Fix updating GitHub Actions & Dockerfiles with mixed versions #6082

deivid-rodriguez · 2022-11-08T17:47:53Z

Fixes #3750.
Fixes #5633.

deivid-rodriguez · 2022-11-08T19:07:10Z

Interesting.

If I understand correctly, when the same dependency is defined in multiple places, the intention is to choose the lowest version so that nothing is misinterpreted as up to date.

And that's what I think it's the culprit for #5633 and what I'm trying to fix here.

However, there are broken specs on several ecosystems, but I'm not really convinced they signal an issue with my fix.

If someone else can have a look, I appreciate it!

deivid-rodriguez · 2022-12-28T17:34:02Z

I rebased this PR after noticing yet another issue it would fix.

In #6336, Dependabot confusingly seems to be trying to upgrade the base Docker image to python:3.11 even if it's already at python:3.11. The update is actually correct thought, because there's a secondary Dockerfile in the same directory that's actually pinned to python:3.9. So Dependanbot fails to detect what the previous version is. With this PR, it properly documents the update as from python:3.9 to python:3.11. This is a separate problem from the crash presented in that PR, but wanted to notice it.

I'm going to have another look at the failing tests to confirm that the issue is with the tests asserting the wrong thing and not with the implementation proposed here.

deivid-rodriguez · 2023-02-21T21:02:04Z

This PR would also partially fix #6700.

deivid-rodriguez · 2023-02-23T18:20:26Z

I worked through the test failures and they all looked as "bad expectations" to me, so I went ahead and updated the tests. I will add inline comments on the updated tests to elaborate.

deivid-rodriguez · 2023-02-23T18:24:59Z

common/spec/dependabot/file_parsers/base/dependency_set_spec.rb

@@ -301,7 +301,7 @@
      expect(dependency_set.dependency_for_name("foo")).to eq(
        Dependabot::Dependency.new(
          name: "foo",
-          version: "1.0",
+          version: "1.1",


If one dependency in the set is a top level dependency (the one at 1.1 in this case), and another one is not (the one at 1.0), then the version of the top level dependency is chosen.

The previous logic would only do this sometimes, in a way that was dependent on the order dependencies are parsed. If a top level dependency would be parsed first, and then an indirect dependency merged into the Dependency Set, then the version of the top level dependency would be respected. But the version of the indirect dependency would win if lower and if the indirect dependency parsed first.

The new logic has the same spirit but it's order independent.

deivid-rodriguez · 2023-02-23T18:26:43Z

maven/spec/dependabot/maven/file_parser_spec.rb

@@ -628,7 +628,7 @@
          expect(dependency).to be_a(Dependabot::Dependency)
          expect(dependency.name).
            to eq("org.apache.maven.plugins:maven-javadoc-plugin")
-          expect(dependency.version).to eq("3.0.0-M1")
+          expect(dependency.version).to eq("2.10.4")


The new logic prefers lower versions if the dependencies are of the same type. This makes sense because it prevents misdirecting things as out of date, and was already the "spirit" of the code. But, due to this bug, sometimes the higher version would win depending on parsing order.

deivid-rodriguez · 2023-02-23T18:27:45Z

common/spec/dependabot/file_parsers/base/dependency_set_spec.rb

@@ -325,7 +325,7 @@
      expect(combined_set.dependency_for_name("foo")).to eq(
        Dependabot::Dependency.new(
          name: "foo",
-          version: "1.0",
+          version: "1.1",


Same explanation as in common/spec/dependabot/file_parsers/base/dependency_set_spec.rb (version of top-level dependency wins).

deivid-rodriguez · 2023-02-23T18:28:43Z

npm_and_yarn/spec/dependabot/npm_and_yarn/helpers_spec.rb

@@ -143,7 +143,7 @@
          ),
          Dependabot::Dependency.new(
            name: "bar",
-            version: "0.2.3",
+            version: "0.2.1",


Same explanation as in maven/spec/dependabot/maven/file_parser_spec.rb (lowest version wins).

deivid-rodriguez · 2023-02-23T18:28:49Z

nuget/spec/dependabot/nuget/file_parser_spec.rb

@@ -80,7 +80,7 @@
        it "has the right details" do
          expect(dependency).to be_a(Dependabot::Dependency)
          expect(dependency.name).to eq("Microsoft.Extensions.DependencyModel")
-          expect(dependency.version).to eq("1.1.1")
+          expect(dependency.version).to eq("1.0.1")


Same explanation as in the maven/spec/dependabot/maven/file_parser_spec.rb (lowest version wins).

mctofu

Makes sense! We weren't expecting a top level dep to have multiple versions but it can happen for ecosystems where we process top level deps from multiple files at once.

deivid-rodriguez · 2023-02-24T15:11:46Z

Thanks for the review @mctofu!

