dependabot-terraform 0.385.0 → 0.386.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6d1ca89854c82fa7e3fb30f29c0c54a1349a2a1d0ba8141b74af54e5a24b9a64
-  data.tar.gz: c1f468d483d4802f42417df0fc195cb7ffbfd91397eca765ea0cb9b8d266e64f
+  metadata.gz: a2db17b06544fab18770f449bd5dfc6868569050c79af1aa5e475a1ea806777f
+  data.tar.gz: 8513583d339fcdf8835510fb77d44543f20435c95c60f3591a7b37bedb80639c
 SHA512:
-  metadata.gz: ebf5726c0729bef200b83243308b3eb3c17856148f529a919b8bc6cc62f0fe7cbc230aff1575d779b5525ff901b7ef5c4a5c7ba6e4edd68782a67d89d5b5cf79
-  data.tar.gz: d6853847fb38d9066171837d9bda41ea79d2a2db6df5488febc30653f98677c49d57e441bbbc9cca730969693fb6539bacd85ed8d35215e6f86b7eaa2070a1ea
+  metadata.gz: f68f3accb451bfd3e1364a314a2928b652f973ce908a74a8aa2675d0e6a40f87907d97de4db935f1703262622c104702d5d66529abb7b91c943cabde2f99e8aa
+  data.tar.gz: 27dc678b5075b3a4914e24cf99cfd4f401a3b73db283979eaafff83b22120d82dfa5fef1acbcf85876cb0b4727c52982d110a7e2c7c0ab580bb538e5bc0e145e

data/lib/dependabot/terraform/package/package_details_fetcher.rb

@@ -13,7 +13,6 @@ module Dependabot
       class PackageDetailsFetcher
         extend T::Sig
 
-        RELEASES_URL_GIT = "https://api.github.com/repos/"
         RELEASE_URL_FOR_PROVIDER = "https://registry.terraform.io/v2/providers/"
         RELEASE_URL_FOR_MODULE = "https://registry.terraform.io/v2/modules/"
         APPLICATION_JSON = "JSON"
@@ -46,34 +45,6 @@ module Dependabot
         sig { returns(T::Array[Dependabot::Credential]) }
         attr_reader :credentials
 
-        sig { returns(T::Array[GitTagWithDetail]) }
-        def fetch_tag_and_release_date
-          truncate_github_url = @dependency.name.gsub("github.com/", "")
-          url = RELEASES_URL_GIT + "#{truncate_github_url}/releases"
-          result_lines = T.let([], T::Array[GitTagWithDetail])
-          # Fetch the releases from the GitHub API
-          response = Excon.get(url, headers: { "Accept" => "application/vnd.github.v3+json" })
-          Dependabot.logger.error("Failed call details: #{response.body}") unless response.status == 200
-          return result_lines unless response.status == 200
-
-          # Parse the JSON response
-          releases = JSON.parse(response.body)
-
-          # Extract version names and release dates into a hash
-          releases.map do |release|
-            result_lines << GitTagWithDetail.new(
-              tag: release["tag_name"],
-              release_date: release["published_at"]
-            )
-          end
-
-          # sort the result lines by tag in descending order
-          result_lines = result_lines.sort_by(&:tag).reverse
-          # Log the extracted details for debugging
-          Dependabot.logger.info("Extracted release details: #{result_lines}")
-          result_lines
-        end
-
         sig { returns(T::Array[GitTagWithDetail]) }
         def fetch_tag_and_release_date_from_provider # rubocop:disable Metrics/AbcSize,Metrics/PerceivedComplexity
           return [] unless dependency_source_details

data/lib/dependabot/terraform/update_checker/latest_version_resolver.rb

@@ -35,34 +35,6 @@ module Dependabot
         sig { returns(Dependabot::Dependency) }
         attr_reader :dependency
 
