dependabot-github_actions 0.112.4 → 0.112.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e85c84d850fc9c8beecf6589294d6b24f251d7fc2ad8612ef975a6e7682598bd
-  data.tar.gz: 6397fe222aa60d3cdad6757f38242e215574f601351caadc9dba4f173eb585fb
+  metadata.gz: 8e9052844f46abcef42fc7daf26a33f0758af5cc20497e915a8cc76d60f45c03
+  data.tar.gz: 14e9930e13a41655a57db54d4ecb3a6f4e57b22c1d45618a3de6afdaf80395f6
 SHA512:
-  metadata.gz: 2f6c02d9727ab2ed9f6551f93a63de99b5123c369e452103249bfc749e92905244272661c2b268113399a7d8449702f6ad324ca55dbb6bcac5f3da3aed76b2da
-  data.tar.gz: 5b53de497ca30c420701a89652a6cb15cbffb412dc0f34a43c05a191cab8364923c05fdc3f885450ac4cc8cd14bd7892858f46ad2e9fcf9e4631f34e8c98dcf5
+  metadata.gz: 14db58db4be4c809aa207b15a133930451c8a0d1b75d56e1d5b91119ad0309f365e59c609982fd438292aef09909e6eee4eee648eb4b67f328d6111e562c1e97
+  data.tar.gz: 2c09449ba87ecf7839db9c906aba1ab59ded7ba3562389b66e9f8b7f25c2f1efd148183c25f1f68e7996e88c81ef562235b9cd507fcb43a3fd13f2323f6d341e

data/lib/dependabot/github_actions/update_checker.rb

@@ -24,6 +24,10 @@ module Dependabot
       end
 
       def updated_requirements
+        if updated_source == dependency_source_details
+          return dependency.requirements
+        end
+
         dependency.requirements.map { |req| req.merge(source: updated_source) }
       end
 
@@ -53,9 +57,10 @@ module Dependabot
         # If the dependency is pinned to a tag that looks like a version then
         # we want to update that tag. The latest version will then be the SHA
         # of the latest tag that looks like a version.
-        if git_commit_checker.pinned_ref_looks_like_version?
+        if git_commit_checker.pinned_ref_looks_like_version? &&
+           git_commit_checker.local_tag_for_latest_version
           latest_tag = git_commit_checker.local_tag_for_latest_version
-          return latest_tag&.fetch(:commit_sha) || dependency.version
+          return latest_tag.fetch(:commit_sha)
         end
 
         # If the dependency is pinned to a tag that doesn't look like a
@@ -71,8 +76,8 @@ module Dependabot
 
         # Update the git tag if updating a pinned version
         if git_commit_checker.pinned_ref_looks_like_version? &&
-           git_commit_checker.local_tag_for_latest_version
-          new_tag = git_commit_checker.local_tag_for_latest_version
+           (new_tag = git_commit_checker.local_tag_for_latest_version) &&
+           new_tag.fetch(:commit_sha) != current_commit
           return dependency_source_details.merge(ref: new_tag.fetch(:tag))
         end
 
@@ -98,6 +103,10 @@ module Dependabot
         sources.first
       end
 
+      def current_commit
+        git_commit_checker.head_commit_for_current_branch
+      end
+
       def git_dependency?
         git_commit_checker.git_dependency?
       end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-github_actions
 version: !ruby/object:Gem::Version
-  version: 0.112.4
+  version: 0.112.5
 platform: ruby
 authors:
 - Dependabot
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.112.4
+        version: 0.112.5
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.112.4
+        version: 0.112.5
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement