Enforce Sorbet typed sigil

.github/workflows/ci.yml

@@ -70,4 +70,5 @@ jobs:
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: coverage/coverage.xml
+          disable_search: true
           fail_ci_if_error: false

.rubocop.yml

@@ -5,6 +5,9 @@ inherit_mode:
   merge:
     - Exclude
 
+plugins:
+  - rubocop-sorbet
+
 AllCops:
   SuggestExtensions: false
   Exclude:
@@ -13,6 +16,43 @@ AllCops:
     - bin/**/*
     - tmp/**/*
 
+# Every Ruby file must declare a `typed:` sigil (bin/ and tmp/ stay excluded
+# via AllCops above).
+Sorbet/ValidSigil:
+  RequireSigilOnAllFiles: true
+
+# Production code is `typed: strict`. Test files are exempt (RSpock's AST
+# transform and type pinnings in setup methods keep them at `typed: false`);
+# sigil presence is still enforced there by Sorbet/ValidSigil.
+Sorbet/StrictSigil:
+  Enabled: true
+  Include:
+    - src/**/*
+    - lib/**/*
+  Exclude:
+    # The pre-bundle bootstrap chain (dependencies.rb -> dev/deps -> ...,
+    # plus ensure_bundler) is loaded by bin/setup.rb and bin/test.rb BEFORE
+    # the bundle exists, so it must stay stdlib-only: `sig` blocks would
+    # require sorbet-runtime at load time. These files cap at `typed: true`
+    # (or `typed: false` where noted).
+    - lib/ensure_bundler.rb
+    - lib/dev/deps.rb
+    - lib/dev/deps/cli_ui.rb
+    - lib/dev/deps/config.rb
+    - lib/dev/deps/lockfile.rb
+    - lib/dev/deps/tap.rb
+    - lib/dev/deps/dependency_installer.rb
+    # `typed: false` holdouts: Data.define with a keyword-args initialize
+    # override is rejected by Sorbet (error 4010)...
+    - lib/dev/deps/dependency.rb
+    - lib/dev/deps/dependency_declaration.rb
+    # ...method_missing dispatch into a required-keyword method needs
+    # T.unsafe, which the pre-bundle constraint forbids...
+    - lib/dev/deps/dsl.rb
+    # ...and Fetcher consumes a consumer-repo Lockfile API (parse,
+    # runtime_ref_map) that doesn't resolve against this repo's Lockfile.
+    - lib/dev/deps/fetcher.rb
+
 # dev's tests are written in the RSpock dialect: bare comparisons in
 # Then/Expect blocks, block-name constants (Given/When/Then/Where), and
 # Where-table rows (`a | b`, sometimes with identical operands) are rewritten

Gemfile

@@ -13,18 +13,23 @@ gem "rspock", "~> 3.0"
 gem "minitest"
 gem "minitest-reporters"
 gem "rake"
-gem "simplecov", "~> 0.22"
-# Codecov can't process SimpleCov's JSON once a `# :nocov:` line appears
+gem "simplecov", "~> 1.0"
+# Codecov can't process SimpleCov's JSON once skipped lines appear
 # (the "ignored" value breaks its parser — codecov/engineering-team#3592),
 # so CI uploads the cobertura report instead.
-gem "simplecov-cobertura", "~> 3.0"
+gem "simplecov-cobertura", "~> 4.0"
+# Skips type-level Sorbet constructs (sig blocks, T.type_alias, T.absurd)
+# so they never read as coverage misses — Sorbet already checks them
+# statically; line coverage on them measures nothing.
+gem "simplecov-sorbet", "~> 0.2", require: false
 
 # bin/console
 gem "pry", "~> 0.14"
 gem "pry-byebug", "~> 3.11"
 
 # Style
 gem "rubocop-shopify", "~> 3.0", require: false
+gem "rubocop-sorbet", "~> 0.10", require: false
 
 # Sorbet: static + runtime type checking
 gem "sorbet", group: :development

Gemfile.lock

@@ -21,7 +21,6 @@ GEM
     cli-ui (2.7.0)
     coderay (1.1.3)
     diff-lcs (2.0.0)
-    docile (1.4.1)
     erubi (1.13.1)
     io-console (0.8.2)
     json (2.21.1)
@@ -86,17 +85,19 @@ GEM
     rubocop-shopify (3.0.1)
       lint_roller
       rubocop (~> 1.72, >= 1.72.1)
+    rubocop-sorbet (0.13.2)
+      lint_roller
+      rubocop (>= 1.75.2)
     ruby-progressbar (1.13.0)
     ruby2_keywords (0.0.5)
-    simplecov (0.22.0)
-      docile (~> 1.1)
-      simplecov-html (~> 0.11)
-      simplecov_json_formatter (~> 0.1)
-    simplecov-cobertura (3.2.0)
+    simplecov (1.1.1)
+    simplecov-cobertura (4.0.0)
       rexml
-      simplecov (~> 0.19)
-    simplecov-html (0.13.2)
-    simplecov_json_formatter (0.1.4)
+      simplecov (~> 1.0)
+    simplecov-sorbet (0.2.0)
+      ast_transform (~> 3.1)
+      simplecov (~> 1.0)
+      sorbet-runtime
     sorbet (0.6.12971)
       sorbet-static (= 0.6.12971)
     sorbet-runtime (0.6.12971)
@@ -154,8 +155,10 @@ DEPENDENCIES
   rbs (~> 4.0.0.dev.5)
   rspock (~> 3.0)
   rubocop-shopify (~> 3.0)
-  simplecov (~> 0.22)
-  simplecov-cobertura (~> 3.0)
+  rubocop-sorbet (~> 0.10)
+  simplecov (~> 1.0)
+  simplecov-cobertura (~> 4.0)
+  simplecov-sorbet (~> 0.2)
   sorbet
   tapioca
 
@@ -170,7 +173,6 @@ CHECKSUMS
   coderay (1.1.3) sha256=dc530018a4684512f8f38143cd2a096c9f02a1fc2459edcfe534787a7fc77d4b
   dev (0.2.79)
   diff-lcs (2.0.0) sha256=708a5d52ec2945b50f8f53a181174aa1ef2c496edf81c05957fe956dabb363d5
-  docile (1.4.1) sha256=96159be799bfa73cdb721b840e9802126e4e03dfc26863db73647204c727f21e
   erubi (1.13.1) sha256=a082103b0885dbc5ecf1172fede897f9ebdb745a4b97a5e8dc63953db1ee4ad9
   io-console (0.8.2) sha256=d6e3ae7a7cc7574f4b8893b4fca2162e57a825b223a177b7afa236c5ef9814cc
   json (2.21.1) sha256=13a43df75d95641443f5702dff350f237164a9d811ff0f2c2800d4d980220583
@@ -200,12 +202,12 @@ CHECKSUMS
   rubocop (1.88.2) sha256=8def251c90cd955feb4daa3edc0ab56893250c4ce90ef81e6c80c03f9a939bbf
   rubocop-ast (1.50.0) sha256=b9ca88300da0803ee222ad20cdb30494c0a784eed06fdc35d254b06d662788db
   rubocop-shopify (3.0.1) sha256=4adffa6313294bd9da2b0896ae44c5eb8e419336b2413de20c38b7691a7e6774
+  rubocop-sorbet (0.13.2) sha256=7901e57b6b8e9e9b970d941dbdbb89f2c9de0183bfd2551460468f8aa9548655
   ruby-progressbar (1.13.0) sha256=80fc9c47a9b640d6834e0dc7b3c94c9df37f08cb072b7761e4a71e22cff29b33
   ruby2_keywords (0.0.5) sha256=ffd13740c573b7301cf7a2e61fc857b2a8e3d3aff32545d6f8300d8bae10e3ef
-  simplecov (0.22.0) sha256=fe2622c7834ff23b98066bb0a854284b2729a569ac659f82621fc22ef36213a5
-  simplecov-cobertura (3.2.0) sha256=70d702658677fcb20e5aceb6915ccf8bc62ff2ccd38b62b3ad5c9db5c0888740
-  simplecov-html (0.13.2) sha256=bd0b8e54e7c2d7685927e8d6286466359b6f16b18cb0df47b508e8d73c777246
-  simplecov_json_formatter (0.1.4) sha256=529418fbe8de1713ac2b2d612aa3daa56d316975d307244399fa4838c601b428
+  simplecov (1.1.1) sha256=25825ef13f0b2e74694d769817dad6ab8e90131dabdaa666e522fea105521e78
+  simplecov-cobertura (4.0.0) sha256=e4fb3159b1ecea545b44f5452a8611305323e78ad23eae8aed35924d072e01ea
+  simplecov-sorbet (0.2.0) sha256=dd1bc785f28289641dc9a021402104dac5c683ea19ca4fa30d60a95be4fd77c6
   sorbet (0.6.12971) sha256=2b22b9dc976ac4f3d5af27e0365c9b0235fca0244ec644f4f52f9e7bb6b67acc
   sorbet-runtime (0.6.12971) sha256=1c2c75a262f88c4fbdb36b5617b0b11bfc7c69b11a500b3334bd67d075288a45
   sorbet-static (0.6.12971-aarch64-linux) sha256=f247bb625cd50238fea2ee7c4328f079869bbef8cdba17da72fc0e21db528bfb

dependencies.rb

@@ -1,3 +1,4 @@
+# typed: false
 # frozen_string_literal: true
 
 # dev's own dependency manifest. Loaded in two ways:

docs/cli-ui-generalization-plan.md

@@ -8,7 +8,7 @@ While investigating, two latent bugs surfaced and are already fixed:
 
 - **`content_tag` Errno::EISDIR** — a recursive `content_globs` (`bin/image/**/*`)
   matched the `bin/image/lib` directory; `content_tag` now skips non-files
-  before reading. (`lib/build_container.rb`, test added.)
+  before reading. (`lib/dev/build_container.rb`, test added.)
 - **`release.rb` clobbered resource sha256s** — a `gsub!` over every
   `sha256 "..."` overwrote vendored-gem resource checksums with the tarball sha;
   now anchored to the package url+sha pair. (`bin/release.rb`.)