dependabot-github_actions 0.391.0 → 0.392.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8704994a565cd7f061c709f5a5ffae85264f537835a88fe992cee829dd56bae4
-  data.tar.gz: 6d7d0b3320cf3d64137ab662f3806aa415a2d05e2f5c16c36d09db1bc0b90545
+  metadata.gz: 6a530d98ee5deaf59ae4a5fae27332419200128915c4586da2be88280572b200
+  data.tar.gz: 1a0809f4f2a0c74c16ffe96834d05f89a27ade9e2da665e7548f52b5d842d044
 SHA512:
-  metadata.gz: e17b3f0d4c5a8b4715f91741cfa199ff1112ba092e64542f6d7aed56ebae3fe5d04c5cfc4f2752a9fe0febaca5192518288c3a18535122129aaa9c118de5e543
-  data.tar.gz: d0f90146d2d2f4e2c512892c834afefdf81a02da7e4d21b477a130264eead6a8f28e3d27f5f3cb2f20d97a36c031a37f0c153d93b4c245abc4674069b29530ce
+  metadata.gz: 1aced24aa66cc77c90d02bd74cf45daa7f06b471e1dd9c711ad1895a35d0ddc717d8448e37287b9306bbd0f6c0b6db761dfc88b930452b931311907a0537d641
+  data.tar.gz: 1d05ded519f6eedcef7d9dee3192b0fca26d47f8b9c0c83f5fe0848489741ff55be0c806f603f56e05a27e62fa54f0d38a3367685d12b4dad98a381fcc1be81a

data/lib/dependabot/github_actions/file_updater.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"
@@ -144,21 +144,21 @@ module Dependabot
         updated_requirement_pairs =
           dependency.requirements.zip(T.must(dependency.previous_requirements))
                     .reject do |new_req, old_req|
-            next true if new_req[:file] != file.name
+            next true if new_req.file != file.name
 
-            new_req[:source] == T.must(old_req)[:source]
+            new_req.source == T.must(old_req).source
           end
 
         updated_content = T.must(file.content)
 
         updated_requirement_pairs.each do |new_req, old_req|
           # TODO: Support updating Docker sources
-          next unless new_req.fetch(:source).fetch(:type) == "git"
+          next unless new_req.source_string("type") == "git"
 
-          old_ref = T.must(old_req).fetch(:source).fetch(:ref)
-          new_ref = new_req.fetch(:source).fetch(:ref)
+          old_ref = T.must(T.must(old_req).source_string("ref"))
+          new_ref = T.must(new_req.source_string("ref"))
 
-          old_declaration = T.must(old_req).fetch(:metadata).fetch(:declaration_string)
+          old_declaration = T.must(T.must(old_req).metadata_string("declaration_string"))
           new_declaration =
             old_declaration
             .gsub(/@.*+/, "@#{new_ref}")

data/lib/dependabot/github_actions/metadata_finder.rb

@@ -15,14 +15,9 @@ module Dependabot
 
       sig { override.returns(T.nilable(Dependabot::Source)) }
       def look_up_source
-        info = dependency.requirements.filter_map { |r| r[:source] }.first
-
-        url =
-          if info.nil?
-            "https://#{source_hostname}/#{dependency.name}"
-          else
-            info[:url] || info.fetch("url")
-          end
+        requirement = dependency.requirements.find(&:source_hash)
+        url = requirement&.source_string("url") ||
+              "https://#{source_hostname}/#{dependency.name}"
         Source.from_url(url)
       end
 

data/lib/dependabot/github_actions/update_checker.rb

@@ -65,24 +65,14 @@ module Dependabot
       sig { override.returns(T::Array[Dependabot::DependencyRequirement]) }
       def updated_requirements
         updated_reqs = dependency.requirements.map do |req|
-          source = T.cast(req.source, GitSource)
+          source = req.source_hash
           updated = updated_ref(source, onboarded: onboarded_requirement?(req))
           next req unless updated
 
-          current = source[:ref]
-
-          # Maintain a short git hash only if it matches the latest
-          if req[:type] == "git" &&
-             git_commit_checker.ref_looks_like_commit_sha?(updated) &&
-             git_commit_checker.ref_looks_like_commit_sha?(T.must(current)) &&
-             updated.start_with?(T.must(current))
-            next req
-          end
-
-          new_source = source.merge(ref: updated)
-          req.merge(source: new_source)
+          new_source = source_with_ref(T.must(source), updated)
+          Dependabot::DependencyRequirement.create(req.merge(source: new_source))
         end
-        wrap_requirements(updated_reqs)
+        updated_reqs
       end
 
       private
@@ -171,9 +161,7 @@ module Dependabot
         @git_metadata_fetcher ||= T.let(
           Dependabot::GitMetadataFetcher.new(
             url: T.must(
-              dependency.requirements.filter_map do |requirement|
-                T.cast(requirement.source, T.nilable(GitSource))&.fetch(:url, nil)
-              end.first
+              dependency.requirements.filter_map { |requirement| requirement.source_string("url") }.first
             ),
             credentials: credentials
           ),
@@ -248,20 +236,24 @@ module Dependabot
       end
 
       sig do
-        params(source: T.nilable(GitSource), onboarded: T::Boolean)
+        params(
+          source: T.nilable(Dependabot::DependencyRequirement::ObjectHash),
+          onboarded: T::Boolean
+        )
           .returns(T.nilable(String))
       end
       def updated_ref(source, onboarded: false)
         # TODO: Support Docker sources
         return unless git_commit_checker.git_dependency?
 
-        finder = onboarded ? latest_version_finder_for(source) : T.must(latest_version_finder)
+        git_source = source && symbolize_source(source)
+        finder = onboarded ? latest_version_finder_for(git_source) : T.must(latest_version_finder)
 
         if vulnerable? && (new_tag = finder.lowest_security_fix_release)
           return new_tag.fetch(:tag)
         end
 
-        source_git_commit_checker = git_helper.git_commit_checker_for(source)
+        source_git_commit_checker = git_helper.git_commit_checker_for(git_source)
 
         # Return the git tag if updating a pinned version
         if source_git_commit_checker.pinned_ref_looks_like_version? &&
@@ -279,6 +271,35 @@ module Dependabot
         nil
       end
 
+      sig do
+        params(source: Dependabot::DependencyRequirement::ObjectHash)
+          .returns(GitSource)
+      end
+      def symbolize_source(source)
+        T.cast(source.to_h { |key, value| [key.to_sym, value] }, GitSource)
+      end
+
+      sig do
+        params(
+          source: Dependabot::DependencyRequirement::ObjectHash,
+          ref: String
+        ).returns(Dependabot::DependencyRequirement::ObjectHash)
+      end
+      def source_with_ref(source, ref)
+        updated = source.dup
+        key = if source.key?(:ref)
+                :ref
+              elsif source.key?("ref")
+                "ref"
+              elsif source.keys.any?(Symbol)
+                :ref
+              else
+                "ref"
+              end
+        updated[key] = ref
+        updated
+      end
+
       sig do
         params(source_checker: Dependabot::GitCommitChecker, finder: LatestVersionFinder)
           .returns(T.nilable(String))

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-github_actions
 version: !ruby/object:Gem::Version
-  version: 0.391.0
+  version: 0.392.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.391.0
+        version: 0.392.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.391.0
+        version: 0.392.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -266,7 +266,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.391.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.392.0
 rdoc_options: []
 require_paths:
 - lib