dependabot-github_actions 0.393.0 → 0.394.0

data/lib/dependabot/github_actions/file_updater/workflow_updater/yaml_comment_finder.rb

@@ -0,0 +1,96 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "dependabot/github_actions/file_updater/workflow_updater"
+
+module Dependabot
+  module GithubActions
+    class FileUpdater < Dependabot::FileUpdaters::Base
+      class WorkflowUpdater
+        class YamlCommentFinder
+          extend T::Sig
+
+          sig { params(suffix: String).returns(T.nilable(String)) }
+          def find(suffix)
+            previous_non_whitespace = T.let(nil, T.nilable(String))
+            index = 0
+
+            while index < suffix.length
+              character = T.must(suffix[index])
+              if quoted_scalar_start?(character, previous_non_whitespace)
+                previous_non_whitespace = character
+                index = quoted_scalar_end(suffix, index)
+                next
+              end
+
+              return comment_with_leading_whitespace(suffix, index) if comment_start?(suffix, index)
+
+              previous_non_whitespace = character unless character.match?(/\s/)
+              index += 1
+            end
+            nil
+          end
+
+          sig { params(suffix: String).returns(T.nilable(String)) }
+          def find_immediate(suffix)
+            comment = find(suffix)
+            return unless comment
+
+            comment_start = T.must(suffix.b.index(comment.b))
+            prefix = suffix.byteslice(0...comment_start) || ""
+            comment if prefix.match?(/\A[ \t]*,?[ \t]*\z/)
+          end
+
+          sig { params(line: String).returns(T.nilable(String)) }
+          def find_line(line)
+            stripped = line.lstrip
+            return stripped if stripped.start_with?("#")
+
+            find(line)
+          end
+
+          private
+
+          sig { params(character: String, previous_non_whitespace: T.nilable(String)).returns(T::Boolean) }
+          def quoted_scalar_start?(character, previous_non_whitespace)
+            return false unless character == "'" || character == '"'
+
+            previous_non_whitespace.nil? || ":,[{?-".include?(previous_non_whitespace)
+          end
+
+          sig { params(suffix: String, quote_index: Integer).returns(Integer) }
+          def quoted_scalar_end(suffix, quote_index)
+            quote = T.must(suffix[quote_index])
+            index = quote_index + 1
+
+            while index < suffix.length
+              character = T.must(suffix[index])
+              if quote == "'" && character == "'" && suffix[index + 1] == "'"
+                index += 2
+              elsif quote == '"' && character == "\\"
+                index += 2
+              elsif character == quote
+                return index + 1
+              else
+                index += 1
+              end
+            end
+            suffix.length
+          end
+
+          sig { params(suffix: String, index: Integer).returns(T::Boolean) }
+          def comment_start?(suffix, index)
+            suffix[index] == "#" && index.positive? && T.must(suffix[index - 1]).match?(/\s/)
+          end
+
+          sig { params(suffix: String, hash_index: Integer).returns(String) }
+          def comment_with_leading_whitespace(suffix, hash_index)
+            comment_start = hash_index
+            comment_start -= 1 while comment_start.positive? && T.must(suffix[comment_start - 1]).match?(/\s/)
+            T.must(suffix[comment_start..])
+          end
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/github_actions/file_updater/workflow_updater.rb

@@ -0,0 +1,222 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "dependabot/github_actions/file_updater"
+
+module Dependabot
+  module GithubActions
+    class FileUpdater < Dependabot::FileUpdaters::Base
+      class WorkflowUpdater
+        extend T::Sig
+
+        class SourceUpdate < T::Struct
+          const :declaration, WorkflowFile::UsesDeclaration
+          const :old_declaration, String
+          const :new_declaration, String
+          const :old_ref, String
+          const :new_ref, String
+        end
+
+        class ContentEdit < T::Struct
+          const :start_offset, Integer
+          const :end_offset, Integer
+          const :replacement, String
+        end
+
+        require_relative "workflow_updater/version_commenter"
+        require_relative "workflow_updater/yaml_comment_finder"
+        require_relative "workflow_updater/source_comment_locator"
+        require_relative "workflow_updater/source_comment_updater"
+        require_relative "workflow_updater/flow_sequence_comments"
+        require_relative "workflow_updater/source_updater"
+
+        sig do
+          params(
+            file: Dependabot::DependencyFile,
+            dependency: Dependabot::Dependency,
+            commenter: VersionCommenter
+          ).void
+        end
+        def initialize(file:, dependency:, commenter:)
+          @file = file
+          @dependency = dependency
+          @commenter = commenter
+          @comment_finder = T.let(YamlCommentFinder.new, YamlCommentFinder)
+        end
+
+        sig { returns(String) }
+        def updated_content
+          workflow_file = WorkflowFile.new(T.must(file.content))
+          source_updates, fallback_pairs = requirement_updates(workflow_file)
+
+          content = SourceUpdater.new(
+            workflow_file: workflow_file,
+            updates: source_updates,
+            commenter: commenter,
+            comment_finder: comment_finder
+          ).updated_content
+          fallback_pairs.each do |new_req, old_req|
+            content = apply_text_update(content, new_req, old_req)
+          end
+          content
+        end
+
+        private
+
+        sig { returns(Dependabot::DependencyFile) }
+        attr_reader :file
+
+        sig { returns(Dependabot::Dependency) }
+        attr_reader :dependency
+
+        sig { returns(VersionCommenter) }
+        attr_reader :commenter
+
+        sig { returns(YamlCommentFinder) }
+        attr_reader :comment_finder
+
+        sig do
+          params(workflow_file: WorkflowFile).returns(
+            [
+              T::Array[SourceUpdate],
+              T::Array[[Dependabot::DependencyRequirement, Dependabot::DependencyRequirement]]
+            ]
+          )
+        end
+        def requirement_updates(workflow_file)
+          source_updates = T.let([], T::Array[SourceUpdate])
+          fallback_pairs = T.let(
+            [],
+            T::Array[[Dependabot::DependencyRequirement, Dependabot::DependencyRequirement]]
+          )
+
+          dependency.requirements.zip(T.must(dependency.previous_requirements)).each do |new_req, old_req|
+            previous_requirement = T.must(old_req)
+            next if new_req.file != file.name || new_req.source == previous_requirement.source
+            next unless new_req.source_string("type") == "git"
+
+            source_update = source_update_for(workflow_file, new_req, previous_requirement)
+            source_update ? source_updates << source_update : fallback_pairs << [new_req, previous_requirement]
+          end
+
+          [source_updates, fallback_pairs]
+        end
+
+        sig do
+          params(
+            workflow_file: WorkflowFile,
+            new_req: Dependabot::DependencyRequirement,
+            old_req: Dependabot::DependencyRequirement
+          ).returns(T.nilable(SourceUpdate))
+        end
+        def source_update_for(workflow_file, new_req, old_req)
+          path = yaml_source_path(old_req)
+          return unless path
+
+          declaration = workflow_file.declaration_at(path)
+          return unless declaration
+          return unless declaration.value_node && declaration.source_node && declaration.mapping_node
+
+          old_declaration = T.must(old_req.metadata_string("declaration_string"))
+          new_ref = T.must(new_req.source_string("ref"))
+          SourceUpdate.new(
+            declaration: declaration,
+            old_declaration: old_declaration,
+            new_declaration: old_declaration.gsub(/@.*+/, "@#{new_ref}"),
+            old_ref: T.must(old_req.source_string("ref")),
+            new_ref: new_ref
+          )
+        end
+
+        sig { params(requirement: Dependabot::DependencyRequirement).returns(T.nilable(WorkflowFile::Path)) }
+        def yaml_source_path(requirement)
+          metadata = requirement.metadata
+          return unless metadata
+
+          raw_source = metadata[:yaml_source] || metadata["yaml_source"]
+          return unless raw_source.is_a?(Hash)
+
+          raw_path = raw_source[:path] || raw_source["path"]
+          return unless raw_path.is_a?(Array)
+          return unless raw_path.all? { |part| part.is_a?(String) || part.is_a?(Integer) }
+
+          path = T.let([], WorkflowFile::Path)
+          raw_path.each { |part| path << part }
+          path
+        end
+
+        sig do
+          params(
+            content: String,
+            new_req: Dependabot::DependencyRequirement,
+            old_req: Dependabot::DependencyRequirement
+          ).returns(String)
+        end
+        def apply_text_update(content, new_req, old_req)
+          old_ref = T.must(old_req.source_string("ref"))
+          new_ref = T.must(new_req.source_string("ref"))
+          old_declaration = T.must(old_req.metadata_string("declaration_string"))
+          new_declaration = old_declaration.gsub(/@.*+/, "@#{new_ref}")
+          declaration_pattern = uses_declaration_pattern(old_declaration)
+
+          content.gsub(/#{declaration_pattern}(?<suffix>[^\r\n]*)/) do |match|
+            updated_workflow_line(
+              match: match,
+              comment: comment_finder.find(T.must(Regexp.last_match(:suffix))),
+              declaration_pattern: declaration_pattern,
+              old_declaration: old_declaration,
+              new_declaration: new_declaration,
+              old_ref: old_ref,
+              new_ref: new_ref
+            )
+          end
+        end
+
+        sig { params(declaration: String).returns(Regexp) }
+        def uses_declaration_pattern(declaration)
+          escaped_declaration = Regexp.escape(declaration)
+
+          /
+            (?:^|[ \t{,])
+            (?:"uses"|'uses'|uses)[ \t]*:[ \t]*
+            (?:"#{escaped_declaration}"|'#{escaped_declaration}'|#{escaped_declaration})
+            (?=[ \t]|$|[,}\]])
+          /x
+        end
+
+        sig do
+          params(
+            match: String,
+            comment: T.nilable(String),
+            declaration_pattern: Regexp,
+            old_declaration: String,
+            new_declaration: String,
+            old_ref: String,
+            new_ref: String
+          ).returns(String)
+        end
+        def updated_workflow_line(
+          match:,
+          comment:,
+          declaration_pattern:,
+          old_declaration:,
+          new_declaration:,
+          old_ref:,
+          new_ref:
+        )
+          line_without_comment = comment ? match.delete_suffix(comment) : match
+          updated_match = line_without_comment.gsub(declaration_pattern) do |declaration|
+            declaration.sub(old_declaration, new_declaration)
+          end
+
+          if comment
+            updated_match << (commenter.updated_comment(comment, old_ref, new_ref) || comment)
+          elsif (new_comment = commenter.new_comment(old_ref, new_ref))
+            updated_match << new_comment
+          end
+          updated_match
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/github_actions/file_updater.rb

@@ -8,12 +8,15 @@ require "dependabot/file_updaters"
 require "dependabot/file_updaters/base"
 require "dependabot/github_actions/constants"
 require "dependabot/github_actions/lockfile"
+require "dependabot/github_actions/workflow_file"
 
 module Dependabot
   module GithubActions
     class FileUpdater < Dependabot::FileUpdaters::Base
       extend T::Sig
 
+      require_relative "file_updater/workflow_updater"
+
       sig { override.returns(T::Array[Dependabot::DependencyFile]) }
       def updated_dependency_files
         updated_files = changed_workflow_files.map do |file|
@@ -138,85 +141,24 @@ module Dependabot
         file.path.delete_prefix("/")
       end
 
-      # rubocop:disable Metrics/AbcSize
       sig { params(file: Dependabot::DependencyFile).returns(String) }
       def updated_workflow_file_content(file)
-        updated_requirement_pairs =
-          dependency.requirements.zip(T.must(dependency.previous_requirements))
-                    .reject do |new_req, old_req|
-            next true if new_req.file != file.name
-
-            new_req.source == T.must(old_req).source
-          end
-
-        updated_content = T.must(file.content)
-
-        updated_requirement_pairs.each do |new_req, old_req|
-          # TODO: Support updating Docker sources
-          next unless new_req.source_string("type") == "git"
-
-          old_ref = T.must(T.must(old_req).source_string("ref"))
-          new_ref = T.must(new_req.source_string("ref"))
-
-          old_declaration = T.must(T.must(old_req).metadata_string("declaration_string"))
-          new_declaration =
-            old_declaration
-            .gsub(/@.*+/, "@#{new_ref}")
-
-          # Replace the old declaration that's preceded by a non-word character (unless it's a hyphen)
-          # and followed by a whitespace character (comments) or EOL.
-          # If the declaration is followed by a comment that lists the version associated
-          # with the SHA source ref, then update the comment to the human-readable new version.
-          # However, if the comment includes additional text beyond the version, for safety
-          # we skip updating the comment in case it's a custom note, todo, warning etc of some kind.
-          # See the related unit tests for examples.
-          updated_content =
-            updated_content
-            .gsub(
-              /(?<=[^a-zA-Z_-]|"|')#{Regexp.escape(old_declaration)}["']?(?<comment>\s+#.*)?(?=\s|$)/
-            ) do |match|
-              comment = Regexp.last_match(:comment)
-              match.gsub!(old_declaration, new_declaration)
-              if comment && (updated_comment = updated_version_comment(comment, old_ref, new_ref))
-                match.gsub!(comment, updated_comment)
-              end
-              match
-            end
-        end
-
-        updated_content
-      end
-      # rubocop:enable Metrics/AbcSize
-
-      sig { params(comment: T.nilable(String), old_ref: String, new_ref: String).returns(T.nilable(String)) }
-      def updated_version_comment(comment, old_ref, new_ref)
-        raise "No comment!" unless comment
-
-        comment = comment.rstrip
-        git_checker = Dependabot::GitCommitChecker.new(dependency: dependency, credentials: credentials)
-        return unless git_checker.ref_looks_like_commit_sha?(old_ref)
-
-        previous_version_tags = git_checker.most_specific_version_tags_for_sha(old_ref)
-        return unless previous_version_tags.any? # There's no tag for this commit
-
-        # Use the most specific (longest) matching version to avoid partial replacements.
-        # Tags are sorted ascending, so ["v1", "v1.0", "v1.0.1"] maps to ["1", "1.0", "1.0.1"].
-        # Without this, "1" could match the end of "v1.0.1", causing gsub("1", "1.1") => "v1.1.0.1.1".
-        previous_version = previous_version_tags.map { |tag| version_class.new(tag).to_s }
-                                                .select { |version| comment.end_with?(version) }
-                                                .max_by(&:length)
-        return unless previous_version
-
-        new_version_tag = git_checker.most_specific_version_tag_for_sha(new_ref)
-        return unless new_version_tag
-
-        new_version = version_class.new(new_version_tag).to_s
-        comment.gsub(previous_version, new_version)
-      end
-
-      sig { returns(T.class_of(Dependabot::GithubActions::Version)) }
-      def version_class
-        GithubActions::Version
+        WorkflowUpdater.new(
+          file: file,
+          dependency: dependency,
+          commenter: version_commenter
+        ).updated_content
+      end
+
+      sig { returns(WorkflowUpdater::VersionCommenter) }
+      def version_commenter
+        @version_commenter ||= T.let(
+          WorkflowUpdater::VersionCommenter.new(
+            dependency: dependency,
+            credentials: credentials
+          ),
+          T.nilable(WorkflowUpdater::VersionCommenter)
+        )
       end
     end
   end

data/lib/dependabot/github_actions/update_checker.rb

@@ -59,7 +59,7 @@ module Dependabot
 
       sig { override.returns(T::Boolean) }
       def up_to_date?
-        super && !onboarded_requirements_changed?
+        super && !relevant_requirements_changed?
       end
 
       sig { override.returns(T::Array[Dependabot::DependencyRequirement]) }
@@ -82,16 +82,36 @@ module Dependabot
         return true if super
         return false unless requirements_to_unlock == :own
 
-        onboarded_requirements_changed?
+        relevant_requirements_changed?
       end
 
       sig { returns(T::Boolean) }
-      def onboarded_requirements_changed?
+      def relevant_requirements_changed?
         dependency.requirements.zip(updated_requirements).any? do |current, updated|
-          onboarded_requirement?(current) && current != updated
+          next false unless updated
+
+          current != updated && (onboarded_requirement?(current) || tag_to_sha_requirement?(current, updated))
         end
       end
 
+      sig do
+        params(
+          current: Dependabot::DependencyRequirement,
+          updated: Dependabot::DependencyRequirement
+        ).returns(T::Boolean)
+      end
+      def tag_to_sha_requirement?(current, updated)
+        return false unless pin_to_sha?
+
+        current_ref = current.source_string("ref")
+        updated_ref = updated.source_string("ref")
+        return false unless current_ref && updated_ref
+        return false unless version_class.correct?(current_ref)
+        return false if Dependabot::GithubActions::Version.path_based?(current_ref)
+
+        git_commit_checker.ref_looks_like_commit_sha?(updated_ref)
+      end
+
       # A requirement is "onboarded" when the repo carries an `actions.lock` that is
       # authoritative for the requirement's workflow. Only onboarded requirements get
       # per-source precision selection; everything else flows through the combined
@@ -246,11 +266,12 @@ module Dependabot
         # TODO: Support Docker sources
         return unless git_commit_checker.git_dependency?
 
-        git_source = source && symbolize_source(source)
+        git_source = git_source_for(source)
+        current_ref = git_source&.fetch(:ref, nil)
         finder = onboarded ? latest_version_finder_for(git_source) : T.must(latest_version_finder)
 
         if vulnerable? && (new_tag = finder.lowest_security_fix_release)
-          return new_tag.fetch(:tag)
+          return ref_for_release(new_tag, current_ref: current_ref)
         end
 
         source_git_commit_checker = git_helper.git_commit_checker_for(git_source)
@@ -258,7 +279,7 @@ module Dependabot
         # Return the git tag if updating a pinned version
         if source_git_commit_checker.pinned_ref_looks_like_version? &&
            (new_tag = finder.latest_version_tag_respecting_cooldown)
-          return new_tag.fetch(:tag)
+          return ref_for_release(new_tag, current_ref: current_ref)
         end
 
         # Return the pinned git commit if one is available
@@ -271,6 +292,34 @@ module Dependabot
         nil
       end
 
+      sig { returns(T::Boolean) }
+      def pin_to_sha?
+        T.cast(options.fetch(:github_actions_pin_to_sha, false), T::Boolean)
+      end
+
+      sig do
+        params(
+          release: T::Hash[Symbol, Object],
+          current_ref: T.nilable(String)
+        ).returns(String)
+      end
+      def ref_for_release(release, current_ref:)
+        return T.cast(release.fetch(:tag), String) unless pin_to_sha?
+        if current_ref && Dependabot::GithubActions::Version.path_based?(current_ref)
+          return T.cast(release.fetch(:tag), String)
+        end
+
+        T.cast(release.fetch(:commit_sha), String)
+      end
+
+      sig do
+        params(source: T.nilable(Dependabot::DependencyRequirement::ObjectHash))
+          .returns(T.nilable(GitSource))
+      end
+      def git_source_for(source)
+        source && symbolize_source(source)
+      end
+
       sig do
         params(source: Dependabot::DependencyRequirement::ObjectHash)
           .returns(GitSource)