Improve Docker tag component detection and comparison #11679
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
kbukum1
reviewed
Feb 25, 2025
kbukum1
reviewed
Feb 25, 2025
| components = [] | ||
|
|
||
| common_components.each do |component| | ||
| components << component if tag_name.match?(/\b#{Regexp.escape(component)}\b/) |
There was a problem hiding this comment.
Maybe that can be changed into?
components << component if tag_name.include?(component)
There was a problem hiding this comment.
I want to use word boundaries to ensure we only match complete component names, not partial substrings. If we have a component like "ruby" and we use include?, it will incorrectly match in tags like "rubygem" as substrings. I don't know if there is going to be a real world scenario where this would happen, but it's a possibility and I want to play it safe to avoid potentially creating issues.
markhallen
reviewed
Feb 26, 2025
robaiken
force-pushed
the
robaiken/improve-Docker-tag-component-detection-and-comparison
branch
from
e54450d to
4692acc
Compare
robaiken
deleted the
robaiken/improve-Docker-tag-component-detection-and-comparison
branch
dmitris
pushed a commit
to dmitris/dependabot-core
that referenced
this pull request
Feb 26, 2025
* Improve Docker tag component detection and comparison * lint * Adding `:docker_tag_component_comparison` feature flag * lint * fixing rubocops catch 22 between explicit and implicit subject * refactoring code
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What are you trying to accomplish?
I'm improving how Dependabot selects Docker images for updates by enhancing the tag comparison logic. Currently, we sometimes incorrectly select images with different component patterns - for example, suggesting an update from
image:3.3-apachetoimage:4-apache-alpinewhen we should only be matching images with identical components (just "apache" in this case).This refactoring makes tag comparison more intelligent by analyzing patterns in image tags to identify their key components (like OS, packages, etc.) and using those patterns as a basis to filter out images that don't match the original structure. By dynamically identifying these components across all available tags, we can ensure we only suggest updates that maintain the same component structure as the original dependency.
Related issues: #8648, #390
Anything you want to highlight for special attention from reviewers?
I've taken a component-based approach to image selection rather than the previous method of stripping characters. The key strategy involves:
alpine,apache,amd64)apachedoesn't match withapache-alpine)This approach makes more semantic sense for Docker tags and better respects their internal structure. I've also split the logic into smaller, focused methods for better maintainability. The refactoring preserves all existing functionality while adding more precise tag filtering.
How will you know you've accomplished your goal?
We'll see more accurate image selection during updates, particularly:
When updating from
owasp/modsecurity-crs:3.3-apache-202209221209we won't incorrectly selectowasp/modsecurity-crs:4-apache-alpine-202502070602(addingalpine)Users should experience more predictable and semantically correct Docker dependency updates.
Checklist