dependabot-helm 0.305.0 → 0.306.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 127736c40071c20edbe562e11bae75d091983ebb0da885de91887f82b43db984
-  data.tar.gz: 4872484aa9c2a32b9b2d345314cad8459681e6aeb4a8877266b94ce5f0663ee1
+  metadata.gz: b17897702b31f74f2e0954212f3c769fef552a9f239feb707921ad3f442d4ca1
+  data.tar.gz: 5484142824705d124e6183178d7ddad3b28de2a931f10a661d16e9fd446dcfde
 SHA512:
-  metadata.gz: e65e50fc0cc8ad8e535317838e0dec248649fe5a2c3dca6e56090922e36cfcea9b74f7b64875819b3bb7180d53716e4f6f6f7edb2cc114f1376b694d41e86cdd
-  data.tar.gz: f812e2508962d829d26448ddb3efea0665844242e0b92416f883b4c64e56564bd494542e3c2dee77da1def0b102630f287a4a9d7bf0a22ded46591c18ae2a695
+  metadata.gz: b444719b58707f99bb0aae5a06d65366e11e07596145dac7ccd0b041dc5527ead4728bf2253f4c2f9a92a968f850e5162329598002271c7e94f966c093db859a
+  data.tar.gz: b4837b38e581ea418bff141ba33ee09d3f9a27d87adc82bf37403e0d4ee279de304e350f7ed929eaee489b34daf7454f30857e1521c7858bb3e95e5d81f53df5

data/lib/dependabot/helm/file_updater/image_updater.rb

@@ -92,20 +92,37 @@ module Dependabot
           return content unless key == "image" && value_node.is_a?(Psych::Nodes::Mapping)
 
           dependency_name = dependency.name
+          has_dependency = contains_dependency?(value_node, dependency_name)
+          return content unless has_dependency
+
           dependency_version = T.must(dependency.version)
-          dependency_requirements = dependency.requirements
+          update_version_tags(value_node, content, dependency_version)
+        end
 
-          has_dependency = value_node.children.any? { |n| n.value == dependency_name }
-          return content unless has_dependency
+        sig { params(node: Psych::Nodes::Node, dependency_name: String).returns(T::Boolean) }
+        def contains_dependency?(node, dependency_name)
+          node.children.any? do |child|
+            child.is_a?(Psych::Nodes::Scalar) && child.value == dependency_name
+          end
+        end
 
-          dependency_requirements.each do |req|
+        sig do
+          params(value_node: Psych::Nodes::Mapping, content: T::Array[String],
+                 dependency_version: String).returns(T::Array[String])
+        end
+        def update_version_tags(value_node, content, dependency_version)
+          dependency.requirements.each do |req|
             next unless req[:metadata][:type] == :docker_image
 
-            version_scalar = value_node.children.find { |n| n.value == req[:source][:tag] }
-            next unless version_scalar
+            tag_value = req[:source][:tag]
+            version_scalar = value_node.children.find do |node|
+              node.is_a?(Psych::Nodes::Scalar) && node.value == tag_value
+            end
 
-            line = version_scalar.start_line
-            content[line] = T.must(content[line]).gsub(req[:source][:tag], dependency_version)
+            if version_scalar
+              line = version_scalar.start_line
+              content[line] = T.must(content[line]).gsub(tag_value, dependency_version)
+            end
           end
 
           content

data/lib/dependabot/helm/update_checker.rb

@@ -107,8 +107,10 @@ module Dependabot
 
       sig { params(repo_url: String).returns(String) }
       def build_index_url(repo_url)
-        repo_url_trimmed = repo_url.to_s.strip.chomp("/")
-        "#{repo_url_trimmed}/index.yaml"
+        repo_url_trimmed = repo_url.strip.chomp("/")
+        normalized_repo_url = repo_url_trimmed.gsub("oci://", "https://")
+
+        "#{normalized_repo_url}/index.yaml"
       end
 
       sig { override.returns(T::Boolean) }
@@ -180,7 +182,7 @@ module Dependabot
       def authenticate_registry_source(repo_url)
         return unless repo_url
 
-        repo_creds = Shared::Utils::CredentialsFinder.new(@credentials, private_repository_type: "helm_repository")
+        repo_creds = Shared::Utils::CredentialsFinder.new(@credentials, private_repository_type: "helm_registry")
                                                      .credentials_for_registry(repo_url)
         return unless repo_creds
 
@@ -225,8 +227,13 @@ module Dependabot
         )
 
         Dependabot.logger.info("Received response from #{index_url} with status #{response.status}")
+        parsed_result = YAML.safe_load(response.body)
+
+        unless parsed_result.is_a?(Hash)
+          raise Dependabot::DependencyFileNotParseable, "Expected YAML to parse into a Hash, got String instead"
+        end
 
-        YAML.safe_load(response.body)
+        parsed_result
       rescue Excon::Error => e
         Dependabot.logger.error("Error fetching Helm index from #{index_url}: #{e.message}")
         nil
@@ -262,6 +269,8 @@ module Dependabot
 
         Dependabot.logger.info("Docker UpdateChecker found latest version: #{latest_version || 'none'}")
 
+        return unless docker_checker.can_update?(requirements_to_unlock: :none)
+
         version_class.new(latest_version)
       end
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-helm
 version: !ruby/object:Gem::Version
-  version: 0.305.0
+  version: 0.306.0
 platform: ruby
 authors:
 - Dependabot
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-04-06 00:00:00.000000000 Z
+date: 2025-04-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,28 +16,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.305.0
+        version: 0.306.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.305.0
+        version: 0.306.0
 - !ruby/object:Gem::Dependency
   name: dependabot-docker
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.305.0
+        version: 0.306.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.305.0
+        version: 0.306.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -271,7 +271,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.305.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.306.0
 post_install_message:
 rdoc_options: []
 require_paths: