dependabot-helm 0.392.0 → 0.393.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 55ca433812d4c1582f706b9bb3800d8b4830d0c572d9a33e66e5920ff1766348
-  data.tar.gz: d4d043b94710e2dec098208e7d71d4cb0f5f02ece40a1a6e9ac2bf32d6432348
+  metadata.gz: 227be55b7636199d6e62c5e85b9b912d638aa975eb05b3e9e0f37b7c2b95c1a8
+  data.tar.gz: 691a554513a02c25655ab9e9694ba3708460d6372a02b563778d6bb6ebd2c38a
 SHA512:
-  metadata.gz: 5ed94d0bb17927edc3b66fcc2d16530df5fdaa006a959cadd1c20a2ffe53d1499156f30fc5bc0d44b9250362b6fc101a0cc07a3beada6fd646baf7d2d0386841
-  data.tar.gz: b913d6f21bc0ee3007bd276f7682683a7c59f9733f75786979d8877681ca33eb33f6e4ee8c511cc58917b15855ada43030d2b1aa6d8e504b9b8cfe678164569e
+  metadata.gz: 597be1cd5fda7853747cbfbc0ccaae9b5dda58d758cc59bd08e218d3c322eb1d7e5cbcc04fbe5138efca921588100d1410ea19c008bd3b5cb8f3dd160dc01633
+  data.tar.gz: b547fa89d94cef82b49555f6698b14831a06a8ccd87eacdf5cbdcf20705483021537c10810591f624c264f01851006844d90ffbb71cd0899c0ec2c650751a8d9

data/lib/dependabot/helm/file_fetcher.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "dependabot/shared/shared_file_fetcher"
@@ -41,7 +41,7 @@ module Dependabot
         @chart_locks ||=
           T.let(
             repo_contents(raise_errors: false)
-                      .select { |f| f.type == "file" && f.name.casecmp(CHART_LOCK_FILENAME).zero? }
+                      .select { |f| f.type == "file" && T.must(f.name.casecmp(CHART_LOCK_FILENAME)).zero? }
                       .map { |f| fetch_file_from_host(f.name) },
             T.nilable(T::Array[DependencyFile])
           )

data/lib/dependabot/helm/requirement.rb

@@ -16,9 +16,12 @@ module Dependabot
     # docker-image path.
     #
     # NOTE: this class is intentionally NOT registered as the requirement class
-    # for "helm" (that remains Docker::Requirement, used by the docker-image
-    # path and ignore conditions). It is used explicitly by the range-preserving
-    # requirements updater.
+    # for "helm" (that remains Docker::Requirement, used by the docker-image path
+    # and by Base, which compares against requirement_class.new(">= 0")). It is
+    # used explicitly by the range-preserving requirements updater, and by
+    # UpdateChecker#helm_ignore_requirements when filtering candidates, since
+    # Docker::Requirement#satisfied_by? is typed for Docker::Version and raises
+    # on a Helm::Version.
     class Requirement < Dependabot::Requirement
       extend T::Sig
 

data/lib/dependabot/helm/update_checker.rb

@@ -235,16 +235,57 @@ module Dependabot
 
       sig { params(releases: T::Array[T::Hash[String, Object]]).returns(T::Array[T::Hash[String, Object]]) }
       def filter_valid_releases(releases)
-        releases.reject do |release|
+        # Compare against current_version (the anchored floor) rather than
+        # dependency.version: for a range constraint (">=1.0.0 <2.0.0") the raw
+        # version string isn't a single parseable version.
+        newer = releases.reject do |release|
+          version_class.new(T.cast(release["version"], String)) <= current_version
+        end
+        filtered = newer.reject do |release|
           release_version = version_class.new(T.cast(release["version"], String))
-          # Compare against current_version (the anchored floor) rather than
-          # dependency.version: for a range constraint (">=1.0.0 <2.0.0") the raw
-          # version string isn't a single parseable version.
-          release_version <= current_version ||
-            ignore_requirements.any? do |r|
-              r.instance_of?(Dependabot::Requirement) && r.satisfied_by?(release_version)
-            end
+          helm_ignore_requirements.any? { |r| r.satisfied_by?(release_version) }
         end
+
+        record_ignore_outcome(newer: newer.any?, surviving: filtered.any?)
+        filtered
+      end
+
+      # Ignore conditions have to be parsed by Helm::Requirement here, not by the
+      # requirement class registered for helm: that is Docker::Requirement, whose
+      # #satisfied_by? is typed for Docker::Version and raises on the
+      # Helm::Version candidates below.
+      #
+      # This deliberately does not override the public #ignore_requirements.
+      # Base#can_update? compares that list against
+      # requirement_class.new(">= 0"), and a Helm::Requirement there puts a
+      # Helm::Version up against a plain Gem::Version, which Helm::Version#<=>'s
+      # sig rejects. So the registered class keeps serving Base, and only the
+      # filtering below uses the Helm parser.
+      sig { returns(T::Array[Dependabot::Requirement]) }
+      def helm_ignore_requirements
+        @helm_ignore_requirements ||= T.let(
+          ignored_versions.flat_map { |req| Helm::Requirement.requirements_array(req) },
+          T.nilable(T::Array[Dependabot::Requirement])
+        )
+      end
+
+      # The updater needs AllVersionsIgnored to tell "everything newer was
+      # ignored" from "nothing newer exists", but the decision cannot be made
+      # in the filters: a source that filters everything out returns nil so the
+      # next source gets a turn, and its list may well contain a version this
+      # one never saw. So each source only records what it saw, and
+      # fetch_latest_chart_version raises once the sources are exhausted.
+      sig { params(newer: T::Boolean, surviving: T::Boolean).void }
+      def record_ignore_outcome(newer:, surviving:)
+        @all_newer_ignored = T.let(
+          (@all_newer_ignored || false) || (newer && !surviving),
+          T.nilable(T::Boolean)
+        )
+      end
+
+      sig { returns(T::Boolean) }
+      def all_newer_ignored?
+        @all_newer_ignored == true
       end
 
       sig { params(repo_url: String).returns(String) }
@@ -360,7 +401,15 @@ module Dependabot
         tag = fetch_latest_oci_tag(chart_name, repo_url) if repo_url&.start_with?("oci://")
         return tag if tag
 
-        fetch_releases_from_index(chart_name, repo_url)
+        from_index = fetch_releases_from_index(chart_name, repo_url)
+        return from_index if from_index
+
+        # Every source came up empty. If at least one of them had newer versions
+        # that an ignore rule removed, that is a different answer than "there is
+        # nothing newer", and the updater handles the two differently.
+        raise Dependabot::AllVersionsIgnored if raise_on_ignored && all_newer_ignored?
+
+        nil
       end
 
       sig { params(chart_name: String, repo_url: String).returns(T.nilable(Gem::Version)) }
@@ -443,12 +492,13 @@ module Dependabot
 
       sig { params(all_versions: T::Array[String]).returns(T::Array[String]) }
       def filter_valid_versions(all_versions)
-        all_versions.reject do |version|
-          version_class.new(version) <= current_version ||
-            ignore_requirements.any? do |r|
-              r.instance_of?(Dependabot::Requirement) && r.satisfied_by?(version_class.new(version))
-            end
+        newer = all_versions.reject { |version| version_class.new(version) <= current_version }
+        filtered = newer.reject do |version|
+          helm_ignore_requirements.any? { |r| r.satisfied_by?(version_class.new(version)) }
         end
+
+        record_ignore_outcome(newer: newer.any?, surviving: filtered.any?)
+        filtered
       end
 
       sig { returns(T.nilable(Gem::Version)) }

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-helm
 version: !ruby/object:Gem::Version
-  version: 0.392.0
+  version: 0.393.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,28 +15,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.392.0
+        version: 0.393.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.392.0
+        version: 0.393.0
 - !ruby/object:Gem::Dependency
   name: dependabot-docker
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.392.0
+        version: 0.393.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.392.0
+        version: 0.393.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -275,7 +275,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.392.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.393.0
 rdoc_options: []
 require_paths:
 - lib