Paginate Docker tag listing and classify registry error responses

[robaiken]

Summary

Docker/docker_compose update jobs fail with unknown_error for images whose registry can't return the full tag list in one response. The clearest case is images with very large tag counts — e.g. hexpm/elixir has ~993k tags, so Docker Hub's GET /v2/hexpm/elixir/tags/list (requested unpaginated) times out with an HTTP 504 after 30s on every run.

Root cause: Dependabot::Docker::UpdateChecker#tags_from_registry requests the tag list without a page size, and the docker_registry2 gem wraps the resulting 504 in DockerRegistry2::RegistryHTTPException, which wasn't rescued — so it surfaced as unknown_error. Separately, a 403 raises RegistryAuthorizationException (sibling of the already-handled RegistryAuthenticationException), which was also unclassified.

Changes

• Paginate on demand. tags_from_registry now makes a single unpaginated request for the common case, and falls back to a paginated request (?n=100) when the registry can't return the full list at once, following the registry's pagination links. This keeps the efficient single call for normal images while avoiding the 504 for large ones.
• Classify registry 5xx. RegistryHTTPException (incl. 504) now raises PrivateSourceBadResponse instead of unknown_error.
• Classify 403. RegistryAuthorizationException now raises PrivateSourceAuthenticationFailure alongside the existing 401 handling, at every registry-touching rescue site.

This also fixes the docker_compose ecosystem, which reuses Dependabot::Docker::UpdateChecker.

Tests

• 504 → paginated fallback resolves the latest version (asserts the ?n=100 request is made).
• Persistent 504 → PrivateSourceBadResponse.
• 403 → PrivateSourceAuthenticationFailure.

Full docker suite: 573 examples, 0 failures; RuboCop clean; Sorbet No errors!.

Note

Pagination resolves the general class of failure. For pathological tag counts like hexpm/elixir (~1M tags), paginating at 100/page is many round-trips; a follow-up could cap the number of pages/tags fetched, but that's out of scope here.

[Copilot]

Pull request overview

Adds resilient Docker registry tag retrieval and clearer registry error classification.

Changes:

• Falls back to paginated tag retrieval after registry HTTP failures.
• Classifies 403 and persistent registry failures appropriately.
• Adds regression coverage for fallback and error handling.

Show a summary per file

File	Description
docker/lib/dependabot/docker/update_checker.rb	Implements pagination fallback and registry exception handling.
docker/spec/dependabot/docker/update_checker_spec.rb	Tests 403, successful 504 fallback, and persistent 504 behavior.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 0
• Review effort level: Medium

[robaiken]

Superseded by #15651, which opens the same change from a branch on dependabot/dependabot-core rather than a fork.