dependabot-github_actions 0.403.0 → 0.404.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: '0090593cc564f949e3abef7c548565cd1b2a678aa405e88cc6c4d852ebf575ce'
-  data.tar.gz: 1125ed0bdbe60e308bf5ad357f0e44afbe58b39c28c7801e38db0d38ab6e7f4f
+  metadata.gz: 439ae35a254e6fb3ec27a8dd060058d37c03a05da17b84de0b321d6c4206fd53
+  data.tar.gz: 74bc5c6f5ae244fec2f7edb9d764c0f758799d7e2d2fdc4c13ab4a6e8249d5b5
 SHA512:
-  metadata.gz: f437b927959898a1756eee795467a34d8c9733bc2f00238e785cbac867344a1f3d4667c4ebdd093e537037fe7fda6b03a356ab6ff4b9522d057ef07456c173ef
-  data.tar.gz: a84a9e716d0a358694d2d018c7e598455aab46342b73c492d89abc5ff952fabe421bbbe3ed84cfdab2f3e6a197ded3eac40b353d67bd3c6ac176ba70079efe6b
+  metadata.gz: faaaa7e87687396144daa0e46dff8b04c4f8f13787d57e1fdccba5cceaf41907415c9992c9d82d21e889d35e70a8637f130387427aee59a761a9c9f04aeeacbc
+  data.tar.gz: da9848633ca5f4c5f018ea55c9ee6c90d72651b8dbe25704b666e6ec82b822b9a997d74668478de0a832c64ae3ad60f23c2d76162c26cdd553cbd8e5f78c5eb7

data/lib/dependabot/github_actions/package/package_details_fetcher.rb

@@ -10,6 +10,7 @@ require "dependabot/errors"
 require "dependabot/git_tag_with_detail"
 require "dependabot/github_actions/containing_branch_finder"
 require "dependabot/github_actions/helpers"
+require "dependabot/github_actions/repository_cloner"
 require "dependabot/github_actions/requirement"
 require "dependabot/github_actions/update_checker"
 require "dependabot/github_actions/version"
@@ -230,10 +231,7 @@ module Dependabot
                 SharedHelpers.in_a_temporary_directory(File.dirname(source.repo)) do |temp_dir|
                   repo_contents_path = File.join(temp_dir, File.basename(source.repo))
 
-                  SharedHelpers.run_shell_command(
-                    "git clone --no-recurse-submodules #{url} #{repo_contents_path}",
-                    fingerprint: "git clone --no-recurse-submodules <url> <path>"
-                  )
+                  RepositoryCloner.clone(url: T.must(url), path: repo_contents_path)
 
                   Dir.chdir(repo_contents_path) do
                     ref_branch = ContainingBranchFinder.find(

data/lib/dependabot/github_actions/repository_cloner.rb

@@ -0,0 +1,38 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "fileutils"
+require "sorbet-runtime"
+
+require "dependabot/logger"
+require "dependabot/shared_helpers"
+
+module Dependabot
+  module GithubActions
+    module RepositoryCloner
+      extend T::Sig
+
+      # Callers only read commits and tags (containing-branch lookup, tag and commit dates), so
+      # skip trees and blobs: a full clone of a large repository can fill the disk or time out.
+      # Git fetches a missing tree on demand if a later command needs one.
+      # Fall back to a full clone if the server or proxy rejects the partial clone, so a lookup
+      # never does worse than before.
+      sig { params(url: String, path: String, bare: T::Boolean).void }
+      def self.clone(url:, path:, bare: false)
+        mode = bare ? "--bare" : "--no-checkout"
+        SharedHelpers.run_shell_command(
+          "git clone #{mode} --filter=tree:0 --no-recurse-submodules #{url} #{path}",
+          fingerprint: "git clone #{mode} --filter=tree:0 --no-recurse-submodules <url> <path>"
+        )
+      rescue SharedHelpers::HelperSubprocessFailed => e
+        Dependabot.logger.warn("Partial clone failed, falling back to a full clone: #{e.message.strip}")
+        FileUtils.rm_rf(path)
+        full_clone_options = bare ? "--bare --no-recurse-submodules" : "--no-recurse-submodules"
+        SharedHelpers.run_shell_command(
+          "git clone #{full_clone_options} #{url} #{path}",
+          fingerprint: "git clone #{full_clone_options} <url> <path>"
+        )
+      end
+    end
+  end
+end

data/lib/dependabot/github_actions/update_checker/latest_version_finder.rb

@@ -11,6 +11,7 @@ require "dependabot/github_actions/package/package_details_fetcher"
 require "dependabot/github_actions/requirement"
 require "dependabot/github_actions/update_checker"
 require "dependabot/github_actions/helpers"
+require "dependabot/github_actions/repository_cloner"
 require "dependabot/package/package_latest_version_finder"
 require "dependabot/shared_helpers"
 require "dependabot/update_checkers/cooldown_calculation"
@@ -349,7 +350,7 @@ module Dependabot
           SharedHelpers.in_a_temporary_directory(File.dirname(source.repo)) do |temp_dir|
             repo_contents_path = File.join(temp_dir, File.basename(source.repo))
 
-            SharedHelpers.run_shell_command("git clone --bare --no-recurse-submodules #{url} #{repo_contents_path}")
+            RepositoryCloner.clone(url: T.must(url), path: repo_contents_path, bare: true)
             Dir.chdir(repo_contents_path) do
               date = if tag_name
                        tag_date = SharedHelpers.run_shell_command(
@@ -360,10 +361,11 @@ module Dependabot
                        tag_date.empty? ? nil : tag_date
                      end
 
+              # --no-mailmap: in a bare repository git log otherwise reads .mailmap from HEAD's tree,
+              # which a tree:0 clone would have to fetch from the remote.
               date ||= SharedHelpers.run_shell_command(
-                "git show --no-patch --format=\"%cd\" " \
-                "--date=iso #{commit_ref}",
-                fingerprint: "git show --no-patch --format=\"%cd\" --date=iso <commit_ref>"
+                "git log -1 --no-mailmap --format=\"%cd\" --date=iso #{commit_ref}",
+                fingerprint: "git log -1 --no-mailmap --format=\"%cd\" --date=iso <commit_ref>"
               ).strip
 
               Dependabot.logger.info("Found release date : #{Time.parse(date)}")

data/lib/dependabot/github_actions/update_checker.rb

@@ -7,6 +7,7 @@ require "dependabot/errors"
 require "dependabot/git_metadata_fetcher"
 require "dependabot/github_actions/constants"
 require "dependabot/github_actions/containing_branch_finder"
+require "dependabot/github_actions/repository_cloner"
 require "dependabot/github_actions/lockfile/reader"
 require "dependabot/github_actions/requirement"
 require "dependabot/github_actions/version"
@@ -240,10 +241,7 @@ module Dependabot
               SharedHelpers.in_a_temporary_directory(File.dirname(source.repo)) do |temp_dir|
                 repo_contents_path = File.join(temp_dir, File.basename(source.repo))
 
-                SharedHelpers.run_shell_command(
-                  "git clone --no-recurse-submodules #{url} #{repo_contents_path}",
-                  fingerprint: "git clone --no-recurse-submodules <url> <path>"
-                )
+                RepositoryCloner.clone(url: T.must(url), path: repo_contents_path)
 
                 Dir.chdir(repo_contents_path) do
                   ref_branch = ContainingBranchFinder.find(

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-github_actions
 version: !ruby/object:Gem::Version
-  version: 0.403.0
+  version: 0.404.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.403.0
+        version: 0.404.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.403.0
+        version: 0.404.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -264,6 +264,7 @@ files:
 - lib/dependabot/github_actions/metadata_finder.rb
 - lib/dependabot/github_actions/package/package_details_fetcher.rb
 - lib/dependabot/github_actions/package_manager.rb
+- lib/dependabot/github_actions/repository_cloner.rb
 - lib/dependabot/github_actions/requirement.rb
 - lib/dependabot/github_actions/update_checker.rb
 - lib/dependabot/github_actions/update_checker/latest_version_finder.rb
@@ -278,7 +279,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.403.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.404.0
 rdoc_options: []
 require_paths:
 - lib