dependabot-nix 0.400.0 → 0.402.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9c43092085abc84998966283a4873a016c473627fc91db6a9facf5583eb8ac4e
-  data.tar.gz: d058639a9e1e91e7af117705000e152ec17fc87847efaa51df63435353b4f9a9
+  metadata.gz: e3bfde27699a8e326f4273ea9ef541785df000510c9027f7404063ddc17aa949
+  data.tar.gz: 83e6801e4c714829d62889aa9ba69a5159df67159c4dae848e9fcd8355cada7a
 SHA512:
-  metadata.gz: d7793b2f1bd1d389c4fa454ca9ae259d65995be485f5267445f05c590408d75805ad4c41f7085061cbd60c6f82e82126378e2576b518c895701307659475aeab
-  data.tar.gz: 8bbe0ba8ddc46cb313f52a37ec532e0c429523dcc7cced9936611edcc2872f2478bf96231b9c3cc0b5e08cb75a0eada3b09e882e13a33ac76d03cf8f83fc2306
+  metadata.gz: 526966c8e4195dc73657ab9791b2cb9bf64d60ff5ee559d5c170d03559944e4e2c4dc56e071a55d2f0abd248c9779046fa4c340ccc648c6ebf33f6f6ecf11514
+  data.tar.gz: 859a61c72241afd980232273d917960c085151dde25e0217d58cd99d499468d1b38110c4dc39fe5eedd57fbacf84015bbe8d7363cbb4d8a40cb2bf43a6ba2b17

data/lib/dependabot/nix/package/package_details_fetcher.rb

@@ -66,11 +66,12 @@ module Dependabot
         TARGET_COMMITS_TO_FETCH = 500
         ACTIVITY_TYPES = "push,force_push"
         SHA_REGEX = /\A[0-9a-f]{40}\z/
+        NULL_SHA = "0000000000000000000000000000000000000000"
         # Heuristic for refs that look like a tag/version rather than a branch
         # (e.g. `v1.2.3`, `1.2`, `2024.01`). Branch names like `nixos-25.05`
         # don't match because they don't start with a digit or `v<digit>`.
         TAG_LIKE_REF_REGEX = /\Av?\d+\./
-        private_constant :TARGET_COMMITS_TO_FETCH, :ACTIVITY_TYPES, :SHA_REGEX, :TAG_LIKE_REF_REGEX
+        private_constant :TARGET_COMMITS_TO_FETCH, :ACTIVITY_TYPES, :SHA_REGEX, :NULL_SHA, :TAG_LIKE_REF_REGEX
 
         # Fetch branch-tip history via GitHub's Repo Activity API. Each entry's
         # `after` SHA was once the actual branch tip — for `nixpkgs` channels
@@ -78,6 +79,13 @@ module Dependabot
         # endpoint, by contrast, returns intermediate commits that were never
         # branch tips and may not be cached.
         #
+        # The `activity_type` filter does not narrow the response to pushes, so it
+        # also holds `branch_creation` and `branch_deletion` entries. A deletion
+        # reports the null SHA as its `after`, which is not a revision anyone can
+        # fetch. When the newest entry is a deletion the branch no longer exists
+        # and has no releases; an older deletion, followed by the branch being
+        # created again, is skipped.
+        #
         # Returns nil when the activity API isn't usable (non-GitHub host,
         # SHA-pinned ref, missing ref, HTTP error). Callers should fall back to
         # the existing /commits walker in that case.
@@ -91,7 +99,12 @@ module Dependabot
           entries = fetch_activity_entries(T.must(url), T.must(ref))
           return nil unless entries.any?
 
-          trim_entries_to_locked_sha(entries)
+          if branch_deletion?(T.must(entries.first))
+            Dependabot.logger.info("Branch #{ref} of #{url} no longer exists, so #{dependency.name} has no releases")
+            return []
+          end
+
+          trim_entries_to_locked_sha(entries.reject { |entry| branch_deletion?(entry) })
         rescue Octokit::Error => e
           Dependabot.logger.info(
             "Repo Activity API failed for #{dependency.name} (#{e.class}: #{e.message}), " \
@@ -141,6 +154,11 @@ module Dependabot
           result
         end
 
+        sig { params(entry: Sawyer::Resource).returns(T::Boolean) }
+        def branch_deletion?(entry)
+          activity_string(entry, :after) == NULL_SHA
+        end
+
         sig { params(timestamp: T.nilable(Object)).returns(T.nilable(String)) }
         def format_timestamp(timestamp)
           return if timestamp.nil?

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-nix
 version: !ruby/object:Gem::Version
-  version: 0.400.0
+  version: 0.402.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.400.0
+        version: 0.402.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.400.0
+        version: 0.402.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -265,7 +265,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.400.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.402.0
 rdoc_options: []
 require_paths:
 - lib