Gradle: Look up repository URLs based on the current project and its …

…root

lib/dependabot/file_parsers/java/gradle/repositories_finder.rb

@@ -17,16 +17,17 @@ class RepositoriesFinder
           MAVEN_REPO_REGEX =
             /maven\s*\{[^\}]*\surl[\s\(]\s*['"](?<url>[^'"]+)['"]/
 
-          def initialize(dependency_files:)
+          def initialize(dependency_files:, target_dependency_file:)
             @dependency_files = dependency_files
+            @target_dependency_file = target_dependency_file
+            raise "No target file!" unless target_dependency_file
           end
 
           def repository_urls
-            repository_urls =
-              buildfile_repositories.
-              map { |url| url.strip.gsub(%r{/$}, "") }.
-              select { |url| valid_url?(url) }.
-              uniq
+            repository_urls = []
+            repository_urls += inherited_repository_urls
+            repository_urls += own_buildfile_repository_urls
+            repository_urls = repository_urls.uniq
 
             return repository_urls unless repository_urls.empty?
 
@@ -35,37 +36,77 @@ def repository_urls
 
           private
 
-          attr_reader :dependency_files
+          attr_reader :dependency_files, :target_dependency_file
+
+          def inherited_repository_urls
+            return [] unless top_level_buildfile
+
+            buildfile_content = comment_free_content(top_level_buildfile)
+            subproject_blocks = []
+
+            buildfile_content.scan(/(?:^|\s)allprojects\s*\{/) do
+              mtch = Regexp.last_match
+              subproject_blocks <<
+                mtch.post_match[0..closing_bracket_index(mtch.post_match)]
+            end
 
-          def buildfile_repositories
-            repositories = []
+            if top_level_buildfile != target_dependency_file
+              buildfile_content.scan(/(?:^|\s)subprojects\s*\{/) do
+                mtch = Regexp.last_match
+                subproject_blocks <<
+                  mtch.post_match[0..closing_bracket_index(mtch.post_match)]
+              end
+            end
+
+            repository_urls_from(subproject_blocks.join("\n"))
+          end
+
+          def own_buildfile_repository_urls
+            buildfile_content = comment_free_content(target_dependency_file)
+
+            buildfile_content.dup.scan(/(?:^|\s)subprojects\s*\{/) do
+              mtch = Regexp.last_match
+              buildfile_content.gsub!(
+                mtch.post_match[0..closing_bracket_index(mtch.post_match)],
+                ""
+              )
+            end
+
+            repository_urls_from(buildfile_content)
+          end
+
+          def repository_urls_from(buildfile_content)
+            repository_urls = []
 
             repository_blocks = []
-            comment_free_content(buildfile).scan(REPOSITORIES_BLOCK_START) do
+            buildfile_content.scan(REPOSITORIES_BLOCK_START) do
               mtch = Regexp.last_match
               repository_blocks <<
                 mtch.post_match[0..closing_bracket_index(mtch.post_match)]
             end
 
             repository_blocks.each do |block|
               if block.include?(" google(")
-                repositories << "https://maven.google.com/"
+                repository_urls << "https://maven.google.com/"
               end
 
               if block.include?(" mavenCentral(")
-                repositories << "https://repo.maven.apache.org/maven2/"
+                repository_urls << "https://repo.maven.apache.org/maven2/"
               end
 
               if block.include?(" jcenter(")
-                repositories << "https://jcenter.bintray.com/"
+                repository_urls << "https://jcenter.bintray.com/"
               end
 
               block.scan(MAVEN_REPO_REGEX) do
-                repositories << Regexp.last_match.named_captures.fetch("url")
+                repository_urls << Regexp.last_match.named_captures.fetch("url")
               end
             end
 
-            repositories.uniq
+            repository_urls.
+              map { |url| url.strip.gsub(%r{/$}, "") }.
+              select { |url| valid_url?(url) }.
+              uniq
           end
 
           def closing_bracket_index(string)
@@ -94,8 +135,8 @@ def comment_free_content(buildfile)
               gsub(%r{(?<=^|\s)/\*.*?\*/}m, "")
           end
 
-          def buildfile
-            @buildfile ||=
+          def top_level_buildfile
+            @top_level_buildfile ||=
               dependency_files.find { |f| f.name == "build.gradle" }
           end
         end

lib/dependabot/update_checkers/java/gradle/version_finder.rb

@@ -131,10 +131,18 @@ def dependency_metadata(repository_url)
           end
 
           def repository_urls
+            requirement_files =
+              dependency.requirements.
+              map { |r| r.fetch(:file) }.
+              map { |nm| dependency_files.find { |f| f.name == nm } }
+
             @repository_urls ||=
-              FileParsers::Java::Gradle::RepositoriesFinder.new(
-                dependency_files: dependency_files
-              ).repository_urls
+              requirement_files.flat_map do |target_file|
+                FileParsers::Java::Gradle::RepositoriesFinder.new(
+                  dependency_files: dependency_files,
+                  target_dependency_file: target_file
+                ).repository_urls
+              end.uniq
           end
 
           def matches_dependency_version_type?(comparison_version)

spec/dependabot/file_parsers/java/gradle/repositories_finder_spec.rb

@@ -5,9 +5,15 @@
 require "dependabot/file_parsers/java/gradle/repositories_finder"
 
 RSpec.describe Dependabot::FileParsers::Java::Gradle::RepositoriesFinder do
-  let(:finder) { described_class.new(dependency_files: dependency_files) }
+  let(:finder) do
+    described_class.new(
+      dependency_files: dependency_files,
+      target_dependency_file: target_dependency_file
+    )
+  end
 
   let(:dependency_files) { [buildfile] }
+  let(:target_dependency_file) { buildfile }
   let(:buildfile) do
     Dependabot::DependencyFile.new(
       name: "build.gradle",

spec/dependabot/update_checkers/java/gradle/version_finder_spec.rb

@@ -34,7 +34,7 @@
   let(:buildfile_fixture_name) { "basic_build.gradle" }
 
   let(:dependency_requirements) do
-    [{ file: "pom.xml", requirement: "23.3-jre", groups: [], source: nil }]
+    [{ file: "build.gradle", requirement: "23.3-jre", groups: [], source: nil }]
   end
   let(:dependency_name) { "com.google.guava:guava" }
   let(:dependency_version) { "23.3-jre" }

spec/dependabot/update_checkers/java/gradle_spec.rb

@@ -98,7 +98,7 @@
       end
       let(:dependency_requirements) do
         [{
-          file: "pom.xml",
+          file: "build.gradle",
           requirement: "1.1.4-3",
           groups: [],
           source: nil,
@@ -129,7 +129,7 @@
       end
       let(:dependency_requirements) do
         [{
-          file: "pom.xml",
+          file: "build.gradle",
           requirement: "1.1.4-3",
           groups: [],
           source: nil,