dependabot-gradle 0.375.0 → 0.376.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 32cf71eceb94cce61d93df445d82e2a7c850239262817e12bb32951c40bb6993
-  data.tar.gz: 8c284ae6607e962e164ec4b62f27f8c1e3e579c182f2c41b735ce6b8a3acd36a
+  metadata.gz: 927977ff944f07aab10b9338ca71c9540520dc07a97f3db8cf2aa9b27d325d9f
+  data.tar.gz: b618b2c6aaeb01de38041a829a0b1f650604df9791889323fe8066388b3e3aeb
 SHA512:
-  metadata.gz: 1b8f8766524956880f2d857f5e4766d5caf0faf38535e83a445bb22eb8a302f01858586fe78d056594a4be5562b85733bf538f11fc637682b891649ce22580bf
-  data.tar.gz: 41cc0d7e7791dffed1f27d7c280a0eff38d8eec076652da7dcce6a4d138e7d0ea8a98895250268b23dadf48fa3ff0cda7ed67d438b049b393073b420fbf2f9cb
+  metadata.gz: 648c6a0d23f8ae1f8026a10d19e66766a14c29be9e4fe3b46cc6386b0b24e82328e357b9504b40b61612322cddff3ab4ad786beca3a1d5d70dc9e42b321aebaf
+  data.tar.gz: 289b073da8a00a76bf0f2b636e8429d76a4472eba85057e4d4630b981b30554a674cbdd23879f3446a78f2a874903089ac00dfdd1f4de44072393245c7ec82e1

data/lib/dependabot/gradle/file_updater/lockfile_updater.rb

@@ -1,10 +1,10 @@
 # typed: strong
 # frozen_string_literal: true
 
-require "sorbet-runtime"
+require "fileutils"
 require "shellwords"
+require "sorbet-runtime"
 
-require "dependabot/gradle/file_parser"
 require "dependabot/gradle/file_updater"
 
 module Dependabot
@@ -13,6 +13,8 @@ module Dependabot
       class LockfileUpdater
         extend T::Sig
 
+        INIT_SCRIPT_TASK_NAME = T.let("dependabotResolveAll", String)
+
         sig { params(dependency_files: T::Array[Dependabot::DependencyFile]).void }
         def initialize(dependency_files:)
           @dependency_files = dependency_files
@@ -20,67 +22,159 @@ module Dependabot
 
         sig { params(build_file: Dependabot::DependencyFile).returns(T::Array[Dependabot::DependencyFile]) }
         def update_lockfiles(build_file)
-          local_lockfiles = dependency_files.select do |file|
-            file.directory == build_file.directory && file.name.end_with?(".lockfile")
-          end
+          root_dir = determine_root_dir(build_file: build_file)
+          lockfiles = lockfiles_for_root(root_dir)
 
-          # If we don't have any lockfiles in the build files don't generate one
-          return dependency_files unless local_lockfiles.any?
+          return dependency_files unless lockfiles.any?
 
           updated_files = dependency_files.dup
+
           SharedHelpers.in_a_temporary_directory do |temp_dir|
             populate_temp_directory(temp_dir)
-            cwd = File.join(temp_dir, build_file.directory, build_file.name)
-            cwd = if build_file.path.end_with?("/gradle/libs.versions.toml")
-                    File.dirname(cwd, 2)
-                  else
-                    File.dirname(cwd)
-                  end
-
-            # Create gradle.properties file with proxy settings
-            # Would prefer to use command line arguments, but they don't work.
-            properties_filename = File.join(temp_dir, build_file.directory, "gradle.properties")
-            write_properties_file(properties_filename)
+
+            cwd = File.join(temp_dir, root_dir == "/" ? "" : root_dir.delete_prefix("/"))
+            FileUtils.mkdir_p(cwd)
+
+            write_properties_file(File.join(cwd, "gradle.properties"))
+
+            init_script_path = File.join(cwd, "dependabot-locking.init.gradle")
+            write_init_script(init_script_path)
 
             command_parts = [
               "gradle",
-              "dependencies",
-              "--no-daemon",
-              "--write-locks"
+              "--init-script", init_script_path,
+              INIT_SCRIPT_TASK_NAME,
+              "--write-locks",
+              "--no-daemon"
             ]
             command = Shellwords.join(command_parts)
 
-            Dir.chdir(cwd) do
-              SharedHelpers.run_shell_command(command, cwd: cwd)
-              update_lockfiles_content(temp_dir, local_lockfiles, updated_files)
-            rescue SharedHelpers::HelperSubprocessFailed => e
-              puts "Failed to update lockfiles: #{e.message}"
-              return updated_files
-            end
+            SharedHelpers.run_shell_command(command, cwd: cwd)
+
+            update_lockfiles_content(temp_dir, lockfiles, updated_files)
+          rescue SharedHelpers::HelperSubprocessFailed => e
+            Dependabot.logger.error("Failed to update lockfiles: #{e.message}")
+            return updated_files
           end
+
           updated_files
         end
 
+        sig { params(build_file: Dependabot::DependencyFile).returns(String) }
+        def determine_root_dir(build_file:)
+          settings_file = find_settings_file(build_file)
+          return normalized_directory_path(settings_file) if settings_file
+
+          file_path = normalized_file_path(build_file)
+          return normalize_path(File.dirname(file_path, 2)) if file_path.end_with?("/gradle/libs.versions.toml")
+
+          normalized_directory_path(build_file)
+        end
+
+        sig { params(file: Dependabot::DependencyFile).returns(String) }
+        def normalized_directory_path(file)
+          file_path = normalized_file_path(file)
+          dir = File.dirname(file_path)
+          dir == "/" ? "/" : normalize_path(dir)
+        end
+
+        sig { params(root_dir: String).returns(T::Array[Dependabot::DependencyFile]) }
+        def lockfiles_for_root(root_dir)
+          sub_build_roots = sub_build_roots_for(root_dir)
+
+          dependency_files.select do |file|
+            next false unless file.name.end_with?(".lockfile")
+
+            file_path = normalized_file_path(file)
+            next false unless path_under_root?(file_path, root_dir)
+
+            sub_build_roots.none? { |sub_root| file_path.start_with?("#{sub_root}/") || file_path == sub_root }
+          end
+        end
+
         sig do
           params(
             temp_dir: T.any(Pathname, String),
-            local_lockfiles: T::Array[Dependabot::DependencyFile],
+            lockfiles: T::Array[Dependabot::DependencyFile],
             updated_lockfiles: T::Array[Dependabot::DependencyFile]
           ).void
         end
-        def update_lockfiles_content(temp_dir, local_lockfiles, updated_lockfiles)
-          local_lockfiles.each do |file|
-            f_content = File.read(File.join(temp_dir, file.directory, file.name))
+        def update_lockfiles_content(temp_dir, lockfiles, updated_lockfiles)
+          lockfiles.each do |file|
+            # Handle "/" directory as root - File.join treats "/" as absolute path and ignores prior components
+            relative_dir = file.directory == "/" ? "" : file.directory
+            lockfile_path = File.join(temp_dir, relative_dir, file.name)
+
+            unless File.exist?(lockfile_path)
+              Dependabot.logger.warn(
+                "Lockfile #{file.name} was not regenerated by Gradle after a successful lockfile update run. " \
+                "Preserving existing lockfile."
+              )
+              next
+            end
+
+            content = File.read(lockfile_path)
+            next if content == file.content
+
             tmp_file = file.dup
-            tmp_file.content = f_content
-            updated_lockfiles[T.must(updated_lockfiles.index(file))] = tmp_file
+            tmp_file.content = content
+
+            index = updated_lockfiles.find_index { |f| f.name == file.name }
+            if index
+              updated_lockfiles[index] = tmp_file
+            else
+              updated_lockfiles << tmp_file
+            end
+          end
+        end
+
+        private
+
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
+        attr_reader :dependency_files
+
+        sig { params(file_path: String, root_dir: String).returns(T::Boolean) }
+        def path_under_root?(file_path, root_dir)
+          root_dir == "/" || file_path == root_dir || file_path.start_with?("#{root_dir}/")
+        end
+
+        # Find all sub-build roots (settings files deeper than root_dir) so we can
+        # exclude lockfiles that belong to an included/composite build.
+        sig { params(root_dir: String).returns(T::Array[String]) }
+        def sub_build_roots_for(root_dir)
+          dependency_files.filter_map do |f|
+            basename = File.basename(f.name)
+            next unless basename == "settings.gradle" || basename == "settings.gradle.kts"
+
+            dir = normalized_directory_path(f)
+            next if dir == root_dir
+
+            dir if path_under_root?(dir, root_dir)
           end
         end
 
+        sig { params(file: Dependabot::DependencyFile).returns(String) }
+        def normalized_file_path(file)
+          # Handle "/" directory as root - File.join treats "/" as absolute path and ignores prior components
+          relative_dir = file.directory == "/" ? "" : file.directory
+          path = relative_dir.empty? ? file.name : File.join(relative_dir, file.name)
+          normalize_path(path)
+        end
+
+        sig { params(path: String).returns(String) }
+        def normalize_path(path)
+          normalized = path.squeeze("/")
+          normalized = "/#{normalized}" unless normalized.start_with?("/")
+          normalized = normalized.sub(%r{/$}, "")
+          normalized.empty? ? "/" : normalized
+        end
+
         sig { params(temp_dir: T.any(Pathname, String)).void }
         def populate_temp_directory(temp_dir)
           @dependency_files.each do |file|
-            in_path_name = File.join(temp_dir, file.directory, file.name)
+            # Handle "/" directory as root - File.join treats "/" as absolute path and ignores prior components
+            relative_dir = file.directory == "/" ? "" : file.directory
+            in_path_name = File.join(temp_dir, relative_dir, file.name)
             FileUtils.mkdir_p(File.dirname(in_path_name))
             File.write(in_path_name, file.content)
           end
@@ -96,6 +190,7 @@ module Dependabot
           https_proxy_host = https_split&.fetch(1, nil)&.gsub("//", "") || "host.docker.internal"
           http_proxy_port = http_split&.fetch(2) || "1080"
           https_proxy_port = https_split&.fetch(2) || "1080"
+
           properties_content = "
 systemProp.http.proxyHost=#{http_proxy_host}
 systemProp.http.proxyPort=#{http_proxy_port}
@@ -104,10 +199,46 @@ systemProp.https.proxyPort=#{https_proxy_port}"
           File.write(file_name, properties_content)
         end
 
-        private
+        sig { params(file_name: String).void }
+        def write_init_script(file_name)
+          # Resolve all resolvable configurations across all loaded projects so
+          # Gradle rewrites every relevant lockfile in one invocation.
+          script_content = <<~GRADLE
+            allprojects {
+              if (tasks.findByName("#{INIT_SCRIPT_TASK_NAME}") == null) {
+                tasks.register("#{INIT_SCRIPT_TASK_NAME}") {
+                  doLast {
+                    configurations.findAll { it.canBeResolved }.each { it.resolve() }
+                  }
+                }
+              }
+            }
+          GRADLE
+          File.write(file_name, script_content)
+        end
 
-        sig { returns(T::Array[Dependabot::DependencyFile]) }
-        attr_reader :dependency_files
+        sig { params(build_file: Dependabot::DependencyFile).returns(T.nilable(Dependabot::DependencyFile)) }
+        def find_settings_file(build_file)
+          settings_files = dependency_files.select do |f|
+            basename = File.basename(f.name)
+            basename == "settings.gradle" || basename == "settings.gradle.kts"
+          end
+
+          return nil if settings_files.empty?
+
+          build_dir = normalized_directory_path(build_file)
+
+          ancestor_settings = settings_files.select do |f|
+            settings_dir = normalized_directory_path(f)
+            path_under_root?(build_dir, settings_dir)
+          end
+
+          return nil if ancestor_settings.empty?
+
+          ancestor_settings.max_by do |f|
+            normalized_directory_path(f).split("/").count { |element| !element.empty? }
+          end
+        end
       end
     end
   end

data/lib/dependabot/gradle/file_updater/property_value_updater.rb

@@ -5,81 +5,22 @@ require "sorbet-runtime"
 
 require "dependabot/gradle/file_updater"
 require "dependabot/gradle/file_parser/property_value_finder"
+require "dependabot/maven/shared/shared_property_value_updater"
 
 module Dependabot
   module Gradle
     class FileUpdater
-      class PropertyValueUpdater
+      class PropertyValueUpdater < Dependabot::Maven::Shared::SharedPropertyValueUpdater
         extend T::Sig
 
