dependabot-nix 0.391.0 → 0.393.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 76a0d538ea07a901db4c105e3f9d9ec9781092a5b140ec7e438a5978ae92f9fb
-  data.tar.gz: f51521922590aaf2eae87c10624a1769ed0f6a1c32bbc583a5410966a6b5ca03
+  metadata.gz: '09f3dd2c398997b22338a69338bdd464270f86f03a2e7656f4ddb342a79a813d'
+  data.tar.gz: d768ac393fc688222704845e790a73c69fcb030b50e31543719a24546fafbaf7
 SHA512:
-  metadata.gz: 8c63389117a33466e4a266b186c6171e20f5a1993d0f2b6ca2570446ecfdd9ab54cdea4401de7530394b0bd43794f2e3636be51faac3a78c10954b5677fe329d
-  data.tar.gz: 73f6a626f8ff11a613094e166a2934fa44bd513485bec60b332e7783cf0862048136907b513db380cab2c7c39444052d96f809f39ad3d21f7a56ef9ec4178036
+  metadata.gz: 18250664fddb5c46b30a64c6881632cdce5be47017a0ef03ae3b0531f8b24392917b54e94b5cc03699ce057910da2202a0648ef8b10c635070cc3b822ff46bbe
+  data.tar.gz: 59099630207f6355731b75ff3e15154d3708d4b6bb5163dc88e1093364d1fce992370b79b88663956c79339f85e418cccabea808c8f080adbd959ed277406d6d

data/lib/dependabot/nix/file_updater.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"
@@ -84,12 +84,12 @@ module Dependabot
 
       sig { returns(T.nilable(String)) }
       def new_source_ref
-        dependency.requirements.first&.dig(:source, :ref)
+        dependency.requirements.first&.source_string("ref")
       end
 
       sig { returns(T.nilable(String)) }
       def old_source_ref
-        dependency.previous_requirements&.first&.dig(:source, :ref)
+        dependency.previous_requirements&.first&.source_string("ref")
       end
 
       sig { override.void }

data/lib/dependabot/nix/metadata_finder.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"
@@ -19,8 +19,7 @@ module Dependabot
 
       sig { override.returns(T.nilable(Dependabot::Source)) }
       def look_up_source
-        source = dependency.requirements.first&.fetch(:source, nil)
-        url = source && (source[:url] || source["url"])
+        url = dependency.requirements.first&.source_string("url")
 
         return Source.from_url(NIXPKGS_SOURCE_URL) if Channel.channel_url?(url)
 

data/lib/dependabot/nix/package/package_details_fetcher.rb

@@ -89,7 +89,7 @@ module Dependabot
 
           Dependabot.logger.info("Fetching branch-tip history for Nix flake input: #{dependency.name}")
           entries = fetch_activity_entries(T.must(url), T.must(ref))
-          return nil unless entries.is_a?(Array) && entries.any?
+          return nil unless entries.any?
 
           trim_entries_to_locked_sha(entries)
         rescue Octokit::Error => e
@@ -106,31 +106,34 @@ module Dependabot
           nil
         end
 
-        sig { params(url: String, ref: String).returns(T.untyped) }
+        sig { params(url: String, ref: String).returns(T::Array[Sawyer::Resource]) }
         def fetch_activity_entries(url, ref)
-          T.unsafe(github_client).get( # rubocop:disable Sorbet/ForbidTUnsafe
+          response = github_client.get(
             "/repos/#{github_repo_path(url)}/activity",
             ref: "refs/heads/#{ref}",
             activity_type: ACTIVITY_TYPES,
             per_page: 100
           )
+          raise TypeError, "GitHub activity response must be an array" unless response.is_a?(Array)
+
+          response
         end
 
         # Trim to entries up to and including the currently locked SHA, stopping
         # once that SHA is reached so we don't introduce candidates older than
         # `dependency.version`.
-        sig { params(entries: T::Array[T.untyped]).returns(T::Array[T::Hash[Symbol, T.untyped]]) }
+        sig { params(entries: T::Array[Sawyer::Resource]).returns(T::Array[T::Hash[Symbol, T.untyped]]) }
         def trim_entries_to_locked_sha(entries)
           locked = dependency.version
           result = T.let([], T::Array[T::Hash[Symbol, T.untyped]])
           entries.each do |e|
-            after_sha = e[:after]
-            result << { tag: after_sha, release_date: format_timestamp(e[:timestamp]) }
+            after_sha = activity_string(e, :after)
+            result << { tag: after_sha, release_date: format_timestamp(T.cast(e[:timestamp], T.nilable(Object))) }
 
             next unless locked
             break if after_sha == locked
 
-            if e[:before] == locked
+            if T.cast(e[:before], Object) == locked
               result << { tag: locked, release_date: nil } unless result.last&.fetch(:tag) == locked
               break
             end
@@ -138,14 +141,22 @@ module Dependabot
           result
         end
 
-        sig { params(timestamp: T.untyped).returns(T.nilable(String)) }
+        sig { params(timestamp: T.nilable(Object)).returns(T.nilable(String)) }
         def format_timestamp(timestamp)
-          return nil if timestamp.nil?
-          return timestamp.iso8601 if timestamp.respond_to?(:iso8601)
+          return if timestamp.nil?
+          return timestamp.iso8601 if timestamp.is_a?(Time)
 
           timestamp.to_s
         end
 
+        sig { params(entry: Sawyer::Resource, key: Symbol).returns(String) }
+        def activity_string(entry, key)
+          value = T.cast(entry[key], Object)
+          return value if value.is_a?(String)
+
+          raise TypeError, "GitHub activity #{key} must be a string"
+        end
+
         sig { params(url: T.nilable(String), ref: T.nilable(String)).returns(T::Boolean) }
         def use_activity_api?(url, ref)
           return false unless url && ref

data/lib/dependabot/nix/update_checker.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"
@@ -97,11 +97,16 @@ module Dependabot
         return dependency.requirements unless result
 
         dependency.requirements.map do |req|
-          source = req[:source]
-          next req unless source
+          next req unless req.source_hash
 
           Dependabot::DependencyRequirement.create(
-            req.merge(source: source.merge(ref: result[:channel], url: result[:url]))
+            req.merge(
+              source: source_with_values(
+                req,
+                "ref" => result[:channel],
+                "url" => result[:url]
+              )
+            )
           )
         end
       end
@@ -151,27 +156,41 @@ module Dependabot
         return dependency.requirements unless new_tag
 
         dependency.requirements.map do |req|
-          source = req[:source]
-          next req unless source
+          next req unless req.source_hash
 
-          Dependabot::DependencyRequirement.create(req.merge(source: source.merge(ref: new_tag[:tag], branch: nil)))
+          Dependabot::DependencyRequirement.create(
+            req.merge(
+              source: source_with_values(
+                req,
+                "ref" => T.cast(new_tag[:tag], String),
+                "branch" => nil
+              )
+            )
+          )
         end
       end
 
       sig { returns(T.nilable(String)) }
       def fetch_latest_version_for_tag
         tag = latest_version_tag
-        tag&.fetch(:commit_sha)
+        tag && tag_commit_sha(tag)
       end
 
-      sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+      sig { returns(T.nilable(T::Hash[Symbol, Object])) }
       def latest_version_tag
         @latest_version_tag ||= T.let(
           git_commit_checker.local_tag_for_latest_version(update_cooldown),
-          T.nilable(T::Hash[Symbol, T.untyped])
+          T.nilable(T::Hash[Symbol, Object])
         )
       end
 
+      sig { params(tag: T::Hash[Symbol, Object]).returns(T.nilable(String)) }
+      def tag_commit_sha(tag)
+        return tag.commit_sha if tag.is_a?(Dependabot::GitTagDetails)
+
+        T.cast(tag[:commit_sha], T.nilable(String))
+      end
+
       # --- Versioned branch support ---
 
       sig { returns(T::Array[Dependabot::DependencyRequirement]) }
@@ -180,10 +199,17 @@ module Dependabot
         return dependency.requirements unless result
 
         dependency.requirements.map do |req|
-          source = req[:source]
-          next req unless source
+          next req unless req.source_hash
 
-          Dependabot::DependencyRequirement.create(req.merge(source: source.merge(ref: result[:branch], branch: nil)))
+          Dependabot::DependencyRequirement.create(
+            req.merge(
+              source: source_with_values(
+                req,
+                "ref" => result[:branch],
+                "branch" => nil
+              )
+            )
+          )
         end
       end
 
@@ -201,6 +227,29 @@ module Dependabot
         )
       end
 
+      sig do
+        params(
+          requirement: Dependabot::DependencyRequirement,
+          values: T::Hash[String, T.nilable(String)]
+        ).returns(Dependabot::DependencyRequirement::ObjectHash)
+      end
+      def source_with_values(requirement, values)
+        source = T.must(requirement.source_hash).dup
+        values.each do |key, value|
+          actual_key = if source.key?(key.to_sym)
+                         key.to_sym
+                       elsif source.key?(key)
+                         key
+                       elsif source.keys.any?(Symbol)
+                         key.to_sym
+                       else
+                         key
+                       end
+          source[actual_key] = value
+        end
+        source
+      end
+
       # --- Commit-tracking (existing behavior) ---
 
       sig { returns(T.nilable(String)) }

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-nix
 version: !ruby/object:Gem::Version
-  version: 0.391.0
+  version: 0.393.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.391.0
+        version: 0.393.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.391.0
+        version: 0.393.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -263,7 +263,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.391.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.393.0
 rdoc_options: []
 require_paths:
 - lib