dependabot-github_actions 0.392.0 → 0.393.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6a530d98ee5deaf59ae4a5fae27332419200128915c4586da2be88280572b200
-  data.tar.gz: 1a0809f4f2a0c74c16ffe96834d05f89a27ade9e2da665e7548f52b5d842d044
+  metadata.gz: 4209eb988f4acc1fdb05b3f95694cfba5e7972ea3cd29020a5a32aca407b64ab
+  data.tar.gz: 5638cd93a7068ed55e5eb77c5f8a85d3f5a0b01c7d3591dc3ef77c5f634498ff
 SHA512:
-  metadata.gz: 1aced24aa66cc77c90d02bd74cf45daa7f06b471e1dd9c711ad1895a35d0ddc717d8448e37287b9306bbd0f6c0b6db761dfc88b930452b931311907a0537d641
-  data.tar.gz: 1d05ded519f6eedcef7d9dee3192b0fca26d47f8b9c0c83f5fe0848489741ff55be0c806f603f56e05a27e62fa54f0d38a3367685d12b4dad98a381fcc1be81a
+  metadata.gz: 93a1ad33067ffe60ffa89d0963fe22df5b949677e00184a798aa27f00cf71d6d86c513248c960459269097e89610cb4128565adb356ee9478053cd141ee7a799
+  data.tar.gz: 8ee8ecae42b4e24b50ac8ae56482553479564564f04842326baf4ecb40557edecf6adc641667f75087184fa1ecda30533df78e591404efc37a13a2c06dd90583

data/lib/dependabot/github_actions/file_fetcher.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"

data/lib/dependabot/github_actions/package/package_details_fetcher.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "json"
@@ -78,14 +78,16 @@ module Dependabot
           # If the dependency is pinned to a tag that looks like a version then
           # we want to update that tag.
           if git_commit_checker.pinned_ref_looks_like_version? && latest_version_tag
-            latest_version = latest_version_tag&.fetch(:version)
+            latest_version = tag_version(T.must(latest_version_tag))
+            return unless latest_version.is_a?(Dependabot::Version)
             return current_version if shortened_semver_eq?(dependency.version, latest_version.to_s)
 
             return latest_version
           end
 
           if git_commit_checker.pinned_ref_looks_like_commit_sha? && latest_version_tag
-            latest_version = latest_version_tag&.fetch(:version)
+            latest_version = tag_version(T.must(latest_version_tag))
+            return unless latest_version.is_a?(Dependabot::Version)
             return latest_commit_for_pinned_ref unless git_commit_checker.local_tag_for_pinned_sha
 
             return latest_version
@@ -97,7 +99,7 @@ module Dependabot
         end
         # rubocop:enable Metrics/PerceivedComplexity
 
-        sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+        sig { returns(T.nilable(T::Hash[Symbol, Object])) }
         def lowest_security_fix_version_tag
           # TODO: Support Docker sources
           return unless git_dependency?
@@ -113,25 +115,27 @@ module Dependabot
                 find_lowest_secure_version(tags)
               end
             end,
-            T.nilable(T::Hash[Symbol, String])
+            T.nilable(T::Hash[Symbol, Object])
           )
         end
 
-        sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+        sig { returns(T.nilable(T::Hash[Symbol, Object])) }
         def latest_version_tag
           @latest_version_tag ||= T.let(
             begin
               return git_commit_checker.local_tag_for_latest_version if dependency.version.nil?
 
               ref = git_commit_checker.local_ref_for_latest_version_matching_existing_precision
-              return ref if ref && ref.fetch(:version) > current_version
+              return ref if ref&.version && T.must(ref.version) > current_version
 
               lower_precision_ref = git_commit_checker.local_ref_for_latest_version_lower_precision
-              return ref if ref&.fetch(:version) == current_version
+              # Keep the matching-precision ref when no newer lower-precision tag exists
+              return ref if ref&.version == current_version &&
+                            (lower_precision_ref.nil? || T.must(lower_precision_ref.version) <= current_version)
 
               lower_precision_ref
             end,
-            T.nilable(T::Hash[Symbol, T.untyped])
+            T.nilable(T::Hash[Symbol, Object])
           )
         end
 
@@ -159,9 +163,7 @@ module Dependabot
           []
         end
 
-        sig do
-          returns(T::Array[T::Hash[Symbol, T.untyped]])
-        end
+        sig { returns(T::Array[T::Hash[Symbol, Object]]) }
         def allowed_version_tags_with_release_dates
           allowed_version_tags_hashes = git_commit_checker.local_tags_for_allowed_versions
           tag_to_release_date = T.let({}, T::Hash[String, T.nilable(String)])
@@ -173,14 +175,14 @@ module Dependabot
 
           # Combine version info with release dates and sort by version descending
           result = allowed_version_tags_hashes.map do |tag_hash|
-            tag_name = tag_hash.fetch(:tag)
+            tag_name = tag_name(tag_hash)
             tag_hash.merge(
               release_date: tag_to_release_date[tag_name]
             )
           end
 
           # Sort by version descending (newest first)
-          result.sort_by { |tag_hash| tag_hash.fetch(:version) }.reverse
+          result.sort_by { |tag_hash| T.cast(tag_hash.fetch(:version), Gem::Version) }.reverse
         end
 
         private
@@ -244,23 +246,39 @@ module Dependabot
         end
 
         sig do
-          params(tags: T::Array[T::Hash[Symbol, T.untyped]]).returns(T.nilable(T::Hash[Symbol, T.untyped]))
+          params(tags: T::Array[T::Hash[Symbol, Object]]).returns(T.nilable(T::Hash[Symbol, Object]))
         end
         def find_lowest_secure_version(tags)
-          relevant_tags = Dependabot::UpdateCheckers::VersionFilters
-                          .filter_vulnerable_versions(tags, security_advisories)
+          relevant_tags = tags.reject do |tag|
+            security_advisories.any? { |advisory| advisory.vulnerable?(T.must(tag_version(tag))) }
+          end
 
           relevant_tags = filter_lower_tags(relevant_tags)
-          relevant_tags.min_by { |tag| tag.fetch(:version) }
+          relevant_tags.min_by { |tag| T.must(tag_version(tag)) }
         end
 
         sig do
-          params(tags_array: T::Array[T::Hash[Symbol, T.untyped]]).returns(T::Array[T::Hash[Symbol, T.untyped]])
+          params(tags_array: T::Array[T::Hash[Symbol, Object]]).returns(T::Array[T::Hash[Symbol, Object]])
         end
         def filter_lower_tags(tags_array)
           return tags_array unless current_version
 
-          tags_array.select { |tag| tag.fetch(:version) > current_version }
+          tags_array.select { |tag| T.must(tag_version(tag)) > current_version }
+        end
+
+        sig { params(tag: T::Hash[Symbol, Object]).returns(String) }
+        def tag_name(tag)
+          return tag.tag if tag.is_a?(Dependabot::GitTagDetails)
+
+          T.cast(tag.fetch(:tag), String)
+        end
+
+        sig { params(tag: T::Hash[Symbol, Object]).returns(T.nilable(Gem::Version)) }
+        def tag_version(tag)
+          return tag.version if tag.is_a?(Dependabot::GitTagDetails)
+
+          version = tag[:version]
+          version if version.is_a?(Gem::Version)
         end
 
         sig { returns(T::Boolean) }

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-github_actions
 version: !ruby/object:Gem::Version
-  version: 0.392.0
+  version: 0.393.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.392.0
+        version: 0.393.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.392.0
+        version: 0.393.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -266,7 +266,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.392.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.393.0
 rdoc_options: []
 require_paths:
 - lib