Enforce Sorbet typed sigil

.rubocop.yml

@@ -5,6 +5,9 @@ inherit_mode:
   merge:
     - Exclude
 
+plugins:
+  - rubocop-sorbet
+
 AllCops:
   SuggestExtensions: false
   Exclude:
@@ -13,6 +16,48 @@ AllCops:
     - bin/**/*
     - tmp/**/*
 
+# Every Ruby file must declare a `typed:` sigil (bin/ and tmp/ stay excluded
+# via AllCops above).
+Sorbet/ValidSigil:
+  RequireSigilOnAllFiles: true
+
+# Production code is `typed: strict`. Test files are exempt (RSpock's AST
+# transform and type pinnings in setup methods keep them at `typed: false`);
+# sigil presence is still enforced there by Sorbet/ValidSigil.
+Sorbet/StrictSigil:
+  Enabled: true
+  Include:
+    - src/**/*
+    - lib/**/*
+  Exclude:
+    # The pre-bundle bootstrap chain (dependencies.rb -> dev/deps -> ...,
+    # plus ensure_bundler) is loaded by bin/setup.rb and bin/test.rb BEFORE
+    # the bundle exists, so it must stay stdlib-only: `sig` blocks would
+    # require sorbet-runtime at load time. These files cap at `typed: true`
+    # (or `typed: false` where noted).
+    - lib/ensure_bundler.rb
+    - lib/dev/deps.rb
+    - lib/dev/deps/cli_ui.rb
+    - lib/dev/deps/config.rb
+    - lib/dev/deps/lockfile.rb
+    - lib/dev/deps/tap.rb
+    - lib/dev/deps/dependency_installer.rb
+    # `typed: false` holdouts: Data.define with a keyword-args initialize
+    # override is rejected by Sorbet (error 4010)...
+    - lib/dev/deps/dependency.rb
+    - lib/dev/deps/dependency_declaration.rb
+    # `typed: true` holdout outside the pre-bundle chain: Sorbet demands sigs
+    # on Data.define-synthesized readers at strict, and wrapping them in the
+    # define block would destroy the originals. Fix by converting to a plain
+    # value class, as clone/repo_spec.rb already did.
+    - lib/dev/cd/repo.rb
+    # ...method_missing dispatch into a required-keyword method needs
+    # T.unsafe, which the pre-bundle constraint forbids...
+    - lib/dev/deps/dsl.rb
+    # ...and Fetcher consumes a consumer-repo Lockfile API (parse,
+    # runtime_ref_map) that doesn't resolve against this repo's Lockfile.
+    - lib/dev/deps/fetcher.rb
+
 # dev's tests are written in the RSpock dialect: bare comparisons in
 # Then/Expect blocks, block-name constants (Given/When/Then/Where), and
 # Where-table rows (`a | b`, sometimes with identical operands) are rewritten

Gemfile

@@ -25,6 +25,7 @@ gem "pry-byebug", "~> 3.11"
 
 # Style
 gem "rubocop-shopify", "~> 3.0", require: false
+gem "rubocop-sorbet", "~> 0.10", require: false
 
 # Sorbet: static + runtime type checking
 gem "sorbet", group: :development

Gemfile.lock

@@ -86,6 +86,9 @@ GEM
     rubocop-shopify (3.0.1)
       lint_roller
       rubocop (~> 1.72, >= 1.72.1)
+    rubocop-sorbet (0.13.2)
+      lint_roller
+      rubocop (>= 1.75.2)
     ruby-progressbar (1.13.0)
     ruby2_keywords (0.0.5)
     simplecov (0.22.0)
@@ -154,6 +157,7 @@ DEPENDENCIES
   rbs (~> 4.0.0.dev.5)
   rspock (~> 3.0)
   rubocop-shopify (~> 3.0)
+  rubocop-sorbet (~> 0.10)
   simplecov (~> 0.22)
   simplecov-cobertura (~> 3.0)
   sorbet
@@ -200,6 +204,7 @@ CHECKSUMS
   rubocop (1.88.2) sha256=8def251c90cd955feb4daa3edc0ab56893250c4ce90ef81e6c80c03f9a939bbf
   rubocop-ast (1.50.0) sha256=b9ca88300da0803ee222ad20cdb30494c0a784eed06fdc35d254b06d662788db
   rubocop-shopify (3.0.1) sha256=4adffa6313294bd9da2b0896ae44c5eb8e419336b2413de20c38b7691a7e6774
+  rubocop-sorbet (0.13.2) sha256=7901e57b6b8e9e9b970d941dbdbb89f2c9de0183bfd2551460468f8aa9548655
   ruby-progressbar (1.13.0) sha256=80fc9c47a9b640d6834e0dc7b3c94c9df37f08cb072b7761e4a71e22cff29b33
   ruby2_keywords (0.0.5) sha256=ffd13740c573b7301cf7a2e61fc857b2a8e3d3aff32545d6f8300d8bae10e3ef
   simplecov (0.22.0) sha256=fe2622c7834ff23b98066bb0a854284b2729a569ac659f82621fc22ef36213a5

dependencies.rb

@@ -1,3 +1,4 @@
+# typed: false
 # frozen_string_literal: true
 
 # dev's own dependency manifest. Loaded in two ways: