dependabot-github_actions 0.390.0 → 0.391.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 915f664971e3665b0f6ee89557dc064b19fac2a49600250d2762a286fca20da7
-  data.tar.gz: a02dc5897d62ee777fac539862d8e0cd728695d43f31ad531e1dc8c5a65db287
+  metadata.gz: 8704994a565cd7f061c709f5a5ffae85264f537835a88fe992cee829dd56bae4
+  data.tar.gz: 6d7d0b3320cf3d64137ab662f3806aa415a2d05e2f5c16c36d09db1bc0b90545
 SHA512:
-  metadata.gz: b1d0fe90498dbae54af7ee1105a98c20a56128633d1ab72e11530e890726130f009fb581d616bda816985aa39a6dd1f7605ca94999e10e05a468d8f1ffecf752
-  data.tar.gz: 76a7272475cb1ffcf7964f74f08ac3cfa80efe4612932f8d520b456c3fead93bfa195770420e494d7e1265b2bf0d2237e6b85e9143ed52bf02d52ed985db5ecb
+  metadata.gz: e17b3f0d4c5a8b4715f91741cfa199ff1112ba092e64542f6d7aed56ebae3fe5d04c5cfc4f2752a9fe0febaca5192518288c3a18535122129aaa9c118de5e543
+  data.tar.gz: d0f90146d2d2f4e2c512892c834afefdf81a02da7e4d21b477a130264eead6a8f28e3d27f5f3cb2f20d97a36c031a37f0c153d93b4c245abc4674069b29530ce

data/lib/dependabot/github_actions/constants.rb

@@ -4,47 +4,44 @@
 module Dependabot
   module GithubActions
     # Reference to the GitHub.com domain
-    GITHUB_COM = T.let("github.com", String)
+    GITHUB_COM = "github.com"
 
     # Regular expression to match a GitHub repository reference
-    GITHUB_REPO_REFERENCE = T.let(
-      %r{
+    GITHUB_REPO_REFERENCE = %r{
             ^(?<owner>[\w.-]+)/
             (?<repo>[\w.-]+)
             (?<path>/[^\@]+)?
             @(?<ref>.+)
-          }x,
-      Regexp
-    )
+          }x
 
     # The ecosystem name for GitHub Actions
-    ECOSYSTEM = T.let("github_actions", String)
+    ECOSYSTEM = "github_actions"
 
     # The pattern to match manifest files
     MANIFEST_FILE_PATTERN = /\.ya?ml$/
     # The name of the manifest file
-    MANIFEST_FILE_YML = T.let("action.yml", String)
+    MANIFEST_FILE_YML = "action.yml"
     # The name of the manifest file
-    MANIFEST_FILE_YAML = T.let("action.yaml", String)
+    MANIFEST_FILE_YAML = "action.yaml"
     # The pattern to match any .yml or .yaml file
-    ANYTHING_YML = T.let("<anything>.yml", String)
+    ANYTHING_YML = "<anything>.yml"
     # The path to the workflow directory
-    WORKFLOW_DIRECTORY = T.let(".github/workflows", String)
+    WORKFLOW_DIRECTORY = ".github/workflows"
     # The path to the config .yml file
     CONFIG_YMLS = T.let("#{WORKFLOW_DIRECTORY}/#{ANYTHING_YML}".freeze, String)
 
     # The basename of the per-repo Actions lockfile generated by gh-actions-lock
-    LOCKFILE_NAME = T.let("actions.lock", String)
+    LOCKFILE_NAME = "actions.lock"
     # The repo-relative path to the Actions lockfile
     LOCKFILE_PATH = T.let("#{WORKFLOW_DIRECTORY}/#{LOCKFILE_NAME}".freeze, String)
     # The only lockfile schema version this ecosystem understands.
-    SUPPORTED_LOCKFILE_VERSION = T.let("v0.0.2", String)
+    SUPPORTED_LOCKFILE_VERSION = "v0.0.2"
 
-    OWNER_KEY = T.let("owner", String)
-    REPO_KEY = T.let("repo", String)
-    PATH_KEY = T.let("path", String)
-    REF_KEY = T.let("ref", String)
-    USES_KEY = T.let("uses", String)
-    STEPS_KEY = T.let("steps", String)
+    OWNER_KEY = "owner"
+    REPO_KEY = "repo"
+    PATH_KEY = "path"
+    REF_KEY = "ref"
+    USES_KEY = "uses"
+    STEPS_KEY = "steps"
   end
 end

data/lib/dependabot/github_actions/containing_branch_finder.rb

@@ -12,10 +12,7 @@ module Dependabot
 
       # A missing commit has no containing branch, so callers can handle it like
       # an empty branch lookup without masking unrelated subprocess failures.
-      COMMIT_NOT_FOUND_REGEX = T.let(
-        /no such commit|malformed object name|bad object|not a valid object name/i,
-        Regexp
-      )
+      COMMIT_NOT_FOUND_REGEX = /no such commit|malformed object name|bad object|not a valid object name/i
 
       sig { params(sha: String).returns(T.nilable(String)) }
       def self.find(sha)

data/lib/dependabot/github_actions/lockfile/cli_engine.rb

@@ -24,8 +24,8 @@ module Dependabot
         extend T::Sig
 
         JsonObject = T.type_alias { T::Hash[String, Object] }
-        FIXED_FINDING_CATEGORIES = T.let(%w(onboarding-required ref-changed stale).freeze, T::Array[String])
-        UNRESOLVABLE_CATEGORIES = T.let(%w(impostor-commit lockfile-forgery).freeze, T::Array[String])
+        FIXED_FINDING_CATEGORIES = %w(onboarding-required ref-changed stale).freeze
+        UNRESOLVABLE_CATEGORIES = %w(impostor-commit lockfile-forgery).freeze
 
         sig { params(credentials: T::Array[Dependabot::Credential]).void }
         def initialize(credentials)

data/lib/dependabot/github_actions/lockfile/env.rb

@@ -17,7 +17,7 @@ module Dependabot
 
         # Placeholder satisfies go-gh's "token must be present" check in hosted mode
         # where the proxy supplies real auth. Mirrors git's installation-token username.
-        DUMMY_TOKEN = T.let("x-access-token", String)
+        DUMMY_TOKEN = "x-access-token"
 
         sig do
           params(credentials: T::Array[Dependabot::Credential])

data/lib/dependabot/github_actions/lockfile/reader.rb

@@ -21,16 +21,16 @@ module Dependabot
         ParsedObject = T.type_alias { T::Hash[String, Object] }
 
         # Every commit must carry an explicit hash-algorithm prefix.
-        ALGO_PREFIXES = T.let(%w(sha1- sha256-).freeze, T::Array[String])
+        ALGO_PREFIXES = %w(sha1- sha256-).freeze
 
         # Keys gh-actions-lock requires on every `dependencies` entry. A missing key
         # makes the engine silently discard the whole lockfile in memory and report
         # every workflow as un-onboarded.
-        REQUIRED_DEPENDENCY_KEYS = T.let(%w(ref commit owner_id repo_id).freeze, T::Array[String])
+        REQUIRED_DEPENDENCY_KEYS = %w(ref commit owner_id repo_id).freeze
 
         sig { params(content: String).void }
         def initialize(content)
-          @content = T.let(content, String)
+          @content = content
           @data = T.let(parse, ParsedObject)
         end
 

data/lib/dependabot/github_actions/package_manager.rb

@@ -13,10 +13,10 @@ module Dependabot
       extend T::Sig
 
       # The package manager name for GitHub Actions
-      NAME = T.let("github_actions", String)
+      NAME = "github_actions"
 
       # The version of the package manager
-      VERSION = T.let("1.0.0", String)
+      VERSION = "1.0.0"
 
       sig { void }
       def initialize

data/lib/dependabot/github_actions/update_checker/latest_version_finder.rb

@@ -131,9 +131,7 @@ module Dependabot
                 if latest_tag&.fetch(:version) == selected_release
                   latest_tag
                 else
-                  T.must(package_details_fetcher)
-                   .allowed_version_tags_with_release_dates
-                   .find { |tag_hash| tag_hash.fetch(:version) == selected_release }
+                  tag_for_version(selected_release)
                 end
               end
             end,
@@ -224,14 +222,23 @@ module Dependabot
           tags_in_cooldown = Set.new(select_version_tags_in_cooldown_period(allowed_versions_with_dates))
           return release if tags_in_cooldown.empty?
 
-          # Walk through all allowed version tags in descending order (newest first)
+          # Only consider tags with the same precision as the pinned ref, so a `v1` style
+          # pin falls back to another major-only tag rather than being rewritten to a fully
+          # qualified version such as `v1.5.5`.
+          candidates = tags_matching_pinned_precision(allowed_versions_with_dates)
+
+          # Walk through the candidate version tags in descending order (newest first)
           # and return the first one NOT in cooldown
-          allowed_versions_with_dates.each do |tag_info|
+          candidates.each do |tag_info|
             tag_name = tag_info.fetch(:tag)
             next if tags_in_cooldown.include?(tag_name)
 
-            # Found a version not in cooldown, return it
             version = tag_info.fetch(:version)
+            # Candidates are sorted descending, so once we drop below the pinned version
+            # every remaining candidate would be a downgrade.
+            break if pinned_version && version < pinned_version
+
+            # Found a version not in cooldown, return it
             Dependabot.logger.info("Found acceptable version outside cooldown: #{version}")
             return version
           end
@@ -241,6 +248,46 @@ module Dependabot
           nil
         end
 
+        # Tags whose version has the same number of segments as the currently pinned
+        # version. Returns every tag when the pin isn't a version we can reason about
+        # (e.g. a commit SHA), since precision has no meaning in that case.
+        sig do
+          params(tags: T::Array[T::Hash[Symbol, T.untyped]])
+            .returns(T::Array[T::Hash[Symbol, T.untyped]])
+        end
+        def tags_matching_pinned_precision(tags)
+          pinned = pinned_version
+          return tags unless pinned
+
+          pinned_precision = precision(pinned.to_s)
+          tags.select { |tag_info| precision(tag_info.fetch(:version).to_s) == pinned_precision }
+        end
+
+        # Resolves a version back to its tag. Versions compare equal across precisions
+        # (`2` == `2.0.0`), so tags matching the pinned precision are preferred to avoid
+        # rewriting e.g. a `v2` pin to `v2.0.0`.
+        sig { params(version: Dependabot::Version).returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+        def tag_for_version(version)
+          all_tags = T.must(package_details_fetcher).allowed_version_tags_with_release_dates
+          matching_precision = tags_matching_pinned_precision(all_tags)
+
+          matching_precision.find { |tag_hash| tag_hash.fetch(:version) == version } ||
+            all_tags.find { |tag_hash| tag_hash.fetch(:version) == version }
+        end
+
+        sig { returns(T.nilable(Dependabot::Version)) }
+        def pinned_version
+          version = dependency.version
+          return nil unless version && Dependabot::GithubActions::Version.correct?(version)
+
+          Dependabot::GithubActions::Version.new(version)
+        end
+
+        sig { params(version: String).returns(Integer) }
+        def precision(version)
+          version.split(".").length
+        end
+
         sig do
           params(
             tags_with_dates: T.nilable(

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-github_actions
 version: !ruby/object:Gem::Version
-  version: 0.390.0
+  version: 0.391.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.390.0
+        version: 0.391.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.390.0
+        version: 0.391.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -266,7 +266,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.390.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.391.0
 rdoc_options: []
 require_paths:
 - lib