[Regression] github-actions: Existing same-precision tag masks a newer less-precise release

[z-Fng]

Is there an existing issue for this?

• I have searched the existing issues

Package ecosystem

github-actions

dependabot.yml content

---
# ~/.github/dependabot.yml
version: 2
updates:
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"
    commit-message:
      prefix: "(chore)"
    cooldown:
      default-days: 14

Updated dependency

Expected:

https://github.com/potatoqualitee/psmodulecache/releases/tag/v6.3

potatoqualitee/psmodulecache v6.2.1 -> v6.3

Actual:

No update needed for potatoqualitee/psmodulecache 6.2.1

What you expected to see, versus what you actually saw

Dependabot should preserve the behavior introduced by #9474, which allows a GitHub Action pinned to a more precise SemVer tag (v6.2.1) to update to a newer, less-precise version (v6.3). Instead, Dependabot reports the current version (v6.2.1) as the latest available version:

Checking if potatoqualitee/psmodulecache 6.2.1 needs updating
Available release version/ref is 6.2.1
Latest version is 6.2.1
No update needed for potatoqualitee/psmodulecache 6.2.1

This appears to be caused by the following logic:

dependabot-core/github_actions/lib/dependabot/github_actions/package/package_details_fetcher.rb

Lines 126 to 132 in 9716f04

	ref = git_commit_checker.local_ref_for_latest_version_matching_existing_precision
	return ref if ref && ref.fetch(:version) > current_version
	lower_precision_ref = git_commit_checker.local_ref_for_latest_version_lower_precision
	return ref if ref&.fetch(:version) == current_version
	lower_precision_ref

The early return was added in commit 072d040 as part of #15267. Its test covers preserving a full SemVer ref when the lower-precision candidate is semantically equivalent, such as:

v1.1.0 vs v1.1

However, the condition also blocks non-equivalent newer releases (#15267 (review)):

v1.1.0 vs v1.2