dependabot-github_actions 0.382.0 → 0.383.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 120830b78ffa858b5e8a74c05f6a3c01be7df7242b58a9e184b570761a7d9508
-  data.tar.gz: '08b5a3ecf297a3a5d318968348f228261e19a4aa1e0a0c50b6f97a7872f862b3'
+  metadata.gz: ef63b9b1d1fee089d9c18503e26ff40fa37182bc5df7d1a519d93e3a113a6191
+  data.tar.gz: 7be6b96adaf0975d097e5c36d6cd1f22d4a6c9108d239669225159c99a3c3e67
 SHA512:
-  metadata.gz: 4579be95addd9c05d41bce7b8eb64ef121005f67b2665536ec24e7ed85df6385e4ad307998b41afabcf57174f02bc01c224b0d320475072c40cf4c0f75409463
-  data.tar.gz: f0f29d0c84437e285fa6a529a0a76e5e6819a7517f4f31b02eb551ede4d53b3b6899378542aca1daf1a201c55aa785ef802df29a8099b7f89c650861faa1948e
+  metadata.gz: 7ddf2f146e672a2771bccd5b4c60584a827694aed4c3ab173bb5a1246c2a6a71376440838274672d89704267d9125091df1af629d0cff2c2656fbb04622c8d57
+  data.tar.gz: 3a52e9c3ea4172bff66eb7eec0184eec44e37f610fe196be7a32a6860ae9ad5b3f6e1b159828ab7f9e535309a62b034e9e67dadf5ba6a15a7dc8660228c7989f

data/lib/dependabot/github_actions/update_checker/latest_version_finder.rb

@@ -3,7 +3,9 @@
 
 require "sorbet-runtime"
 
+require "dependabot/clients/github_with_retries"
 require "dependabot/errors"
+require "dependabot/git_cooldown_date_resolver"
 require "dependabot/github_actions/file_parser"
 require "dependabot/github_actions/package/package_details_fetcher"
 require "dependabot/github_actions/requirement"
@@ -19,6 +21,7 @@ module Dependabot
     class UpdateChecker
       class LatestVersionFinder < Dependabot::Package::PackageLatestVersionFinder
         extend T::Sig
+        include Dependabot::GitCooldownDateResolver
 
         sig do
           params(
@@ -126,6 +129,16 @@ module Dependabot
           )
         end
 
+        sig { override.returns(T.nilable(String)) }
+        def cooldown_source_url
+          @git_helper.git_commit_checker.dependency_source_details&.fetch(:url)
+        end
+
+        sig { override.returns(T::Array[Dependabot::Credential]) }
+        def cooldown_credentials
+          @credentials
+        end
+
         private
 
         sig { returns(T.nilable(Dependabot::GithubActions::Package::PackageDetailsFetcher)) }
@@ -235,36 +248,70 @@ module Dependabot
           []
         end
 
+        # Returns the release date for the latest version tag.
+        # Priority: GitHub Release published_at > tag creation date > commit date.
+        # This ensures re-tagged or republished releases are evaluated based on
+        # when they were actually made available.
         sig { returns(T.nilable(String)) }
         def commit_metadata_details
           @commit_metadata_details ||= T.let(
-            begin
-              url = @git_helper.git_commit_checker.dependency_source_details&.fetch(:url)
-              source = T.must(Source.from_url(url))
-
-              SharedHelpers.in_a_temporary_directory(File.dirname(source.repo)) do |temp_dir|
-                repo_contents_path = File.join(temp_dir, File.basename(source.repo))
-
-                SharedHelpers.run_shell_command("git clone --bare --no-recurse-submodules #{url} #{repo_contents_path}")
-                Dir.chdir(repo_contents_path) do
-                  date = SharedHelpers.run_shell_command(
-                    "git show --no-patch --format=\"%cd\" " \
-                    "--date=iso #{commit_ref}"
-                  )
-                  Dependabot.logger.info("Found release date : #{Time.parse(date)}")
-                  return date
-                end
-              end
-            rescue StandardError => e
-              msg = "Error (github actions) while checking release date for #{dependency.name}: #{e.message}"
-              Dependabot.logger.warn(msg)
-
-              nil
-            end,
+            resolve_commit_metadata_details,
             T.nilable(String)
           )
         end
 
+        sig { returns(T.nilable(String)) }
+        def resolve_commit_metadata_details
+          # First, try GitHub Release published_at via Octokit
+          tag_name = latest_version_tag&.fetch(:tag, nil)
+          normalized_tag = tag_name ? normalize_tag_name(tag_name) : nil
+          if normalized_tag
+            release_date = github_release_published_at(normalized_tag)
+            if release_date
+              Dependabot.logger.info("Found release date from GitHub Release: #{release_date}")
+              return release_date.iso8601
+            end
+          end
+
+          # Fallback to git-based date detection
+          fetch_date_from_git(normalized_tag)
+        rescue StandardError => e
+          msg = "Error (github actions) while checking release date for #{dependency.name}: #{e.message}"
+          Dependabot.logger.warn(msg)
+          nil
+        end
+
+        sig { params(tag_name: T.nilable(String)).returns(T.nilable(String)) }
+        def fetch_date_from_git(tag_name)
+          url = cooldown_source_url
+          source = T.must(Source.from_url(url))
+
+          SharedHelpers.in_a_temporary_directory(File.dirname(source.repo)) do |temp_dir|
+            repo_contents_path = File.join(temp_dir, File.basename(source.repo))
+
+            SharedHelpers.run_shell_command("git clone --bare --no-recurse-submodules #{url} #{repo_contents_path}")
+            Dir.chdir(repo_contents_path) do
+              date = if tag_name
+                       tag_date = SharedHelpers.run_shell_command(
+                         "git for-each-ref --format=\"%(creatordate:iso)\" " \
+                         "\"refs/tags/#{tag_name}\"",
+                         fingerprint: "git for-each-ref --format=\"%(creatordate:iso)\" \"refs/tags/<tag_name>\""
+                       ).strip
+                       tag_date.empty? ? nil : tag_date
+                     end
+
+              date ||= SharedHelpers.run_shell_command(
+                "git show --no-patch --format=\"%cd\" " \
+                "--date=iso #{commit_ref}",
+                fingerprint: "git show --no-patch --format=\"%cd\" --date=iso <commit_ref>"
+              ).strip
+
+              Dependabot.logger.info("Found release date : #{Time.parse(date)}")
+              date
+            end
+          end
+        end
+
         sig { params(release_date: T.nilable(String)).returns(T::Boolean) }
         def check_if_version_in_cooldown_period?(release_date)
           return false unless release_date&.length&.positive?

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-github_actions
 version: !ruby/object:Gem::Version
-  version: 0.382.0
+  version: 0.383.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.382.0
+        version: 0.383.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.382.0
+        version: 0.383.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -259,7 +259,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.382.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.383.0
 rdoc_options: []
 require_paths:
 - lib