[restful-api] Introduce Steep Typechecking

.github/workflows/restful-api.yml → .github/workflows/ruby-on-rails--restful-api.yml

@@ -5,14 +5,14 @@
 # This workflow will install a prebuilt Ruby version, install dependencies, and
 # run tests and linters.
 
-name: RESTful API
+name: Ruby on Rails - RESTful API
 
 on:
   push:
     branches:
       - master
     paths:
-      - '.github/workflows/restful-api.yml'
+      - '.github/workflows/ruby-on-rails--restful-api.yml'
       - '.ruby-version'
       - 'ruby-on-rails/restful-api/.ruby-version'
       - 'ruby-on-rails/restful-api/Gemfile'
@@ -23,7 +23,7 @@ on:
       - 'ruby-on-rails/restful-api/**/*.yml'
   pull_request:
     paths:
-      - '.github/workflows/restful-api.yml'
+      - '.github/workflows/ruby-on-rails--restful-api.yml'
       - '.ruby-version'
       - 'ruby-on-rails/restful-api/.ruby-version'
       - 'ruby-on-rails/restful-api/Gemfile'
@@ -78,3 +78,9 @@ jobs:
       - name: Run Brakeman
         working-directory: ./ruby-on-rails/restful-api
         run: bundle exec brakeman --no-pager
+      - name: Generate RBS
+        working-directory: ./ruby-on-rails/restful-api
+        run: bundle exec rbs-inline --output sig
+      - name: Run Steep
+        working-directory: ./ruby-on-rails/restful-api
+        run: bundle exec steep check

ruby-on-rails/restful-api/Gemfile

@@ -33,8 +33,6 @@ gem 'will_paginate', '~> 4.0.1'
 # environmental variables
 gem 'dotenv-rails', '~> 3.2.0'
 
-gem 'nokogiri', '~> 1.19.2'
-
 gem 'net-smtp', '~> 0.5.0'
 
 # The Observer pattern provides a simple mechanism for one object to inform a set of interested third-party objects when its state changes.
@@ -43,16 +41,16 @@ gem 'observer', '~> 0.1.2'
 # Data structure, similar to a Hash, that allows the definition of arbitrary attributes with their accompanying values
 gem 'ostruct', '~> 0.6.3'
 
-# A foreign function interface (FFI) is a mechanism by which a program written in one programming language can call routines or make use of services written or compiled in another one
-gem 'ffi', '~> 1.17.4'
-
 group :development, :test do
   # Debug tool used with binding.irb. Explicit require avoids eager loading `debug/prelude`
   # which interferes with the Docker boot process.
   # [Ref] https://ruby.github.io/irb/#label-Debugging+with+IRB
   # [Ref] https://github.com/ruby/debug#debug-command-on-the-debug-console
   # [Ref] https://guides.rubyonrails.org/debugging_rails_applications.html#debugging-with-the-debug-gem
   gem 'debug', platforms: %i[ mri windows ], require: false
+  # Typechecking
+  gem 'rbs-inline', '~> 0.13.0', require: false
+  gem 'steep', '~> 1.10.0', require: false
 end
 
 group :development do

ruby-on-rails/restful-api/Gemfile.lock

@@ -80,6 +80,7 @@ GEM
       securerandom (>= 0.3)
       tzinfo (~> 2.0, >= 2.0.5)
       uri (>= 0.13.1)
+    ast (2.4.3)
     base64 (0.3.0)
     bcrypt (3.1.22)
     bigdecimal (4.1.1)
@@ -93,6 +94,7 @@ GEM
     concurrent-ruby (1.3.6)
     connection_pool (3.0.2)
     crass (1.0.6)
+    csv (3.3.5)
     database_cleaner (2.1.0)
       database_cleaner-active_record (>= 2, < 3)
     database_cleaner-active_record (2.2.2)
@@ -118,8 +120,8 @@ GEM
       railties (>= 6.1.0)
     faker (3.6.1)
       i18n (>= 1.8.11, < 2)
-    ffi (1.17.4)
     ffi (1.17.4-x86_64-linux-gnu)
+    fileutils (1.8.0)
     globalid (1.3.0)
       activesupport (>= 6.1)
     i18n (1.14.8)
@@ -134,6 +136,11 @@ GEM
     jsonapi-renderer (0.2.2)
     jwt (3.1.2)
       base64
+    language_server-protocol (3.17.0.5)
+    listen (3.10.0)
+      logger
+      rb-fsevent (~> 0.10, >= 0.10.3)
+      rb-inotify (~> 0.9, >= 0.9.10)
     logger (1.7.0)
     loofah (2.25.1)
       crass (~> 1.0.2)
@@ -146,11 +153,11 @@ GEM
       net-smtp
     marcel (1.1.0)
     mini_mime (1.1.5)
-    mini_portile2 (2.8.9)
     minitest (6.0.3)
       drb (~> 2.0)
       prism (~> 1.5)
     msgpack (1.8.0)
+    mutex_m (0.3.0)
     mysql2 (0.5.7)
       bigdecimal
     net-imap (0.6.3)
@@ -163,13 +170,13 @@ GEM
     net-smtp (0.5.1)
       net-protocol
     nio4r (2.7.5)
-    nokogiri (1.19.2)
-      mini_portile2 (~> 2.8.2)
-      racc (~> 1.4)
     nokogiri (1.19.2-x86_64-linux-gnu)
       racc (~> 1.4)
     observer (0.1.2)
     ostruct (0.6.3)
+    parser (3.3.11.1)
+      ast (~> 2.4.1)
+      racc
     pp (0.6.3)
       prettyprint
     prettyprint (0.2.0)
@@ -218,7 +225,17 @@ GEM
       thor (~> 1.0, >= 1.2.2)
       tsort (>= 0.2)
       zeitwerk (~> 2.6)
+    rainbow (3.1.1)
     rake (13.3.1)
+    rb-fsevent (0.11.2)
+    rb-inotify (0.11.1)
+      ffi (~> 1.0)
+    rbs (3.10.4)
+      logger
+      tsort
+    rbs-inline (0.13.0)
+      prism (>= 0.29)
+      rbs (>= 3.8.0)
     rdoc (7.2.0)
       erb
       psych (>= 4.0.0)
@@ -245,12 +262,35 @@ GEM
     securerandom (0.4.1)
     shoulda-matchers (7.0.1)
       activesupport (>= 7.1)
+    steep (1.10.0)
+      activesupport (>= 5.1)
+      concurrent-ruby (>= 1.1.10)
+      csv (>= 3.0.9)
+      fileutils (>= 1.1.0)
+      json (>= 2.1.0)
+      language_server-protocol (>= 3.17.0.4, < 4.0)
+      listen (~> 3.0)
+      logger (>= 1.3.0)
+      mutex_m (>= 0.3.0)
+      parser (>= 3.1)
+      rainbow (>= 2.2.2, < 4.0)
+      rbs (~> 3.9)
+      securerandom (>= 0.1)
+      strscan (>= 1.0.0)
+      terminal-table (>= 2, < 5)
+      uri (>= 0.12.0)
     stringio (3.2.0)
+    strscan (3.1.8)
+    terminal-table (4.0.0)
+      unicode-display_width (>= 1.1.1, < 4)
     thor (1.5.0)
     timeout (0.6.1)
     tsort (0.2.0)
     tzinfo (2.0.6)
       concurrent-ruby (~> 1.0)
+    unicode-display_width (3.2.0)
+      unicode-emoji (~> 4.1)
+    unicode-emoji (4.2.0)
     uri (1.1.1)
     useragent (0.16.11)
     websocket-driver (0.8.0)
@@ -261,7 +301,6 @@ GEM
     zeitwerk (2.7.5)
 
 PLATFORMS
-  ruby
   x86_64-linux
 
 DEPENDENCIES
@@ -274,17 +313,17 @@ DEPENDENCIES
   dotenv-rails (~> 3.2.0)
   factory_bot_rails (~> 6.5.1)
   faker (~> 3.6.0)
-  ffi (~> 1.17.4)
   jwt (~> 3.1.2)
   mysql2 (~> 0.5.7)
   net-smtp (~> 0.5.0)
-  nokogiri (~> 1.19.2)
   observer (~> 0.1.2)
   ostruct (~> 0.6.3)
   puma (~> 8.0.0)
   rails (~> 8.1.3)
+  rbs-inline (~> 0.13.0)
   rspec-rails (~> 8.0.4)
   shoulda-matchers (~> 7.0.1)
+  steep (~> 1.10.0)
   tzinfo-data
   will_paginate (~> 4.0.1)
 
