dependabot-github_actions 0.401.0 → 0.402.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f52dcc4ffca3fffd85efa133c46ee31fee800ddca84ed787876441ec34414b47
-  data.tar.gz: a623cf219e7f0b21463f6e3345cccce0c30773340695adf102cbf332d018f163
+  metadata.gz: 2b4e91bfa491ff4e2ec830e11a36ede433981bb4eed911892731ee86c1524e5a
+  data.tar.gz: 72215130e11597be9306a4d06aaef10c14f23324b7c05e9a9ede16ab407c8a8c
 SHA512:
-  metadata.gz: eabbda950f81fdeef7ec92d5865b67a467beaf70652ca53123a740d1ad1346b4e3a624b7542da3336e3a3a9e3daef68da641930ae034e903baf1620afd08b7b9
-  data.tar.gz: bfd97e4e98fd61922cb6b8034dc3160ccbb2d1924174f14431650e5b82d9291473f63f61c17ca13427f78a32f4e389df1f4c699b927a6acfb9f13edee67c7f35
+  metadata.gz: 0de27643b909bdc0145989098cd705eec0c96cf3d3a78dcba5556c15c5db16b2542dfd2d6a82d1ac73f1d07d0a3321427cc9fad93c732fc4a079bd6efd3040ca
+  data.tar.gz: cd48b7b7093a9f6c4b8a607ff4607272e0b993206deafca33d1c72731365c2c6af0e569bb1254d287d96c8087bbb5ef0bfcc26ae1fc51165a370ea249509cac4

data/lib/dependabot/github_actions/file_updater/workflow_updater.rb

@@ -176,11 +176,13 @@ module Dependabot
         def uses_declaration_pattern(declaration)
           escaped_declaration = Regexp.escape(declaration)
 
+          # The declaration must end at whitespace, a flow delimiter or the end of the line. `$` does not match
+          # before a carriage return, so a CRLF line ending has to be listed explicitly.
           /
             (?:^|[ \t{,])
             (?:"uses"|'uses'|uses)[ \t]*:[ \t]*
             (?:"#{escaped_declaration}"|'#{escaped_declaration}'|#{escaped_declaration})
-            (?=[ \t]|$|[,}\]])
+            (?=[ \t\r]|$|[,}\]])
           /x
         end
 

data/lib/dependabot/github_actions/file_updater.rb

@@ -108,8 +108,8 @@ module Dependabot
       end
 
       # Repository workflows whose step-level `$/` chain (through nested composites)
-      # reaches a changed action. Only `$/` matters: gh-actions-lock refuses
-      # `./` refs in locked workflows.
+      # reaches a changed action. Only `$/` matters: gh-actions-lock never follows
+      # `./` actions.
       sig do
         params(changed_actions: T::Array[Dependabot::DependencyFile])
           .returns(T::Array[Dependabot::DependencyFile])

data/lib/dependabot/github_actions/lockfile/cli_engine.rb

@@ -28,6 +28,7 @@ module Dependabot
         UNRESOLVABLE_CATEGORIES = %w(
           unreachable-pin repo-replaced repo-unavailable repo-renamed not-pinned
           local-action invalid-self-repository-ref misleading-sha
+          tag-commit-mismatch incomplete-lockfile ref-missing invalid-workflow
         ).freeze
 
         # Host-identity failures from the engine: the lock is bound to a host it can't
@@ -35,6 +36,10 @@ module Dependabot
         # engine wraps every lookup error, so only a 404 counts; 5xx/429/403/timeouts stay EngineError.
         HOST_IDENTITY_ERROR = /verifying repository identity .*: HTTP 404\b|repository IDs|not the selected host/
 
+        # Write-time refusals (an incomplete lock graph, or a `uses:` cycle the lock
+        # can't record). Deterministic and user-actionable, so retrying never helps.
+        WRITE_REFUSED_ERROR = /refusing to write /
+
         # `hostname` is the repository's home host. The engine binds every pin with an
         # omitted lockfile `hostname` to it, so it must never be guessed.
         sig { params(credentials: T::Array[Dependabot::Credential], hostname: String).void }
@@ -52,7 +57,10 @@ module Dependabot
 
         # Re-pins workflows already tracked in the lockfile. `--no-onboard` refuses new
         # workflows/actions (surfaced as onboarding-required skips); `--no-narrow`
-        # keeps the exact ref Dependabot wrote.
+        # keeps the exact ref Dependabot wrote. `--ignore-local-actions` keeps `./`
+        # actions a warning: the lock can't record them, Dependabot never rewrites
+        # them, and whether their action.yml is readable here depends on whether the
+        # repo also uses `$/`.
         sig do
           params(
             workflow_files: T::Array[Dependabot::DependencyFile],
@@ -68,15 +76,16 @@ module Dependabot
           action_files: []
         )
           in_repo(workflow_files + action_files, lockfile) do |dir|
-            args = %w(--no-onboard --no-narrow --no-interactive --json=findings) +
+            args = %w(--no-onboard --no-narrow --ignore-local-actions --no-interactive --json=findings) +
                    ["--hostname", hostname] + workflow_paths
             json, exit_status = run(dir, args)
 
             skipped = onboarding_skips(json, lockfile)
             log_skips(skipped)
 
-            # `findings` is the PRE-fix diagnosis; at exit 0 fix-mode already resolved
-            # them. Writes are all-or-nothing, so exit 1 means nothing was written.
+            # At exit 1 `findings` is the pre-fix diagnosis of what blocked the fix;
+            # at exit 0 it reports the post-fix state. Writes are all-or-nothing, so
+            # exit 1 means nothing was written.
             raise_on_findings(json) if exit_status == 1
 
             File.read(File.join(dir, LOCKFILE_PATH))
@@ -120,12 +129,16 @@ module Dependabot
 
         # Invokes the binary and returns [parsed JSON, exit code]. Exit is tri-state:
         # 0 = valid, 1 = blocking findings (still well-formed JSON on stdout, parse it),
-        # 2+ = tool failure (no usable JSON). JSON and exit are not interchangeable in
-        # fix-mode: findings/valid are PRE-fix, exit is POST-fix, so callers gate on exit.
+        # 2+ = tool failure (no usable JSON). In fix-mode, findings/valid describe the
+        # post-fix state after a successful fix but the pre-fix state at exit 1, so
+        # callers gate on exit.
         sig { params(dir: String, args: T::Array[String]).returns([JsonObject, Integer]) }
         def run(dir, args)
           stdout, stderr, exit_status = invoke(dir, args)
-          raise DependencyFileNotResolvable, stderr.strip if exit_status > 1 && stderr.match?(HOST_IDENTITY_ERROR)
+          if exit_status > 1 && stderr.match?(Regexp.union(HOST_IDENTITY_ERROR, WRITE_REFUSED_ERROR))
+            raise DependencyFileNotResolvable, stderr.strip
+          end
+
           raise EngineError, "gh-actions-lock failed (exit #{exit_status}): #{stderr.strip}" if exit_status > 1
 
           json = case (parsed = JSON.parse(stdout))
@@ -165,7 +178,7 @@ module Dependabot
           unresolvable = errors.find { |finding| UNRESOLVABLE_CATEGORIES.include?(finding["category"].to_s) }
           if unresolvable
             raise UnresolvableDependency.new(
-              (unresolvable["dependency"] || "unknown").to_s,
+              (unresolvable["dependency"] || unresolvable["workflow"] || "unknown").to_s,
               (unresolvable["detail"] || unresolvable["category"]).to_s
             )
           end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-github_actions
 version: !ruby/object:Gem::Version
-  version: 0.401.0
+  version: 0.402.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.401.0
+        version: 0.402.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.401.0
+        version: 0.402.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -278,7 +278,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.401.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.402.0
 rdoc_options: []
 require_paths:
 - lib