fix(github-actions): harden job container extraction (#19838)

lib/modules/manager/github-actions/extract.ts

@@ -1,11 +1,12 @@
+import is from '@sindresorhus/is';
 import { load } from 'js-yaml';
 import { logger } from '../../../logger';
 import { newlineRegex, regEx } from '../../../util/regex';
 import { GithubTagsDatasource } from '../../datasource/github-tags';
 import * as dockerVersioning from '../../versioning/docker';
 import { getDep } from '../dockerfile/extract';
 import type { PackageDependency, PackageFile } from '../types';
-import type { Container, Workflow } from './types';
+import type { Workflow } from './types';
 
 const dockerActionRe = regEx(/^\s+uses: ['"]?docker:\/\/([^'"]+)\s*$/);
 const actionRe = regEx(
@@ -76,14 +77,13 @@ function extractWithRegex(content: string): PackageDependency[] {
   return deps;
 }
 
-function extractContainer(container: string | Container): PackageDependency {
-  let dep: PackageDependency;
-  if (typeof container === 'string') {
-    dep = getDep(container);
-  } else {
-    dep = getDep(container?.image);
+function extractContainer(container: unknown): PackageDependency | undefined {
+  if (is.string(container)) {
+    return getDep(container);
+  } else if (is.plainObject(container) && is.string(container.image)) {
+    return getDep(container.image);
   }
-  return dep;
+  return undefined;
 }
 
 function extractWithYAMLParser(
@@ -105,16 +105,18 @@ function extractWithYAMLParser(
   }
 
   for (const job of Object.values(pkg?.jobs ?? {})) {
-    if (job.container !== undefined) {
-      const dep = extractContainer(job.container);
+    const dep = extractContainer(job.container);
+    if (dep) {
       dep.depType = 'container';
       deps.push(dep);
     }
 
     for (const service of Object.values(job.services ?? {})) {
       const dep = extractContainer(service);
-      dep.depType = 'service';
-      deps.push(dep);
+      if (dep) {
+        dep.depType = 'service';
+        deps.push(dep);
+      }
     }
   }