dependabot-helm 0.310.0 → 0.311.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 46d34de989ab4d8315a05e165d2aa34693f40ad3fd03c21d40842e375e7a9d89
-  data.tar.gz: a134496cc57eb7f7ddf42a81529d94a89de236ea94738de017d4fc73039d2b88
+  metadata.gz: a4b54115834be1156fae985ea9407c7a02a6b5e96b7bfd781df3035452813cc1
+  data.tar.gz: 1c66887b733f1ba078ced605d360f5c8cb0eba32a06f095b74c1e2f4c015782f
 SHA512:
-  metadata.gz: a5c039462fbc357f23e3bcabb596b34e694d9d3f8ab75e6aceab1c734f46bbac6fd7d39d76ec9da37e21925bcacc0bf149a2f1f569579232b8d06e185ff5a778
-  data.tar.gz: 898d936f36e271c6719847f8bfca1274cc9b30d1509792776798ed88a8d87b898b8ea4c0ca96a1bff774be1a2d063d9e46bb8a32dcc19b25b8bf9fcb85449a99
+  metadata.gz: 33da54922f3c7bd7d9a86418deed00a9e189965f22495ddb4a1ee810f193e905268d8da0caf37a7ca2763a1014679c9af30a0d4bb7a2e605c7bb1485fce53ebc
+  data.tar.gz: cf6e8954811a5c63ac882995aca63c2f86b92e1d28c01a4fdddd20c93071755d23e5abfc35bbd333f9ac7cc797cc9162a41cbfad75c5362bbc5ba823c2970c4b

data/lib/dependabot/helm/helpers.rb

@@ -66,6 +66,31 @@ module Dependabot
         )
         raise
       end
+
+      sig { params(username: String, password: String, repository_url: String).returns(String) }
+      def self.oci_registry_login(username, password, repository_url)
+        Dependabot.logger.info("Logging into OCI registry \"#{repository_url}\"")
+
+        Dependabot::SharedHelpers.run_shell_command(
+          "oras login --username #{username} --password #{password} #{repository_url}",
+          fingerprint: "oras login --username <username> --password <password> <repository_url>"
+        )
+      rescue StandardError => e
+        Dependabot.logger.error(
+          "Failed to authenticate for #{repository_url}: #{e.message}"
+        )
+        raise
+      end
+
+      sig { params(name: String).returns(String) }
+      def self.fetch_oci_tags(name)
+        Dependabot.logger.info("Searching OCI tags for: #{name}")
+
+        Dependabot::SharedHelpers.run_shell_command(
+          "oras repo tags #{name}",
+          fingerprint: "oras repo tags <name>"
+        ).strip
+      end
     end
   end
 end

data/lib/dependabot/helm/package_manager.rb

@@ -3,7 +3,7 @@
 
 require "sorbet-runtime"
 require "dependabot/ecosystem"
-require "dependabot/docker/version"
+require "dependabot/helm/version"
 
 module Dependabot
   module Helm

data/lib/dependabot/helm/update_checker.rb

@@ -5,7 +5,7 @@ require "sorbet-runtime"
 require "dependabot/update_checkers"
 require "dependabot/update_checkers/base"
 require "dependabot/errors"
-require "dependabot/docker/version"
+require "dependabot/helm/version"
 require "dependabot/docker/requirement"
 require "dependabot/shared/utils/credentials_finder"
 require "dependabot/shared_helpers"
@@ -191,6 +191,19 @@ module Dependabot
         raise PrivateSourceAuthenticationFailure, repo_url
       end
 
+      sig { params(repo_url: T.nilable(String)).returns(T.nilable(String)) }
+      def authenticate_oci_registry_source(repo_url)
+        return unless repo_url
+
+        repo_creds = Shared::Utils::CredentialsFinder.new(@credentials, private_repository_type: "helm_registry")
+                                                     .credentials_for_registry(repo_url)
+        return unless repo_creds
+
+        Helpers.oci_registry_login(T.must(repo_creds["username"]), T.must(repo_creds["password"]), repo_url)
+      rescue StandardError
+        raise PrivateSourceAuthenticationFailure, repo_url
+      end
+
       sig { returns(T.nilable(Gem::Version)) }
       def fetch_latest_chart_version
         chart_name = dependency.name
@@ -201,9 +214,35 @@ module Dependabot
         releases = fetch_releases_with_helm_cli(chart_name, repo_name, repo_url)
         return releases if releases
 
+        tag = fetch_latest_oci_tag(chart_name, repo_url) if repo_url&.start_with?("oci://")
+        return tag if tag
+
         fetch_releases_from_index(chart_name, repo_url)
       end
 
+      sig { params(chart_name: String, repo_url: String).returns(T.nilable(Gem::Version)) }
+      def fetch_latest_oci_tag(chart_name, repo_url)
+        tags = fetch_oci_tags(chart_name, repo_url)
+        return nil unless tags && !tags.empty?
+
+        valid_tags = filter_valid_versions(tags)
+        return nil if valid_tags.empty?
+
+        highest_tag = valid_tags.map { |v| version_class.new(v) }.max
+        Dependabot.logger.info("Highest valid OCI tag for #{chart_name} is #{highest_tag}")
+        highest_tag
+      end
+
+      sig { params(chart_name: String, repo_url: String).returns(T.nilable(T::Array[String])) }
+      def fetch_oci_tags(chart_name, repo_url)
+        Dependabot.logger.info("Fetching OCI tags for #{repo_url}")
+        oci_registry = repo_url.gsub("oci://", "")
+        authenticate_oci_registry_source(repo_url)
+
+        release_tags = Helpers.fetch_oci_tags("#{oci_registry}/#{chart_name}").split("\n")
+        release_tags.map { |tag| tag.tr("_", "+") }
+      end
+
       sig { params(repo_url: T.nilable(String)).returns(T.nilable(String)) }
       def extract_repo_name(repo_url)
         return nil unless repo_url

data/lib/dependabot/helm/version.rb

@@ -0,0 +1,100 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "dependabot/version"
+require "dependabot/utils"
+require "dependabot/docker/tag"
+require "sorbet-runtime"
+
+module Dependabot
+  module Helm
+    # In the special case of Java, the version string may also contain
+    # optional "update number" and "identifier" components.
+    # See https://www.oracle.com/java/technologies/javase/versioning-naming.html
+    # for a description of Java versions.
+    #
+    class Version < Dependabot::Version
+      extend T::Sig
+      # The regex has limits for the 0,255 and 1,255 repetitions to avoid infinite limits which makes codeql angry.
+      # A docker image cannot be longer than 255 characters anyways.
+      HELM_VERSION_REGEX = /^(?<prefix>[a-z._\-]{0,255})[_\-v]?(?<version>[^+]{1,255})(\+(?<digest>.+))?$/
+
+      sig { override.params(version: VersionParameter).void }
+      def initialize(version)
+        parsed_version = version.to_s.match(HELM_VERSION_REGEX)
+        release_part, update_part = T.must(T.must(parsed_version)[:version]).split("_", 2)
+
+        # The numeric_version is needed here to validate the version string (ex: 20.9.0-alpine3.18)
+        # when the call is made via Dependabot Api to convert the image version to semver.
+        release_part = Dependabot::Docker::Tag.new(
+          T.must(release_part).chomp(".").chomp("-").chomp("_")
+        ).numeric_version
+
+        @digest = T.let(T.must(parsed_version)[:digest], T.nilable(String))
+        @release_part = T.let(Dependabot::Version.new(T.must(release_part).tr("-", ".")), Dependabot::Version)
+        @update_part = T.let(
+          Dependabot::Version.new(update_part&.start_with?(/[0-9]/) ? update_part : 0),
+          Dependabot::Version
+        )
+
+        super(@release_part)
+      end
+
+      sig { override.params(version: VersionParameter).returns(T::Boolean) }
+      def self.correct?(version)
+        return true if version.is_a?(Gem::Version)
+
+        # We can't call new here because Gem::Version calls self.correct? in its initialize method
+        # causing an infinite loop, so instead we check if the release_part of the version is correct
+        parsed_version = version.to_s.match(HELM_VERSION_REGEX)
+        return false if parsed_version.nil?
+
+        release_part, = T.must(parsed_version[:version]).split("_", 2)
+        release_part = Dependabot::Docker::Tag.new(
+          T.must(release_part).chomp(".").chomp("-").chomp("_")
+        ).numeric_version
+        return false unless release_part
+
+        super(release_part.to_s)
+      rescue ArgumentError
+        # if we can't instantiate a version, it can't be correct
+        false
+      end
+
+      sig { override.returns(String) }
+      def to_semver
+        @release_part.to_semver
+      end
+
+      sig { returns(T::Array[String]) }
+      def segments
+        @release_part.segments
+      end
+
+      sig { returns(T.nilable(String)) }
+      def to_s
+        return nil if @release_part.nil?
+
+        version_string = @release_part.to_s
+        version_string += "+#{@digest}" unless @digest.nil?
+        version_string
+      end
+
+      sig { returns(Dependabot::Version) }
+      attr_reader :release_part
+
+      sig { params(other: Dependabot::Helm::Version).returns(T.nilable(Integer)) }
+      def <=>(other)
+        sort_criteria <=> other.sort_criteria
+      end
+
+      sig { returns(T::Array[Dependabot::Version]) }
+      def sort_criteria
+        [@release_part, @update_part]
+      end
+    end
+  end
+end
+
+Dependabot::Utils
+  .register_version_class("helm", Dependabot::Helm::Version)

data/lib/dependabot/helm.rb

@@ -11,10 +11,12 @@ require "dependabot/helm/file_parser"
 require "dependabot/helm/file_updater"
 require "dependabot/helm/update_checker"
 
-Dependabot::Utils.register_version_class("helm", Dependabot::Docker::Version)
 Dependabot::Utils.register_requirement_class("helm", Dependabot::Docker::Requirement)
 Dependabot::MetadataFinders.register("helm", Dependabot::Docker::MetadataFinder)
 
+require "dependabot/helm/version"
+Dependabot::Utils.register_version_class("helm", Dependabot::Helm::Version)
+
 require "dependabot/pull_request_creator/labeler"
 Dependabot::PullRequestCreator::Labeler
   .register_label_details("helm", name: "helm", colour: "E5F2FC")

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-helm
 version: !ruby/object:Gem::Version
-  version: 0.310.0
+  version: 0.311.0
 platform: ruby
 authors:
 - Dependabot
 bindir: bin
 cert_chain: []
-date: 2025-04-24 00:00:00.000000000 Z
+date: 2025-05-01 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -15,28 +15,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.310.0
+        version: 0.311.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.310.0
+        version: 0.311.0
 - !ruby/object:Gem::Dependency
   name: dependabot-docker
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.310.0
+        version: 0.311.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.310.0
+        version: 0.311.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -237,16 +237,16 @@ dependencies:
   name: webrick
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.7'
+        version: '1.9'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.7'
+        version: '1.9'
 description: Dependabot-Helm provides support for bumping Helm image tags via Dependabot.
   If you want support for multiple package managers, you probably want the meta-gem
   dependabot-omnibus.
@@ -265,12 +265,13 @@ files:
 - lib/dependabot/helm/helpers.rb
 - lib/dependabot/helm/package_manager.rb
 - lib/dependabot/helm/update_checker.rb
+- lib/dependabot/helm/version.rb
 homepage: https://github.com/dependabot/dependabot-core
 licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.310.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.311.0
 rdoc_options: []
 require_paths:
 - lib