dependabot-helm 0.394.0 → 0.395.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cf9e2bbc8681daa0e6c7570ceabcf694fb7ca7e3a9ee4e1b7718b563d009e665
-  data.tar.gz: 691a554513a02c25655ab9e9694ba3708460d6372a02b563778d6bb6ebd2c38a
+  metadata.gz: 66957e7dcbc920c485cc615845dfcebe5c7f05b6e1f21e22e89a8a0ba7501709
+  data.tar.gz: 5abe7647baa0d3e87d680dc1450c8766de9d9a78b9c68777a5e56591bd672371
 SHA512:
-  metadata.gz: b814f45944384a70ff7488b60882ecb8a913f579b25fa07f0fdd2b3d03af2f0302fbc25a1f2aae197f6de4f8ec14f0cc4480795b248181d3da9a48340aeb9a9e
-  data.tar.gz: b547fa89d94cef82b49555f6698b14831a06a8ccd87eacdf5cbdcf20705483021537c10810591f624c264f01851006844d90ffbb71cd0899c0ec2c650751a8d9
+  metadata.gz: 2540ab6c3f7ea1f48a9679a42eb6fe3be10525c32b337c21334f4ddba80a71cc8ae657526560dc20eb06ba2dc9d67e35e8d8023fcdcf864ffdb7b397de32f00b
+  data.tar.gz: c58f75ddbd53ac731d258ebb5e6863bc1a314c2a6bfdb0bdb709256439a56b9c88b62001996d0cc5374b7c8fb6f612c50dc4d36d254ad3172856bac36b9d7420

data/lib/dependabot/helm/file_updater/image_updater.rb

@@ -40,7 +40,8 @@ module Dependabot
 
         sig { params(yaml_stream: Psych::Nodes::Stream, content: String).returns(String) }
         def update_image_tags_recursive(yaml_stream, content)
-          updated_content = content.dup.split("\n")
+          # -1 keeps a trailing empty element so join restores a final newline
+          updated_content = content.dup.split("\n", -1)
 
           yaml_stream.children.each do |document|
             document.children.each do |root_node|
@@ -90,8 +91,19 @@ module Dependabot
 
         sig { params(key: String, value_node: Psych::Nodes::Node, content: T::Array[String]).returns(T::Array[String]) }
         def process_image_key(key, value_node, content)
-          return content unless key == "image" && value_node.is_a?(Psych::Nodes::Mapping)
+          return content unless key == "image"
+
+          if value_node.is_a?(Psych::Nodes::Mapping)
+            process_mapping_image(value_node, content)
+          elsif value_node.is_a?(Psych::Nodes::Scalar)
+            process_scalar_image(value_node, content)
+          else
+            content
+          end
+        end
 
+        sig { params(value_node: Psych::Nodes::Mapping, content: T::Array[String]).returns(T::Array[String]) }
+        def process_mapping_image(value_node, content)
           dependency_name = dependency.name
           has_dependency = contains_dependency?(value_node, dependency_name)
           return content unless has_dependency
@@ -100,6 +112,12 @@ module Dependabot
           update_version_tags(value_node, content, dependency_version)
         end
 
+        sig { params(value_node: Psych::Nodes::Scalar, content: T::Array[String]).returns(T::Array[String]) }
+        def process_scalar_image(value_node, content)
+          dependency_version = T.must(dependency.version)
+          update_scalar_image_tag(value_node, content, dependency_version)
+        end
+
         sig { params(node: Psych::Nodes::Node, dependency_name: String).returns(T::Boolean) }
         def contains_dependency?(node, dependency_name)
           node.children.any? do |child|
@@ -133,6 +151,73 @@ module Dependabot
 
           content
         end
+
+        sig do
+          params(
+            value_node: Psych::Nodes::Scalar,
+            content: T::Array[String],
+            dependency_version: String
+          ).returns(T::Array[String])
+        end
+        def update_scalar_image_tag(value_node, content, dependency_version)
+          dependency_name = dependency.name
+
+          dependency.requirements.each do |req|
+            next unless req.metadata_symbol("type") == :docker_image
+
+            old_tag = req.source_string("tag")
+            next unless old_tag
+            # digest-pinned images resolve by digest, so a tag-only bump would silently keep the old image
+            next if req.source_string("digest")
+
+            old_declaration = scalar_image_declaration(dependency_name, req, old_tag)
+            next unless value_node.value.chomp == old_declaration
+
+            new_declaration = scalar_image_declaration(dependency_name, req, dependency_version)
+            replace_within_node_span(value_node, content, old_declaration, new_declaration)
+          end
+
+          content
+        end
+
+        sig do
+          params(
+            value_node: Psych::Nodes::Scalar,
+            content: T::Array[String],
+            old_declaration: String,
+            new_declaration: String
+          ).void
+        end
+        def replace_within_node_span(value_node, content, old_declaration, new_declaration)
+          start_line = value_node.start_line
+          end_line = value_node.end_line
+
+          if start_line == end_line
+            line = T.must(content[start_line])
+            prefix = line[0...value_node.start_column]
+            rest = T.must(line[value_node.start_column..])
+            content[start_line] = "#{prefix}#{rest.sub(old_declaration, new_declaration)}"
+          else
+            # block/folded scalar: the declaration text lives on a line after start_line, so
+            # search the node's whole line span rather than just the line Psych anchors it to
+            segment = T.must(content[start_line..end_line]).join("\n")
+            content[start_line..end_line] = segment.sub(old_declaration, new_declaration).split("\n", -1)
+          end
+        end
+
+        sig do
+          params(
+            name: String,
+            req: Dependabot::DependencyRequirement,
+            tag: String
+          ).returns(String)
+        end
+        def scalar_image_declaration(name, req, tag)
+          registry = req.source_string("registry")
+          # the parser already folds a detected registry into the name itself (e.g. "docker.io/nginx")
+          declaration = registry && !name.start_with?("#{registry}/") ? "#{registry}/#{name}" : name
+          "#{declaration}:#{tag}"
+        end
       end
     end
   end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-helm
 version: !ruby/object:Gem::Version
-  version: 0.394.0
+  version: 0.395.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,28 +15,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.394.0
+        version: 0.395.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.394.0
+        version: 0.395.0
 - !ruby/object:Gem::Dependency
   name: dependabot-docker
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.394.0
+        version: 0.395.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.394.0
+        version: 0.395.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -192,19 +192,19 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '1.1'
 - !ruby/object:Gem::Dependency
-  name: turbo_tests
+  name: turbo_tests2
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 2.2.5
+        version: 3.2.7
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 2.2.5
+        version: 3.2.7
 - !ruby/object:Gem::Dependency
   name: vcr
   requirement: !ruby/object:Gem::Requirement
@@ -275,7 +275,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.394.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.395.0
 rdoc_options: []
 require_paths:
 - lib