capistrano-bundle_audit 0.0.1 → 0.0.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: f488e189ceed7bef5eb2bb93ced8d25bfc517b38
-  data.tar.gz: dfb1933cd4db78ad9d39a06fb4b1ccef34d7fbe4
+  metadata.gz: 4f6157938e40feb73815c43c9bbbf5bdddc58492
+  data.tar.gz: a76db4d182893e2ff65e4aa815909ad4471443c2
 SHA512:
-  metadata.gz: da5abe0534f095efc6ae058cbca241636177a678dcad400fea38096f5e412b486c8fdac05d93dcdea52ddb7b6a8389a0122040d6de60a8bbed22fd35e13895f9
-  data.tar.gz: 28718f4bd9a47f03f69f155919894df35e0006882d3a062ffd1e0d28e0ba44b81633abe9645b0d0b9cc3ce096f3de29918de5d1e4e85a7268f171c9fb36a14f9
+  metadata.gz: d32b94727ce50a46fdc4da9c97abd02f7bcb7d63c59f1cfa9e88859dc468c78739e18a2b7c39d9cfb39dd3fe7ee28db2524d5c97e3ec866a9093a07af89587d3
+  data.tar.gz: fc8cf08160e752b76523b1d03c4a316b0a9fb1fc771cfd0a22ab24d1b476ad45a9842990fab196984c9c5f222c24cf9f7fb4f42915cb67483e6e37a700843902

data/lib/capistrano/bundle_audit/version.rb

@@ -1,5 +1,5 @@
 module Capistrano
   module BundleAudit
-    VERSION = "0.0.1"
+    VERSION = "0.0.2"
   end
 end

data/lib/capistrano/bundle_audit.rb

@@ -2,7 +2,6 @@ require "capistrano/bundle_audit/version"
 
 module Capistrano
   module BundleAudit
-    # Your code goes here...
   end
 end
 

data/lib/capistrano/tasks/bundle_audit.rake

@@ -2,20 +2,28 @@ require 'tmpdir'
 
 namespace :deploy do
   namespace :check do
+    desc "Audit the Gemfile/Gemfile.lock for known vulnerabilities"
     task :bundle_audit do
-       on roles(:app) do |host|
+      on roles(:app) do |host|
+
+        # Download the relevant files and run bundle-audit on them locally
         Dir.mktmpdir do |dir| 
           Dir.chdir dir do
             download! "#{release_path}/Gemfile.lock", "Gemfile.lock"
             download! "#{release_path}/Gemfile", "Gemfile"
-            
+
             run_locally do
+
+              # Get the latest vulnerability information
               execute "bundle-audit update &> /dev/null"
+
               bundle_audit_output = capture "bundle-audit"
-              unless ENV['SKIP_BUNDLE_AUDIT']
-                if bundle_audit_output =~ /Name:/
-                  raise "Bundle audit failed; update your vulnerable dependencies and redeploy"
-                end
+
+              # bundle-audit includes failures for both gem vulnerabilities
+              # and insecure gem sources, and offers no way to distinguish those cases.
+              # unfortunately, we only want to fail when vulnerable gems are required.
+              if bundle_audit_output =~ /Name:/
+                fail "Bundle audit failed; update your vulnerable dependencies before deploying"
               end
             end
           end
@@ -24,5 +32,5 @@ namespace :deploy do
     end
   end
   
-  before 'deploy:starting', 'deploy:check:bundle_audit' 
+  after 'deploy:updating', 'deploy:check:bundle_audit' unless ENV['SKIP_BUNDLE_AUDIT']
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: capistrano-bundle_audit
 version: !ruby/object:Gem::Version
-  version: 0.0.1
+  version: 0.0.2
 platform: ruby
 authors:
 - Chris Beer