bootprint 0.2.0 → 0.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4d4c97b0a32461ce90a144849e6fb9c1416682f0b682039cd5e89cfb2d2ca171
-  data.tar.gz: d228014f4dca8d75d8aa03eab9b343e8ee0a9449e5cc8e50220c91549a305803
+  metadata.gz: 6ae8e01ef715b2bb8a62bedb57882a0cf2af5a783ff72c15673b46ecabbff4ea
+  data.tar.gz: a5c4b0fbf1d54ff4c65b0e338d1e117f6eaaf2d1f5c2f1a558824441af5cdca8
 SHA512:
-  metadata.gz: ae4e15f6cd2655c988c3f7b845d417240e433b8e1384c5145b984bc0c243fbb0ad10c5fd09fb93cd8c38570b0682538a459e98db931a77c43c16686bf2963d71
-  data.tar.gz: 7070a15b2d7a82018cb526c9b0fad201ea8259f87a6daa63641ad5be745fe9eee899348c33f41d1f80879e2a103cb6f3a89444eb65b839ec70660e587b76cc5c
+  metadata.gz: d536be2a2d5cd4059b6572736b555b2c2d4ddeaea2245f229dcca4d3d1e1d1726d7e35f4cc04a2b012c19212c8f32b31bb6fccbcc0a249ad152cccd475078123
+  data.tar.gz: 9d973eb86bcb2c82451af1799e80426fe17174b7b269d7bc75fb228e10027cd1d80f76866724935491a573f40d2d2cfeeac121e80f93d69fc06853ca4beb699c

data/ARCHITECTURE.md

@@ -30,6 +30,8 @@ human / JSON / SARIF / Markdown / CI annotations
 - Formatters contain no detection logic.
 - Docker and security-audit code are lazy-loaded by their CLI commands.
 - Rails hooks load only when `Rails::Railtie` already exists; expensive profiling requires `BOOTPRINT_PROFILE_BOOT=1`.
+- The VS Code extension is a workspace-trusted process adapter. It spawns the same Ruby CLI without a shell and contains no duplicate diagnosis logic.
+- The public website is a dependency-free static surface under `site/`; it has no access to snapshots or application data and is deployed independently through GitHub Pages.
 
 ## Plugin contract
 

data/CHANGELOG.md

@@ -2,6 +2,33 @@
 
 All notable changes to Bootprint are documented here. The project follows Semantic Versioning before and after 1.0 where practical.
 
+## Unreleased
+
+## 0.4.0 - 2026-08-11
+
+### Added
+
+- `Bootprint::Advisories` for matching snapshot gem versions against offline JSON advisory bundles.
+- `Bootprint.advisories` and `Bootprint.advise` convenience APIs.
+- `bootprint advisories SNAPSHOT` CLI command with `--bundle` and `--format human|json` options.
+- Sample empty advisory bundle schema at `data/advisories/schema/empty.json`.
+
+## 0.3.0 - 2026-08-04
+
+### Added
+
+- `Bootprint::Matrix` for comparing two or more named snapshots at once.
+- Majority-based consensus values for multi-environment drift analysis.
+- Deterministic outlier identification and per-environment outlier counts.
+- Missing-value reporting for incomplete staging, CI, container, or production fingerprints.
+- `Bootprint.matrix` as the public convenience API.
+- Stable matrix JSON through `Matrix#to_h`.
+
+### Compatibility
+
+- Existing capture, diff, diagnosis, policy, report, CLI, Rails, and plugin APIs are unchanged.
+- Generated timestamps, environment labels, and capture metadata remain excluded from semantic comparisons.
+
 ## 0.2.0 - 2026-08-02
 
 ### Added

data/README.md

@@ -8,7 +8,9 @@
 
 <p align="center">
   <a href="https://github.com/theworker02/bootprint/actions/workflows/test.yml"><img alt="Test status" src="https://github.com/theworker02/bootprint/actions/workflows/test.yml/badge.svg"></a>
-  <img alt="Bootprint 0.2.0" src="https://img.shields.io/badge/version-0.2.0-CC342D">
+  <a href="https://rubygems.org/gems/bootprint"><img alt="Bootprint on RubyGems" src="https://img.shields.io/gem/v/bootprint?logo=rubygems&logoColor=white&color=CC342D"></a>
+  <a href="https://open-vsx.org/extension/theworker02/bootprint"><img alt="Bootprint on Open VSX" src="https://img.shields.io/open-vsx/v/theworker02/bootprint?label=Open%20VSX&color=6C4FBB"></a>
+  <a href="https://theworker02.github.io/bootprint/"><img alt="Bootprint website" src="https://img.shields.io/badge/website-GitHub%20Pages-3977F6?logo=githubpages&logoColor=white"></a>
   <img alt="Ruby 3.1 or newer" src="https://img.shields.io/badge/Ruby-%E2%89%A5%203.1-CC342D?logo=ruby&logoColor=white">
   <img alt="Snapshot schema version 2" src="https://img.shields.io/badge/snapshot_schema-v2-3977F6">
   <a href="LICENSE"><img alt="MIT license" src="https://img.shields.io/badge/license-MIT-171A21"></a>
@@ -16,6 +18,10 @@
 
 Bootprint is a local-first Ruby runtime fingerprint and compatibility diagnostic. It captures a sanitized description of an application environment, compares that description with CI, Docker, staging, or production, and turns raw drift into explanations, severity, evidence, remediation, and enforceable policy.
 
+Explore the project at [theworker02.github.io/bootprint](https://theworker02.github.io/bootprint/).
+
+Install the official [`bootprint` gem from RubyGems.org](https://rubygems.org/gems/bootprint):
+
 ```console
 gem install bootprint
 bootprint capture local
@@ -23,6 +29,8 @@ bootprint docker capture myapp:latest
 bootprint diagnose local myapp-latest
 ```
 
+The official editor extension is available from [Open VSX as `theworker02.bootprint`](https://open-vsx.org/extension/theworker02/bootprint).
+
 Bootprint 0.2 combines a dependency compatibility analyzer, Rails boot inspector, environment-drift detector, and CI policy engine. Ordinary capture performs no network requests, suggested commands never execute automatically, and environment-variable values are never recorded.
 
 ## Contents
@@ -40,6 +48,7 @@ Bootprint 0.2 combines a dependency compatibility analyzer, Rails boot inspector
 - [Rules and plugins](#rules-and-plugins)
 - [Privacy and security](#privacy-and-security)
 - [Platform support and performance](#platform-support-and-performance)
+- [VS Code extension](#vs-code-extension)
 - [Documentation](#documentation)
 - [Development](#development)
 
@@ -386,6 +395,34 @@ Bootprint is designed around these practical limits:
 
 Rails, Docker, SARIF, and plugin code are lazy-loaded so basic CLI use does not pay for integrations it does not invoke. Performance varies with Ruby, filesystem, dependency count, and host load.
 
+## VS Code extension
+
+Bootprint includes an Open VSX-ready editor extension in [`editors/vscode`](editors/vscode), available from the official [`theworker02.bootprint` Open VSX listing](https://open-vsx.org/extension/theworker02/bootprint). It provides capture, diagnose, doctor, and verify commands, streams CLI output inside the editor, and adds snapshot diagnosis to the Explorer context menu.
+
+Install it from an Open VSX-compatible editor or with VSCodium:
+
+```console
+codium --install-extension theworker02.bootprint
+```
+
+The extension uses the workspace bundle by default:
+
+```ruby
+gem "bootprint", "~> 0.2"
+```
+
+Build and install the versioned VSIX locally:
+
+```console
+cd editors/vscode
+npm install
+npm run check
+npm run package:vsix
+code --install-extension ../../pkg/bootprint-vscode-0.2.1.vsix --force
+```
+
+See the [editor extension guide](editors/vscode/README.md) for commands, configuration, trust behavior, Open VSX setup, and direct-executable setup.
+
 ## Documentation
 
 - [Installation](docs/installation.md)
@@ -403,6 +440,8 @@ Rails, Docker, SARIF, and plugin code are lazy-loaded so basic CLI use does not
 - [Snapshot schema](docs/snapshot-schema.md)
 - [Troubleshooting](docs/troubleshooting.md)
 - [Maintainer setup](docs/maintainer-setup.md)
+- [VS Code extension](editors/vscode/README.md)
+- [Open VSX publishing](docs/open-vsx.md)
 
 ## Development
 

data/RELEASE.md

@@ -54,8 +54,8 @@ The tag starts `.github/workflows/release.yml`, which:
 2. runs tests and RuboCop;
 3. builds, installs, and smoke-tests a preflight `.gem` from the tagged source;
 4. pauses at the protected `release` environment;
-5. rebuilds and publishes through the official RubyGems OIDC action;
-6. prints the published package's SHA-256 digest; and
+5. prints the release package's SHA-256 digest;
+6. rebuilds and publishes through the official RubyGems OIDC action; and
 7. creates a GitHub release with that same package attached.
 
