dependabot-gradle 0.389.0 → 0.390.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bbe1f38539a5dd887e3c8fa64bb88e70766c846ca198c504780303b63464c8ab
-  data.tar.gz: e5618a45ebe2bd554fb3edaf73b89e5472d5d334919676cac60e154a38b6853f
+  metadata.gz: 93f82ad110e67a9345a7a672f828eabb90aac5cfa6349d2f5ec939f18e4a16c5
+  data.tar.gz: ea556afb860bfd5bcbb565eb722ebb0523240163d8b99d197972771647dfd080
 SHA512:
-  metadata.gz: 0ef872f7affa834445ba93e8f1c47ced0bd9c77165edf43b07eac7de49f7b1d38bf22a80826ed1bf3849b922bd43ca4c1cfd1d72ad4da5c2e38afc7ed41bfdcb
-  data.tar.gz: 44b02a0f2b977a165d499c33405ddd12fc53424af928fcfa358ecd8c0184b592f60a5ed4455db2465b853b0a987c0c7daa07f247f4c3f15c55905b6425b4341d
+  metadata.gz: a447eb2f78a3ab4163126e1fc63bb472d8162a8b1f452de815e1d4fc84caf5610c107af127f9f770b06e06cfda024f9080f41c0b052c30443ed9f604139ff52d
+  data.tar.gz: 0551f56c448535c80265c04797a0af1f6f019b8250d41286b99901a2b1740de9bfc4b94eeae966283bbf6c4dbacfa5c0f2bfad7723ae76bf1ac3a7b3703dc145

data/lib/dependabot/gradle/file_fetcher/settings_file_parser.rb

@@ -33,6 +33,22 @@ module Dependabot
           subprojects.uniq.map { |name| process_subproject_name(name) }
         end
 
+        # Returns a map of filesystem directory path => Gradle project name for all declared subprojects.
+        # For example: { 'app' => ':app', 'subprojects/chrome-trace' => ':chrome-trace' }
+        # This correctly handles custom projectDir mappings in settings files.
+        sig { returns(T::Hash[String, String]) }
+        def subproject_path_to_name_map
+          subprojects = T.let([], T::Array[String])
+          process_include_functions(subprojects)
+          subprojects.uniq.each_with_object(T.let({}, T::Hash[String, String])) do |name, map|
+            path = process_subproject_name(name)
+            next unless path
+
+            # Normalise name to Gradle colon-separated project path (e.g. ':app', ':sub:module')
+            map[path] = ":#{name.sub(/^:/, '')}"
+          end
+        end
+
         private
 
         sig { params(subprojects: T::Array[String]).void }

data/lib/dependabot/gradle/file_fetcher.rb

@@ -35,6 +35,9 @@ module Dependabot
       SUPPORTED_VERSION_CATALOG_FILE_PATH =
         T.let(%w(/gradle/libs.versions.toml).freeze, T::Array[String])
 
+      PLUGIN_SOURCE_SET_DIRS =
+        T.let(%w(src/main/java src/main/kotlin src/main/groovy src/main/resources).freeze, T::Array[String])
+
       sig do
         override
           .params(
@@ -88,10 +91,74 @@ module Dependabot
         files += subproject_buildfiles(root_dir)
         files += subproject_lockfiles(root_dir)
         files += dependency_script_plugins(root_dir)
+        files += convention_plugin_source_files(files, root_dir) if fetch_plugin_sources_for_lockfiles?
+
         files + included_builds(root_dir)
                 .flat_map { |dir| all_buildfiles_in_build(dir) }
       end
 
+      sig { returns(T::Boolean) }
+      def fetch_plugin_sources_for_lockfiles?
+        Dependabot::Experiments.enabled?(:gradle_lockfile_updater)
+      end
+
+      # Only fetch source trees for *nested* project directories (e.g. "build-logic/convention"
+      # or "included/convention"), plus the root of a non-top-level build (e.g. "build-logic" or
+      # "buildSrc" itself), never the top-level repo root ("app" style modules of the outermost
+      # build). This targets the common convention-plugin module pattern - whether declared at an
+      # included/buildSrc build's own root or nested within it - without recursively scanning
+      # every ordinary top-level application module of the outermost build.
+      sig { params(files: T::Array[DependencyFile], root_dir: String).returns(T::Array[DependencyFile]) }
+      def convention_plugin_source_files(files, root_dir)
+        nested_plugin_project_dirs(files, root_dir).flat_map do |project_dir|
+          PLUGIN_SOURCE_SET_DIRS.flat_map do |relative_dir|
+            fetch_tree_support_files(clean_join([project_dir, relative_dir]))
+          end
+        end
+      end
+
+      sig { params(files: T::Array[DependencyFile], root_dir: String).returns(T::Array[String]) }
+      def nested_plugin_project_dirs(files, root_dir)
+        buildfile_dirs(files).select { |dir| plugin_source_eligible_dir?(dir, root_dir) }
+      end
+
+      # A directory is eligible for convention-plugin source scanning if it's nested below the
+      # outermost repo root (contains a "/"), or if it's the own root of a build that is itself
+      # nested (i.e. root_dir isn't the outermost "."), such as an included build or buildSrc.
+      sig { params(dir: String, root_dir: String).returns(T::Boolean) }
+      def plugin_source_eligible_dir?(dir, root_dir)
+        return true if root_dir != "." && dir == root_dir
+
+        dir.include?("/")
+      end
+
+      sig { params(files: T::Array[DependencyFile]).returns(T::Array[String]) }
+      def buildfile_dirs(files)
+        files.filter_map do |file|
+          next unless SUPPORTED_BUILD_FILE_NAMES.include?(File.basename(file.name))
+
+          clean_join([File.dirname(file.name)])
+        end
+      end
+
+      sig { params(dir: String).returns(T::Array[DependencyFile]) }
+      def fetch_tree_support_files(dir)
+        entries = repo_contents(dir: dir, raise_errors: false)
+        return [] if entries.empty?
+
+        entries.flat_map do |entry|
+          entry_path = clean_join([dir, entry.name])
+          if entry.type == "dir"
+            fetch_tree_support_files(entry_path)
+          else
+            file = fetch_support_file(entry_path)
+            file ? [file] : []
+          end
+        end
+      rescue Dependabot::DependencyFileNotFound
+        []
+      end
+
       sig { params(root_dir: String).returns(T::Array[String]) }
       def included_builds(root_dir)
         builds = []

data/lib/dependabot/gradle/file_updater/lockfile_updater.rb

@@ -7,6 +7,7 @@ require "shellwords"
 require "sorbet-runtime"
 
 require "dependabot/gradle/file_updater"
+require "dependabot/gradle/file_fetcher/settings_file_parser"
 
 module Dependabot
   module Gradle
@@ -15,14 +16,31 @@ module Dependabot
         extend T::Sig
 
         INIT_SCRIPT_TASK_NAME = T.let("dependabotResolveAll", String)
-
-        sig { params(dependency_files: T::Array[Dependabot::DependencyFile]).void }
-        def initialize(dependency_files:)
+        GRADLE_JVMARGS_ATTEMPTS = T.let(
+          [
+            "-Xmx1536m -Dfile.encoding=UTF-8",
+            "-Xmx2048m -Dfile.encoding=UTF-8"
+          ].freeze,
+          T::Array[String]
+        )
+        sig do
+          params(
+            dependency_files: T::Array[Dependabot::DependencyFile],
+            repo_contents_path: T.nilable(String)
+          ).void
+        end
+        def initialize(dependency_files:, repo_contents_path: nil)
           @dependency_files = dependency_files
+          @repo_contents_path = repo_contents_path
         end
 
-        sig { params(build_file: Dependabot::DependencyFile).returns(T::Array[Dependabot::DependencyFile]) }
-        def update_lockfiles(build_file)
+        sig do
+          params(
+            build_file: Dependabot::DependencyFile,
+            build_files: T::Array[Dependabot::DependencyFile]
+          ).returns(T::Array[Dependabot::DependencyFile])
+        end
+        def update_lockfiles(build_file, build_files: [build_file])
           root_dir = determine_root_dir(build_file: build_file)
           lockfiles = lockfiles_for_root(root_dir)
 
@@ -36,7 +54,7 @@ module Dependabot
             cwd = File.join(temp_dir, root_dir == "/" ? "" : root_dir.delete_prefix("/"))
             FileUtils.mkdir_p(cwd)
 
-            write_properties_file(File.join(cwd, "gradle.properties"))
+            properties_file_path = File.join(cwd, "gradle.properties")
 
             init_script_path = File.join(cwd, "dependabot-locking.init.gradle")
             write_init_script(init_script_path)
@@ -44,12 +62,17 @@ module Dependabot
             command_parts = [
               gradle_executable_for(cwd: cwd, workspace_root: temp_dir.to_s),
               "--init-script", init_script_path,
-              INIT_SCRIPT_TASK_NAME,
+              *lockfile_tasks_for(build_files),
               "--write-locks",
-              "--no-daemon"
+              "--no-daemon",
+              "--no-configuration-cache"
             ]
             command = Shellwords.join(command_parts)
-            SharedHelpers.run_shell_command(command, cwd: cwd)
+            run_lockfile_update_with_retry(
+              command: command,
+              cwd: cwd,
+              properties_file_path: properties_file_path
+            )
 
             update_lockfiles_content(temp_dir, lockfiles, updated_files)
           rescue SharedHelpers::HelperSubprocessFailed => e
@@ -171,6 +194,8 @@ module Dependabot
 
         sig { params(temp_dir: T.any(Pathname, String)).void }
         def populate_temp_directory(temp_dir)
+          copy_repo_contents_to_temp_dir(temp_dir, @repo_contents_path)
+
           @dependency_files.each do |file|
             # Handle "/" directory as root - File.join treats "/" as absolute path and ignores prior components
             relative_dir = file.directory == "/" ? "" : file.directory
@@ -180,8 +205,33 @@ module Dependabot
           end
         end
 
-        sig { params(file_name: String).void }
-        def write_properties_file(file_name) # rubocop:disable Metrics/PerceivedComplexity
+        sig { params(temp_dir: T.any(Pathname, String), repo_contents_path: T.nilable(String)).void }
+        def copy_repo_contents_to_temp_dir(temp_dir, repo_contents_path)
+          return if repo_contents_path.nil? || repo_contents_path.strip.empty?
+
+          source_dir = Pathname.new(repo_contents_path).expand_path
+          return unless source_dir.directory?
+
+          # Use the full checkout when available to ensure Gradle can compile
+          # convention plugin implementations from non-manifest source trees.
+          Dir.each_child(source_dir.to_s) do |entry|
+            entry = T.let(entry, String)
+            source_entry = File.join(source_dir.to_s, entry)
+            dest_entry = File.join(temp_dir.to_s, entry)
+
+            if entry == ".git"
+              # Some convention plugins shell out to `git` (e.g. for version derivation) and
+              # fail without a working repository. Symlink instead of copying to avoid the
+              # disk/time cost of duplicating the whole history for every lockfile update.
+              File.symlink(source_entry, dest_entry)
+            else
+              FileUtils.cp_r(source_entry, dest_entry)
+            end
+          end
+        end
+
+        sig { params(file_name: String, jvmargs: String, base_content: String).void }
+        def write_properties_file(file_name, jvmargs:, base_content:) # rubocop:disable Metrics/PerceivedComplexity
           http_proxy = ENV.fetch("HTTP_PROXY", nil)
           https_proxy = ENV.fetch("HTTPS_PROXY", nil)
           http_split = http_proxy&.split(":")
@@ -191,9 +241,20 @@ module Dependabot
           http_proxy_port = http_split&.fetch(2) || "1080"
           https_proxy_port = https_split&.fetch(2) || "1080"
 
-          existing_content = File.exist?(file_name) ? File.read(file_name) : ""
+          existing_jvmargs = base_content[/^org\.gradle\.jvmargs=(.*)$/, 1]
+          # Preserve any existing jvmargs (e.g. --add-opens flags) by merging rather than
+          # replacing them outright; the raw line is dropped from existing_content below
+          # since combined_jvmargs already includes its value.
+          has_existing_jvmargs = existing_jvmargs && !existing_jvmargs.strip.empty?
+          combined_jvmargs = has_existing_jvmargs ? "#{existing_jvmargs.strip} #{jvmargs}" : jvmargs
+          existing_content = base_content.gsub(/^org\.gradle\.jvmargs=.*$\n?/, "")
 
           proxy_properties = "
+org.gradle.jvmargs=#{combined_jvmargs}
+org.gradle.workers.max=1
+org.gradle.java.installations.auto-download=false
+org.gradle.java.installations.paths=#{installed_gradle_toolchain_paths}
+kotlin.compiler.execution.strategy=in-process
 systemProp.http.proxyHost=#{http_proxy_host}
 systemProp.http.proxyPort=#{http_proxy_port}
 systemProp.https.proxyHost=#{https_proxy_host}
@@ -203,6 +264,50 @@ systemProp.https.proxyPort=#{https_proxy_port}"
           File.write(file_name, existing_content + separator + proxy_properties)
         end
 
+        sig { params(command: String, cwd: String, properties_file_path: String).void }
+        def run_lockfile_update_with_retry(command:, cwd:, properties_file_path:)
+          base_content = File.exist?(properties_file_path) ? File.read(properties_file_path) : ""
+
+          catch(:success) do
+            GRADLE_JVMARGS_ATTEMPTS.each_with_index do |jvmargs, index|
+              write_properties_file(properties_file_path, jvmargs: jvmargs, base_content: base_content)
+              begin
+                SharedHelpers.run_shell_command(command, cwd: cwd)
+                throw :success
+              rescue SharedHelpers::HelperSubprocessFailed => e
+                # If this is the last attempt, re-raise the error
+                raise e if index == GRADLE_JVMARGS_ATTEMPTS.length - 1
+
+                # Only retry if it's a retryable failure
+                raise e unless retryable_daemon_failure?(e)
+
+                Dependabot.logger.warn(
+                  "Gradle build failed with jvmargs '#{jvmargs}'. Retrying once with larger heap size..."
+                )
+              end
+            end
+          end
+        end
+
+        sig { params(error: SharedHelpers::HelperSubprocessFailed).returns(T::Boolean) }
+        def retryable_daemon_failure?(error)
+          message = error.message.downcase
+          # Retry if daemon disappeared
+          if message.include?("daemon disappeared") || message.include?("build daemon disappeared unexpectedly")
+            return true
+          end
+
+          # Retry if process was killed (SIGKILL)
+          return true if T.cast(error.error_context[:process_termsig], T.nilable(Integer)) == SharedHelpers::SIGKILL
+
+          false
+        end
+
+        sig { returns(String) }
+        def installed_gradle_toolchain_paths
+          Dir.glob("/usr/lib/jvm/java-*-openjdk-*").join(",")
+        end
+
         sig { params(file_name: String).void }
         def write_init_script(file_name)
           # Resolve all resolvable configurations across all loaded projects so
@@ -212,7 +317,13 @@ systemProp.https.proxyPort=#{https_proxy_port}"
               if (tasks.findByName("#{INIT_SCRIPT_TASK_NAME}") == null) {
                 tasks.register("#{INIT_SCRIPT_TASK_NAME}") {
                   doLast {
-                    configurations.findAll { it.canBeResolved }.each { it.resolve() }
+                    configurations.findAll {
+                      it.canBeResolved &&
+                        it.resolutionStrategy.dependencyLockingEnabled &&
+                        it.allDependencies.any { dependency ->
+                          dependency instanceof org.gradle.api.artifacts.ModuleDependency
+                        }
+                    }.each { it.incoming.resolutionResult.allDependencies }
                   }
                 }
               }
@@ -221,6 +332,46 @@ systemProp.https.proxyPort=#{https_proxy_port}"
           File.write(file_name, script_content)
         end
 
+        sig { params(build_files: T::Array[Dependabot::DependencyFile]).returns(T::Array[String]) }
+        def lockfile_tasks_for(build_files)
+          build_files.filter_map { |build_file| dependency_task_for(build_file) }.uniq << INIT_SCRIPT_TASK_NAME
+        end
+
+        sig { params(build_file: Dependabot::DependencyFile).returns(T.nilable(String)) }
+        def dependency_task_for(build_file)
+          settings_file = find_settings_file(build_file)
+          return nil unless settings_file
+
+          root_dir = determine_root_dir(build_file: build_file)
+          file_path = normalized_file_path(build_file)
+          relative_path = path_relative_to_root(file_path, root_dir)
+
+          return nil if relative_path.start_with?("gradle/")
+
+          dirname = File.dirname(relative_path)
+          return nil if dirname == "." || dirname.empty?
+
+          # Look up the canonical Gradle project name from the settings file to handle repos
+          # that use custom projectDir mappings
+          # (e.g. project(':chrome-trace').projectDir = file('subprojects/chrome-trace')).
+          # Deriving the task from the filesystem path alone would produce a wrong Gradle task path.
+          parser = FileFetcher::SettingsFileParser.new(settings_file: settings_file)
+          project_name = parser.subproject_path_to_name_map[dirname]
+          return nil unless project_name
+
+          "#{project_name}:dependencies"
+        end
+
+        sig { params(file_path: String, root_dir: String).returns(String) }
+        def path_relative_to_root(file_path, root_dir)
+          return file_path.sub(%r{^/}, "") if root_dir == "/"
+
+          root_prefix = "#{root_dir}/"
+          return file_path.delete_prefix(root_prefix) if file_path.start_with?(root_prefix)
+
+          file_path.sub(%r{^/}, "")
+        end
+
         sig { params(cwd: String, workspace_root: String).returns(String) }
         def gradle_executable_for(cwd:, workspace_root:)
           cwd_path = Pathname.new(cwd).expand_path

data/lib/dependabot/gradle/file_updater.rb

@@ -17,7 +17,7 @@ module Dependabot
       require_relative "file_updater/lockfile_updater"
       require_relative "file_updater/wrapper_updater"
 
-      SUPPORTED_BUILD_FILE_NAMES = %w(build.gradle build.gradle.kts gradle.lockfile).freeze
+      SUPPORTED_BUILD_FILE_NAMES = %w(build.gradle build.gradle.kts).freeze
 
       sig { override.returns(T::Array[::Dependabot::DependencyFile]) }
       def updated_dependency_files
@@ -97,7 +97,10 @@ module Dependabot
             files[T.must(files.index(buildfile))] = update_version_in_buildfile(dependency, buildfile, old_req, new_req)
           end
 
-          buildfiles_processed[buildfile.name] = buildfile
+          # Always look up the updated buildfile from files after any modification
+          # to ensure buildfiles_processed contains the latest version
+          updated_buildfile = files.find { |f| f.name == buildfile.name }
+          buildfiles_processed[buildfile.name] = T.must(updated_buildfile)
         end
 
         # runs native updaters (e.g. wrapper, lockfile) on relevant build files updated
@@ -122,17 +125,28 @@ module Dependabot
         ).void
       end
       def update_lockfiles_for_buildfiles(files, buildfiles_processed)
-        lockfile_roots_processed = T.let(Set.new, T::Set[String])
+        # Support files (e.g. fetched convention plugin sources) are excluded from
+        # `buildfiles`/`files`, but Gradle still needs them on disk to compile
+        # plugins referenced by included/buildSrc builds, so pass them through too.
+        support_files = dependency_files.select(&:support_file?)
+        lockfile_updater = LockfileUpdater.new(
+          dependency_files: files + support_files,
+          repo_contents_path: repo_contents_path
+        )
+        buildfiles_by_root = T.let({}, T::Hash[String, T::Array[Dependabot::DependencyFile]])
 
         buildfiles_processed.each_value do |buildfile|
-          lockfile_updater = LockfileUpdater.new(dependency_files: files)
           root_dir = lockfile_updater.determine_root_dir(build_file: buildfile)
-          next if lockfile_roots_processed.include?(root_dir)
+          buildfiles_by_root[root_dir] ||= []
+          T.must(buildfiles_by_root[root_dir]) << buildfile
+        end
 
-          lockfile_roots_processed.add(root_dir)
+        buildfiles_by_root.each_value do |buildfiles|
+          updated_files = lockfile_updater.update_lockfiles(T.must(buildfiles.first), build_files: buildfiles)
 
-          updated_files = lockfile_updater.update_lockfiles(buildfile)
-          replace_updated_files(files, updated_files)
+          # Support files are only needed to populate Gradle's working directory;
+          # they must never be reintroduced into the buildfiles-only result set.
+          replace_updated_files(files, updated_files.reject(&:support_file?))
         end
       end
       sig do

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-gradle
 version: !ruby/object:Gem::Version
-  version: 0.389.0
+  version: 0.390.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,28 +15,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.389.0
+        version: 0.390.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.389.0
+        version: 0.390.0
 - !ruby/object:Gem::Dependency
   name: dependabot-maven
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.389.0
+        version: 0.390.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.389.0
+        version: 0.390.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -291,7 +291,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.389.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.390.0
 rdoc_options: []
 require_paths:
 - lib