Merge branch 'main' into add-directory-to-dependency

hex/lib/dependabot/hex/file_updater.rb

@@ -1,23 +1,28 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "dependabot/file_updaters"
 require "dependabot/file_updaters/base"
 require "dependabot/shared_helpers"
+require "sorbet-runtime"
 
 module Dependabot
   module Hex
     class FileUpdater < Dependabot::FileUpdaters::Base
+      extend T::Sig
+
       require_relative "file_updater/mixfile_updater"
       require_relative "file_updater/lockfile_updater"
 
+      sig { override.returns(T::Array[Regexp]) }
       def self.updated_files_regex
         [
           /^mix\.exs$/,
           /^mix\.lock$/
         ]
       end
 
+      sig { override.returns(T::Array[Dependabot::DependencyFile]) }
       def updated_dependency_files
         updated_files = []
 
@@ -30,40 +35,45 @@ def updated_dependency_files
 
         if lockfile
           updated_files <<
-            updated_file(file: lockfile, content: updated_lockfile_content)
+            updated_file(file: T.must(lockfile), content: updated_lockfile_content)
         end
 
         updated_files
       end
 
       private
 
+      sig { override.void }
       def check_required_files
         raise "No mix.exs!" unless get_original_file("mix.exs")
       end
 
+      sig { params(file: Dependabot::DependencyFile).returns(String) }
       def updated_mixfile_content(file)
         MixfileUpdater.new(
           dependencies: dependencies,
           mixfile: file
         ).updated_mixfile_content
       end
 
+      sig { returns(String) }
       def updated_lockfile_content
-        @updated_lockfile_content ||=
-          LockfileUpdater.new(
-            dependencies: dependencies,
-            dependency_files: dependency_files,
-            credentials: credentials
-          ).updated_lockfile_content
+        @updated_lockfile_content ||= T.let(nil, T.nilable(String))
+        LockfileUpdater.new(
+          dependencies: dependencies,
+          dependency_files: dependency_files,
+          credentials: credentials
+        ).updated_lockfile_content
       end
 
+      sig { returns(T::Array[Dependabot::DependencyFile]) }
       def mixfiles
         dependency_files.select { |f| f.name.end_with?("mix.exs") }
       end
 
+      sig { returns(T.nilable(Dependabot::DependencyFile)) }
       def lockfile
-        @lockfile ||= get_original_file("mix.lock")
+        @lockfile ||= T.let(get_original_file("mix.lock"), T.nilable(Dependabot::DependencyFile))
       end
     end
   end

hex/lib/dependabot/hex/file_updater/mixfile_git_pin_updater.rb

@@ -1,13 +1,17 @@
-# typed: true
+# typed: strong
 # frozen_string_literal: true
 
 require "dependabot/hex/file_updater"
 require "dependabot/shared_helpers"
+require "sorbet-runtime"
 
 module Dependabot
   module Hex
     class FileUpdater
       class MixfileGitPinUpdater
+        extend T::Sig
+
+        sig { params(dependency_name: String, mixfile_content: String, previous_pin: String, updated_pin: String).void }
         def initialize(dependency_name:, mixfile_content:,
                        previous_pin:, updated_pin:)
           @dependency_name = dependency_name
@@ -16,6 +20,7 @@ def initialize(dependency_name:, mixfile_content:,
           @updated_pin     = updated_pin
         end
 
+        sig { returns(String) }
         def updated_content
           updated_content = update_pin(mixfile_content)
 
@@ -26,11 +31,19 @@ def updated_content
 
         private
 
+        sig { returns(String) }
         attr_reader :dependency_name
+
+        sig { returns(String) }
         attr_reader :mixfile_content
+
+        sig { returns(String) }
         attr_reader :previous_pin
+
+        sig { returns(String) }
         attr_reader :updated_pin
 
+        sig { params(content: String).returns(String) }
         def update_pin(content)
           requirement_line_regex =
             /
@@ -43,6 +56,7 @@ def update_pin(content)
           end
         end
 
+        sig { returns(T::Boolean) }
         def content_should_change?
           previous_pin == updated_pin
         end

hex/lib/dependabot/hex/native_helpers.rb

@@ -1,16 +1,22 @@
-# typed: true
+# typed: strong
 # frozen_string_literal: true
 
+require "sorbet-runtime"
+
 module Dependabot
   module Hex
     module NativeHelpers
+      extend T::Sig
+
+      sig { returns(String) }
       def self.hex_helpers_dir
         helpers_root = ENV.fetch("DEPENDABOT_NATIVE_HELPERS_PATH", nil)
         return File.join(helpers_root, "hex") unless helpers_root.nil?
 
         File.join(__dir__, "../../../../hex/helpers")
       end
 
+      sig { params(path: String).returns(String) }
       def self.clean_path(path)
         Pathname.new(path).cleanpath.to_path
       end

maven/lib/dependabot/maven/file_fetcher.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "nokogiri"
@@ -16,10 +16,12 @@ class FileFetcher < Dependabot::FileFetchers::Base
       MODULE_SELECTOR = "project > modules > module, " \
                         "profile > modules > module"
 
+      sig { override.params(filenames: T::Array[String]).returns(T::Boolean) }
       def self.required_files_in?(filenames)
         filenames.include?("pom.xml")
       end
 
+      sig { override.returns(String) }
       def self.required_files_message
         "Repo must contain a pom.xml."
       end
@@ -36,20 +38,22 @@ def fetch_files
 
       private
 
+      sig { returns(T.nilable(Dependabot::DependencyFile)) }
       def pom
-        @pom ||= fetch_file_from_host("pom.xml")
+        @pom ||= T.let(fetch_file_from_host("pom.xml"), T.nilable(Dependabot::DependencyFile))
       end
 
+      sig { returns(T.nilable(Dependabot::DependencyFile)) }
       def extensions
-        return @extensions if defined?(@extensions)
-
-        fetch_file_if_present(".mvn/extensions.xml")
+        @extensions ||= T.let(fetch_file_if_present(".mvn/extensions.xml"), T.nilable(Dependabot::DependencyFile))
       end
 
+      sig { returns(T::Array[DependencyFile]) }
       def child_poms
-        recursively_fetch_child_poms(pom, fetched_filenames: ["pom.xml"])
+        recursively_fetch_child_poms(T.must(pom), fetched_filenames: ["pom.xml"])
       end
 
+      sig { params(fetched_files: T::Array[Dependabot::DependencyFile]).returns(T::Array[Dependabot::DependencyFile]) }
       def relative_path_parents(fetched_files)
         fetched_files.flat_map do |file|
           recursively_fetch_relative_path_parents(
@@ -59,6 +63,10 @@ def relative_path_parents(fetched_files)
         end
       end
 
+      sig do
+        params(pom: Dependabot::DependencyFile,
+               fetched_filenames: T::Array[String]).returns(T::Array[Dependabot::DependencyFile])
+      end
       def recursively_fetch_child_poms(pom, fetched_filenames:)
         base_path = File.dirname(pom.name)
         doc = Nokogiri::XML(pom.content)
@@ -91,6 +99,10 @@ def recursively_fetch_child_poms(pom, fetched_filenames:)
         end
       end
 
+      sig do
+        params(pom: Dependabot::DependencyFile,
+               fetched_filenames: T::Array[String]).returns(T::Array[Dependabot::DependencyFile])
+      end
       def recursively_fetch_relative_path_parents(pom, fetched_filenames:)
         path = parent_path_for_pom(pom)
 
@@ -118,6 +130,7 @@ def recursively_fetch_relative_path_parents(pom, fetched_filenames:)
         []
       end
 
+      sig { params(pom: Dependabot::DependencyFile).returns(T.nilable(String)) }
       def parent_path_for_pom(pom)
         doc = Nokogiri::XML(pom.content)
         doc.remove_namespaces!
@@ -136,6 +149,7 @@ def parent_path_for_pom(pom)
         Pathname.new(File.join(name_parts)).cleanpath.to_path
       end
 
+      sig { params(pom: Dependabot::DependencyFile, parent_pom: Dependabot::DependencyFile).returns(T::Boolean) }
       def fetched_pom_is_parent(pom, parent_pom)
         pom_doc = Nokogiri::XML(pom.content).remove_namespaces!
         pom_artifact_id, pom_group_id, pom_version = fetch_pom_unique_ids(pom_doc, true)
@@ -150,6 +164,7 @@ def fetched_pom_is_parent(pom, parent_pom)
         end
       end
 
+      sig { params(doc: Nokogiri::XML::Document, check_parent_node: T::Boolean).returns(T::Array[T.nilable(String)]) }
       def fetch_pom_unique_ids(doc, check_parent_node)
         parent = check_parent_node ? "/parent" : ""
         group_id = doc.at_xpath("/project#{parent}/groupId")&.content&.strip