@@ -302,6 +341,7 @@ CHECKSUMS
   activerecord (8.1.3) sha256=8003be7b2466ba0a2a670e603eeb0a61dd66058fccecfc49901e775260ac70ab
   activestorage (8.1.3) sha256=0564ce9309143951a67615e1bb4e090ee54b8befed417133cae614479b46384d
   activesupport (8.1.3) sha256=21a5e0dfbd4c3ddd9e1317ec6a4d782fa226e7867dc70b0743acda81a1dca20e
+  ast (2.4.3) sha256=954615157c1d6a382bc27d690d973195e79db7f55e9765ac7c481c60bdb4d383
   base64 (0.3.0) sha256=27337aeabad6ffae05c265c450490628ef3ebd4b67be58257393227588f5a97b
   bcrypt (3.1.22) sha256=1f0072e88c2d705d94aff7f2c5cb02eb3f1ec4b8368671e19112527489f29032
   bigdecimal (4.1.1) sha256=1c09efab961da45203c8316b0cdaec0ff391dfadb952dd459584b63ebf8054ca
@@ -312,6 +352,7 @@ CHECKSUMS
   concurrent-ruby (1.3.6) sha256=6b56837e1e7e5292f9864f34b69c5a2cbc75c0cf5338f1ce9903d10fa762d5ab
   connection_pool (3.0.2) sha256=33fff5ba71a12d2aa26cb72b1db8bba2a1a01823559fb01d29eb74c286e62e0a
   crass (1.0.6) sha256=dc516022a56e7b3b156099abc81b6d2b08ea1ed12676ac7a5657617f012bd45d
+  csv (3.3.5) sha256=6e5134ac3383ef728b7f02725d9872934f523cb40b961479f69cf3afa6c8e73f
   database_cleaner (2.1.0) sha256=1dcba26e3b1576da692fc6bac10136a4744da5bcc293d248aae19640c65d89cd
   database_cleaner-active_record (2.2.2) sha256=88296b9f3088c31f7c0d4fcec10f68e4b71c96698043916de59b04debec10388
   database_cleaner-core (2.0.1) sha256=8646574c32162e59ed7b5258a97a208d3c44551b854e510994f24683865d846c
@@ -326,33 +367,35 @@ CHECKSUMS
   factory_bot (6.5.6) sha256=12beb373214dccc086a7a63763d6718c49769d5606f0501e0a4442676917e077
   factory_bot_rails (6.5.1) sha256=d3cc4851eae4dea8a665ec4a4516895045e710554d2b5ac9e68b94d351bc6d68
   faker (3.6.1) sha256=c513d23c1d26b426283e913b25e0b714576011d7c1ad368a9ac6ea2113a1ccde
-  ffi (1.17.4) sha256=bcd1642e06f0d16fc9e09ac6d49c3a7298b9789bcb58127302f934e437d60acf
   ffi (1.17.4-x86_64-linux-gnu) sha256=9d3db14c2eae074b382fa9c083fe95aec6e0a1451da249eab096c34002bc752d
+  fileutils (1.8.0) sha256=8c6b1df54e2540bdb2f39258f08af78853aa70bad52b4d394bbc6424593c6e02
   globalid (1.3.0) sha256=05c639ad6eb4594522a0b07983022f04aa7254626ab69445a0e493aa3786ff11
   i18n (1.14.8) sha256=285778639134865c5e0f6269e0b818256017e8cde89993fdfcbfb64d088824a5
   io-console (0.8.2) sha256=d6e3ae7a7cc7574f4b8893b4fca2162e57a825b223a177b7afa236c5ef9814cc
   irb (1.17.0) sha256=168c4ddb93d8a361a045c41d92b2952c7a118fa73f23fe14e55609eb7a863aae
   json (2.19.3) sha256=289b0bb53052a1fa8c34ab33cc750b659ba14a5c45f3fcf4b18762dc67c78646
   jsonapi-renderer (0.2.2) sha256=b5c44b033d61b4abdb6500fa4ab84807ca0b36ea0e59e47a2c3ca7095a6e447b
   jwt (3.1.2) sha256=af6991f19a6bb4060d618d9add7a66f0eeb005ac0bc017cd01f63b42e122d535
+  language_server-protocol (3.17.0.5) sha256=fd1e39a51a28bf3eec959379985a72e296e9f9acfce46f6a79d31ca8760803cc
+  listen (3.10.0) sha256=c6e182db62143aeccc2e1960033bebe7445309c7272061979bb098d03760c9d2
   logger (1.7.0) sha256=196edec7cc44b66cfb40f9755ce11b392f21f7967696af15d274dde7edff0203
   loofah (2.25.1) sha256=d436c73dbd0c1147b16c4a41db097942d217303e1f7728704b37e4df9f6d2e04
   mail (2.9.0) sha256=6fa6673ecd71c60c2d996260f9ee3dd387d4673b8169b502134659ece6d34941
   marcel (1.1.0) sha256=fdcfcfa33cc52e93c4308d40e4090a5d4ea279e160a7f6af988260fa970e0bee
   mini_mime (1.1.5) sha256=8681b7e2e4215f2a159f9400b5816d85e9d8c6c6b491e96a12797e798f8bccef
-  mini_portile2 (2.8.9) sha256=0cd7c7f824e010c072e33f68bc02d85a00aeb6fce05bb4819c03dfd3c140c289
   minitest (6.0.3) sha256=88ac8a1de36c00692420e7cb3cc11a0773bbcb126aee1c249f320160a7d11411
   msgpack (1.8.0) sha256=e64ce0212000d016809f5048b48eb3a65ffb169db22238fb4b72472fecb2d732
+  mutex_m (0.3.0) sha256=cfcb04ac16b69c4813777022fdceda24e9f798e48092a2b817eb4c0a782b0751
   mysql2 (0.5.7) sha256=ba09ede515a0ae8a7192040a1b778c0fb0f025fa5877e9be895cd325fa5e9d7b
   net-imap (0.6.3) sha256=9bab75f876596d09ee7bf911a291da478e0cd6badc54dfb82874855ccc82f2ad
   net-pop (0.1.2) sha256=848b4e982013c15b2f0382792268763b748cce91c9e91e36b0f27ed26420dff3
   net-protocol (0.2.2) sha256=aa73e0cba6a125369de9837b8d8ef82a61849360eba0521900e2c3713aa162a8
   net-smtp (0.5.1) sha256=ed96a0af63c524fceb4b29b0d352195c30d82dd916a42f03c62a3a70e5b70736
   nio4r (2.7.5) sha256=6c90168e48fb5f8e768419c93abb94ba2b892a1d0602cb06eef16d8b7df1dca1
-  nokogiri (1.19.2) sha256=38fdd8b59db3d5ea9e7dfb14702e882b9bf819198d5bf976f17ebce12c481756
   nokogiri (1.19.2-x86_64-linux-gnu) sha256=fa8feca882b73e871a9845f3817a72e9734c8e974bdc4fbad6e4bc6e8076b94f
   observer (0.1.2) sha256=d8a3107131ba661138d748e7be3dbafc0d82e732fffba9fccb3d7829880950ac
   ostruct (0.6.3) sha256=95a2ed4a4bd1d190784e666b47b2d3f078e4a9efda2fccf18f84ddc6538ed912
+  parser (3.3.11.1) sha256=d17ace7aabe3e72c3cc94043714be27cc6f852f104d81aa284c2281aecc65d54
   pp (0.6.3) sha256=2951d514450b93ccfeb1df7d021cae0da16e0a7f95ee1e2273719669d0ab9df6
   prettyprint (0.2.0) sha256=2bc9e15581a94742064a3cc8b0fb9d45aae3d03a1baa6ef80922627a0766f193
   prism (1.9.0) sha256=7b530c6a9f92c24300014919c9dcbc055bf4cdf51ec30aed099b06cd6674ef85
@@ -367,7 +410,12 @@ CHECKSUMS
   rails-dom-testing (2.3.0) sha256=8acc7953a7b911ca44588bf08737bc16719f431a1cc3091a292bca7317925c1d
