dependabot-helm 0.402.0 → 0.403.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9b304ef01a7abd3e8b754af59a846e913e1ee5d88ceff9cecfa26f04dabb8be1
-  data.tar.gz: 0df2acdd54edb333ec859941bf965b910ae24dc31df8aa0425282ba126010f23
+  metadata.gz: a5253094d06486bd961a35fe66c8d1da5591c711be1e52a7d9d3af1433ed1d31
+  data.tar.gz: 0f3b05054523f8bb2bb122104e721b4be51b69bc856b683c81a4983d9531ed45
 SHA512:
-  metadata.gz: 20eeb495ab29fb49c19933bcc4f8f6f76f15ec5c03f76dadf33bac6ab4a115e110a9ea318c94cdfb18ca6e38725c26465dfcabc1b73270092a4e1a1144dcbb4b
-  data.tar.gz: 131cec5c4fdfdc225c1cab68fb5c9d370a126a255bb128e6b75a0eb50c74469b2294c2e99d2c7900bbdfb1687813c785168c8041403f3151153de7f7e5e082d1
+  metadata.gz: 0513cd80b1b5cd1f938ddad7831550c32729fed73dcaeff5ed67f0ed2c00538ad6a41fa1efcc02e29e1fa9020e99fcfc637adc6a4f8d01c43870e23d2ef586e5
+  data.tar.gz: ad99f9e80a7e785315e3dde4713b5399236fc43180fa39a904fdb7b6b8dc4baff733d3ae76c431fe12062389448ae336c208f0e05041e3accf62cad7c5536ec1

data/lib/dependabot/helm/update_checker.rb

@@ -505,9 +505,11 @@ module Dependabot
       def fetch_latest_image_version
         docker_dependency = build_docker_dependency
 
+        docker_cooldown = docker_cooldown_options
+
         Dependabot.logger.info("Delegating to Docker UpdateChecker for image: #{docker_dependency.name}")
 
-        docker_checker = if cooldown_enabled?
+        docker_checker = if docker_cooldown
                            Dependabot::UpdateCheckers.for_package_manager("docker").new(
                              dependency: docker_dependency,
                              dependency_files: dependency_files,
@@ -515,7 +517,7 @@ module Dependabot
                              ignored_versions: ignored_versions,
                              security_advisories: security_advisories,
                              raise_on_ignored: raise_on_ignored,
-                             update_cooldown: update_cooldown
+                             update_cooldown: docker_cooldown
                            )
                          else
                            Dependabot::UpdateCheckers.for_package_manager("docker").new(
@@ -534,7 +536,7 @@ module Dependabot
 
         return unless docker_checker.can_update?(requirements_to_unlock: :none)
 
-        version_class.new(latest_version)
+        ImageTag.new(latest_version)
       end
 
       sig { params(tags: T::Array[String], repo_url: String).returns(T::Array[GitTagWithDetail]) }
@@ -583,6 +585,9 @@ module Dependabot
         end
 
         registry = requirement.source_string("registry")
+        # The parser folds a detected registry into the name (e.g. "quay.io/org/app"), but the
+        # Docker checker builds the repository path from the name and the host from the registry.
+        name = name.delete_prefix("#{registry}/") if registry
 
         Dependency.new(
           name: name,
@@ -600,6 +605,21 @@ module Dependabot
         )
       end
 
+      # The Docker checker matches include/exclude against the shortened image name, so resolve
+      # them here against the original Helm dependency name and delegate a pattern-free cooldown.
+      sig { returns(T.nilable(Dependabot::Package::ReleaseCooldownOptions)) }
+      def docker_cooldown_options
+        cooldown = update_cooldown
+        return nil if cooldown.nil? || !cooldown_enabled? || !cooldown.included?(dependency.name)
+
+        Dependabot::Package::ReleaseCooldownOptions.new(
+          default_days: cooldown.default_days,
+          semver_major_days: cooldown.semver_major_days,
+          semver_minor_days: cooldown.semver_minor_days,
+          semver_patch_days: cooldown.semver_patch_days
+        )
+      end
+
       sig { returns(T::Boolean) }
       def cooldown_enabled?
         # This is a simple check to see if user has put cooldown days.

data/lib/dependabot/helm/version.rb

@@ -107,6 +107,23 @@ module Dependabot
         Dependabot::Version.new(valid ? group : 0)
       end
     end
+
+    # A Docker image tag. It compares like a Helm::Version, but is written back exactly as the
+    # registry publishes it, so "v1.5.0" and "1.2.3-alpine" keep their prefix and suffix.
+    class ImageTag < Version
+      extend T::Sig
+
+      sig { override.params(version: VersionParameter).void }
+      def initialize(version)
+        @tag = T.let(version.to_s, String)
+        super
+      end
+
+      sig { override.returns(T.nilable(String)) }
+      def to_s
+        @tag
+      end
+    end
   end
 end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-helm
 version: !ruby/object:Gem::Version
-  version: 0.402.0
+  version: 0.403.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,28 +15,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.402.0
+        version: 0.403.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.402.0
+        version: 0.403.0
 - !ruby/object:Gem::Dependency
   name: dependabot-docker
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.402.0
+        version: 0.403.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.402.0
+        version: 0.403.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -275,7 +275,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.402.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.403.0
 rdoc_options: []
 require_paths:
 - lib