dependabot-nix 0.392.0 → 0.393.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: '0854f16dea1cbd1246cd58a76f290198c7bd4f124681b2aa1e2b28063e88b30c'
-  data.tar.gz: ce83d066b3331ed94082a1c021f21d72054f5b6ecdade603cc39cc91b98791d8
+  metadata.gz: '09f3dd2c398997b22338a69338bdd464270f86f03a2e7656f4ddb342a79a813d'
+  data.tar.gz: d768ac393fc688222704845e790a73c69fcb030b50e31543719a24546fafbaf7
 SHA512:
-  metadata.gz: 137558c3e44e6dcc6fa7013982d6feea2f79f19ea669538453a76d5d0f2c32c04ada2a07a51f58682509740274d553efeb97345a1d5bbf0ed06653304da69c7b
-  data.tar.gz: c0ee7a47fbee3e1e22294db2cfda26ef2ccf69e163845a42261795cc5246e91089cc8f136c7e7254d2595d1ca7874a268c6cd5a0455ffde8f168ed9ef113617e
+  metadata.gz: 18250664fddb5c46b30a64c6881632cdce5be47017a0ef03ae3b0531f8b24392917b54e94b5cc03699ce057910da2202a0648ef8b10c635070cc3b822ff46bbe
+  data.tar.gz: 59099630207f6355731b75ff3e15154d3708d4b6bb5163dc88e1093364d1fce992370b79b88663956c79339f85e418cccabea808c8f080adbd959ed277406d6d

data/lib/dependabot/nix/package/package_details_fetcher.rb

@@ -89,7 +89,7 @@ module Dependabot
 
           Dependabot.logger.info("Fetching branch-tip history for Nix flake input: #{dependency.name}")
           entries = fetch_activity_entries(T.must(url), T.must(ref))
-          return nil unless entries.is_a?(Array) && entries.any?
+          return nil unless entries.any?
 
           trim_entries_to_locked_sha(entries)
         rescue Octokit::Error => e
@@ -106,31 +106,34 @@ module Dependabot
           nil
         end
 
-        sig { params(url: String, ref: String).returns(T.untyped) }
+        sig { params(url: String, ref: String).returns(T::Array[Sawyer::Resource]) }
         def fetch_activity_entries(url, ref)
-          T.unsafe(github_client).get( # rubocop:disable Sorbet/ForbidTUnsafe
+          response = github_client.get(
             "/repos/#{github_repo_path(url)}/activity",
             ref: "refs/heads/#{ref}",
             activity_type: ACTIVITY_TYPES,
             per_page: 100
           )
+          raise TypeError, "GitHub activity response must be an array" unless response.is_a?(Array)
+
+          response
         end
 
         # Trim to entries up to and including the currently locked SHA, stopping
         # once that SHA is reached so we don't introduce candidates older than
         # `dependency.version`.
-        sig { params(entries: T::Array[T.untyped]).returns(T::Array[T::Hash[Symbol, T.untyped]]) }
+        sig { params(entries: T::Array[Sawyer::Resource]).returns(T::Array[T::Hash[Symbol, T.untyped]]) }
         def trim_entries_to_locked_sha(entries)
           locked = dependency.version
           result = T.let([], T::Array[T::Hash[Symbol, T.untyped]])
           entries.each do |e|
-            after_sha = e[:after]
-            result << { tag: after_sha, release_date: format_timestamp(e[:timestamp]) }
+            after_sha = activity_string(e, :after)
+            result << { tag: after_sha, release_date: format_timestamp(T.cast(e[:timestamp], T.nilable(Object))) }
 
             next unless locked
             break if after_sha == locked
 
-            if e[:before] == locked
+            if T.cast(e[:before], Object) == locked
               result << { tag: locked, release_date: nil } unless result.last&.fetch(:tag) == locked
               break
             end
@@ -138,14 +141,22 @@ module Dependabot
           result
         end
 
-        sig { params(timestamp: T.untyped).returns(T.nilable(String)) }
+        sig { params(timestamp: T.nilable(Object)).returns(T.nilable(String)) }
         def format_timestamp(timestamp)
-          return nil if timestamp.nil?
-          return timestamp.iso8601 if timestamp.respond_to?(:iso8601)
+          return if timestamp.nil?
+          return timestamp.iso8601 if timestamp.is_a?(Time)
 
           timestamp.to_s
         end
 
+        sig { params(entry: Sawyer::Resource, key: Symbol).returns(String) }
+        def activity_string(entry, key)
+          value = T.cast(entry[key], Object)
+          return value if value.is_a?(String)
+
+          raise TypeError, "GitHub activity #{key} must be a string"
+        end
+
         sig { params(url: T.nilable(String), ref: T.nilable(String)).returns(T::Boolean) }
         def use_activity_api?(url, ref)
           return false unless url && ref

data/lib/dependabot/nix/update_checker.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"
@@ -173,17 +173,24 @@ module Dependabot
       sig { returns(T.nilable(String)) }
       def fetch_latest_version_for_tag
         tag = latest_version_tag
-        tag&.fetch(:commit_sha)
+        tag && tag_commit_sha(tag)
       end
 
-      sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+      sig { returns(T.nilable(T::Hash[Symbol, Object])) }
       def latest_version_tag
         @latest_version_tag ||= T.let(
           git_commit_checker.local_tag_for_latest_version(update_cooldown),
-          T.nilable(T::Hash[Symbol, T.untyped])
+          T.nilable(T::Hash[Symbol, Object])
         )
       end
 
+      sig { params(tag: T::Hash[Symbol, Object]).returns(T.nilable(String)) }
+      def tag_commit_sha(tag)
+        return tag.commit_sha if tag.is_a?(Dependabot::GitTagDetails)
+
+        T.cast(tag[:commit_sha], T.nilable(String))
+      end
+
       # --- Versioned branch support ---
 
       sig { returns(T::Array[Dependabot::DependencyRequirement]) }

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-nix
 version: !ruby/object:Gem::Version
-  version: 0.392.0
+  version: 0.393.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.392.0
+        version: 0.393.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.392.0
+        version: 0.393.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -263,7 +263,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.392.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.393.0
 rdoc_options: []
 require_paths:
 - lib