Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

incrementals-tools generates version numbers which are Dependabot prereleases #34

Closed
basil opened this issue Jan 22, 2023 · 8 comments · Fixed by #35
Closed

incrementals-tools generates version numbers which are Dependabot prereleases #34

basil opened this issue Jan 22, 2023 · 8 comments · Fixed by #35
Assignees

Comments

@basil
Copy link
Member

basil commented Jan 22, 2023

https://github.com/jenkinsci/jenkins-test-harness/releases/tag/1933.vda_8285a_2162a was not offered by Dependabot as expected. Rather it was erroneously filtered out as a prerelease by https://github.com/dependabot/dependabot-core/blob/1afa8518245f23c14eb652452e6f9539e48893d7/maven/lib/dependabot/maven/update_checker/version_finder.rb#L34. The Dependabot tokenization of this version was ["1933", "vda_8285", "a_2162", "a"]. The last token causes https://github.com/dependabot/dependabot-core/blob/1afa8518245f23c14eb652452e6f9539e48893d7/maven/lib/dependabot/maven/version.rb#L57 to erroneously flag this as an alpha version. One solution would be to append an underscore in cases like this so that the last token would be "a_" and would not trigger https://github.com/dependabot/dependabot-core/blob/1afa8518245f23c14eb652452e6f9539e48893d7/maven/lib/dependabot/maven/version.rb#L57.

@basil
Copy link
Member Author

basil commented Jan 22, 2023

@basil basil mentioned this issue Jan 24, 2023
6 tasks
@jglick
Copy link
Member

jglick commented Jan 24, 2023

Previously

FTR #28 + jenkinsci/plugin-compat-tester#340 + #24 + jenkinsci/plugin-compat-tester#341 + #31

One solution would be to append an underscore in cases like this

Reverting #31 basically (except retaining test coverage). Seems like the most prudent approach. @jetersen @timja any comment?

@basil
Copy link
Member Author

basil commented Jan 24, 2023

To be clear, the lack of a trailing underscore is fine for any digit or letter except for "a" or "b", in which case it triggers https://github.com/dependabot/dependabot-core/blob/1afa8518245f23c14eb652452e6f9539e48893d7/maven/lib/dependabot/maven/version.rb#L57.

@jetersen
Copy link
Member

what if we remove the last a or b at the end the commit sha will still be unique enough?

@jglick
Copy link
Member

jglick commented Jan 25, 2023

I am not comfortable with that. Adding hex digits until you find [0-9c-f] would be OK (though obviously this trick would not work if your commit hash happened to be like d9c67b3aaaaabbbbaabbbabaaabbb).

@basil
Copy link
Member Author

basil commented Feb 9, 2023

Since this issue has not been resolved two weeks after it was filed, should the relevant commit be reverted?

@jglick
Copy link
Member

jglick commented Feb 9, 2023

Yes as per #34 (comment); was just waiting to see if there were any alternate ideas, since this did not appear urgent.

@basil
Copy link
Member Author

basil commented Mar 2, 2023

Caused downstream issues: jenkinsci/bom#1805, jenkinsci/bom#1806, jenkinsci/bom#1807

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants