dependabot-gradle 0.320.0 → 0.320.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ae374cdbd3063f10d8e5bff56047b4ce71a93ba34e38fe65aece2d5a0976d58a
-  data.tar.gz: 7334fea2720015456d756a60c58baf745092f818b4186a4cd605d9010f627910
+  metadata.gz: 31067c56f37f35e9c1bcf8783e119cb0e84e497afd66f5ae519feddddaabd1ec
+  data.tar.gz: 61c257a69fa157d23ba11254a83d18cb27e29a0439fe0d3c20562d6f65423259
 SHA512:
-  metadata.gz: 3d0576c61f8881dab4d89e382d689124c3ea6634cb582bf789c63193b7148acdbea576d381412c352f27c93edf49933684a8a9ecdd360814abc474761cea25e0
-  data.tar.gz: 6980420566a75d5dbc813d9026fecfd36ec238757e7264f002dbfc03c6a47fed05af8e4ab1f06ee388a9c1157afe8b740aea8a33590792214649aef271c60ca5
+  metadata.gz: 5ed3ef4e13f13f6de42a7b2a929dc8ef9af2fcc0cd65f2e661c4aa918cf18e2805d134bb92ae1fbb83b49231490d3f37ff3462335f1435e16a21c054871edd43
+  data.tar.gz: b7c9591526fa54fbede3cbb0161a3951ef3fe199aeff3cebb293684026b1b9ac1a94183c4d87d81c10b78be5632a17a966fc461eeaee07a8d94cc1c2e63f123c

data/lib/dependabot/gradle/file_parser/property_value_finder.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"
@@ -68,16 +68,23 @@ module Dependabot
           /(#{REGULAR_NAMESPACED_DECLARATION_REGEX}|#{KOTLIN_MAP_NAMESPACED_DECLARATION_REGEX})/
         # rubocop:enable Layout/LineLength
 
+        sig { params(dependency_files: T::Array[Dependabot::DependencyFile]).void }
         def initialize(dependency_files:)
-          @dependency_files = dependency_files
+          @dependency_files = T.let(dependency_files, T::Array[Dependabot::DependencyFile])
+          @properties = T.let({}, T::Hash[String, T::Hash[String, T::Hash[Symbol, String]]])
+          @top_level_buildfile = T.let(nil, T.nilable(Dependabot::DependencyFile))
         end
 
+        sig do
+          params(property_name: String, callsite_buildfile: Dependabot::DependencyFile)
+            .returns(T.nilable(T::Hash[Symbol, String]))
+        end
         def property_details(property_name:, callsite_buildfile:)
           # If the root project was specified, just look in the top-level
           # buildfile
           if property_name.start_with?("rootProject.")
             property_name = property_name.sub("rootProject.", "")
-            return properties(top_level_buildfile).fetch(property_name, nil)
+            return properties(T.must(top_level_buildfile)).fetch(property_name, nil)
           end
 
           # If this project was specified strip the specifier
@@ -90,7 +97,7 @@ module Dependabot
           # for the property in the top-level buildfile
           all_files = [callsite_buildfile, top_level_buildfile].concat(
             FileParser.find_includes(callsite_buildfile, dependency_files),
-            FileParser.find_includes(top_level_buildfile, dependency_files)
+            top_level_buildfile ? FileParser.find_includes(T.must(top_level_buildfile), dependency_files) : []
           ).compact
           all_files.each do |file|
             details = properties(file).fetch(property_name, nil)
@@ -99,6 +106,7 @@ module Dependabot
           nil
         end
 
+        sig { params(property_name: String, callsite_buildfile: Dependabot::DependencyFile).returns(T.nilable(String)) }
         def property_value(property_name:, callsite_buildfile:)
           property_details(
             property_name: property_name,
@@ -108,26 +116,23 @@ module Dependabot
 
         private
 
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         attr_reader :dependency_files
 
+        sig { params(buildfile: Dependabot::DependencyFile).returns(T::Hash[String, T::Hash[Symbol, String]]) }
         def properties(buildfile)
-          @properties ||= {}
-          return @properties[buildfile.name] if @properties[buildfile.name]
-
-          @properties[buildfile.name] = {}
-
-          @properties[buildfile.name]
-            .merge!(fetch_single_property_declarations(buildfile))
+          @properties[buildfile.name] ||= {}
+          buildfile_props = T.must(@properties[buildfile.name])
+          buildfile_props.merge!(fetch_single_property_declarations(buildfile))
 
-          @properties[buildfile.name]
-            .merge!(fetch_kotlin_block_property_declarations(buildfile))
+          buildfile_props.merge!(fetch_kotlin_block_property_declarations(buildfile))
 
-          @properties[buildfile.name]
-            .merge!(fetch_multi_property_declarations(buildfile))
+          buildfile_props.merge!(fetch_multi_property_declarations(buildfile))
 
-          @properties[buildfile.name]
+          buildfile_props
         end
 
+        sig { params(buildfile: Dependabot::DependencyFile).returns(T::Hash[String, T::Hash[Symbol, String]]) }
         def fetch_single_property_declarations(buildfile)
           properties = {}
 
@@ -148,6 +153,7 @@ module Dependabot
           properties
         end
 
+        sig { params(buildfile: Dependabot::DependencyFile).returns(T::Hash[String, T::Hash[Symbol, String]]) }
         def fetch_kotlin_block_property_declarations(buildfile)
           properties = {}
 
@@ -178,6 +184,7 @@ module Dependabot
           properties
         end
 
+        sig { params(buildfile: Dependabot::DependencyFile).returns(T::Hash[String, T::Hash[Symbol, String]]) }
         def fetch_multi_property_declarations(buildfile)
           properties = {}
 
@@ -202,13 +209,15 @@ module Dependabot
           properties
         end
 
+        sig { params(buildfile: Dependabot::DependencyFile).returns(String) }
         def prepared_content(buildfile)
           # Remove any comments
-          buildfile.content
-                   .gsub(%r{(?<=^|\s)//.*$}, "\n")
-                   .gsub(%r{(?<=^|\s)/\*.*?\*/}m, "")
+          T.must(buildfile.content)
+           .gsub(%r{(?<=^|\s)//.*$}, "\n")
+           .gsub(%r{(?<=^|\s)/\*.*?\*/}m, "")
         end
 
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def top_level_buildfile
           @top_level_buildfile ||= dependency_files.find do |f|
             SUPPORTED_BUILD_FILE_NAMES.include?(f.name)

data/lib/dependabot/gradle/file_parser/repositories_finder.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "sorbet-runtime"
@@ -11,8 +11,8 @@ module Dependabot
       class RepositoriesFinder
         extend T::Sig
 
-        SUPPORTED_BUILD_FILE_NAMES = %w(build.gradle build.gradle.kts).freeze
-        SUPPORTED_SETTINGS_FILE_NAMES = %w(settings.gradle settings.gradle.kts).freeze
+        SUPPORTED_BUILD_FILE_NAMES = T.let(%w(build.gradle build.gradle.kts).freeze, T::Array[String])
+        SUPPORTED_SETTINGS_FILE_NAMES = T.let(%w(settings.gradle settings.gradle.kts).freeze, T::Array[String])
 
         # The Central Repo doesn't have special status for Gradle, but until
         # we're confident we're selecting repos correctly it's wise to include
@@ -29,17 +29,27 @@ module Dependabot
 
         MAVEN_REPO_REGEX = /(#{KOTLIN_MAVEN_REPO_REGEX}|#{GROOVY_MAVEN_REPO_REGEX})/
 
+        sig do
+          params(
+            dependency_files: T::Array[Dependabot::DependencyFile],
+            target_dependency_file: T.nilable(Dependabot::DependencyFile)
+          ).void
+        end
         def initialize(dependency_files:, target_dependency_file:)
-          @dependency_files = dependency_files
-          @target_dependency_file = target_dependency_file
+          @dependency_files = T.let(dependency_files, T::Array[Dependabot::DependencyFile])
           raise "No target file!" unless target_dependency_file
+
+          @target_dependency_file = T.let(target_dependency_file, Dependabot::DependencyFile)
         end
 
+        sig { returns(T::Array[String]) }
         def repository_urls
-          repository_urls = []
+          repository_urls = T.let([], T::Array[String])
           repository_urls += inherited_repository_urls(top_level_buildfile)
-          FileParser.find_includes(top_level_buildfile, dependency_files).each do |dependency_file|
-            repository_urls += inherited_repository_urls(dependency_file)
+          if top_level_buildfile
+            FileParser.find_includes(T.must(top_level_buildfile), dependency_files).each do |dependency_file|
+              repository_urls += inherited_repository_urls(dependency_file)
+            end
           end
           repository_urls += own_buildfile_repository_urls
           repository_urls += settings_file_repository_urls(top_level_settings_file)
@@ -52,45 +62,50 @@ module Dependabot
 
         private
 
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         attr_reader :dependency_files
+
+        sig { returns(Dependabot::DependencyFile) }
         attr_reader :target_dependency_file
 
+        sig { params(dependency_file: T.nilable(Dependabot::DependencyFile)).returns(T::Array[String]) }
         def inherited_repository_urls(dependency_file)
           return [] unless dependency_file
 
           buildfile_content = comment_free_content(dependency_file)
-          subproject_blocks = []
+          subproject_blocks = T.let([], T::Array[String])
 
           buildfile_content.scan(/(?:^|\s)allprojects\s*\{/) do
             mtch = T.must(Regexp.last_match)
             subproject_blocks <<
-              mtch.post_match[0..closing_bracket_index(mtch.post_match)]
+              T.must(mtch.post_match[0..closing_bracket_index(mtch.post_match)])
           end
 
           if top_level_buildfile != target_dependency_file
             buildfile_content.scan(/(?:^|\s)subprojects\s*\{/) do
               mtch = T.must(Regexp.last_match)
               subproject_blocks <<
-                mtch.post_match[0..closing_bracket_index(mtch.post_match)]
+                T.must(mtch.post_match[0..closing_bracket_index(mtch.post_match)])
             end
           end
 
           repository_urls_from(subproject_blocks.join("\n"))
         end
 
+        sig { returns(T::Array[String]) }
         def own_buildfile_repository_urls
           return [] unless top_level_buildfile
 
-          buildfile_content = comment_free_content(top_level_buildfile)
+          buildfile_content = comment_free_content(T.must(top_level_buildfile))
 
-          own_buildfile_urls = []
+          own_buildfile_urls = T.let([], T::Array[String])
 
-          subproject_buildfile_content = buildfile_content.dup.scan(/(?:^|\s)subprojects\s*\{/) do
+          subproject_buildfile_content = buildfile_content.dup
+          buildfile_content.scan(/(?:^|\s)subprojects\s*\{/) do
             mtch = T.must(Regexp.last_match)
-            buildfile_content.gsub(
-              mtch.post_match[0..closing_bracket_index(mtch.post_match)],
-              ""
-            )
+            post_match = mtch.post_match
+            section_to_remove = post_match[0..closing_bracket_index(post_match)]
+            subproject_buildfile_content = subproject_buildfile_content.gsub(section_to_remove, "") if section_to_remove
           end
 
           own_buildfile_urls += repository_urls_from(buildfile_content)
@@ -98,29 +113,31 @@ module Dependabot
           own_buildfile_urls
         end
 
+        sig { params(settings_file: T.nilable(Dependabot::DependencyFile)).returns(T::Array[String]) }
         def settings_file_repository_urls(settings_file)
           return [] unless settings_file
 
           settings_file_content = comment_free_content(settings_file)
-          dependency_resolution_management_repositories = []
+          dependency_resolution_management_repositories = T.let([], T::Array[String])
 
           settings_file_content.scan(/(?:^|\s)dependencyResolutionManagement\s*\{/) do
             mtch = T.must(Regexp.last_match)
             dependency_resolution_management_repositories <<
-              mtch.post_match[0..closing_bracket_index(mtch.post_match)]
+              T.must(mtch.post_match[0..closing_bracket_index(mtch.post_match)])
           end
 
           repository_urls_from(dependency_resolution_management_repositories.join("\n"))
         end
 
-        def repository_urls_from(buildfile_content)
-          repository_urls = []
+        sig { params(buildfile_content: String).returns(T::Array[String]) }
+        def repository_urls_from(buildfile_content) # rubocop:disable Metrics/AbcSize
+          repository_urls = T.let([], T::Array[String])
 
-          repository_blocks = []
+          repository_blocks = T.let([], T::Array[String])
           buildfile_content.scan(REPOSITORIES_BLOCK_START) do
             mtch = T.must(Regexp.last_match)
             repository_blocks <<
-              mtch.post_match[0..closing_bracket_index(mtch.post_match)]
+              T.must(mtch.post_match[0..closing_bracket_index(mtch.post_match)])
           end
 
           repository_blocks.each do |block|
@@ -133,7 +150,7 @@ module Dependabot
             repository_urls << GRADLE_PLUGINS_REPO if block.match?(/\sgradlePluginPortal\(/)
 
             block.scan(MAVEN_REPO_REGEX) do
-              repository_urls << T.must(Regexp.last_match).named_captures.fetch("url")
+              repository_urls << T.must(T.must(Regexp.last_match).named_captures.fetch("url"))
             end
           end
 
@@ -143,6 +160,7 @@ module Dependabot
             .uniq
         end
 
+        sig { params(string: String).returns(Integer) }
         def closing_bracket_index(string)
           closes_required = 1
 
@@ -155,6 +173,7 @@ module Dependabot
           0
         end
 
+        sig { params(url: String).returns(T::Boolean) }
         def valid_url?(url)
           # Reject non-http URLs because they're probably parsing mistakes
           return false unless url.start_with?("http")
@@ -165,22 +184,31 @@ module Dependabot
           false
         end
 
+        sig { params(buildfile: Dependabot::DependencyFile).returns(String) }
         def comment_free_content(buildfile)
-          buildfile.content
-                   .gsub(%r{(?<=^|\s)//.*$}, "\n")
-                   .gsub(%r{(?<=^|\s)/\*.*?\*/}m, "")
+          T.must(buildfile.content)
+           .gsub(%r{(?<=^|\s)//.*$}, "\n")
+           .gsub(%r{(?<=^|\s)/\*.*?\*/}m, "")
         end
 
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def top_level_buildfile
-          @top_level_buildfile ||= dependency_files.find do |f|
-            SUPPORTED_BUILD_FILE_NAMES.include?(f.name)
-          end
+          @top_level_buildfile = T.let(
+            @top_level_buildfile || dependency_files.find do |f|
+              SUPPORTED_BUILD_FILE_NAMES.include?(f.name)
+            end,
+            T.nilable(Dependabot::DependencyFile)
+          )
         end
 
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def top_level_settings_file
-          @top_level_settings_file ||= dependency_files.find do |f|
-            SUPPORTED_SETTINGS_FILE_NAMES.include?(f.name)
-          end
+          @top_level_settings_file = T.let(
+            @top_level_settings_file || dependency_files.find do |f|
+              SUPPORTED_SETTINGS_FILE_NAMES.include?(f.name)
+            end,
+            T.nilable(Dependabot::DependencyFile)
+          )
         end
       end
     end