dependabot-github_actions 0.318.0 → 0.319.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 250d36ac87750395de567aee349134a7ad7f6ff59700623fb98aaa57585b42db
-  data.tar.gz: ad35f5f8dba65555fb3597c82a7b508a8ae97f65f54dcad95eaa195c68f1151f
+  metadata.gz: fc4883bf917e6eb180ff085886dff4548085a8b49cb364c6c0e670a04e722283
+  data.tar.gz: 723663decd469822de084aeee604bdef7aa6b3cf0e0f86f4fb38a80c52753363
 SHA512:
-  metadata.gz: b1af3ca6d04cb15f3a11e10993336fa4a837e076ff78a83e2b9c22c4332920835bbb6fb33177946174419dd7fa8565138287cf12bdf9e0acb95495ca06b5ab85
-  data.tar.gz: 5e9e44ca3c060558381bd68d32b78fef896741b8365171c9172dcf8dc9a0031585dadf4ac0845a1184422b75f1958d402a5583d0896d26664d1d841ee9393003
+  metadata.gz: 247ff7c4c4219bd38c373e81b7150a7696667db8f9ec152c74d3de49957efc13074498bcb3d26a175832fac41a2f6d07949feb45ab50ad0e4377e8692a9ebfe8
+  data.tar.gz: 7e0c4f1b2f8a61471c20f9d77e690bde837d9eb317eba956f6676e1c8ed63d4fa3821290fc152683269e277cf98d5074beaf5194fb715dc154084160e242f7ee

data/lib/dependabot/github_actions/helpers.rb

@@ -0,0 +1,80 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "dependabot/dependency"
+require "dependabot/errors"
+require "dependabot/file_fetchers"
+require "dependabot/file_fetchers/base"
+require "dependabot/github_actions/constants"
+require "dependabot/github_actions/requirement"
+require "dependabot/github_actions/version"
+require "dependabot/update_checkers"
+require "dependabot/update_checkers/base"
+require "dependabot/update_checkers/version_filters"
+require "sorbet-runtime"
+
+module Dependabot
+  module GithubActions
+    module Helpers
+      class Githelper
+        extend T::Sig
+
+        sig do
+          params(
+            dependency: Dependabot::Dependency,
+            credentials: T::Array[Dependabot::Credential],
+            ignored_versions: T::Array[String],
+            raise_on_ignored: T::Boolean,
+            consider_version_branches_pinned: T::Boolean,
+            dependency_source_details: T.nilable(T::Hash[Symbol, String])
+          )
+            .void
+        end
+        def initialize(dependency:, credentials:,
+                       ignored_versions: [], raise_on_ignored: false,
+                       consider_version_branches_pinned: false, dependency_source_details: nil)
+          @dependency = dependency
+          @credentials = credentials
+          @ignored_versions = ignored_versions
+          @raise_on_ignored = raise_on_ignored
+          @consider_version_branches_pinned = consider_version_branches_pinned
+          @dependency_source_details = dependency_source_details
+        end
+
+        sig { returns(Dependabot::Dependency) }
+        attr_reader :dependency
+        sig { returns(T::Array[Dependabot::Credential]) }
+        attr_reader :credentials
+        sig { returns(T::Array[String]) }
+        attr_reader :ignored_versions
+        sig { returns(T::Boolean) }
+        attr_reader :raise_on_ignored
+
+        sig { returns(Dependabot::GitCommitChecker) }
+        def git_commit_checker
+          @git_commit_checker ||= T.let(
+            git_commit_checker_for(nil),
+            T.nilable(Dependabot::GitCommitChecker)
+          )
+        end
+
+        sig { params(source: T.nilable(T::Hash[Symbol, String])).returns(Dependabot::GitCommitChecker) }
+        def git_commit_checker_for(source)
+          @git_commit_checkers ||= T.let(
+            {},
+            T.nilable(T::Hash[T.nilable(T::Hash[Symbol, String]), Dependabot::GitCommitChecker])
+          )
+
+          @git_commit_checkers[source] ||= Dependabot::GitCommitChecker.new(
+            dependency: dependency,
+            credentials: credentials,
+            ignored_versions: ignored_versions,
+            raise_on_ignored: raise_on_ignored,
+            consider_version_branches_pinned: true,
+            dependency_source_details: source
+          )
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/github_actions/package/package_details_fetcher.rb

@@ -0,0 +1,237 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "cgi"
+require "json"
+require "nokogiri"
+require "sorbet-runtime"
+require "time"
+
+require "dependabot/errors"
+require "dependabot/github_actions/helpers"
+require "dependabot/github_actions/requirement"
+require "dependabot/github_actions/update_checker"
+require "dependabot/github_actions/version"
+require "dependabot/package/package_details"
+require "dependabot/package/package_release"
+require "dependabot/registry_client"
+require "dependabot/shared_helpers"
+
+module Dependabot
+  module GithubActions
+    module Package
+      class PackageDetailsFetcher
+        extend T::Sig
+
+        sig do
+          params(
+            dependency: Dependabot::Dependency,
+            credentials: T::Array[Dependabot::Credential],
+            ignored_versions: T::Array[String],
+            raise_on_ignored: T::Boolean,
+            security_advisories: T::Array[Dependabot::SecurityAdvisory]
+          ).void
+        end
+        def initialize(dependency:,
+                       credentials:,
+                       ignored_versions: [],
+                       raise_on_ignored: false,
+                       security_advisories: [])
+          @dependency = dependency
+          @credentials = credentials
+          @raise_on_ignored = raise_on_ignored
+          @ignored_versions = ignored_versions
+          @security_advisories = security_advisories
+
+          @git_helper = T.let(git_helper, Dependabot::GithubActions::Helpers::Githelper)
+        end
+
+        sig { returns(Dependabot::Dependency) }
+        attr_reader :dependency
+        sig { returns(T::Array[Dependabot::Credential]) }
+        attr_reader :credentials
+        sig { returns(T::Array[String]) }
+        attr_reader :ignored_versions
+        sig { returns(T::Boolean) }
+        attr_reader :raise_on_ignored
+        sig { returns(T::Array[Dependabot::SecurityAdvisory]) }
+        attr_reader :security_advisories
+
+        # rubocop:disable Metrics/PerceivedComplexity
+        sig { returns(T.nilable(T.any(Dependabot::Version, String))) }
+        def release_list_for_git_dependency
+          # TODO: Support Docker sources
+          return unless git_dependency?
+          return current_commit unless git_commit_checker.pinned?
+
+          # If the dependency is pinned to a tag that looks like a version then
+          # we want to update that tag.
+          if git_commit_checker.pinned_ref_looks_like_version? && latest_version_tag
+            latest_version = latest_version_tag&.fetch(:version)
+            return current_version if shortened_semver_eq?(dependency.version, latest_version.to_s)
+
+            return latest_version
+          end
+
+          if git_commit_checker.pinned_ref_looks_like_commit_sha? && latest_version_tag
+            latest_version = latest_version_tag&.fetch(:version)
+            return latest_commit_for_pinned_ref unless git_commit_checker.local_tag_for_pinned_sha
+
+            return latest_version
+          end
+
+          # If the dependency is pinned to a tag that doesn't look like a
+          # version or a commit SHA then there's nothing we can do.
+          nil
+        end
+        # rubocop:enable Metrics/PerceivedComplexity
+
+        sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+        def lowest_security_fix_version_tag
+          # TODO: Support Docker sources
+          return unless git_dependency?
+
+          @lowest_security_fix_version_tag ||= T.let(
+            begin
+              tags_matching_precision = git_commit_checker.local_tags_for_allowed_versions_matching_existing_precision
+              lowest_fixed_version = find_lowest_secure_version(tags_matching_precision)
+              if lowest_fixed_version
+                lowest_fixed_version
+              else
+                tags = git_commit_checker.local_tags_for_allowed_versions
+                find_lowest_secure_version(tags)
+              end
+            end,
+            T.nilable(T::Hash[Symbol, String])
+          )
+        end
+
+        sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+        def latest_version_tag
+          @latest_version_tag ||= T.let(
+            begin
+              return git_commit_checker.local_tag_for_latest_version if dependency.version.nil?
+
+              ref = git_commit_checker.local_ref_for_latest_version_matching_existing_precision
+              return ref if ref && ref.fetch(:version) > current_version
+
+              git_commit_checker.local_ref_for_latest_version_lower_precision
+            end,
+            T.nilable(T::Hash[Symbol, T.untyped])
+          )
+        end
+
+        private
+
+        sig { returns(Dependabot::GitCommitChecker) }
+        def git_commit_checker
+          @git_commit_checker ||= T.let(
+            @git_helper.git_commit_checker,
+            T.nilable(Dependabot::GitCommitChecker)
+          )
+        end
+
+        sig { returns(T.nilable(String)) }
+        def current_commit
+          git_commit_checker.head_commit_for_current_branch
+        end
+
+        sig { params(base: T.nilable(String), other: String).returns(T::Boolean) }
+        def shortened_semver_eq?(base, other)
+          return false unless base
+
+          base_split = base.split(".")
+          other_split = other.split(".")
+          return false unless base_split.length <= other_split.length
+
+          other_split[0..base_split.length - 1] == base_split
+        end
+
+        sig { returns(T.nilable(Dependabot::Version)) }
+        def current_version
+          @current_version ||= T.let(dependency.numeric_version, T.nilable(Dependabot::Version))
+        end
+
+        sig { returns(T.nilable(String)) }
+        def latest_commit_for_pinned_ref
+          @latest_commit_for_pinned_ref ||= T.let(
+            begin
+              head_commit_for_ref_sha = git_commit_checker.head_commit_for_pinned_ref
+              if head_commit_for_ref_sha
+                head_commit_for_ref_sha
+              else
+                url = git_commit_checker.dependency_source_details&.fetch(:url)
+                source = T.must(Source.from_url(url))
+
+                SharedHelpers.in_a_temporary_directory(File.dirname(source.repo)) do |temp_dir|
+                  repo_contents_path = File.join(temp_dir, File.basename(source.repo))
+
+                  SharedHelpers.run_shell_command("git clone --no-recurse-submodules #{url} #{repo_contents_path}")
+
+                  Dir.chdir(repo_contents_path) do
+                    ref_branch = find_container_branch(git_commit_checker.dependency_source_details&.fetch(:ref))
+                    git_commit_checker.head_commit_for_local_branch(ref_branch) if ref_branch
+                  end
+                end
+              end
+            end,
+            T.nilable(String)
+          )
+        end
+
+        sig { params(sha: String).returns(T.nilable(String)) }
+        def find_container_branch(sha)
+          branches_including_ref = SharedHelpers.run_shell_command(
+            "git branch --remotes --contains #{sha}",
+            fingerprint: "git branch --remotes --contains <sha>"
+          ).split("\n").map { |branch| branch.strip.gsub("origin/", "") }
+          return if branches_including_ref.empty?
+
+          current_branch = branches_including_ref.find { |branch| branch.start_with?("HEAD -> ") }
+
+          if current_branch
+            current_branch.delete_prefix("HEAD -> ")
+          elsif branches_including_ref.size > 1
+            # If there are multiple non default branches including the pinned SHA,
+            # then it's unclear how we should proceed
+            raise "Multiple ambiguous branches (#{branches_including_ref.join(', ')}) include #{sha}!"
+          else
+            branches_including_ref.first
+          end
+        end
+
+        sig do
+          params(tags: T::Array[T::Hash[Symbol, T.untyped]]).returns(T.nilable(T::Hash[Symbol, T.untyped]))
+        end
+        def find_lowest_secure_version(tags)
+          relevant_tags = Dependabot::UpdateCheckers::VersionFilters
+                          .filter_vulnerable_versions(tags, security_advisories)
+
+          relevant_tags = filter_lower_tags(relevant_tags)
+          relevant_tags.min_by { |tag| tag.fetch(:version) }
+        end
+
+        sig do
+          params(tags_array: T::Array[T::Hash[Symbol, T.untyped]]).returns(T::Array[T::Hash[Symbol, T.untyped]])
+        end
+        def filter_lower_tags(tags_array)
+          return tags_array unless current_version
+
+          tags_array.select { |tag| tag.fetch(:version) > current_version }
+        end
+
+        sig { returns(T::Boolean) }
+        def git_dependency?
+          git_commit_checker.git_dependency?
+        end
+
+        sig { returns(Dependabot::GithubActions::Helpers::Githelper) }
+        def git_helper
+          Helpers::Githelper.new(dependency: dependency, credentials: credentials,
+                                 ignored_versions: ignored_versions, raise_on_ignored: raise_on_ignored,
+                                 consider_version_branches_pinned: false, dependency_source_details: nil)
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/github_actions/update_checker/latest_version_finder.rb

@@ -0,0 +1,230 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "excon"
+require "sorbet-runtime"
+
+require "dependabot/errors"
+require "dependabot/github_actions/file_parser"
+require "dependabot/github_actions/package/package_details_fetcher"
+require "dependabot/github_actions/requirement"
+require "dependabot/github_actions/update_checker"
+require "dependabot/github_actions/helpers"
+require "dependabot/package/package_latest_version_finder"
+require "dependabot/shared_helpers"
+require "dependabot/update_checkers/version_filters"
+
+module Dependabot
+  module GithubActions
+    class UpdateChecker
+      class LatestVersionFinder < Dependabot::Package::PackageLatestVersionFinder
+        extend T::Sig
+
+        sig do
+          params(
+            dependency: Dependabot::Dependency,
+            dependency_files: T::Array[Dependabot::DependencyFile],
+            credentials: T::Array[Dependabot::Credential],
+            ignored_versions: T::Array[String],
+            security_advisories: T::Array[Dependabot::SecurityAdvisory],
+            raise_on_ignored: T::Boolean,
+            options: T::Hash[Symbol, T.untyped],
+            cooldown_options: T.nilable(Dependabot::Package::ReleaseCooldownOptions)
+          ).void
+        end
+        def initialize(
+          dependency:,
+          dependency_files:,
+          credentials:,
+          ignored_versions:,
+          security_advisories:,
+          raise_on_ignored:,
+          options: {},
+          cooldown_options: nil
+        )
+          @dependency          = dependency
+          @dependency_files    = dependency_files
+          @credentials         = credentials
+          @ignored_versions    = ignored_versions
+          @security_advisories = security_advisories
+          @raise_on_ignored    = raise_on_ignored
+          @options             = options
+          @cooldown_options = cooldown_options
+
+          @git_helper = T.let(git_helper, Dependabot::GithubActions::Helpers::Githelper)
+          super
+        end
+
+        sig { returns(Dependabot::Dependency) }
+        attr_reader :dependency
+        sig { returns(T::Array[Dependabot::Credential]) }
+        attr_reader :credentials
+        sig { returns(T.nilable(Dependabot::Package::ReleaseCooldownOptions)) }
+        attr_reader :cooldown_options
+        sig { returns(T::Array[String]) }
+        attr_reader :ignored_versions
+        sig { returns(T::Array[Dependabot::SecurityAdvisory]) }
+        attr_reader :security_advisories
+        sig { returns(T::Boolean) }
+        attr_reader :raise_on_ignored
+
+        sig { override.returns(T.nilable(Dependabot::Package::PackageDetails)) }
+        def package_details; end
+
+        sig { returns(T.nilable(T.any(Dependabot::Version, String))) }
+        def latest_release
+          release = available_release
+          return nil unless release
+
+          Dependabot.logger.info("Available release version/ref is #{release}")
+
+          release = cooldown_filter(release)
+          if release.nil?
+            Dependabot.logger.info("Returning current version/ref (no viable filtered release) #{current_version}")
+            return current_version
+          end
+
+          release
+        end
+
+        sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+        def lowest_security_fix_release
+          available_security_fix_releases
+        end
+
+        sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+        def latest_version_tag
+          available_latest_version_tag
+        end
+
+        private
+
+        sig { returns(T.nilable(Dependabot::GithubActions::Package::PackageDetailsFetcher)) }
+        def package_details_fetcher
+          @package_details_fetcher = T.let(Dependabot::GithubActions::Package::PackageDetailsFetcher
+            .new(
+              dependency: dependency,
+              credentials: credentials,
+              ignored_versions: ignored_versions,
+              raise_on_ignored: raise_on_ignored,
+              security_advisories: security_advisories
+            ), T.nilable(Dependabot::GithubActions::Package::PackageDetailsFetcher))
+        end
+
+        sig { returns(T.nilable(T.any(Dependabot::Version, String))) }
+        def available_release
+          @available_release = T.let(T.must(package_details_fetcher).release_list_for_git_dependency,
+                                     T.nilable(T.any(Dependabot::Version, String)))
+        end
+
+        sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+        def available_security_fix_releases
+          @available_security_fix_releases = T.let(T.must(package_details_fetcher).lowest_security_fix_version_tag,
+                                                   T.nilable(T::Hash[Symbol, T.untyped]))
+        end
+
+        sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+        def available_latest_version_tag
+          @latest_version_tag = T.let(T.must(package_details_fetcher).latest_version_tag,
+                                      T.nilable(T::Hash[Symbol, T.untyped]))
+        end
+
+        sig { override.returns(T::Boolean) }
+        def cooldown_enabled?
+          Dependabot::Experiments.enabled?(:enable_cooldown_for_github_actions)
+        end
+
+        sig do
+          params(release: T.nilable(T.any(Dependabot::Version, String)))
+            .returns(T.nilable(T.any(Dependabot::Version, String)))
+        end
+        def cooldown_filter(release)
+          return release unless cooldown_enabled?
+          return release unless cooldown_options
+
+          Dependabot.logger.info("Initializing cooldown filter")
+          release_date = commit_metadata_details
+
+          unless release_date
+            Dependabot.logger.info("No release date found, skipping cooldown filtering")
+            return release
+          end
+
+          if release_in_cooldown_period?(Time.parse(release_date))
+            Dependabot.logger.info("Filtered out (cooldown) #{dependency.name}, #{release}")
+            return nil
+          end
+
+          release
+        end
+
+        sig { returns(T.nilable(String)) }
+        def commit_metadata_details
+          @commit_metadata_details ||= T.let(
+            begin
+              url = @git_helper.git_commit_checker.dependency_source_details&.fetch(:url)
+              source = T.must(Source.from_url(url))
+
+              SharedHelpers.in_a_temporary_directory(File.dirname(source.repo)) do |temp_dir|
+                repo_contents_path = File.join(temp_dir, File.basename(source.repo))
+
+                SharedHelpers.run_shell_command("git clone --bare --no-recurse-submodules #{url} #{repo_contents_path}")
+                Dir.chdir(repo_contents_path) do
+                  date = SharedHelpers.run_shell_command("git show --no-patch --format=\"%cd\" " \
+                                                         "--date=iso #{commit_ref}")
+                  Dependabot.logger.info("Found release date : #{Time.parse(date)}")
+                  return date
+                end
+              end
+            rescue StandardError => e
+              Dependabot.logger.error("Error (github actions) while checking release date for #{dependency.name}")
+              Dependabot.logger.error(e.message)
+
+              nil
+            end,
+            T.nilable(String)
+          )
+        end
+
+        sig { params(release_date: Time).returns(T::Boolean) }
+        def release_in_cooldown_period?(release_date)
+          cooldown = @cooldown_options
+
+          return false unless T.must(cooldown).included?(dependency.name)
+
+          days = T.must(cooldown).default_days
+          passed_seconds = Time.now.to_i - release_date.to_i
+
+          Dependabot.logger.info("Days since release : #{passed_seconds / (3600 * 24)} " \
+                                 "(cooldown days #{T.must(cooldown_options).default_days})")
+
+          passed_seconds < days * DAY_IN_SECONDS
+        end
+
+        sig { returns(String) }
+        def commit_ref
+          latest_version_tag&.fetch(:commit_sha)
+        end
+
+        sig { returns(T.nilable(T.any(Dependabot::Version, String))) }
+        def current_version
+          return dependency.source_details(allowed_types: ["git"])&.fetch(:ref) if release_type_sha?
+
+          T.let(dependency.numeric_version, T.nilable(Dependabot::Version))
+        end
+
+        sig { returns(T::Boolean) }
+        def release_type_sha?
+          available_release.is_a?(String)
+        end
+
+        sig { returns(Dependabot::GithubActions::Helpers::Githelper) }
+        def git_helper
+          Helpers::Githelper.new(dependency: dependency, credentials: credentials,
+                                 ignored_versions: ignored_versions, raise_on_ignored: raise_on_ignored,
+                                 consider_version_branches_pinned: false, dependency_source_details: nil)
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/github_actions/update_checker.rb

@@ -16,10 +16,12 @@ module Dependabot
     class UpdateChecker < Dependabot::UpdateCheckers::Base
       extend T::Sig
 
+      require_relative "update_checker/latest_version_finder"
+
       sig { override.returns(T.nilable(T.any(String, Gem::Version))) }
       def latest_version
         @latest_version ||= T.let(
-          fetch_latest_version,
+          T.must(latest_version_finder).latest_release,
           T.nilable(T.any(String, Gem::Version))
         )
       end
@@ -36,20 +38,20 @@ module Dependabot
         dependency.version
       end
 
+      sig { override.returns(T.nilable(Dependabot::Version)) }
+      def lowest_resolvable_security_fix_version
+        # Resolvability isn't an issue for GitHub Actions.
+        lowest_security_fix_version
+      end
+
       sig { override.returns(T.nilable(Dependabot::Version)) }
       def lowest_security_fix_version
         @lowest_security_fix_version ||= T.let(
-          fetch_lowest_security_fix_version,
+          T.must(latest_version_finder).lowest_security_fix_release&.fetch(:version),
           T.nilable(Dependabot::Version)
         )
       end
 
-      sig { override.returns(T.nilable(Dependabot::Version)) }
-      def lowest_resolvable_security_fix_version
-        # Resolvability isn't an issue for GitHub Actions.
-        lowest_security_fix_version
-      end
-
       sig { override.returns(T::Array[T::Hash[Symbol, T.untyped]]) }
       def updated_requirements
         dependency.requirements.map do |req|
@@ -74,6 +76,21 @@ module Dependabot
 
       private
 
+      sig { returns(T.nilable(Dependabot::GithubActions::UpdateChecker::LatestVersionFinder)) }
+      def latest_version_finder
+        @latest_version_finder ||=
+          T.let(LatestVersionFinder.new(
+                  dependency: dependency,
+                  credentials: credentials,
+                  dependency_files: dependency_files,
+                  security_advisories: security_advisories,
+                  ignored_versions: ignored_versions,
+                  raise_on_ignored: raise_on_ignored,
+                  cooldown_options: update_cooldown
+                ),
+                T.nilable(Dependabot::GithubActions::UpdateChecker::LatestVersionFinder))
+      end
+
       sig { returns(T::Array[Dependabot::SecurityAdvisory]) }
       def active_advisories
         security_advisories.select do |advisory|
@@ -93,82 +110,6 @@ module Dependabot
         raise NotImplementedError
       end
 
-      sig { returns(T.nilable(T.any(Dependabot::Version, String))) }
-      def fetch_latest_version
-        # TODO: Support Docker sources
-        return unless git_dependency?
-
-        fetch_latest_version_for_git_dependency
-      end
-
-      sig { returns(T.nilable(T.any(Dependabot::Version, String))) }
-      def fetch_latest_version_for_git_dependency
-        return current_commit unless git_commit_checker.pinned?
-
-        # If the dependency is pinned to a tag that looks like a version then
-        # we want to update that tag.
-        if git_commit_checker.pinned_ref_looks_like_version? && latest_version_tag
-          latest_version = latest_version_tag&.fetch(:version)
-          return current_version if shortened_semver_eq?(dependency.version, latest_version.to_s)
-
-          return latest_version
-        end
-
-        if git_commit_checker.pinned_ref_looks_like_commit_sha? && latest_version_tag
-          latest_version = latest_version_tag&.fetch(:version)
-          return latest_commit_for_pinned_ref unless git_commit_checker.local_tag_for_pinned_sha
-
-          return latest_version
-        end
-
-        # If the dependency is pinned to a tag that doesn't look like a
-        # version or a commit SHA then there's nothing we can do.
-        nil
-      end
-
-      sig { returns(T.nilable(Dependabot::Version)) }
-      def fetch_lowest_security_fix_version
-        # TODO: Support Docker sources
-        return unless git_dependency?
-
-        fetch_lowest_security_fix_version_for_git_dependency
-      end
-
-      sig { returns(T.nilable(Dependabot::Version)) }
-      def fetch_lowest_security_fix_version_for_git_dependency
-        lowest_security_fix_version_tag&.fetch(:version)
-      end
-
-      sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
-      def lowest_security_fix_version_tag
-        @lowest_security_fix_version_tag ||= T.let(
-          begin
-            tags_matching_precision = git_commit_checker.local_tags_for_allowed_versions_matching_existing_precision
-            lowest_fixed_version = find_lowest_secure_version(tags_matching_precision)
-            if lowest_fixed_version
-              lowest_fixed_version
-            else
-              tags = git_commit_checker.local_tags_for_allowed_versions
-              find_lowest_secure_version(tags)
-            end
-          end,
-          T.nilable(T::Hash[Symbol, String])
-        )
-      end
-
-      sig do
-        params(
-          tags: T::Array[T::Hash[Symbol, T.untyped]]
-        )
-          .returns(T.nilable(T::Hash[Symbol, T.untyped]))
-      end
-      def find_lowest_secure_version(tags)
-        relevant_tags = Dependabot::UpdateCheckers::VersionFilters.filter_vulnerable_versions(tags, security_advisories)
-        relevant_tags = filter_lower_tags(relevant_tags)
-
-        relevant_tags.min_by { |tag| tag.fetch(:version) }
-      end
-
       sig { returns(T.nilable(String)) }
       def latest_commit_for_pinned_ref
         @latest_commit_for_pinned_ref ||= T.let(
@@ -196,49 +137,20 @@ module Dependabot
         )
       end
 
-      sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
-      def latest_version_tag
-        @latest_version_tag ||= T.let(
-          begin
-            return git_commit_checker.local_tag_for_latest_version if dependency.version.nil?
-
-            ref = git_commit_checker.local_ref_for_latest_version_matching_existing_precision
-            return ref if ref && ref.fetch(:version) > current_version
-
-            git_commit_checker.local_ref_for_latest_version_lower_precision
-          end,
-          T.nilable(T::Hash[Symbol, T.untyped])
-        )
-      end
-
-      sig do
-        params(
-          tags_array: T::Array[T::Hash[Symbol, T.untyped]]
-        )
-          .returns(T::Array[T::Hash[Symbol, T.untyped]])
-      end
-      def filter_lower_tags(tags_array)
-        return tags_array unless current_version
-
-        tags_array
-          .select { |tag| tag.fetch(:version) > current_version }
-      end
-
       sig { params(source: T.nilable(T::Hash[Symbol, String])).returns(T.nilable(String)) }
       def updated_ref(source)
         # TODO: Support Docker sources
-        return unless git_dependency?
+        return unless git_commit_checker.git_dependency?
 
