dependabot-github_actions 0.237.0 → 0.238.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9f21866075019c5a142acbc0f0c620a6bbfba50eb16a1bb59e37cd0474c0d88f
-  data.tar.gz: 70fec17d129dff3814b61e810d6238985ac08ed59e2aa99319cb6ae3c5eba4b3
+  metadata.gz: 417a5dc780b5653b184e1b85bf500acba5f75527d0c6533b2d18a137aad5a1a6
+  data.tar.gz: d6162c2c02bf9c61ece051e9cc9c7df0af9037b0c0b10499fce246a685b00407
 SHA512:
-  metadata.gz: c5eb1345d8690120321f69856e735d0aea769705105dc4168b2f007ea1ad97ed71b2c1c3e2df0ad1179d1c88327326b272e07ffe4e2fb55c305f70c14ee6957c
-  data.tar.gz: bb5ea0c6225529c1c07f6c2ca88d11a7b038d852084450b097fa46df1331e2ad3addc890b0189039445882ee7639e553f6598e9c95db5624646ac6f0b11177f4
+  metadata.gz: 11f0acafb4b769b2e808b5447de805cbc5c62a4bbfc57b3ca869886c83fdd1124607d1406b5071a85e36953734186f5596cf6997cb96d3a3adc020dd11a112c2
+  data.tar.gz: 3cfdc22db82f2c0317709ed293fbb8f7ce941f3e5b38b58ea43f7e23cd59ac8db462fe154e7802924071483801e72c7a0b63433b21f594c7fdd38fbf6970b9e8

data/lib/dependabot/github_actions/file_parser.rb

@@ -55,19 +55,21 @@ module Dependabot
             credentials: credentials,
             consider_version_branches_pinned: true
           )
-          next unless git_checker.pinned?
-
-          # If dep does not have an assigned (semver) version, look for a commit that references a semver tag
-          unless dep.version
-            resolved = git_checker.local_tag_for_pinned_sha
-
-            if resolved && version_class.correct?(resolved)
-              dep = Dependency.new(
-                name: dep.name,
-                version: version_class.new(resolved).to_s,
-                requirements: dep.requirements,
-                package_manager: dep.package_manager
-              )
+          if git_checker.git_repo_reachable?
+            next unless git_checker.pinned?
+
+            # If dep does not have an assigned (semver) version, look for a commit that references a semver tag
+            unless dep.version
+              resolved = git_checker.version_for_pinned_sha
+
+              if resolved
+                dep = Dependency.new(
+                  name: dep.name,
+                  version: resolved.to_s,
+                  requirements: dep.requirements,
+                  package_manager: dep.package_manager
+                )
+              end
             end
           end
 

data/lib/dependabot/github_actions/update_checker.rb

@@ -153,8 +153,7 @@ module Dependabot
 
               Dir.chdir(repo_contents_path) do
                 ref_branch = find_container_branch(git_commit_checker.dependency_source_details[:ref])
-
-                git_commit_checker.head_commit_for_local_branch(ref_branch)
+                git_commit_checker.head_commit_for_local_branch(ref_branch) if ref_branch
               end
             end
           end
@@ -254,6 +253,7 @@ module Dependabot
           "git branch --remotes --contains #{sha}",
           fingerprint: "git branch --remotes --contains <sha>"
         ).split("\n").map { |branch| branch.strip.gsub("origin/", "") }
+        return if branches_including_ref.empty?
 
         current_branch = branches_including_ref.find { |branch| branch.start_with?("HEAD -> ") }
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-github_actions
 version: !ruby/object:Gem::Version
-  version: 0.237.0
+  version: 0.238.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2023-11-21 00:00:00.000000000 Z
+date: 2023-12-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.237.0
+        version: 0.238.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.237.0
+        version: 0.238.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -227,7 +227,7 @@ licenses:
 - Nonstandard
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.237.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.238.0
 post_install_message: 
 rdoc_options: []
 require_paths: