Start updating Gradle lockfiles

gradle/.rubocop.yml

@@ -10,7 +10,6 @@ Sorbet/StrictSigil:
     - lib/dependabot/gradle/file_parser/repositories_finder.rb
     - lib/dependabot/gradle/file_parser.rb
     - lib/dependabot/gradle/file_updater/property_value_updater.rb
-    - lib/dependabot/gradle/file_updater.rb
     - lib/dependabot/gradle/update_checker/multi_dependency_updater.rb
     - lib/dependabot/gradle/update_checker/version_finder.rb
     - lib/dependabot/gradle/update_checker.rb

gradle/Dockerfile

@@ -1,7 +1,43 @@
 FROM ghcr.io/dependabot/dependabot-updater-core
 
+# Install Java
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    openjdk-21-jdk \
+    # avoids keytool usage
+    ca-certificates-java \
+    wget \
+    # we need to allow the dependabot user to write to these files for when update-ca-certificates is run
+    && chgrp dependabot /etc/default/cacerts  \
+    && chmod g+rw /etc/default/cacerts \
+    && chgrp dependabot /etc/ssl/certs/java/cacerts  \
+    && chmod g+rw /etc/ssl/certs/java/cacerts \
+    && rm -rf /var/lib/apt/lists/*
+
+# Install Gradle
+ENV GRADLE_HOME=/opt/gradle
+ENV GRADLE_VERSION=8.14.2
+ARG GRADLE_DOWNLOAD_SHA256=7197a12f450794931532469d4ff21a59ea2c1cd59a3ec3f89c035c3c420a6999
+RUN set -o errexit -o nounset \
+    && echo "Downloading Gradle" \
+    && wget --no-verbose --output-document=gradle.zip "https://services.gradle.org/distributions/gradle-${GRADLE_VERSION}-bin.zip" \
+    \
+    && echo "Checking Gradle download hash" \
+    && echo "${GRADLE_DOWNLOAD_SHA256} *gradle.zip" | sha256sum -c - \
+    \
+    && echo "Installing Gradle" \
+    && unzip gradle.zip \
+    && rm gradle.zip \
+    && mv "gradle-${GRADLE_VERSION}" "${GRADLE_HOME}/" \
+    && ln -s "${GRADLE_HOME}/bin/gradle" /usr/bin/gradle
+
 USER dependabot
 
+ENV PATH=/usr/bin/gradle:$PATH
+
+RUN set -o errexit -o nounset \
+    && echo "Testing Gradle installation" \
+    && gradle --version
+
 COPY --chown=dependabot:dependabot maven $DEPENDABOT_HOME/maven
 COPY --chown=dependabot:dependabot gradle $DEPENDABOT_HOME/gradle
 COPY --chown=dependabot:dependabot common $DEPENDABOT_HOME/common

gradle/lib/dependabot/gradle/file_fetcher.rb

@@ -15,6 +15,8 @@ class FileFetcher < Dependabot::FileFetchers::Base
       require_relative "file_parser"
       require_relative "file_fetcher/settings_file_parser"
 
+      SUPPORTED_LOCK_FILE_NAMES = T.let(%w(gradle.lockfile).freeze, T::Array[String])
+
       SUPPORTED_BUILD_FILE_NAMES =
         T.let(%w(build.gradle build.gradle.kts).freeze, T::Array[String])
 
@@ -38,6 +40,7 @@ class FileFetcher < Dependabot::FileFetchers::Base
       def initialize(source:, credentials:, repo_contents_path: nil, options: {})
         super
 
+        @lockfile_name = T.let(T.must(SUPPORTED_LOCK_FILE_NAMES.first), String)
         @buildfile_name = T.let(nil, T.nilable(String))
       end
 
@@ -62,8 +65,10 @@ def fetch_files
 
       sig { params(root_dir: String).returns(T::Array[DependencyFile]) }
       def all_buildfiles_in_build(root_dir)
-        files = [buildfile(root_dir), settings_file(root_dir), version_catalog_file(root_dir)].compact
+        files = [buildfile(root_dir), settings_file(root_dir), version_catalog_file(root_dir), lockfile(root_dir)]
+                .compact
         files += subproject_buildfiles(root_dir)
+        files += subproject_lockfiles(root_dir)
         files += dependency_script_plugins(root_dir)
         files + included_builds(root_dir)
                 .flat_map { |dir| all_buildfiles_in_build(dir) }
@@ -93,6 +98,24 @@ def clean_join(parts)
         Pathname.new(File.join(parts)).cleanpath.to_path
       end
 
+      sig { params(root_dir: String).returns(T::Array[DependencyFile]) }
+      def subproject_lockfiles(root_dir)
+        return [] unless settings_file(root_dir)
+
+        subproject_paths =
+          SettingsFileParser
+          .new(settings_file: T.must(settings_file(root_dir)))
+          .subproject_paths
+
+        subproject_paths.filter_map do |path|
+          lockfile_path = File.join(root_dir, path, @lockfile_name)
+          fetch_file_from_host(lockfile_path)
+        rescue Dependabot::DependencyFileNotFound
+          # Gradle itself doesn't worry about missing subprojects, so we don't
+          nil
+        end
+      end
+
       sig { params(root_dir: String).returns(T::Array[DependencyFile]) }
       def subproject_buildfiles(root_dir)
         return [] unless settings_file(root_dir)
@@ -155,6 +178,11 @@ def file_exists_in_submodule?(path)
         false
       end
 
+      sig { params(dir: String).returns(T.nilable(DependencyFile)) }
+      def lockfile(dir)
+        fetch_file_if_present(File.join(dir, @lockfile_name))
+      end
+
       sig { params(dir: String).returns(T.nilable(DependencyFile)) }
       def buildfile(dir)
         file = find_first(dir, SUPPORTED_BUILD_FILE_NAMES) || return