 For 0.2.0, use the release title `Bootprint 0.2 — From Environment Differences to Actionable Diagnoses` when editing the generated GitHub release notes.
@@ -71,6 +71,22 @@ gem owner bootprint
 
 Confirm the RubyGems page shows the correct links, MIT license, Ruby requirement, MFA requirement, checksum, owners, and trusted publisher. Confirm the GitHub release attachment has the same SHA-256 digest as the workflow output.
 
+## Build and publish the Open VSX package
+
+Keep `editors/vscode/package.json` aligned with the intended extension release version. The extension depends on the Ruby gem at runtime but is versioned and distributed independently.
+
+```console
+cd editors/vscode
+npm ci
+npm run check
+npm run package:vsix
+code --install-extension ../../pkg/bootprint-vscode-VERSION.vsix
+```
+
+Before distributing the VSIX, inspect its contents with `vsce ls`, verify the bundled license and logo, and smoke-test capture and doctor commands in both Bundler and direct-executable modes. Follow [docs/open-vsx.md](docs/open-vsx.md) for the one-time `theworker02` namespace and protected token setup.
+
+Use the manual **Open VSX** workflow to build an artifact without publishing. Set its `publish` input only for an intentional registry release from a reviewed ref. Open VSX versions are immutable, so increment the extension version before every subsequent publication.
+
 ## Emergency and manual release policy
 
 Prefer rerunning a failed trusted-publishing job. A manual `gem push` is an emergency fallback only and must use an MFA-protected, least-privilege RubyGems API key from an approved maintainer workstation. Never store that key, an OTP, or a signing private key in the repository, workflow variables, shell history, or issue attachments.

data/data/advisories/schema/empty.json

@@ -0,0 +1,5 @@
+{
+  "schema_version": 1,
+  "generated_at": "2026-08-11T00:00:00Z",
+  "advisories": []
+}

data/docs/maintainer-setup.md

@@ -5,10 +5,10 @@ This checklist covers settings that cannot be represented completely by committe
 ## Repository profile
 
 - Description: `Diagnose why Ruby environments work locally but fail in CI, Docker, staging, or production.`
-- Website: `https://rubygems.org/gems/bootprint`
+- Website: `https://theworker02.github.io/bootprint/`
 - Topics: `ruby`, `rails`, `bundler`, `rubygems`, `docker`, `ci`, `diagnostics`, `reproducibility`, `developer-tools`
 - Default branch: `main`
-- Social preview: `assets/branding/bootprint-logo-512.png`
+- Social preview: `site/assets/bootprint-social.png`
 - Enable Issues and Discussions; disable the wiki unless maintainers intend to support it.
 
 ## Ruleset for `main`
@@ -24,6 +24,16 @@ This checklist covers settings that cannot be represented completely by committe
 
 CodeQL runs weekly or on explicit maintainer request rather than adding another check to every pull request.
 
+## GitHub Pages
+
+In **Settings → Pages**, set the publishing source to **GitHub Actions**. The focused `pages.yml` workflow deploys only the dependency-free files under `site/` when that directory changes or when a maintainer runs it manually.
+
+- Expected URL: `https://theworker02.github.io/bootprint/`
+- Deployment environment: `github-pages`
+- Allow deployments only from `main`.
+- Set the repository website field to the Pages URL after the first successful deployment.
+- Do not add a custom domain or `CNAME` until its DNS ownership is verified.
+
 ## Actions and security
 
 - Allow GitHub-authored actions plus `ruby/setup-ruby` and `rubygems/release-gem`.

data/docs/matrix.md

@@ -0,0 +1,28 @@
+# Multi-environment matrix
+
+Bootprint 0.3.0 can compare a fleet of named snapshots instead of only a local/target pair.
+
+```ruby
+matrix = Bootprint.matrix(
+  local: Bootprint::Snapshot.load("tmp/local.json"),
+  ci: Bootprint::Snapshot.load("tmp/ci.json"),
+  staging: Bootprint::Snapshot.load("tmp/staging.json"),
+  production: Bootprint::Snapshot.load("tmp/production.json")
+)
+
+matrix.entries.each do |entry|
+  puts "#{entry.path}: consensus=#{entry.consensus.inspect} outliers=#{entry.outliers.join(',')}"
+end
+```
+
+A matrix entry contains:
+
+- the deterministic dotted path;
+- values by environment;
+- environments where the path is missing;
+- a consensus value when a strict majority agrees;
+- the environments outside that consensus.
+
+`outlier_counts` ranks environments by the number of divergent paths. When no strict majority exists, every environment is reported as an outlier for that path instead of guessing which value is correct.
+
+Bootprint excludes the same non-semantic timestamps, labels, and capture metadata used by pairwise diffing.

data/docs/open-vsx.md

@@ -0,0 +1,45 @@
+# Open VSX publishing
+
+Bootprint's editor extension uses the Open VSX identifier [`theworker02.bootprint`](https://open-vsx.org/extension/theworker02/bootprint). Open VSX publication is separate from RubyGems and GitHub Releases.
+
+## One-time account setup
+
+1. Create an [Eclipse account](https://accounts.eclipse.org/user/register) and set its GitHub username to `theworker02`.
+2. Sign in to [Open VSX](https://open-vsx.org/) with that same GitHub account.
+3. From the Open VSX profile, connect the Eclipse account, read, and accept the Publisher Agreement.
+4. Generate a dedicated CI access token from [Open VSX Access Tokens](https://open-vsx.org/user-settings/tokens). Copy it immediately; Open VSX will not show it again.
+5. Load the token from a password manager into the trusted workstation's process environment as `OVSX_PAT`, then create the namespace once without placing the token in the command arguments:
+
+   ```console
+   npx ovsx create-namespace theworker02
+   ```
+
+6. Claim ownership of `theworker02` through the public process documented in the [Open VSX namespace guide](https://github.com/eclipse-openvsx/openvsx/wiki/Namespace-Access). Creating a namespace permits publishing, but claiming it is required for the registry's verified-owner indicator.
+
+Never commit, paste into an issue, or store the token in ordinary project configuration.
+
+## GitHub setup
+
+1. Create a GitHub environment named `open-vsx`.
+2. Add an environment secret named `OVSX_PAT` containing a dedicated Open VSX CI token.
+3. Add required reviewers to the environment so publication requires explicit approval.
+4. Restrict deployment branches or tags to reviewed release refs.
+
+The [Open VSX workflow](../.github/workflows/open-vsx.yml) is manual-only. Running it with `publish` disabled builds and retains a VSIX artifact for review. Running it with `publish` enabled enters the protected environment and uploads the already-tested package.
+
+## Local release gate
+
+```console
+cd editors/vscode
+npm ci
+npm run check
+npm run package:vsix
+```
+
+Inspect `pkg/bootprint-vscode-VERSION.vsix`, install it into an Open VSX-compatible editor, and test capture, diagnosis, doctor, and verify before publishing. For an intentional manual fallback, provide `OVSX_PAT` only through the process environment and run:
+
+```console
+npm run publish:openvsx
+```
+
+Do not publish the same version twice. Update `editors/vscode/package.json`, the lockfile, changelog, and documentation before publishing the next version.

data/lib/bootprint/advisories.rb

@@ -0,0 +1,118 @@
+# frozen_string_literal: true
+
+require "json"
+require_relative "advisory_bundle_matcher"
+
+module Bootprint
+  # Matches snapshot gem versions against an offline advisory bundle.
+  class Advisories
+    DEFAULT_BUNDLE = File.expand_path("../../data/advisories/schema/empty.json", __dir__).freeze
+
+    Advisory = Struct.new(:id, :gem, :title, :severity, :affected_versions, :url, :cve, keyword_init: true) do
+      def to_h
+        {
+          "id" => id,
+          "gem" => gem,
+          "title" => title,
+          "severity" => severity,
+          "affected_versions" => affected_versions,
+          "url" => url,
+          "cve" => cve
+        }.compact
+      end
+    end
+
+    Match = Struct.new(:gem, :version, :advisory, keyword_init: true) do
+      def to_h
+        {
+          "gem" => gem,
+          "version" => version,
+          "advisory" => advisory.to_h
+        }
+      end
+    end
+
+    attr_reader :bundle
+
+    def self.load(path = DEFAULT_BUNDLE)
+      parsed = JSON.parse(File.read(path, encoding: "UTF-8"))
+      new(parsed, path:)
+    rescue JSON::ParserError => error
+      raise InvalidSnapshotError, "#{File.expand_path(path)} is not valid advisory JSON: #{error.message}"
+    rescue Errno::ENOENT
+      raise InvalidSnapshotError, "Advisory bundle not found: #{File.expand_path(path)}"
+    end
+
+    def self.match(snapshot, bundle: DEFAULT_BUNDLE)
+      advisories(bundle).matches(snapshot)
+    end
+
+    def self.advisories(bundle = DEFAULT_BUNDLE)
+      case bundle
+      when Advisories then bundle
+      when Hash then new(bundle)
+      else load(bundle)
+      end
+    end
+
+    def initialize(bundle, path: nil)
+      @bundle = normalize_bundle(bundle)
+      @path = path
+    end
+
+    def matches(snapshot)
+      gems = extract_gems(snapshot)
+      bundle_advisories.flat_map do |advisory|
+        installed = gems[advisory.gem]
+        next [] unless installed
+
+        version = installed.is_a?(Hash) ? installed["version"] : installed
+        next [] unless version && AdvisoryBundleMatcher.version_satisfies?(version, advisory.affected_versions)
+
+        Match.new(gem: advisory.gem, version: version.to_s, advisory:)
+      end
+    end
+
+    def clean?(snapshot) = matches(snapshot).empty?
+
+    def to_h(snapshot = nil)
+      matches = snapshot ? matches(snapshot) : []
+      {
+        "schema_version" => bundle.fetch("schema_version", 1),
+        "bundle" => @path || "inline",
+        "clean" => matches.empty?,
+        "matches" => matches.map(&:to_h)
+      }
+    end
+
+    private
+
+    def bundle_advisories
+      Array(bundle["advisories"]).map do |entry|
+        Advisory.new(
+          id: entry.fetch("id"),
+          gem: entry.fetch("gem"),
+          title: entry["title"] || entry.fetch("id"),
+          severity: entry["severity"] || "unknown",
+          affected_versions: AdvisoryBundleMatcher.normalize_versions(entry["affected_versions"] || entry["versions"]),
+          url: entry["url"],
+          cve: entry["cve"]
+        )
+      end
+    end
+
+    def extract_gems(snapshot)
+      data = snapshot.is_a?(Snapshot) ? snapshot.data : snapshot
+      gems = data.dig("environment", "dependencies", "gems") || {}
+      gems.transform_keys(&:to_s)
+    end
+
+    def normalize_bundle(bundle)
+      case bundle
+      when Hash then bundle.transform_keys(&:to_s)
+      when String then self.class.load(bundle).bundle
+      else raise ArgumentError, "bundle must be a Hash or path"
+      end
+    end
+  end
+end

data/lib/bootprint/advisory_bundle_matcher.rb

@@ -0,0 +1,39 @@
+# frozen_string_literal: true
+
+require "rubygems"
+
+module Bootprint
+  module AdvisoryBundleMatcher
+    module_function
+
+    def normalize_versions(value)
+      case value
+      when nil then []
+      when Array then value.map(&:to_s)
+      else [value.to_s]
+      end
+    end
+
+    def version_satisfies?(version, constraints)
+      constraints = normalize_versions(constraints)
+      return true if constraints.empty?
+
+      gem_version = Gem::Version.new(version.to_s)
+      Gem::Requirement.new(constraints).satisfied_by?(gem_version)
+    rescue ArgumentError
+      false
+    end
+
+    def value_in_set?(value, allowed)
+      case allowed
+      when nil then true
+      when Array then allowed.any? { |item| values_equal?(value, item) }
+      else values_equal?(value, allowed)
+      end
+    end
+
+    def values_equal?(left, right)
+      left == right || left.to_s == right.to_s
+    end
+  end
+end

data/lib/bootprint/cli.rb

@@ -37,6 +37,7 @@ module Bootprint
       when "docker" then docker_command
       when "ci" then ci_command
       when "security" then security_command
+      when "advisories" then advisories_command
       when "version", "--version", "-v" then version
       when "help", "--help", "-h", nil then help(EXIT_OK)
       else
@@ -294,6 +295,34 @@ module Bootprint
       issues.empty? ? EXIT_OK : EXIT_POLICY
     end
 
+    def advisories_command
+      options = { format: "human", bundle: Bootprint::Advisories::DEFAULT_BUNDLE }
+      parser = OptionParser.new do |opts|
+        opts.banner = "Usage: bootprint advisories SNAPSHOT [--bundle PATH] [--format human|json]"
+        opts.on("--bundle PATH", "Offline advisory bundle JSON") { |value| options[:bundle] = value }
+        opts.on("--format FORMAT", %w[human json]) { |value| options[:format] = value }
+      end
+      return EXIT_OK unless parse_options(parser)
+
+      reference = @argv.shift or raise OptionParser::MissingArgument, "SNAPSHOT is required"
+      reject_extra_arguments!
+      snapshot = load_snapshot(reference)
+      bundle = Bootprint::Advisories.load(options[:bundle])
+      matches = bundle.matches(snapshot)
+      if options[:format] == "json"
+        @out.puts JSON.pretty_generate(bundle.to_h(snapshot))
+      elsif matches.empty?
+        @out.puts "Advisory check passed: no known vulnerabilities in bundled advisories."
+      else
+        @out.puts "Advisory check found #{matches.length} affected gem(s):"
+        matches.each do |match|
+          advisory = match.advisory
+          @out.puts "#{advisory.severity.to_s.upcase} #{match.gem} #{match.version}: #{advisory.title} (#{advisory.id})"
+        end
+      end
+      matches.empty? ? EXIT_OK : EXIT_POLICY
+    end
+
     def report_options
       { format: "human", allows: [], policy: default_policy_path, only: nil, minimum: nil }
     end
@@ -449,6 +478,7 @@ module Bootprint
           docker COMMAND          Capture, compare, or diagnose a local Docker image
           ci verify               Verify with CI-native annotations
           security audit          Audit a snapshot for sensitive data
+          advisories SNAPSHOT     Match gems against offline advisories
 
         Run `bootprint COMMAND --help` for command-specific options.
       HELP

data/lib/bootprint/matrix.rb

@@ -0,0 +1,109 @@
+# frozen_string_literal: true
+
+module Bootprint
+  # Compares two or more snapshots to find consensus values and outlier environments.
+  class Matrix
+    # :values is the matrix cell payload; the name mirrors the JSON "values" key.
+    Entry = Struct.new(:path, :values, :missing, :consensus, :outliers, keyword_init: true) do # rubocop:disable Lint/StructNewOverride
+      def consensus?
+        !consensus.nil?
+      end
+
+      def to_h
+        {
+          "path" => path,
+          "values" => values,
+          "missing" => missing,
+          "consensus" => consensus,
+          "outliers" => outliers
+        }
+      end
+    end
+
+    attr_reader :snapshots
+
+    def initialize(snapshots)
+      @snapshots = snapshots.to_h.transform_keys(&:to_s).transform_values do |snapshot|
+        snapshot.is_a?(Snapshot) ? snapshot.semantic_data : snapshot
+      end.freeze
+      raise ArgumentError, "matrix requires at least two named snapshots" if @snapshots.length < 2
+    end
+
+    def entries
+      @entries ||= begin
+        flattened = snapshots.transform_values { |data| flatten(data) }
+        paths = flattened.values.flat_map(&:keys).uniq.sort.reject { |path| ignored?(path) }
+        paths.filter_map do |path|
+          values = {}
+          missing = []
+          flattened.each do |name, data|
+            data.key?(path) ? values[name] = data[path] : missing << name
+          end
+          distinct = values.values.map { |value| canonical(value) }.uniq.length
+          next if distinct <= 1 && missing.empty?
+
+          consensus = consensus_value(values, snapshots.length)
+          outliers = if consensus.nil?
+                       snapshots.keys.sort
+                     else
+                       (values.filter_map { |name, value| name unless value == consensus } + missing).sort
+                     end
+          Entry.new(path:, values: values.sort.to_h, missing: missing.sort, consensus:, outliers:)
+        end
+      end
+    end
+
+    def clean?
+      entries.empty?
+    end
+
+    def outlier_counts
+      counts = snapshots.keys.to_h { |name| [name, 0] }
+      entries.each { |entry| entry.outliers.each { |name| counts[name] += 1 } }
+      counts.sort.to_h
+    end
+
+    def to_h
+      {
+        "schema" => 1,
+        "environments" => snapshots.keys.sort,
+        "clean" => clean?,
+        "outlier_counts" => outlier_counts,
+        "entries" => entries.map(&:to_h)
+      }
+    end
+
+    private
+
+    def flatten(value, prefix = nil, output = {})
+      if value.is_a?(Hash)
+        value.keys.sort_by(&:to_s).each do |original_key|
+          key = original_key.to_s
+          path = [prefix, key].compact.join(".")
+          flatten(value.fetch(original_key), path, output)
+        end
+      else
+        output[prefix] = value
+      end
+      output
+    end
+
+    def ignored?(path)
+      Diff::IGNORED_PATHS.include?(path) || path == "capture" || path.start_with?("capture.")
+    end
+
+    def consensus_value(values, total)
+      groups = values.values.group_by { |value| canonical(value) }
+      winner = groups.max_by { |key, grouped| [grouped.length, key] }
+      return nil unless winner && winner.last.length > total / 2
+
+      winner.last.first
+    end
+
+    def canonical(value)
+      Marshal.dump(value)
+    rescue TypeError
+      value.inspect
+    end
+  end
+end

data/lib/bootprint/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Bootprint
-  VERSION = "0.2.0"
+  VERSION = "0.4.0"
 end

data/lib/bootprint.rb

@@ -8,6 +8,8 @@ require_relative "bootprint/schema"
 require_relative "bootprint/plugins"
 require_relative "bootprint/snapshot"
 require_relative "bootprint/diff"
+require_relative "bootprint/matrix"
+require_relative "bootprint/advisories"
 require_relative "bootprint/doctor"
 require_relative "bootprint/policy"
 
@@ -28,6 +30,19 @@ module Bootprint
     def capture(label: nil, **options)
       Snapshot.capture(label:, **options)
     end
+
+    # Compares named snapshots and identifies consensus values and outliers.
+    def matrix(snapshots)
+      Matrix.new(snapshots)
+    end
+
+    def advisories(snapshot, bundle: Advisories::DEFAULT_BUNDLE)
+      Advisories.advisories(bundle).matches(snapshot)
+    end
+
+    def advise(snapshot, bundle: Advisories::DEFAULT_BUNDLE)
+      advisories(snapshot, bundle:)
+    end
   end
 end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: bootprint
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.4.0
 platform: ruby
 authors:
 - Magnexis
@@ -34,6 +34,7 @@ files:
 - assets/branding/bootprint-logo-512.png
 - assets/branding/bootprint-logo-64.png
 - assets/branding/bootprint-logo.png
+- data/advisories/schema/empty.json
 - docs/capturing.md
 - docs/ci.md
 - docs/comparing.md
@@ -42,6 +43,8 @@ files:
 - docs/findings.md
 - docs/installation.md
 - docs/maintainer-setup.md
+- docs/matrix.md
+- docs/open-vsx.md
 - docs/plugins.md
 - docs/policy.md
 - docs/privacy.md
@@ -51,6 +54,8 @@ files:
 - docs/troubleshooting.md
 - exe/bootprint
 - lib/bootprint.rb
+- lib/bootprint/advisories.rb
+- lib/bootprint/advisory_bundle_matcher.rb
 - lib/bootprint/analysis.rb
 - lib/bootprint/cli.rb
 - lib/bootprint/collectors/environment.rb
@@ -73,6 +78,7 @@ files:
 - lib/bootprint/formatters/markdown.rb
 - lib/bootprint/formatters/sarif.rb
 - lib/bootprint/initializer_profiler.rb
+- lib/bootprint/matrix.rb
 - lib/bootprint/plugins.rb
 - lib/bootprint/policy.rb
 - lib/bootprint/rails_state.rb
@@ -88,12 +94,12 @@ files:
 - lib/bootprint/snapshot.rb
 - lib/bootprint/version.rb
 - lib/tasks/bootprint.rake
-homepage: https://github.com/theworker02/bootprint
+homepage: https://theworker02.github.io/bootprint/
 licenses:
 - MIT
 metadata:
   source_code_uri: https://github.com/theworker02/bootprint/tree/main
-  homepage_uri: https://github.com/theworker02/bootprint
+  homepage_uri: https://theworker02.github.io/bootprint/
   documentation_uri: https://github.com/theworker02/bootprint/tree/main/docs
   changelog_uri: https://github.com/theworker02/bootprint/blob/main/CHANGELOG.md
   bug_tracker_uri: https://github.com/theworker02/bootprint/issues