dependabot-github_actions 0.232.0 → 0.233.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0524731a606dc14446bebfe44e80046692fe9fd2d483f94eaeb59122c8bc576d
-  data.tar.gz: fd8726293069d378227023a47489ec16126824ae8ead8be198c2d1cd00871f36
+  metadata.gz: 43d431ad1f6f124ba6a4a8703ff0aa1bc588c29c9d1b809b47cff5e90db76e9d
+  data.tar.gz: 4e3c822a8100f3875234923e8752490c663fb01e4f074ea4b3a02321eac73bad
 SHA512:
-  metadata.gz: 1a2898be502554fbdcbd4a3fc234a0de19d398388f8f3099092552ab037937717343a5df6cae9cf5a99c366dcad4b837132ab80f7e3cb2d83bb6dc9ae4800109
-  data.tar.gz: bb25ac90622ca1a53c85b4315b52bed3d9a52b477c4559271c137bb360b4f42db4a12403e595597c08b27f86df69b07fbac3b00249596eb8507fa7832e0a709e
+  metadata.gz: 8e165bc83afd8ec58a8fbaf67fe71ffb7829891eb0f83f921e4a11769715058d429b90d3c4256ffcebed5c0176ac499dff9a7c82b23b9db936661d3867213edb
+  data.tar.gz: 3754c5a99c3ff13b67978b2cd69c08790f3b4b544ceac91d9c936abfd37f3106caac7a45b8ee70ca31c9a2d2e4f3c5dfd2bb9e694307df0e4956320d513e40a1

data/lib/dependabot/github_actions/file_updater.rb

@@ -60,10 +60,13 @@ module Dependabot
           # TODO: Support updating Docker sources
           next unless new_req.fetch(:source).fetch(:type) == "git"
 
+          old_ref = old_req.fetch(:source).fetch(:ref)
+          new_ref = new_req.fetch(:source).fetch(:ref)
+
           old_declaration = old_req.fetch(:metadata).fetch(:declaration_string)
           new_declaration =
             old_declaration
-            .gsub(/@.*+/, "@#{new_req.fetch(:source).fetch(:ref)}")
+            .gsub(/@.*+/, "@#{new_ref}")
 
           # Replace the old declaration that's preceded by a non-word character
           # and followed by a whitespace character (comments) or EOL.
@@ -79,7 +82,7 @@ module Dependabot
             ) do |match|
               comment = Regexp.last_match(:comment)
               match.gsub!(old_declaration, new_declaration)
-              if comment && (updated_comment = updated_version_comment(comment, new_req))
+              if comment && (updated_comment = updated_version_comment(comment, old_ref, new_ref))
                 match.gsub!(comment, updated_comment)
               end
               match
@@ -89,17 +92,24 @@ module Dependabot
         updated_content
       end
 
-      def updated_version_comment(comment, new_req)
+      def updated_version_comment(comment, old_ref, new_ref)
         raise "No comment!" unless comment
 
         comment = comment.rstrip
-        return unless dependency.previous_version && dependency.version
-        return unless comment.end_with? dependency.previous_version
-
         git_checker = Dependabot::GitCommitChecker.new(dependency: dependency, credentials: credentials)
-        return unless git_checker.ref_looks_like_commit_sha?(new_req.fetch(:source).fetch(:ref))
+        return unless git_checker.ref_looks_like_commit_sha?(old_ref)
+
+        previous_version_tag = git_checker.most_specific_version_tag_for_sha(old_ref)
+        previous_version = version_class.new(previous_version_tag).to_s
+        return unless comment.end_with? previous_version
+
+        new_version_tag = git_checker.most_specific_version_tag_for_sha(new_ref)
+        new_version = version_class.new(new_version_tag).to_s
+        comment.gsub(previous_version, new_version)
+      end
 
-        comment.gsub(dependency.previous_version, dependency.version)
+      def version_class
+        GithubActions::Version
       end
     end
   end

data/lib/dependabot/github_actions/update_checker.rb

@@ -35,20 +35,21 @@ module Dependabot
       end
 
       def updated_requirements
-        updated = updated_ref
-
         dependency.requirements.map do |req|
+          source = req[:source]
+          updated = updated_ref(source)
           next req unless updated
 
+          current = source[:ref]
+
           # Maintain a short git hash only if it matches the latest
           if req[:type] == "git" &&
-             updated.match?(/^[0-9a-f]{6,40}$/) &&
-             req[:ref]&.match?(/^[0-9a-f]{6,40}$/) &&
-             updated.start_with?(req[:ref])
+             git_commit_checker.ref_looks_like_commit_sha?(updated) &&
+             git_commit_checker.ref_looks_like_commit_sha?(current) &&
+             updated.start_with?(current)
             next req
           end
 
-          source = req[:source]
           new_source = source.merge(ref: updated)
           req.merge(source: new_source)
         end
@@ -172,7 +173,7 @@ module Dependabot
           .select { |tag| tag.fetch(:version) > current_version }
       end
 
-      def updated_ref
+      def updated_ref(source)
         # TODO: Support Docker sources
         return unless git_dependency?
 
@@ -181,14 +182,16 @@ module Dependabot
           return new_tag.fetch(:tag)
         end
 
+        source_git_commit_checker = git_commit_checker_for(source)
+
         # Return the git tag if updating a pinned version
-        if git_commit_checker.pinned_ref_looks_like_version? &&
+        if source_git_commit_checker.pinned_ref_looks_like_version? &&
            (new_tag = latest_version_tag)
           return new_tag.fetch(:tag)
         end
 
         # Return the pinned git commit if one is available
-        if git_commit_checker.pinned_ref_looks_like_commit_sha? &&
+        if source_git_commit_checker.pinned_ref_looks_like_commit_sha? &&
            (new_commit_sha = latest_commit_sha)
           return new_commit_sha
         end
@@ -217,12 +220,19 @@ module Dependabot
       end
 
       def git_commit_checker
-        @git_commit_checker ||= Dependabot::GitCommitChecker.new(
+        @git_commit_checker ||= git_commit_checker_for(nil)
+      end
+
+      def git_commit_checker_for(source)
+        @git_commit_checkers ||= {}
+
+        @git_commit_checkers[source] ||= Dependabot::GitCommitChecker.new(
           dependency: dependency,
           credentials: credentials,
           ignored_versions: ignored_versions,
           raise_on_ignored: raise_on_ignored,
-          consider_version_branches_pinned: true
+          consider_version_branches_pinned: true,
+          dependency_source_details: source
         )
       end
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-github_actions
 version: !ruby/object:Gem::Version
-  version: 0.232.0
+  version: 0.233.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2023-09-14 00:00:00.000000000 Z
+date: 2023-10-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.232.0
+        version: 0.233.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.232.0
+        version: 0.233.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -52,20 +52,6 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '2.0'
-- !ruby/object:Gem::Dependency
-  name: parallel_tests
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: 4.2.0
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: 4.2.0
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
@@ -164,6 +150,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: 0.2.16
+- !ruby/object:Gem::Dependency
+  name: turbo_tests
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 2.2.0
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 2.2.0
 - !ruby/object:Gem::Dependency
   name: vcr
   requirement: !ruby/object:Gem::Requirement
@@ -213,7 +213,7 @@ licenses:
 - Nonstandard
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.232.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.233.0
 post_install_message: 
 rdoc_options: []
 require_paths: