bundle_update 0.0.1 → 0.1.0

data/lib/bundle_update/cli.rb

@@ -0,0 +1,125 @@
+# frozen_string_literal: true
+
+require "net/http"
+require "uri"
+require "time"
+require "English"
+
+module BundleUpdate
+  # The `bundle_update` executable. Distinguishes its own subcommands
+  # (report/auth/status/version) from arguments meant for `bundle update`,
+  # and otherwise forwards everything verbatim and unmodified.
+  class CLI
+    SUBCOMMANDS = %w[report auth status version].freeze
+
+    def self.start(argv)
+      new(argv).run
+    end
+
+    def initialize(argv)
+      @argv = argv
+    end
+
+    def run
+      if @argv.first == "--"
+        run_bundle_update(@argv[1..] || [])
+      elsif SUBCOMMANDS.include?(@argv.first)
+        run_subcommand(@argv[0], @argv[1..] || [])
+      else
+        run_bundle_update(@argv)
+      end
+    end
+
+    private
+
+    def run_subcommand(name, rest)
+      case name
+      when "report" then run_report
+      when "auth" then run_auth(rest)
+      when "status" then run_status
+      when "version" then run_version
+      end
+    end
+
+    def run_report
+      Runner.new(config: Config.new).refetch_latest
+      0
+    end
+
+    def run_auth(rest)
+      key = rest.first
+      if key.nil? || key.empty?
+        warn "Usage: bundle_update auth KEY"
+        return 1
+      end
+
+      Config.save_api_key(key)
+      puts "API key saved (#{Config.mask(key)})."
+      0
+    end
+
+    def run_status
+      config = Config.new
+      puts "bundle_update #{BundleUpdate::VERSION}"
+      puts "Project:       #{config.project_name}"
+      puts "API URL:       #{config.api_url}"
+      puts "API key:       #{config.api_key? ? config.masked_api_key : "not configured"}"
+      puts "Disabled:      #{config.disabled?}"
+      puts "API reachable: #{api_reachable?(config) ? "yes" : "no"}" if config.api_key?
+      0
+    end
+
+    def run_version
+      puts "bundle_update #{BundleUpdate::VERSION}"
+      0
+    end
+
+    # A bare connectivity check against the configured host — no report
+    # contract involved, so it can't be affected by API changes.
+    def api_reachable?(config)
+      uri = URI.parse(config.api_url)
+      http = Net::HTTP.new(uri.host, uri.port)
+      http.use_ssl = uri.scheme == "https"
+      http.open_timeout = 2
+      http.read_timeout = 2
+      http.start { true }
+    rescue StandardError
+      false
+    end
+
+    def run_bundle_update(bundler_args)
+      lockfile_path = File.join(Dir.pwd, "Gemfile.lock")
+      lockfile_before = read_lockfile(lockfile_path)
+
+      run_command("bundle", "update", *bundler_args)
+      code = exit_status
+      return code unless code.zero?
+
+      run_reporting_pipeline(lockfile_path, lockfile_before)
+      code
+    end
+
+    # Thin seams around Kernel#system / $? so specs can verify the exact
+    # bundler invocation and simulate its exit code without shelling out.
+    def run_command(*args)
+      system(*args)
+    end
+
+    def exit_status
+      $CHILD_STATUS&.exitstatus || 1
+    end
+
+    def run_reporting_pipeline(lockfile_path, lockfile_before)
+      lockfile_after = read_lockfile(lockfile_path)
+      Runner.new(config: Config.new).report(lockfile_before: lockfile_before, lockfile_after: lockfile_after, ran_at: Time.now)
+    rescue StandardError
+      # The reporting pipeline already fails open internally; this is an
+      # unreachable last resort so a bug here can never fail the bundle run.
+      nil
+    end
+
+    def read_lockfile(path)
+      File.exist?(path) ? File.read(path) : ""
+    end
+  end
+end

data/lib/bundle_update/config.rb

@@ -0,0 +1,172 @@
+# frozen_string_literal: true
+
+require "yaml"
+require "fileutils"
+
+module BundleUpdate
+  # Layered configuration: built-in defaults -> ~/.config/bundle_update/config.yml
+  # -> ./.bundle_update.yml (per-project) -> environment variables. Each layer
+  # overrides the previous one, key by key.
+  #
+  # API keys belong in a config file or an environment variable — never in the
+  # Gemfile, where they'd be committed to source control.
+  class Config
+    # TEMPORARY: pointed at the local dev backend (served via puma-dev, see
+    # ~/.puma-dev/bundleupdate) while bundleupdate.com isn't live yet.
+    # Revert to "https://bundleupdate.com" before shipping.
+    DEFAULT_API_URL = "http://bundleupdate.test"
+    DEFAULT_REPORTS_DIR = "bundle_update_reports"
+    DEFAULT_STATE_DIR = ".bundle_update"
+
+    ENV_KEYS = {
+      "BUNDLE_UPDATE_API_KEY" => :api_key,
+      "BUNDLE_UPDATE_API_URL" => :api_url,
+      "BUNDLE_UPDATE_DISABLED" => :disabled,
+      "BUNDLE_UPDATE_DEBUG" => :debug
+    }.freeze
+
+    TRUTHY = %w[1 true yes on].freeze
+
+    attr_reader :api_key, :api_url, :project_name, :git_remote_url, :reports_dir, :state_dir, :project_root
+
+    def self.user_config_path
+      File.join(Dir.home, ".config", "bundle_update", "config.yml")
+    end
+
+    def self.project_config_path(root)
+      File.join(root, ".bundle_update.yml")
+    end
+
+    def self.mask(key)
+      return nil if key.nil? || key.empty?
+
+      visible = key[0, [key.length - 4, 12].min.clamp(0, key.length)]
+      visible.empty? ? "…" : "#{visible}…"
+    end
+
+    def initialize(env: ENV, project_root: Dir.pwd, user_config_path: self.class.user_config_path)
+      @project_root = project_root
+      merged = [
+        defaults(project_root),
+        load_yaml(user_config_path),
+        load_yaml(self.class.project_config_path(project_root)),
+        from_env(env)
+      ].each_with_object({}) { |layer, acc| acc.merge!(layer) }
+
+      @api_key = merged[:api_key]
+      @api_url = merged[:api_url]
+      @project_name = merged[:project_name]
+      @git_remote_url = merged[:git_remote_url]
+      @reports_dir = merged[:reports_dir]
+      @state_dir = merged[:state_dir]
+      @disabled = truthy?(merged[:disabled])
+      @debug = truthy?(merged[:debug])
+    end
+
+    def api_key?
+      !api_key.to_s.empty?
+    end
+
+    def masked_api_key
+      self.class.mask(api_key)
+    end
+
+    def disabled?
+      @disabled
+    end
+
+    def debug?
+      @debug
+    end
+
+    def state_file_path
+      File.join(@project_root, state_dir, "last_run.json")
+    end
+
+    def debug_log_path
+      File.join(@project_root, state_dir, "debug.log")
+    end
+
+    # Persists the API key to the user-level config file so it applies across
+    # every project. Preserves any other keys already present in that file.
+    def self.save_api_key(key, path: user_config_path)
+      existing = File.exist?(path) ? (YAML.safe_load_file(path) || {}) : {}
+      existing["api_key"] = key
+      FileUtils.mkdir_p(File.dirname(path))
+      File.write(path, existing.to_yaml)
+      FileUtils.chmod(0o600, path)
+    end
+
+    private
+
+    def defaults(project_root)
+      {
+        api_key: nil,
+        api_url: DEFAULT_API_URL,
+        project_name: default_project_name(project_root),
+        git_remote_url: default_git_remote_url(project_root),
+        reports_dir: DEFAULT_REPORTS_DIR,
+        state_dir: DEFAULT_STATE_DIR,
+        disabled: false,
+        debug: false
+      }
+    end
+
+    def default_project_name(root)
+      remote = raw_git_remote(root)
+      remote ? remote.split("/").last.to_s.sub(/\.git\z/, "") : File.basename(File.expand_path(root))
+    end
+
+    def default_git_remote_url(root)
+      normalize_remote_url(raw_git_remote(root))
+    end
+
+    def raw_git_remote(root)
+      config_file = File.join(root, ".git", "config")
+      return nil unless File.exist?(config_file)
+
+      content = File.read(config_file)
+      match = content.match(/url\s*=\s*(\S+)/)
+      match && match[1]
+    rescue Errno::ENOENT, Errno::EACCES
+      nil
+    end
+
+    # Collapses SSH (git@host:path), ssh:// and https:// forms of the same
+    # remote into one comparable "host/path" identity, so the same repo
+    # cloned differently in different places still resolves to the same
+    # bundleupdate.com project.
+    def normalize_remote_url(url)
+      return nil if url.nil?
+
+      stripped = url.strip.sub(/\.git\z/, "").sub(%r{/\z}, "")
+      match = stripped.match(/\Agit@([^:]+):(.+)\z/) || stripped.match(%r{\A\w+://(?:[^@/]+@)?([^/]+)/(.+)\z})
+      match ? "#{match[1].downcase}/#{match[2]}" : stripped
+    end
+
+    def load_yaml(path)
+      return {} unless path && File.exist?(path)
+
+      data = YAML.safe_load_file(path) || {}
+      symbolize(data)
+    rescue Psych::SyntaxError
+      {}
+    end
+
+    def from_env(env)
+      ENV_KEYS.each_with_object({}) do |(env_key, config_key), hash|
+        hash[config_key] = env[env_key] if env.key?(env_key) && !env[env_key].nil?
+      end
+    end
+
+    def symbolize(hash)
+      hash.each_with_object({}) { |(k, v), acc| acc[k.to_sym] = v }
+    end
+
+    def truthy?(value)
+      return value if [true, false].include?(value)
+
+      TRUTHY.include?(value.to_s.strip.downcase)
+    end
+  end
+end

data/lib/bundle_update/diff.rb

@@ -0,0 +1,103 @@
+# frozen_string_literal: true
+
+module BundleUpdate
+  # Computes the set of gem changes between two Snapshots.
+  class Diff
+    Update = Struct.new(:name, :from, :to, :severity, keyword_init: true)
+
+    SEVERITIES = %i[major minor patch other].freeze
+
+    attr_reader :updated, :added, :removed
+
+    def initialize(before, after)
+      @before = before
+      @after = after
+      @updated = []
+      @added = []
+      @removed = []
+      compute
+    end
+
+    def empty?
+      updated.empty? && added.empty? && removed.empty?
+    end
+
+    def counts_by_severity
+      SEVERITIES.to_h { |s| [s, 0] }.tap do |counts|
+        updated.each { |u| counts[u.severity] += 1 }
+      end
+    end
+
+    def total_changes
+      updated.size + added.size + removed.size
+    end
+
+    private
+
+    def compute
+      before_specs = @before.specs
+      after_specs = @after.specs
+
+      after_specs.each do |name, after_spec|
+        before_spec = before_specs[name]
+        if before_spec.nil?
+          @added << after_spec
+        elsif before_spec.version != after_spec.version
+          @updated << Update.new(
+            name: name,
+            from: before_spec.version,
+            to: after_spec.version,
+            severity: classify(before_spec.version, after_spec.version)
+          )
+        end
+      end
+
+      before_specs.each_key do |name|
+        @removed << before_specs[name] unless after_specs.key?(name)
+      end
+
+      @updated.sort_by!(&:name)
+      @added.sort_by!(&:name)
+      @removed.sort_by!(&:name)
+    end
+
+    # :major/:minor/:patch by comparing the first three Gem::Version segments.
+    # Prerelease versions and unparseable strings are always :other — segment
+    # comparison across a prerelease boundary (1.0.0 -> 1.0.0.rc1) doesn't map
+    # cleanly onto semver severity, so we refuse to guess.
+    def classify(from, to)
+      from_version = safe_version(from)
+      to_version = safe_version(to)
+      return :other unless comparable?(from_version, to_version)
+
+      severity_for(padded_segments(from_version), padded_segments(to_version))
+    end
+
+    def comparable?(from_version, to_version)
+      return false if from_version.nil? || to_version.nil?
+
+      !from_version.prerelease? && !to_version.prerelease?
+    end
+
+    def severity_for(from_segments, to_segments)
+      return :major if from_segments[0] != to_segments[0]
+      return :minor if from_segments[1] != to_segments[1]
+      return :patch if from_segments[2] != to_segments[2]
+
+      :other
+    end
+
+    def safe_version(str)
+      return nil if str.nil?
+
+      Gem::Version.new(str)
+    rescue ArgumentError
+      nil
+    end
+
+    def padded_segments(version)
+      segments = version.segments
+      [segments[0] || 0, segments[1] || 0, segments[2] || 0]
+    end
+  end
+end

data/lib/bundle_update/local_report.rb

@@ -0,0 +1,124 @@
+# frozen_string_literal: true
+
+module BundleUpdate
+  # Renders the free-tier output for a Diff: a terminal summary and a
+  # markdown report. Pure rendering — writing either to disk is ReportWriter's
+  # job, so the same markdown can be reused as the fallback body when the API
+  # tier degrades to a 202/error response.
+  class LocalReport
+    SEVERITY_ORDER = %i[major minor patch other].freeze
+    SEVERITY_LABELS = { major: "Major", minor: "Minor", patch: "Patch", other: "Other" }.freeze
+    SEVERITY_COLORS = { major: 31, minor: 33, patch: 32, other: 36 }.freeze # red/yellow/green/cyan
+    BOLD = 1
+
+    def initialize(diff:, project_name:, ran_at: Time.now, no_color: nil)
+      @diff = diff
+      @project_name = project_name
+      @ran_at = ran_at
+      @no_color = no_color.nil? ? !ENV["NO_COLOR"].to_s.empty? : no_color
+    end
+
+    def terminal_summary
+      return "bundle_update: no changes to Gemfile.lock\n" if @diff.empty?
+
+      lines = [count_line(colored: true), ""]
+      lines.concat(table_lines)
+      if @diff.added.any?
+        lines << ""
+        lines << "Added: #{@diff.added.map(&:name).join(", ")}"
+      end
+      if @diff.removed.any?
+        lines << ""
+        lines << "Removed: #{@diff.removed.map(&:name).join(", ")}"
+      end
+      "#{lines.join("\n")}\n"
+    end
+
+    def markdown
+      <<~MARKDOWN
+        # bundle_update report — #{@project_name}
+
+        _#{@ran_at.strftime("%Y-%m-%d %H:%M %z")}_
+
+        ## Summary
+
+        #{summary_bullets.join("\n")}
+
+        ## Security
+
+        _Security advisory checks aren't available in the free tier. [Get a bundleupdate.com API key](https://www.bundleupdate.com) for CVE-aware changelog reports._
+
+        ## Changes
+
+        #{changes_markdown}
+      MARKDOWN
+    end
+
+    private
+
+    def summary_bullets
+      return ["- No changes."] if @diff.empty?
+
+      bullets = ["- #{count_line(colored: false)}"]
+      bullets << "- #{@diff.added.size} gem#{"s" unless @diff.added.size == 1} added" if @diff.added.any?
+      bullets << "- #{@diff.removed.size} gem#{"s" unless @diff.removed.size == 1} removed" if @diff.removed.any?
+      bullets
+    end
+
+    def changes_markdown
+      return "_No changes._" if @diff.empty?
+
+      sections = []
+      SEVERITY_ORDER.each do |severity|
+        group = @diff.updated.select { |u| u.severity == severity }
+        next if group.empty?
+
+        sections << update_table(SEVERITY_LABELS[severity], group)
+      end
+      sections << name_version_table("Added", @diff.added) if @diff.added.any?
+      sections << name_version_table("Removed", @diff.removed) if @diff.removed.any?
+      sections.join("\n\n")
+    end
+
+    def update_table(title, group)
+      rows = group.map { |u| "| #{u.name} | #{u.from} | #{u.to} |" }
+      ["### #{title}", "", "| Gem | From | To |", "|---|---|---|", *rows].join("\n")
+    end
+
+    def name_version_table(title, specs)
+      rows = specs.map { |s| "| #{s.name} | #{s.version} |" }
+      ["### #{title}", "", "| Gem | Version |", "|---|---|", *rows].join("\n")
+    end
+
+    def count_line(colored:)
+      counts = @diff.counts_by_severity
+      parts = SEVERITY_ORDER.filter_map { |sev| "#{counts[sev]} #{sev}" if counts[sev].positive? }
+      total = @diff.updated.size
+      noun = total == 1 ? "update" : "updates"
+      text = "#{parts.join(", ")} #{noun}"
+      colored ? colorize(text, BOLD) : text
+    end
+
+    def table_lines
+      lines = []
+      name_width = @diff.updated.map { |u| u.name.length }.max.to_i
+
+      SEVERITY_ORDER.each do |severity|
+        group = @diff.updated.select { |u| u.severity == severity }
+        next if group.empty?
+
+        lines << colorize(SEVERITY_LABELS[severity], SEVERITY_COLORS[severity])
+        group.each do |u|
+          lines << "  #{u.name.ljust(name_width)}  #{u.from} → #{u.to}"
+        end
+      end
+      lines
+    end
+
+    def colorize(text, code)
+      return text if @no_color
+
+      "\e[#{code}m#{text}\e[0m"
+    end
+  end
+end

data/lib/bundle_update/plugin.rb

@@ -0,0 +1,126 @@
+# frozen_string_literal: true
+
+require "time"
+
+module BundleUpdate
+  # Wires the reporting pipeline into Bundler's plugin hook system so it
+  # fires automatically on `bundle install`/`bundle update` without the CLI
+  # wrapper, once the plugin is installed via `bundle plugin install
+  # bundle_update`.
+  #
+  # See DECISIONS.md for the Bundler source investigation this is based on:
+  # both bundle install and bundle update route through
+  # Bundler::Installer.install, which fires GEM_BEFORE_INSTALL_ALL
+  # ("before-install-all") then GEM_AFTER_INSTALL_ALL ("after-install-all")
+  # around the same run() call that resolves the definition and (eventually)
+  # writes the lockfile — so both hooks fire for a plain `bundle install`
+  # too, and the empty-diff case is handled by Runner, not here.
+  module Plugin
+    BEFORE_EVENT = "before-install-all"
+    AFTER_EVENT = "after-install-all"
+
+    # Registers the hooks. Every failure mode — missing/renamed Bundler
+    # plugin API, hook registration errors, anything — is swallowed so a
+    # plugin bug can never break the host's bundle install/update. Called
+    # from plugins.rb at the gem root, which Bundler loads automatically
+    # once the plugin is installed.
+    def self.install!
+      return false unless hook_api_available?
+
+      state = RunState.new
+      Bundler::Plugin.add_hook(BEFORE_EVENT) { state.capture_before! }
+      Bundler::Plugin.add_hook(AFTER_EVENT) { state.capture_after_and_report! }
+      # Defensive fallback for Bundler versions/paths where the lockfile
+      # isn't rewritten yet when after-install-all fires: re-check once more
+      # at process exit. No-ops if capture_after_and_report! already ran.
+      at_exit { state.fallback_report! }
+      true
+    rescue StandardError
+      false
+    end
+
+    def self.hook_api_available?
+      defined?(Bundler::Plugin) &&
+        Bundler::Plugin.respond_to?(:add_hook) &&
+        defined?(Bundler::Plugin::Events) &&
+        Bundler::Plugin::Events.respond_to?(:defined_event?) &&
+        Bundler::Plugin::Events.defined_event?(BEFORE_EVENT) &&
+        Bundler::Plugin::Events.defined_event?(AFTER_EVENT)
+    rescue StandardError
+      false
+    end
+
+    # Captures the lockfile before/after around the two hooks and calls
+    # Runner exactly once. A plain instance (not a singleton) so each
+    # install! call — and each spec example — gets an isolated one.
+    class RunState
+      def initialize(lockfile_path: nil)
+        @lockfile_path = lockfile_path || default_lockfile_path
+        @before = nil
+        @reported = false
+      end
+
+      def capture_before!(*)
+        @before = read_lockfile
+      rescue StandardError
+        @before = nil
+      end
+
+      def capture_after_and_report!(*)
+        return if @reported || @before.nil?
+
+        report(resolved_lockfile_content)
+      rescue StandardError
+        nil
+      end
+
+      # Last-resort safety net: if after-install-all already reported, or we
+      # never captured a before state, this is a no-op.
+      def fallback_report!
+        return if @reported || @before.nil?
+
+        report(read_lockfile)
+      rescue StandardError
+        nil
+      end
+
+      private
+
+      def report(after_content)
+        return if after_content.nil?
+
+        @reported = true
+        Runner.new(config: Config.new).report(lockfile_before: @before, lockfile_after: after_content, ran_at: Time.now)
+      end
+
+      # The in-memory resolved definition reflects the new lockfile even on
+      # Bundler versions/paths where the file on disk hasn't been rewritten
+      # yet at hook time.
+      def resolved_lockfile_content
+        if defined?(Bundler) && Bundler.respond_to?(:definition)
+          Bundler.definition.to_lock
+        else
+          read_lockfile
+        end
+      rescue StandardError
+        read_lockfile
+      end
+
+      def read_lockfile
+        File.exist?(@lockfile_path) ? File.read(@lockfile_path) : nil
+      rescue StandardError
+        nil
+      end
+
+      def default_lockfile_path
+        if defined?(Bundler) && Bundler.respond_to?(:default_lockfile)
+          Bundler.default_lockfile.to_s
+        else
+          File.join(Dir.pwd, "Gemfile.lock")
+        end
+      rescue StandardError
+        File.join(Dir.pwd, "Gemfile.lock")
+      end
+    end
+  end
+end