-        if vulnerable? &&
-           (new_tag = lowest_security_fix_version_tag)
+        if vulnerable? && (new_tag = T.must(latest_version_finder).lowest_security_fix_release)
           return new_tag.fetch(:tag)
         end
 
-        source_git_commit_checker = git_commit_checker_for(source)
+        source_git_commit_checker = git_helper.git_commit_checker_for(source)
 
         # Return the git tag if updating a pinned version
         if source_git_commit_checker.pinned_ref_looks_like_version? &&
-           (new_tag = latest_version_tag)
+           (new_tag = T.must(latest_version_finder).latest_version_tag)
           return new_tag.fetch(:tag)
         end
 
@@ -254,7 +166,7 @@ module Dependabot
 
       sig { returns(T.nilable(String)) }
       def latest_commit_sha
-        new_tag = latest_version_tag
+        new_tag = T.must(latest_version_finder).latest_version_tag
         return unless new_tag
 
         if git_commit_checker.local_tag_for_pinned_sha
@@ -264,50 +176,16 @@ module Dependabot
         end
       end
 
-      sig { returns(T.nilable(String)) }
-      def current_commit
-        git_commit_checker.head_commit_for_current_branch
-      end
-
-      sig { returns(T::Boolean) }
-      def git_dependency?
-        git_commit_checker.git_dependency?
-      end
-
       sig { returns(Dependabot::GitCommitChecker) }
       def git_commit_checker
-        @git_commit_checker ||= T.let(
-          git_commit_checker_for(nil),
-          T.nilable(Dependabot::GitCommitChecker)
-        )
+        @git_commit_checker ||= T.let(git_helper.git_commit_checker, T.nilable(Dependabot::GitCommitChecker))
       end
 
-      sig { params(source: T.nilable(T::Hash[Symbol, String])).returns(Dependabot::GitCommitChecker) }
-      def git_commit_checker_for(source)
-        @git_commit_checkers ||= T.let(
-          {},
-          T.nilable(T::Hash[T.nilable(T::Hash[Symbol, String]), Dependabot::GitCommitChecker])
-        )
-
-        @git_commit_checkers[source] ||= Dependabot::GitCommitChecker.new(
-          dependency: dependency,
-          credentials: credentials,
-          ignored_versions: ignored_versions,
-          raise_on_ignored: raise_on_ignored,
-          consider_version_branches_pinned: true,
-          dependency_source_details: source
-        )
-      end
-
-      sig { params(base: T.nilable(String), other: String).returns(T::Boolean) }
-      def shortened_semver_eq?(base, other)
-        return false unless base
-
-        base_split = base.split(".")
-        other_split = other.split(".")
-        return false unless base_split.length <= other_split.length
-
-        other_split[0..base_split.length - 1] == base_split
+      sig { returns(Dependabot::GithubActions::Helpers::Githelper) }
+      def git_helper
+        Helpers::Githelper.new(dependency: dependency, credentials: credentials,
+                               ignored_versions: ignored_versions, raise_on_ignored: raise_on_ignored,
+                               consider_version_branches_pinned: false, dependency_source_details: nil)
       end
 
       sig { params(sha: String).returns(T.nilable(String)) }

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-github_actions
 version: !ruby/object:Gem::Version
-  version: 0.318.0
+  version: 0.319.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.318.0
+        version: 0.319.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.318.0
+        version: 0.319.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -246,17 +246,20 @@ files:
 - lib/dependabot/github_actions/file_fetcher.rb
 - lib/dependabot/github_actions/file_parser.rb
 - lib/dependabot/github_actions/file_updater.rb
+- lib/dependabot/github_actions/helpers.rb
 - lib/dependabot/github_actions/metadata_finder.rb
+- lib/dependabot/github_actions/package/package_details_fetcher.rb
 - lib/dependabot/github_actions/package_manager.rb
 - lib/dependabot/github_actions/requirement.rb
 - lib/dependabot/github_actions/update_checker.rb
+- lib/dependabot/github_actions/update_checker/latest_version_finder.rb
 - lib/dependabot/github_actions/version.rb
 homepage: https://github.com/dependabot/dependabot-core
 licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.318.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.319.0
 rdoc_options: []
 require_paths:
 - lib