_checker.pinned_ref_looks_like_version? && latest_version_tag
-            latest_version = latest_version_tag&.fetch(:version)
+            latest_version = tag_version(T.must(latest_version_tag))
+            return unless latest_version.is_a?(Dependabot::Version)
             return current_version if shortened_semver_eq?(dependency.version, latest_version.to_s)
 
             return latest_version
           end
 
           if git_commit_checker.pinned_ref_looks_like_commit_sha? && latest_version_tag
-            latest_version = latest_version_tag&.fetch(:version)
+            latest_version = tag_version(T.must(latest_version_tag))
+            return unless latest_version.is_a?(Dependabot::Version)
             return latest_commit_for_pinned_ref unless git_commit_checker.local_tag_for_pinned_sha
 
             return latest_version
@@ -97,7 +99,7 @@ module Dependabot
         end
         # rubocop:enable Metrics/PerceivedComplexity
 
-        sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+        sig { returns(T.nilable(T::Hash[Symbol, Object])) }
         def lowest_security_fix_version_tag
           # TODO: Support Docker sources
           return unless git_dependency?
@@ -113,25 +115,27 @@ module Dependabot
                 find_lowest_secure_version(tags)
               end
             end,
-            T.nilable(T::Hash[Symbol, String])
+            T.nilable(T::Hash[Symbol, Object])
           )
         end
 
-        sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+        sig { returns(T.nilable(T::Hash[Symbol, Object])) }
         def latest_version_tag
           @latest_version_tag ||= T.let(
             begin
               return git_commit_checker.local_tag_for_latest_version if dependency.version.nil?
 
               ref = git_commit_checker.local_ref_for_latest_version_matching_existing_precision
-              return ref if ref && ref.fetch(:version) > current_version
+              return ref if ref&.version && T.must(ref.version) > current_version
 
               lower_precision_ref = git_commit_checker.local_ref_for_latest_version_lower_precision
-              return ref if ref&.fetch(:version) == current_version
+              # Keep the matching-precision ref when no newer lower-precision tag exists
+              return ref if ref&.version == current_version &&
+                            (lower_precision_ref.nil? || T.must(lower_precision_ref.version) <= current_version)
 
               lower_precision_ref
             end,
-            T.nilable(T::Hash[Symbol, T.untyped])
+            T.nilable(T::Hash[Symbol, Object])
           )
         end
 
@@ -159,9 +163,7 @@ module Dependabot
           []
         end
 
-        sig do
-          returns(T::Array[T::Hash[Symbol, T.untyped]])
-        end
+        sig { returns(T::Array[T::Hash[Symbol, Object]]) }
         def allowed_version_tags_with_release_dates
           allowed_version_tags_hashes = git_commit_checker.local_tags_for_allowed_versions
           tag_to_release_date = T.let({}, T::Hash[String, T.nilable(String)])
@@ -173,14 +175,14 @@ module Dependabot
 
           # Combine version info with release dates and sort by version descending
           result = allowed_version_tags_hashes.map do |tag_hash|
-            tag_name = tag_hash.fetch(:tag)
+            tag_name = tag_name(tag_hash)
             tag_hash.merge(
               release_date: tag_to_release_date[tag_name]
             )
           end
 
           # Sort by version descending (newest first)
-          result.sort_by { |tag_hash| tag_hash.fetch(:version) }.reverse
+          result.sort_by { |tag_hash| T.cast(tag_hash.fetch(:version), Gem::Version) }.reverse
         end
 
         private
@@ -244,23 +246,39 @@ module Dependabot
         end
 
         sig do
-          params(tags: T::Array[T::Hash[Symbol, T.untyped]]).returns(T.nilable(T::Hash[Symbol, T.untyped]))
+          params(tags: T::Array[T::Hash[Symbol, Object]]).returns(T.nilable(T::Hash[Symbol, Object]))
         end
         def find_lowest_secure_version(tags)
-          relevant_tags = Dependabot::UpdateCheckers::VersionFilters
-                          .filter_vulnerable_versions(tags, security_advisories)
+          relevant_tags = tags.reject do |tag|
+            security_advisories.any? { |advisory| advisory.vulnerable?(T.must(tag_version(tag))) }
+          end
 
           relevant_tags = filter_lower_tags(relevant_tags)
-          relevant_tags.min_by { |tag| tag.fetch(:version) }
+          relevant_tags.min_by { |tag| T.must(tag_version(tag)) }
         end
 
         sig do
-          params(tags_array: T::Array[T::Hash[Symbol, T.untyped]]).returns(T::Array[T::Hash[Symbol, T.untyped]])
+          params(tags_array: T::Array[T::Hash[Symbol, Object]]).returns(T::Array[T::Hash[Symbol, Object]])
         end
         def filter_lower_tags(tags_array)
           return tags_array unless current_version
 
-          tags_array.select { |tag| tag.fetch(:version) > current_version }
+          tags_array.select { |tag| T.must(tag_version(tag)) > current_version }
+        end
+
+        sig { params(tag: T::Hash[Symbol, Object]).returns(String) }
+        def tag_name(tag)
+          return tag.tag if tag.is_a?(Dependabot::GitTagDetails)
+
+          T.cast(tag.fetch(:tag), String)
+        end
+
+        sig { params(tag: T::Hash[Symbol, Object]).returns(T.nilable(Gem::Version)) }
+        def tag_version(tag)
+          return tag.version if tag.is_a?(Dependabot::GitTagDetails)
+
+          version = tag[:version]
+          version if version.is_a?(Gem::Version)
         end
 
         sig { returns(T::Boolean) }

data/lib/dependabot/github_actions/update_checker.rb

@@ -65,24 +65,14 @@ module Dependabot
       sig { override.returns(T::Array[Dependabot::DependencyRequirement]) }
       def updated_requirements
         updated_reqs = dependency.requirements.map do |req|
-          source = T.cast(req.source, GitSource)
+          source = req.source_hash
           updated = updated_ref(source, onboarded: onboarded_requirement?(req))
           next req unless updated
 
-          current = source[:ref]
-
-          # Maintain a short git hash only if it matches the latest
-          if req[:type] == "git" &&
-             git_commit_checker.ref_looks_like_commit_sha?(updated) &&
-             git_commit_checker.ref_looks_like_commit_sha?(T.must(current)) &&
-             updated.start_with?(T.must(current))
-            next req
-          end
-
-          new_source = source.merge(ref: updated)
-          req.merge(source: new_source)
+          new_source = source_with_ref(T.must(source), updated)
+          Dependabot::DependencyRequirement.create(req.merge(source: new_source))
         end
-        wrap_requirements(updated_reqs)
+        updated_reqs
       end
 
       private
@@ -171,9 +161,7 @@ module Dependabot
         @git_metadata_fetcher ||= T.let(
           Dependabot::GitMetadataFetcher.new(
             url: T.must(
-              dependency.requirements.filter_map do |requirement|
-                T.cast(requirement.source, T.nilable(GitSource))&.fetch(:url, nil)
-              end.first
+              dependency.requirements.filter_map { |requirement| requirement.source_string("url") }.first
             ),
             credentials: credentials
           ),
@@ -248,20 +236,24 @@ module Dependabot
       end
 
       sig do
-        params(source: T.nilable(GitSource), onboarded: T::Boolean)
+        params(
+          source: T.nilable(Dependabot::DependencyRequirement::ObjectHash),
+          onboarded: T::Boolean
+        )
           .returns(T.nilable(String))
       end
       def updated_ref(source, onboarded: false)
         # TODO: Support Docker sources
         return unless git_commit_checker.git_dependency?
 
-        finder = onboarded ? latest_version_finder_for(source) : T.must(latest_version_finder)
+        git_source = source && symbolize_source(source)
+        finder = onboarded ? latest_version_finder_for(git_source) : T.must(latest_version_finder)
 
         if vulnerable? && (new_tag = finder.lowest_security_fix_release)
           return new_tag.fetch(:tag)
         end
 
-        source_git_commit_checker = git_helper.git_commit_checker_for(source)
+        source_git_commit_checker = git_helper.git_commit_checker_for(git_source)
 
         # Return the git tag if updating a pinned version
         if source_git_commit_checker.pinned_ref_looks_like_version? &&
@@ -279,6 +271,35 @@ module Dependabot
         nil
       end
 
+      sig do
+        params(source: Dependabot::DependencyRequirement::ObjectHash)
+          .returns(GitSource)
+      end
+      def symbolize_source(source)
+        T.cast(source.to_h { |key, value| [key.to_sym, value] }, GitSource)
+      end
+
+      sig do
+        params(
+          source: Dependabot::DependencyRequirement::ObjectHash,
+          ref: String
+        ).returns(Dependabot::DependencyRequirement::ObjectHash)
+      end
+      def source_with_ref(source, ref)
+        updated = source.dup
+        key = if source.key?(:ref)
+                :ref
+              elsif source.key?("ref")
+                "ref"
+              elsif source.keys.any?(Symbol)
+                :ref
+              else
+                "ref"
+              end
+        updated[key] = ref
+        updated
+      end
+
       sig do
         params(source_checker: Dependabot::GitCommitChecker, finder: LatestVersionFinder)
           .returns(T.nilable(String))

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-github_actions
 version: !ruby/object:Gem::Version
-  version: 0.391.0
+  version: 0.393.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.391.0
+        version: 0.393.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.391.0
+        version: 0.393.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -266,7 +266,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.391.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.393.0
 rdoc_options: []
 require_paths:
 - lib