port Docker updater improvements from Azure DevOps

[brettfo]

As part of the work inside Azure DevOps to improve dependabot (see #8179) there were some updates to the Docker updater that needed to be split out into their own PR, specifically:

• Allow docker version prefixes to contain underscores
• Add support for digests when updating helm charts

(cc @brbayes-msft)

[abdulapopoola]

Thank you so much for this! Would it be possible to have some tests to avoid regressions in the future please?

[ryanbrandenburg]

@abdulapopoola I'm not the greatest regex wizard but I think this would be a pre-existing condition (IE, this was not caused by our change to this REGEX but was already "inefficient" and just somehow grandfather-ed in). Do you have any advise for resolving this given that that's the case.

[abdulapopoola]

As a team, I think we accept RE as necessary and that codeQL flagging might be too sensitive; tagging @deivid-rodriguez and @jakecoffman to get their thoughts.

[deivid-rodriguez]

I think it's fine for CodeQL to flag these but I don't like it that it flags issues on any changed lines, even if they were present also before the changes. It places unnecessary burden on contributions like here.

Anyways, I believe it's fine to ignore.

Still, I had a look and I think this change may fix it, and it does not seem to break any specs:

diff --git a/docker/lib/dependabot/docker/tag.rb b/docker/lib/dependabot/docker/tag.rb
index 65c21e267..8eb805614 100644
--- a/docker/lib/dependabot/docker/tag.rb
+++ b/docker/lib/dependabot/docker/tag.rb
@@ -8,7 +8,7 @@ module Dependabot
     class Tag
       WORDS_WITH_BUILD = /(?:(?:-[a-z]+)+-[0-9]+)+/
       VERSION_REGEX = /v?(?<version>[0-9]+(?:\.[0-9]+)*(?:_[0-9]+|\.[a-z0-9]+|#{WORDS_WITH_BUILD}|-(?:kb)?[0-9]+)*)/i
-      VERSION_WITH_SFX = /^#{VERSION_REGEX}(?<suffix>-[a-z][a-z0-9.\-]*)?$/i
+      VERSION_WITH_SFX = /^#{VERSION_REGEX}(?<suffix>-[a-z][a-z0-9.]*)?$/i
       VERSION_WITH_PFX = /^(?<prefix>[a-z][a-z0-9.\-]*-)?#{VERSION_REGEX}$/i
       VERSION_WITH_PFX_AND_SFX = /^(?<prefix>[a-z\-]+-)?#{VERSION_REGEX}(?<suffix>-[a-z\-]+)?$/i
       NAME_WITH_VERSION =

Just in case we want to change that separately.

[deivid-rodriguez]

Is it this a real example, or just a simplified version for the sake of testing? Do you have an example of a realworld image tagged like this?

So far we've been trying to support to most widely used versioning schemes out there since there's no official spec for versioning docker tags. But arbitrarily putting an underscore after the version number does not make a lot of sense to me.

[ryanbrandenburg]

This is not a real example. The version we're thinking of is non-public, but it's a docker container for which the tag is shaped something like someRepo_19700101.4. I can replace the above with that now that I know what shape we're imagining.

[deivid-rodriguez]

So, just to confirm, you need to support underscores as suffixes to the version, not as prefixes as originally stated, correct?

[ryanbrandenburg]

This should be ready for re-review.

[deivid-rodriguez]

Would it be possible to split this PR into two commits, one for the helm charts feature, and another way for the detection of docker images with underscored suffixes? That'd help with the review!

[ryanbrandenburg]

I have rebased the commits as per your request.

[deivid-rodriguez]

This is looking good. The changes for supporting underscore prefixes look good to me, feel free to propose separately if you want those merged straightaway. For heml charts I had some questions.

[brettfo]

@deivid-rodriguez I've cleaned up the commits based on your feedback and rebased on the current main.