…-with-mixed-versions

deivid-rodriguez force-pushed the deivid-rodriguez/fix-updating-github-actions-with-mixed-versions branch from 25a46ff to 97d964d Compare November 8, 2022 18:21

This was referenced Nov 15, 2022

GitHub Actions aren't bumped if two files have different versions of an action #3750

Closed

Dependabot doesn't handle mixed versions #6011

Closed

deivid-rodriguez force-pushed the deivid-rodriguez/fix-updating-github-actions-with-mixed-versions branch from 97d964d to bac23a3 Compare December 28, 2022 17:29

deivid-rodriguez mentioned this pull request Dec 28, 2022

Dependabot fails to update #6336

Closed

1 task

deivid-rodriguez mentioned this pull request Feb 21, 2023

Dependabot only raises one PR where 2 FROM statements exist in Dockerfile #6700

Open

1 task

deivid-rodriguez force-pushed the deivid-rodriguez/fix-updating-github-actions-with-mixed-versions branch 4 times, most recently from 0da1f84 to 5a707c8 Compare February 22, 2023 14:14

deivid-rodriguez mentioned this pull request Feb 22, 2023

Dependabot doesn't update actions with mixed tag use #6695

Closed

1 task

deivid-rodriguez force-pushed the deivid-rodriguez/fix-updating-github-actions-with-mixed-versions branch from 5a707c8 to 65d474b Compare February 22, 2023 20:37

deivid-rodriguez commented Feb 23, 2023

View reviewed changes

deivid-rodriguez force-pushed the deivid-rodriguez/fix-updating-github-actions-with-mixed-versions branch from 65d474b to 360707b Compare February 23, 2023 18:35

deivid-rodriguez marked this pull request as ready for review February 23, 2023 18:35

deivid-rodriguez requested a review from a team as a code owner February 23, 2023 18:35

deivid-rodriguez changed the title ~~Fix updating GitHub Actions with mixed versions~~ Fix updating GitHub Actions & Dockerfiles with mixed versions Feb 23, 2023

mctofu approved these changes Feb 23, 2023

View reviewed changes

Fix updating GitHub Actions with mixed versions

984a267

deivid-rodriguez force-pushed the deivid-rodriguez/fix-updating-github-actions-with-mixed-versions branch from 360707b to 984a267 Compare February 24, 2023 15:11

deivid-rodriguez enabled auto-merge (squash) February 24, 2023 15:11

Merge branch 'main' into deivid-rodriguez/fix-updating-github-actions…

9b61bb9

…-with-mixed-versions

deivid-rodriguez merged commit 90b8d40 into main Feb 24, 2023

deivid-rodriguez deleted the deivid-rodriguez/fix-updating-github-actions-with-mixed-versions branch February 24, 2023 15:53

LingMan mentioned this pull request Feb 27, 2023

Github Actions: Unexpected change of branch #6739

Closed

deivid-rodriguez mentioned this pull request Feb 27, 2023

Don't ever update GitHub Actions unless they are actually pinned #6743

Merged

radeksimko mentioned this pull request May 2, 2023

GitHub Actions with mixed versions not getting updated #7214

Closed

1 task

jeffwidman added the L: docker Docker containers label May 23, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix updating GitHub Actions & Dockerfiles with mixed versions #6082

Fix updating GitHub Actions & Dockerfiles with mixed versions #6082

deivid-rodriguez commented Nov 8, 2022 •

edited

Loading

deivid-rodriguez commented Nov 8, 2022

deivid-rodriguez commented Dec 28, 2022

deivid-rodriguez commented Feb 21, 2023

deivid-rodriguez commented Feb 23, 2023

deivid-rodriguez Feb 23, 2023

deivid-rodriguez Feb 23, 2023

deivid-rodriguez Feb 23, 2023 •

edited

Loading

deivid-rodriguez Feb 23, 2023 •

edited

Loading

deivid-rodriguez Feb 23, 2023 •

edited

Loading

mctofu left a comment

deivid-rodriguez commented Feb 24, 2023

Fix updating GitHub Actions & Dockerfiles with mixed versions #6082

Fix updating GitHub Actions & Dockerfiles with mixed versions #6082

Conversation

deivid-rodriguez commented Nov 8, 2022 • edited Loading

deivid-rodriguez commented Nov 8, 2022

deivid-rodriguez commented Dec 28, 2022

deivid-rodriguez commented Feb 21, 2023

deivid-rodriguez commented Feb 23, 2023

deivid-rodriguez Feb 23, 2023

Choose a reason for hiding this comment

deivid-rodriguez Feb 23, 2023

Choose a reason for hiding this comment

deivid-rodriguez Feb 23, 2023 • edited Loading

Choose a reason for hiding this comment

deivid-rodriguez Feb 23, 2023 • edited Loading

Choose a reason for hiding this comment

deivid-rodriguez Feb 23, 2023 • edited Loading

Choose a reason for hiding this comment

mctofu left a comment

Choose a reason for hiding this comment

deivid-rodriguez commented Feb 24, 2023

deivid-rodriguez commented Nov 8, 2022 •

edited

Loading

deivid-rodriguez Feb 23, 2023 •

edited

Loading

deivid-rodriguez Feb 23, 2023 •

edited

Loading

deivid-rodriguez Feb 23, 2023 •

edited

Loading