-        # Return latest version tag for the dependency, it removes tags that are in cooldown period
-        # and returns the latest version tag that is not in cooldown period. If exception occurs
-        # it will return the latest version tag from the git_commit_checker. as it was before
-        sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
-        def latest_version_tag
-          # step one fetch allowed version tags and
-          allowed_version_tags = git_commit_checker.allowed_version_tags
-          begin
-            if cooldown_enabled?
-              # sort the allowed version tags by name in descending order
-              select_version_tags_in_cooldown_period&.each do |tag_name|
-                # filter out if name is not in cooldown period
-                allowed_version_tags.reject! do |gitref_filtered|
-                  true if gitref_filtered.name == tag_name
-                end
-              end
-            end
-            Dependabot.logger.info(
-              "Allowed version tags after filtering versions in cooldown:
-              #{allowed_version_tags.map(&:name).join(', ')}"
-            )
-            git_commit_checker.max_local_tag(allowed_version_tags)
-          rescue StandardError => e
-            Dependabot.logger.error("Error fetching latest version tag: #{e.message}")
-            git_commit_checker.local_tag_for_latest_version
-          end
-        end
-
         # To filter versions in cooldown period based on version tags from registry call
         sig do
           params(versions: T::Array[Dependabot::Terraform::Version])
@@ -115,21 +87,6 @@ module Dependabot
           versions
         end
 
-        sig { returns(T.nilable(T::Array[String])) }
-        def select_version_tags_in_cooldown_period
-          version_tags_in_cooldown_period = T.let([], T::Array[String])
-
-          package_details_fetcher.fetch_tag_and_release_date.each do |git_tag_with_detail|
-            if check_if_version_in_cooldown_period?(T.must(git_tag_with_detail.release_date))
-              version_tags_in_cooldown_period << git_tag_with_detail.tag
-            end
-          end
-          version_tags_in_cooldown_period
-        rescue StandardError => e
-          Dependabot.logger.error("Error checking if version is in cooldown: #{e.message}")
-          version_tags_in_cooldown_period
-        end
-
         sig { params(release_date: String).returns(T::Boolean) }
         def check_if_version_in_cooldown_period?(release_date)
           return false unless release_date.length.positive?
@@ -195,17 +152,6 @@ module Dependabot
           )
         end
 
-        sig { returns(T::Boolean) }
-        def cooldown_enabled?
-          # This is a simple check to see if user has put cooldown days.
-          # If not set, then we aassume user does not want cooldown.
-          # Since Terraform does not support Semver versioning, So option left
-          # for the user is to set cooldown default days.
-          return false if @cooldown_options.nil?
-
-          @cooldown_options.default_days.positive?
-        end
-
         sig { returns(Dependabot::GitCommitChecker) }
         attr_reader :git_commit_checker
 

data/lib/dependabot/terraform/update_checker.rb

@@ -172,31 +172,26 @@ module Dependabot
 
         # If the dependency is pinned to a tag that looks like a version then
         # we want to update that tag. Because we don't have a lockfile, the
-        # latest version is the tag itself.
-        if git_commit_checker.pinned_ref_looks_like_version?
-          # Filter version tags that are in cooldown period
-          latest_tag =  latest_version_resolver.latest_version_tag&.fetch(:tag)
-          version_rgx = GitCommitChecker::VERSION_REGEX
-          return unless latest_tag.match(version_rgx)
-
-          version = latest_tag.match(version_rgx)
-                              .named_captures.fetch("version")
-          return version_class.new(version)
-        end
+        # latest version is the tag itself. Tags within their cooldown window
+        # are filtered out by the shared GitCommitChecker.
+        latest_tag = git_commit_checker.local_tag_for_pinned_version_ref(update_cooldown)&.fetch(:tag)
+        return unless latest_tag
 
-        # If the dependency is pinned to a tag that doesn't look like a
-        # version then there's nothing we can do.
-        nil
+        version_rgx = GitCommitChecker::VERSION_REGEX
+        return unless latest_tag.match(version_rgx)
+
+        version = latest_tag.match(version_rgx)
+                            .named_captures.fetch("version")
+        version_class.new(version)
       end
 
       sig { returns(T.nilable(String)) }
       def tag_for_latest_version
         return unless git_commit_checker.git_dependency?
-        return unless git_commit_checker.pinned?
-        return unless git_commit_checker.pinned_ref_looks_like_version?
 
-        latest_tag = git_commit_checker.local_tag_for_latest_version
+        latest_tag = git_commit_checker.local_tag_for_pinned_version_ref(update_cooldown)
                                        &.fetch(:tag)
+        return unless latest_tag
 
         version_rgx = GitCommitChecker::VERSION_REGEX
         return unless latest_tag.match(version_rgx)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-terraform
 version: !ruby/object:Gem::Version
-  version: 0.385.0
+  version: 0.386.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.385.0
+        version: 0.386.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.385.0
+        version: 0.386.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -263,7 +263,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.385.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.386.0
 rdoc_options: []
 require_paths:
 - lib