Updating Gradle binaries support

Author: gmazzo

.github/workflows/smoke.yml

@@ -15,7 +15,7 @@ concurrency:
 env:
   GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   SMOKE_TEST_REPO: gmazzo/dependabot-smoke-tests
-  SMOKE_TEST_BRANCH: gradle-wrapper-support
+  SMOKE_TEST_BRANCH: gradle-wrapper-support-binaries
 jobs:
   discover:
     runs-on: ubuntu-latest

gradle/lib/dependabot/gradle/file_fetcher.rb

@@ -23,8 +23,12 @@ class FileFetcher < Dependabot::FileFetchers::Base
       SUPPORTED_SETTINGS_FILE_NAMES =
         T.let(%w(settings.gradle settings.gradle.kts).freeze, T::Array[String])
 
-      SUPPORTED_WRAPPER_PROPERTIES_FILE_PATH =
-        %w(gradle/wrapper/gradle-wrapper.properties).freeze
+      SUPPORTED_WRAPPER_FILES_PATH = %w(
+        gradlew
+        gradlew.bat
+        gradle/wrapper/gradle-wrapper.jar
+        gradle/wrapper/gradle-wrapper.properties
+      ).freeze
 
       # For now Gradle only supports library .toml files in the main gradle folder
       SUPPORTED_VERSION_CATALOG_FILE_PATH =
@@ -69,13 +73,9 @@ def fetch_files
 
       sig { params(root_dir: String).returns(T::Array[DependencyFile]) }
       def all_buildfiles_in_build(root_dir)
-        files = [
-          buildfile(root_dir),
-          settings_file(root_dir),
-          wrapper_properties_file(root_dir),
-          version_catalog_file(root_dir),
-          lockfile(root_dir)
-        ].compact
+        files = [buildfile(root_dir), settings_file(root_dir), version_catalog_file(root_dir), lockfile(root_dir)]
+                .compact
+        files += wrapper_files(root_dir)
         files += subproject_buildfiles(root_dir)
         files += subproject_lockfiles(root_dir)
         files += dependency_script_plugins(root_dir)
@@ -147,14 +147,23 @@ def subproject_buildfiles(root_dir)
         end
       end
 
-      sig { params(root_dir: String).returns(T.nilable(DependencyFile)) }
-      def wrapper_properties_file(root_dir)
-        return nil unless Experiments.enabled?(:gradle_wrapper_updater)
+      sig { params(dir: String).returns(T::Array[DependencyFile]) }
+      def wrapper_files(dir)
+        return [] unless Experiments.enabled?(:gradle_wrapper_updater)
 
-        gradle_wrapper_properties_file(root_dir)
-      rescue Dependabot::DependencyFileNotFound
-        # Wrapper file is optional for Gradle
-        nil
+        SUPPORTED_WRAPPER_FILES_PATH.filter_map do |filename|
+          file = fetch_file_if_present(File.join(dir, filename))
+          next unless file
+
+          if file.name.end_with?(".jar")
+            file.content = Base64.encode64(T.must(file.content)) if file.content
+            file.content_encoding = DependencyFile::ContentEncoding::BASE64
+          end
+          file
+        rescue Dependabot::DependencyFileNotFound
+          # Gradle itself doesn't worry about missing subprojects, so we don't
+          nil
+        end
       end
 
       sig { params(root_dir: String).returns(T.nilable(DependencyFile)) }
@@ -209,11 +218,6 @@ def buildfile(dir)
         file
       end
 
-      sig { params(dir: String).returns(T.nilable(DependencyFile)) }
-      def gradle_wrapper_properties_file(dir)
-        find_first(dir, SUPPORTED_WRAPPER_PROPERTIES_FILE_PATH)
-      end
-
       sig { params(dir: String).returns(T.nilable(DependencyFile)) }
       def gradle_toml_file(dir)
         find_first(dir, SUPPORTED_VERSION_CATALOG_FILE_PATH)

gradle/lib/dependabot/gradle/file_updater.rb

@@ -15,6 +15,7 @@ class FileUpdater < Dependabot::FileUpdaters::Base
       require_relative "file_updater/dependency_set_updater"
       require_relative "file_updater/property_value_updater"
       require_relative "file_updater/lockfile_updater"
+      require_relative "file_updater/wrapper_updater"
 
       SUPPORTED_BUILD_FILE_NAMES = %w(build.gradle build.gradle.kts gradle.lockfile).freeze
 
@@ -23,8 +24,9 @@ def self.updated_files_regex
         [
           # Matches build.gradle or build.gradle.kts in root directory
           %r{(^|.*/)build\.gradle(\.kts)?$},
-          # Matches gradle/wrapper/gradle-wrapper.properties in root or any subdirectory
-          %r{(^|.*/)?gradle/wrapper/gradle-wrapper.properties$},
+          # Matches gradle-wrapper files in root or any subdirectory
+          %r{(^|.*/)?gradlew(\.bat)?$},
+          %r{(^|.*/)?gradle/wrapper/gradle-wrapper\.(properties|jar)$},
           # Matches gradle/libs.versions.toml in root or any subdirectory
           %r{(^|.*/)?gradle/libs\.versions\.toml$},
           # Matches settings.gradle or settings.gradle.kts in root or any subdirectory
@@ -81,6 +83,10 @@ def original_file
       def update_buildfiles_for_dependency(buildfiles:, dependency:)
         files = buildfiles.dup
 
+        # dependencies may have multiple requirements targeting the same file or build dir
+        # we keep the last one by path to later run its native helpers
+        buildfiles_processed = T.let({}, T::Hash[String, Dependabot::DependencyFile])
+
         # The UpdateChecker ensures the order of requirements is preserved
         # when updating, so we can zip them together in new/old pairs.
         reqs = dependency.requirements.zip(T.must(dependency.previous_requirements))
@@ -110,16 +116,20 @@ def update_buildfiles_for_dependency(buildfiles:, dependency:)
             files[T.must(files.index(buildfile))] = update_version_in_buildfile(dependency, buildfile, old_req, new_req)
           end
 
-          next unless Dependabot::Experiments.enabled?(:gradle_lockfile_updater)
+          buildfiles_processed[buildfile.name] = buildfile
+        end
+
+        # runs native updaters (e.g. wrapper, lockfile) on relevant build files updated
+        updaters = native_updaters(files, dependency)
+        buildfiles_processed.each do |_, buildfile|
+          updated_files = updaters.flat_map { |updater| updater.update_files(buildfile) }
 
-          lockfile_updater = LockfileUpdater.new(dependency_files: files)
-          lockfiles = lockfile_updater.update_lockfiles(buildfile)
-          lockfiles.each do |lockfile|
-            existing_file = files.find { |f| f.name == lockfile.name && f.directory == lockfile.directory }
+          updated_files.each do |file|
+            existing_file = files.find { |f| f.name == file.name && f.directory == file.directory }
             if existing_file.nil?
-              files << lockfile
+              files << file
             else
-              files[T.must(files.index(existing_file))] = lockfile
+              files[T.must(files.index(existing_file))] = file
             end
           end
         end
@@ -130,6 +140,18 @@ def update_buildfiles_for_dependency(buildfiles:, dependency:)
       # rubocop:enable Metrics/CyclomaticComplexity
       # rubocop:enable Metrics/AbcSize
 
+      sig do
+        params(files: T::Array[Dependabot::DependencyFile],
+               dependency: Dependabot::Dependency).returns(T::Array[GradleUpdaterBase])
+      end
+      def native_updaters(files, dependency)
+        updaters = T.let([], T::Array[GradleUpdaterBase])
+        updaters << LockfileUpdater.new(dependency_files: files) if Experiments.enabled?(:gradle_lockfile_updater)
+        updaters << WrapperUpdater.new(dependency_files: files, dependency: dependency) if
+          Experiments.enabled?(:gradle_wrapper_updater)
+        updaters
+      end
+
       sig do
         params(
           buildfiles: T::Array[Dependabot::DependencyFile],

gradle/lib/dependabot/gradle/file_updater/gradle_updater_base.rb

@@ -10,72 +10,88 @@
 module Dependabot
   module Gradle
     class FileUpdater
-      class LockfileUpdater
+      class GradleUpdaterBase
         extend T::Sig
 
         sig { params(dependency_files: T::Array[Dependabot::DependencyFile]).void }
         def initialize(dependency_files:)
           @dependency_files = dependency_files
         end
 
+        sig { params(_file: Dependabot::DependencyFile).returns(T::Boolean) }
+        def target_file?(_file)
+          raise NotImplementedError
+        end
+
+        sig { returns(T::Array[String]) }
+        def command_args
+          raise NotImplementedError
+        end
+
+        sig { params(build_file: Dependabot::DependencyFile).returns(String) }
+        def base_path(build_file)
+          File.dirname(File.join(build_file.directory, build_file.name))
+        end
+
         sig { params(build_file: Dependabot::DependencyFile).returns(T::Array[Dependabot::DependencyFile]) }
-        def update_lockfiles(build_file)
-          local_lockfiles = dependency_files.select do |file|
-            file.directory == build_file.directory && file.name.end_with?(".lockfile")
+        def update_files(build_file)
+          local_files = dependency_files.select do |file|
+            file.directory == build_file.directory && target_file?(file)
           end
 
-          # If we don't have any lockfiles in the build files don't generate one
-          return dependency_files unless local_lockfiles.any?
+          # If we don't have any files in the build files don't generate one
+          return dependency_files unless local_files.any?
 
           updated_files = dependency_files.dup
           SharedHelpers.in_a_temporary_directory do |temp_dir|
             populate_temp_directory(temp_dir)
-            cwd = File.join(temp_dir, build_file.directory, build_file.name)
-            cwd = File.dirname(cwd)
+            cwd = File.join(temp_dir, base_path(build_file))
 
             # Create gradle.properties file with proxy settings
             # Would prefer to use command line arguments, but they don't work.
             properties_filename = File.join(temp_dir, build_file.directory, "gradle.properties")
             write_properties_file(properties_filename)
 
-            command_parts = [
-              "gradle",
-              "dependencies",
-              "--no-daemon",
-              "--write-locks"
-            ]
+            command_parts = %w(gradle --no-daemon --stacktrace) + command_args
             command = Shellwords.join(command_parts)
 
             Dir.chdir(cwd) do
               SharedHelpers.run_shell_command(command, cwd: cwd)
-              update_lockfiles_content(temp_dir, local_lockfiles, updated_files)
+              update_files_content(temp_dir, local_files, updated_files)
             rescue SharedHelpers::HelperSubprocessFailed => e
-              puts "Failed to update lockfiles: #{e.message}"
+              puts "Failed to update files: #{e.message}"
               return updated_files
             end
           end
           updated_files
         end
 
+        private
+
         sig do
           params(
             temp_dir: T.any(Pathname, String),
-            local_lockfiles: T::Array[Dependabot::DependencyFile],
-            updated_lockfiles: T::Array[Dependabot::DependencyFile]
+            local_files: T::Array[Dependabot::DependencyFile],
+            updated_files: T::Array[Dependabot::DependencyFile]
           ).void
         end
-        def update_lockfiles_content(temp_dir, local_lockfiles, updated_lockfiles)
-          local_lockfiles.each do |file|
+        def update_files_content(temp_dir, local_files, updated_files)
+          local_files.each do |file|
             f_content = File.read(File.join(temp_dir, file.directory, file.name))
             tmp_file = file.dup
             tmp_file.content = f_content
-            updated_lockfiles[T.must(updated_lockfiles.index(file))] = tmp_file
+            updated_files[T.must(updated_files.index(file))] = tmp_file
           end
         end
 
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
+        def files_to_populate
+          @dependency_files
+        end
+
         sig { params(temp_dir: T.any(Pathname, String)).void }
         def populate_temp_directory(temp_dir)
-          @dependency_files.each do |file|
+          files_to_populate.each do |file|
             in_path_name = File.join(temp_dir, file.directory, file.name)
             FileUtils.mkdir_p(File.dirname(in_path_name))
             File.write(in_path_name, file.content)
@@ -100,8 +116,6 @@ def write_properties_file(file_name) # rubocop:disable Metrics/PerceivedComplexi
           File.write(file_name, properties_content)
         end
 
-        private
-
         sig { returns(T::Array[Dependabot::DependencyFile]) }
         attr_reader :dependency_files
       end

gradle/lib/dependabot/gradle/file_updater/lockfile_updater.rb

@@ -0,0 +1,27 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+require "shellwords"
+
+require "dependabot/gradle/file_updater/gradle_updater_base"
+
+module Dependabot
+  module Gradle
+    class FileUpdater
+      class LockfileUpdater < GradleUpdaterBase
+        extend T::Sig
+
+        sig { override.params(file: Dependabot::DependencyFile).returns(T::Boolean) }
+        def target_file?(file)
+          file.name.end_with?(".lockfile")
+        end
+
+        sig { override.returns(T::Array[String]) }
+        def command_args
+          %w(dependencies --write-locks)
+        end
+      end
+    end
+  end
+end

gradle/lib/dependabot/gradle/file_updater/wrapper_updater.rb

@@ -0,0 +1,77 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+require "shellwords"
+
+require "dependabot/gradle/distributions"
+require "dependabot/gradle/file_updater/gradle_updater_base"
+
+module Dependabot
+  module Gradle
+    class FileUpdater
+      class WrapperUpdater < GradleUpdaterBase
+        extend T::Sig
+        include Dependabot::Gradle::Distributions
+
+        sig { params(dependency_files: T::Array[Dependabot::DependencyFile], dependency: Dependabot::Dependency).void }
+        def initialize(dependency_files:, dependency:)
+          super(dependency_files: dependency_files)
+          @dependency = dependency
+          @target_files = T.let(%w(
+            /gradlew
+            /gradlew.bat
+            /gradle/wrapper/gradle-wrapper.properties
+            /gradle/wrapper/gradle-wrapper.jar
+          ), T::Array[String])
+          @build_files = T.let(%w(
+            build.gradle
+            build.gradle.kts
+            settings.gradle
+            settings.gradle.kts
+          ), T::Array[String])
+        end
+
+        sig { override.params(file: Dependabot::DependencyFile).returns(T::Boolean) }
+        def target_file?(file)
+          @target_files.any? { |r| "/#{file.name}".end_with?(r) }
+        end
+
+        sig { override.returns(T::Array[String]) }
+        def command_args
+          version = T.let(dependency.requirements[0]&.[](:requirement), String)
+          checksum = T.let(dependency.requirements[1]&.[](:requirement), String) if dependency.requirements.size > 1
+
+          args = %W(wrapper --gradle-version #{version} --no-validate-url)
+          args += %W(--gradle-distribution-sha256-sum #{checksum}) if checksum
+          args
+        end
+
+        sig { params(build_file: Dependabot::DependencyFile).returns(String) }
+        def base_path(build_file)
+          super.delete_suffix("/gradle/wrapper")
+        end
+
+        private
+
+        # Gradle builds can be complex, to maximize the chances of a successful we just keep related wrapper files
+        # and produce a minimal build for it to run (losing any customisations of the `wrapper` task in the process)
+        sig { override.returns(T::Array[Dependabot::DependencyFile]) }
+        def files_to_populate
+          @dependency_files.filter_map do |f|
+            next f if target_file?(f)
+            next Dependabot::DependencyFile.new(directory: f.directory, name: f.name, content: "") if build_file?(f)
+          end
+        end
+
+        sig { params(file: Dependabot::DependencyFile).returns(T::Boolean) }
+        def build_file?(file)
+          @build_files.include?(File.basename(file.name))
+        end
+
+        sig { returns(Dependabot::Dependency) }
+        attr_reader :dependency
+      end
+    end
+  end
+end