feat: add cooldown filter for github_actions using existing git_commit_checker and available_latest_version_tag

[v-HaripriyaC]

What are you trying to accomplish?

Fixes #14579 — The GitHub Actions cooldown filter was only evaluating the single latest release against the cooldown window. If that latest release fell within the cooldown period, Dependabot immediately returned "no viable filtered release" and proposed no update at all — even when multiple older releases existed that were well past the cooldown window.

This effectively made cooldown a permanent blocker for frequently-released dependencies (e.g. ruby/setup-ruby, renovatebot/github-action), which is clearly not the intended behavior.

Before (broken behavior):

Found release date : 2026-03-27 01:19:02 +0000
Days since release : 0 (cooldown days 7)
Filtered out (cooldown) ruby/setup-ruby, 1.298.0
Returning current version/ref (no viable filtered release) 1.288.0
Latest version is 1.288.0
No update needed for ruby/setup-ruby 1.288.0

Versions 1.289.0–1.297.0 were all over 7 days old and should have been proposed, but were never evaluated.

After (fixed behavior):
Dependabot fetches the release dates for all allowed version tags, builds a set of tags that are within the cooldown window, and checks whether the proposed release tag is in that set. Tags outside the cooldown window remain valid candidates for update.

What changed?

• package_details_fetcher.rb: Added fetch_tag_and_release_date (public) and fetch_release_date_for_tag (private). These use git clone --bare + git show --format="%cd" to retrieve the commit date for each allowed version tag —with existing methods git_commit_checker and available_latest_version_tag via git-native repository.

• latest_version_finder.rb:

  • Replaced the single-tag commit_metadata_details + release_in_cooldown_period? flow in cooldown_filter with a new select_version_tags_in_cooldown_period method that evaluates all allowed version tags.
  • The filter now checks whether the proposed release tag is a member of the in-cooldown set, rather than whether its own date is within the window.
  • Added check_if_version_in_cooldown_period? and release_date_to_seconds as testable, isolated helpers.
  • Added DAY_IN_SECONDS constant (previously referenced but defined elsewhere).

• Tests: Added specs for fetch_tag_and_release_date, check_if_version_in_cooldown_period?, release_date_to_seconds, and select_version_tags_in_cooldown_period, covering nil/empty/invalid date inputs, missing cooldown options, and error recovery.

Anything you want to highlight for special attention from reviewers?

• The fetch_release_date_for_tag method currently runs a full git clone --bare per tag. For repos with a large number of allowed version tags this could be slow. A follow-up optimization to clone once and run all git show commands within that single bare clone would be worthwhile, but is out of scope for this fix.
• The old release_in_cooldown_period? included a cooldown.included?(dependency.name) guard. This has been removed in the new check_if_version_in_cooldown_period?. Please confirm whether per-dependency inclusion scoping needs to be preserved here.

How will you know you've accomplished your goal?

• The new unit tests for select_version_tags_in_cooldown_period and check_if_version_in_cooldown_period? pass.
• Manually: a GitHub Actions dependency with cooldown: default-days: 7 and a latest release < 7 days old will now be updated to the most recent release that is ≥ 7 days old, rather than receiving "no viable filtered release."
• Reproducer from the issue: ruby/setup-ruby pinned at 1.288.0, run when 1.298.0 is 0 days old — Dependabot should now propose updating to 1.297.0 (or whichever is the newest release outside the cooldown window).

Checklist

• I have run the complete test suite to ensure all tests and linters pass.
• I have thoroughly tested my code changes to ensure they work as expected, including adding additional tests for new functionality.
• I have written clear and descriptive commit messages.
• I have provided a detailed description of the changes in the pull request, including the problem it addresses, how it fixes the problem, and any relevant details about the implementation.
• I have ensured that the code is well-documented and easy to understand.

[Copilot]

Pull request overview

This PR fixes GitHub Actions cooldown behavior so that when the newest tag is within the cooldown window, Dependabot can still select the newest older allowed tag that is outside the cooldown window (instead of returning “no viable filtered release”).

Changes:

• Add tag→release-date retrieval to evaluate cooldown across all allowed version tags.
• Rework cooldown_filter to select the newest allowed tag not in cooldown, based on a computed “in cooldown” set.
• Add/adjust specs for cooldown date parsing and tag selection logic.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
github_actions/lib/dependabot/github_actions/update_checker/latest_version_finder.rb	Reworks cooldown filtering to consider all allowed tags and adds helper methods/constants for date handling.
github_actions/lib/dependabot/github_actions/package/package_details_fetcher.rb	Introduces tag+release-date fetching and combines release dates with allowed version tags.
github_actions/spec/dependabot/github_actions/update_checker/latest_version_finder_spec.rb	Adds unit coverage for new cooldown helper methods and tag selection.
github_actions/spec/dependabot/github_actions/update_checker_spec.rb	Updates cooldown-related scenarios to account for new git-based release-date lookups.
github_actions/spec/dependabot/github_actions/package/package_details_fetcher_spec.rb	Adds spec coverage for fetch_tag_and_release_date.

[thavaahariharangit]

I’m asking you to run the CLI against the workflow to confirm that everything works as expected. RSpec only validates functionality at the unit level, As most of the APIs and layers are mocked. So please perform an end‑to‑end test as well.

That's why I gave the workflow, to run dependabot cli and confirm the expected results
https://github.com/Homebrew/homebrew-brew-vulns/actions/runs/23637238472/job/68849057678

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 6 comments.

[thavaahariharangit]

This update is working as expected. But copilot comments needs to be addressed

Before this update:

updater | 2026/04/09 08:48:27 INFO Finished job processing
updater | 2026/04/09 08:48:27 INFO Results:
updater | +----------------------------------------------------------+
updater | |           Changes to Dependabot Pull Requests            |
updater | +---------+------------------------------------------------+
updater | | created | github/codeql-action ( from 4.32.6 to 4.35.1 ) |
updater | +---------+------------------------------------------------+
  proxy | 2026/04/09 08:48:27 90/126 calls cached (71%)
  proxy | 2026/04/09 08:48:27 Skipping sending metrics because api endpoint is empty

After this update:

updater | 2026/04/09 08:53:51 INFO Results:
updater | +-------------------------------------------------------------------------------------------------------+
updater | |                                  Changes to Dependabot Pull Requests                                  |
updater | +---------+---------------------------------------------------------------------------------------------+
updater | | created | github/codeql-action ( from 4.32.6 to 4.35.1 ), ruby/setup-ruby ( from 1.288.0 to 1.299.0 ) |
updater | +---------+---------------------------------------------------------------------------------------------+
  proxy | 2026/04/09 08:53:52 Skipping sending metrics because api endpoint is empty

[thavaahariharangit]

Took a pass through the changes. The fix itself works — cooldown filtering now properly walks tags and falls back to older versions, which is a real improvement. Left some inline comments, mostly about duplication and divergence from shared patterns.

[thavaahariharangit]

Verified that the PR behaves as intended and confirmed the code meets quality standards.