Module: Dependabot::GitCooldownDateResolver

Extended by:
T::Helpers, T::Sig
Included in:
GitCommitChecker
Defined in:
lib/dependabot/git_cooldown_date_resolver.rb

Overview

Shared logic for resolving release dates from git-based sources for cooldown purposes. Used by ecosystems that rely on git tags (pre-commit, GitHub Actions) rather than package registries.

Priority: GitHub Release published_at > tag creation date (for-each-ref) > commit date.

Including classes must implement:

- `cooldown_source_url` — returns the git source URL
- `cooldown_credentials` — returns the credentials array

Instance Method Summary collapse

Instance Method Details

#cached_github_releases ⇒ Object 



94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
 
# File 'lib/dependabot/git_cooldown_date_resolver.rb', line 94

def cached_github_releases
  @cached_github_releases ||= T.let(
    begin
      url = cooldown_source_url
      source = Source.from_url(url)
      if source&.provider == "github"
        client = Dependabot::Clients::GithubWithRetries.for_source(
          source: T.must(source),
          credentials: cooldown_credentials
        )
        releases = T.let(
          client.releases(T.must(source).repo, per_page: 100),
          T.nilable(T::Array[Sawyer::Resource])
        )
        (releases || []).filter_map do |release|
          Dependabot::Clients::GithubRelease.from_resource(release)
        end
      else
        []
      end
    rescue StandardError => e
      Dependabot.logger.debug("Error fetching GitHub releases: #{e.message}")
      []
    end,
    T.nilable(T::Array[Dependabot::Clients::GithubRelease])
  )
end

#cooldown_credentials ⇒ Object 



32
 
# File 'lib/dependabot/git_cooldown_date_resolver.rb', line 32

def cooldown_credentials; end

#cooldown_source_url ⇒ Object 



28
 
# File 'lib/dependabot/git_cooldown_date_resolver.rb', line 28

def cooldown_source_url; end

#github_release_published_at(tag_name) ⇒ Object 



59
60
61
62
63
64
65
66
67
68
69
70
 
# File 'lib/dependabot/git_cooldown_date_resolver.rb', line 59

def github_release_published_at(tag_name)
  releases = cached_github_releases
  return nil if releases.empty?

  release = releases.find { |r| r.tag_name == tag_name }
  return nil unless release&.published_at

  release.published_at
rescue StandardError => e
  Dependabot.logger.debug("Error fetching GitHub release date for #{tag_name}: #{e.message}")
  nil
end

#normalize_tag_name(tag_name) ⇒ Object 



38
39
40
 
# File 'lib/dependabot/git_cooldown_date_resolver.rb', line 38

def normalize_tag_name(tag_name)
  tag_name.delete_prefix("tags/")
end

#resolve_candidate_date(tag_name, commit_sha) ⇒ Object 



45
46
47
48
49
50
51
52
53
54
 
# File 'lib/dependabot/git_cooldown_date_resolver.rb', line 45

def resolve_candidate_date(tag_name, commit_sha)
  releases = cached_github_releases
  unless releases.empty?
    release = releases.find { |r| r.tag_name == tag_name }
    published_at = release&.published_at
    return published_at if published_at
  end

  tag_creation_date(tag_name, commit_sha)
end

#tag_creation_date(tag_name, commit_sha) ⇒ Object 



75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
 
# File 'lib/dependabot/git_cooldown_date_resolver.rb', line 75

def tag_creation_date(tag_name, commit_sha)
  tag_date_str = SharedHelpers.run_shell_command(
    "git for-each-ref --format=\"%(creatordate:iso)\" \"refs/tags/#{tag_name}\"",
    fingerprint: "git for-each-ref --format=\"%(creatordate:iso)\" \"refs/tags/<tag_name>\""
  ).strip

  if tag_date_str.empty?
    tag_date_str = SharedHelpers.run_shell_command(
      "git show --no-patch --format=\"%cd\" --date=iso #{commit_sha}",
      fingerprint: "git show --no-patch --format=\"%cd\" --date=iso <commit_sha>"
    ).strip
  end

  Time.parse(tag_date_str)
end