   rails-html-sanitizer (1.7.0) sha256=28b145cceaf9cc214a9874feaa183c3acba036c9592b19886e0e45efc62b1e89
   railties (8.1.3) sha256=913eb0e0cb520aac687ffd74916bd726d48fa21f47833c6292576ef6a286de22
+  rainbow (3.1.1) sha256=039491aa3a89f42efa1d6dec2fc4e62ede96eb6acd95e52f1ad581182b79bc6a
   rake (13.3.1) sha256=8c9e89d09f66a26a01264e7e3480ec0607f0c497a861ef16063604b1b08eb19c
+  rb-fsevent (0.11.2) sha256=43900b972e7301d6570f64b850a5aa67833ee7d87b458ee92805d56b7318aefe
+  rb-inotify (0.11.1) sha256=a0a700441239b0ff18eb65e3866236cd78613d6b9f78fea1f9ac47a85e47be6e
+  rbs (3.10.4) sha256=b17d7c4be4bb31a11a3b529830f0aa206a807ca42f2e7921a3027dfc6b7e5ce8
+  rbs-inline (0.13.0) sha256=aba6e48c2d1b75276e8557376164f4b4ba96dd0204e779a5cee2af442bd30442
   rdoc (7.2.0) sha256=8650f76cd4009c3b54955eb5d7e3a075c60a57276766ebf36f9085e8c9f23192
   reline (0.6.3) sha256=1198b04973565b36ec0f11542ab3f5cfeeec34823f4e54cebde90968092b1835
   rspec-core (3.13.6) sha256=a8823c6411667b60a8bca135364351dda34cd55e44ff94c4be4633b37d828b2d
@@ -377,11 +425,16 @@ CHECKSUMS
   rspec-support (3.13.7) sha256=0640e5570872aafefd79867901deeeeb40b0c9875a36b983d85f54fb7381c47c
   securerandom (0.4.1) sha256=cc5193d414a4341b6e225f0cb4446aceca8e50d5e1888743fac16987638ea0b1
   shoulda-matchers (7.0.1) sha256=b4bfd8744c10e0a36c8ac1a687f921ee7e25ed529e50488d61b79a8688749c77
+  steep (1.10.0) sha256=1b295b55f9aaff1b8d3ee42453ee55bc2a1078fda0268f288edb2dc014f4d7d1
   stringio (3.2.0) sha256=c37cb2e58b4ffbd33fe5cd948c05934af997b36e0b6ca6fdf43afa234cf222e1
+  strscan (3.1.8) sha256=aae2db611a225559f21ffbb71765c9a4e60fd262534a9ea84f4f11c7f32f679e
+  terminal-table (4.0.0) sha256=f504793203f8251b2ea7c7068333053f0beeea26093ec9962e62ea79f94301d2
   thor (1.5.0) sha256=e3a9e55fe857e44859ce104a84675ab6e8cd59c650a49106a05f55f136425e73
   timeout (0.6.1) sha256=78f57368a7e7bbadec56971f78a3f5ecbcfb59b7fcbb0a3ed6ddc08a5094accb
   tsort (0.2.0) sha256=9650a793f6859a43b6641671278f79cfead60ac714148aabe4e3f0060480089f
   tzinfo (2.0.6) sha256=8daf828cc77bcf7d63b0e3bdb6caa47e2272dcfaf4fbfe46f8c3a9df087a829b
+  unicode-display_width (3.2.0) sha256=0cdd96b5681a5949cdbc2c55e7b420facae74c4aaf9a9815eee1087cb1853c42
+  unicode-emoji (4.2.0) sha256=519e69150f75652e40bf736106cfbc8f0f73aa3fb6a65afe62fefa7f80b0f80f
   uri (1.1.1) sha256=379fa58d27ffb1387eaada68c749d1426738bd0f654d812fcc07e7568f5c57c6
   useragent (0.16.11) sha256=700e6413ad4bb954bb63547fa098dddf7b0ebe75b40cc6f93b8d54255b173844
   websocket-driver (0.8.0) sha256=ed0dba4b943c22f17f9a734817e808bc84cdce6a7e22045f5315aa57676d4962

ruby-on-rails/restful-api/Steepfile

@@ -0,0 +1,13 @@
+D = Steep::Diagnostic
+
+target :app do
+  check "app"
+  check "spec"
+  signature "sig"
+
+  library "net-smtp"
+  library "observer"
+  library "ostruct"
+
+  configure_code_diagnostics(D::Ruby.default)
+end

ruby-on-rails/restful-api/app/auth/authenticate_user.rb

@@ -1,3 +1,4 @@
+# rbs_inline: enabled
 class AuthenticateUser
   def initialize(email, password)
     @email = email

ruby-on-rails/restful-api/app/auth/authorize_api_request.rb

@@ -1,3 +1,4 @@
+# rbs_inline: enabled
 class AuthorizeApiRequest
   def initialize(headers = {})
     @headers = headers

ruby-on-rails/restful-api/app/channels/application_cable/channel.rb

@@ -1,3 +1,4 @@
+# rbs_inline: enabled
 module ApplicationCable
   class Channel < ActionCable::Channel::Base
   end

ruby-on-rails/restful-api/app/channels/application_cable/connection.rb

@@ -1,3 +1,4 @@
+# rbs_inline: enabled
 module ApplicationCable
   class Connection < ActionCable::Connection::Base
   end

ruby-on-rails/restful-api/app/controllers/application_controller.rb

@@ -1,3 +1,4 @@
+# rbs_inline: enabled
 class ApplicationController < ActionController::API
   include Response
   include ExceptionHandler

ruby-on-rails/restful-api/app/controllers/authentication_controller.rb

@@ -1,3 +1,4 @@
+# rbs_inline: enabled
 class AuthenticationController < ApplicationController
   skip_before_action :authorize_request, only: :authenticate
 

ruby-on-rails/restful-api/app/controllers/concerns/exception_handler.rb

@@ -1,3 +1,4 @@
+# rbs_inline: enabled
 module ExceptionHandler
   extend ActiveSupport::Concern
 

ruby-on-rails/restful-api/app/controllers/concerns/response.rb

@@ -1,3 +1,4 @@
+# rbs_inline: enabled
 module Response
   def json_response(object, status = :ok)
     render json: object, status: status

ruby-on-rails/restful-api/app/controllers/users_controller.rb

@@ -1,3 +1,4 @@
+# rbs_inline: enabled
 class UsersController < ApplicationController
   skip_before_action :authorize_request, only: :create
 

ruby-on-rails/restful-api/app/controllers/v1/items_controller.rb

@@ -1,3 +1,4 @@
+# rbs_inline: enabled
 class V1::ItemsController < ApplicationController
   before_action :set_todo
   before_action :set_todo_item, only: %i(show update destroy)

ruby-on-rails/restful-api/app/controllers/v1/todos_controller.rb

@@ -1,3 +1,4 @@
+# rbs_inline: enabled
 class V1::TodosController < ApplicationController
   before_action :set_todo, only: %i(show update destroy)
 

ruby-on-rails/restful-api/app/controllers/v2/todos_controller.rb

@@ -1,3 +1,4 @@
+# rbs_inline: enabled
 class V2::TodosController < ApplicationController
   def index
     # a dummy response

ruby-on-rails/restful-api/app/jobs/application_job.rb

@@ -1,3 +1,4 @@
+# rbs_inline: enabled
 class ApplicationJob < ActiveJob::Base
   # Automatically retry jobs that encountered a deadlock
   # retry_on ActiveRecord::Deadlocked

ruby-on-rails/restful-api/app/lib/api_version.rb

@@ -1,3 +1,4 @@
+# rbs_inline: enabled
 class ApiVersion
   attr_reader :version, :default
 

ruby-on-rails/restful-api/app/lib/concerns/exception_handler.rb

@@ -1,3 +1,4 @@
+# rbs_inline: enabled
 module ExceptionHandler
   extend ActiveSupport::Concern
 

ruby-on-rails/restful-api/app/lib/json_web_token.rb

@@ -1,3 +1,4 @@
+# rbs_inline: enabled
 class JsonWebToken
   # secret to encode and decode token
   HMAC_SECRET = Rails.application.credentials.secret_key_base

ruby-on-rails/restful-api/app/lib/message.rb

@@ -1,3 +1,4 @@
+# rbs_inline: enabled
 class Message
   def self.not_found(record = 'record')
     "Sorry, #{record} not found."