-        sig { params(dependency_files: T::Array[DependencyFile]).void }
-        def initialize(dependency_files:)
-          @dependency_files = dependency_files
-          @property_value_finder = T.let(nil, T.nilable(Gradle::FileParser::PropertyValueFinder))
-        end
-
-        sig do
-          params(
-            property_name: String,
-            callsite_buildfile: DependencyFile,
-            previous_value: String,
-            updated_value: String
-          )
-            .returns(T::Array[DependencyFile])
-        end
-        def update_files_for_property_change(
-          property_name:,
-          callsite_buildfile:,
-          previous_value:,
-          updated_value:
-        )
-          declaration_details = T.must(
-            property_value_finder.property_details(
-              property_name: property_name,
-              callsite_buildfile: callsite_buildfile
-            )
-          )
-          declaration_string = declaration_details.fetch(:declaration_string)
-          filename = declaration_details.fetch(:file)
-
-          file_to_update = T.must(dependency_files.find { |f| f.name == filename })
-          updated_content = T.must(file_to_update.content).sub(
-            declaration_string,
-            declaration_string.sub(
-              previous_value_regex(previous_value),
-              updated_value
-            )
-          )
-
-          updated_files = dependency_files.dup
-          updated_files[T.must(updated_files.index(file_to_update))] =
-            update_file(file: file_to_update, content: updated_content)
-
-          updated_files
-        end
-
         private
 
-        sig { returns(T::Array[DependencyFile]) }
-        attr_reader :dependency_files
-
-        sig { returns(Gradle::FileParser::PropertyValueFinder) }
+        sig { override.returns(Gradle::FileParser::PropertyValueFinder) }
         def property_value_finder
-          @property_value_finder ||=
-            Gradle::FileParser::PropertyValueFinder
-            .new(dependency_files: dependency_files)
-        end
-
-        sig { params(file: DependencyFile, content: String).returns(DependencyFile) }
-        def update_file(file:, content:)
-          updated_file = file.dup
-          updated_file.content = content
-          updated_file
-        end
-
-        sig { params(previous_value: String).returns(Regexp) }
-        def previous_value_regex(previous_value)
-          /(?<=['"])#{Regexp.quote(previous_value)}(?=['"])/
+          @property_value_finder ||= T.let(
+            Gradle::FileParser::PropertyValueFinder.new(dependency_files: dependency_files),
+            T.nilable(Gradle::FileParser::PropertyValueFinder)
+          )
         end
       end
     end

data/lib/dependabot/gradle/file_updater.rb

@@ -107,17 +107,34 @@ module Dependabot
           replace_updated_files(files, updated_files)
         end
         if Dependabot::Experiments.enabled?(:gradle_lockfile_updater)
-          buildfiles_processed.each_value do |buildfile|
-            lockfile_updater = LockfileUpdater.new(dependency_files: files)
-            updated_files = lockfile_updater.update_lockfiles(buildfile)
-            replace_updated_files(files, updated_files)
-          end
+          update_lockfiles_for_buildfiles(files, buildfiles_processed)
         end
 
         files
       end
       # rubocop:enable Metrics/PerceivedComplexity
       # rubocop:enable Metrics/AbcSize
+
+      sig do
+        params(
+          files: T::Array[Dependabot::DependencyFile],
+          buildfiles_processed: T::Hash[String, Dependabot::DependencyFile]
+        ).void
+      end
+      def update_lockfiles_for_buildfiles(files, buildfiles_processed)
+        lockfile_roots_processed = T.let(Set.new, T::Set[String])
+
+        buildfiles_processed.each_value do |buildfile|
+          lockfile_updater = LockfileUpdater.new(dependency_files: files)
+          root_dir = lockfile_updater.determine_root_dir(build_file: buildfile)
+          next if lockfile_roots_processed.include?(root_dir)
+
+          lockfile_roots_processed.add(root_dir)
+
+          updated_files = lockfile_updater.update_lockfiles(buildfile)
+          replace_updated_files(files, updated_files)
+        end
+      end
       sig do
         params(
           files: T::Array[Dependabot::DependencyFile],

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-gradle
 version: !ruby/object:Gem::Version
-  version: 0.375.0
+  version: 0.376.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,28 +15,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.375.0
+        version: 0.376.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.375.0
+        version: 0.376.0
 - !ruby/object:Gem::Dependency
   name: dependabot-maven
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.375.0
+        version: 0.376.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.375.0
+        version: 0.376.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -285,7 +285,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.375.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.376.0
 rdoc_options: []
 require_paths:
 - lib