gemfile-audit 1.0.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: f7075c7b895832615c7a6f71f7e9dcaeb697b6c077a4d1ba6cd6a453c9168f9b
+  data.tar.gz: 5bb001386eb6f57b5101d2794a675449d17295bdce54a1c81287008b0cba8075
+SHA512:
+  metadata.gz: fd5c6848b704868311ff14a0d6c9db8d625784f2755d7035c35f47dd96c624efaec585d05eda4ad5f16b81e05c2e0259954973ee54030ff3b85398a7b2eea331
+  data.tar.gz: 5c1f1be103e1dc761dd7eefd9b0fb01eab94a936582cf97f211fca242a2d1e4fe9f99de1c4dd3eb951519dae17672d29a991e371ad87f0b63550a5009e314381

data/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 gemfile.io, operated by ExtractMethod
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

data/README.md

@@ -0,0 +1,108 @@
+# gemfile-audit
+
+## What it does
+
+gemfile-audit measures your Rails test run while it happens: how much of your code the tests cover and which deprecation warnings they raise. It sends those measurements to gemfile.io, which returns a private preview of an upgrade audit for your app.
+
+## What it sends
+
+- file paths with their coverage percentages and line counts;
+- deprecation messages, with file and line number;
+- gem, Ruby, Bundler, Node, Redis and database versions, including your lockfile;
+- test counts: run, passed, failed and skipped;
+- the repository name, branch, commit and kind of run, so the preview can be labelled.
+
+## What it never sends
+
+- source code or any line of it;
+- test names;
+- test output;
+- environment variables;
+- secrets;
+- database contents.
+
+## GitHub Actions
+
+Add these steps to your workflow. They must come after the step that installs Ruby:
+
+```yaml
+- uses: ruby/setup-ruby@v1
+  with:
+    bundler-cache: true
+- run: 'gem install gemfile-audit --no-document && gemfile-audit start || echo "gemfile-audit: could not start. Your build is not affected."'
+- run: bin/rails test   # your existing test step, unchanged
+- run: gemfile-audit finish || true
+  if: always()
+```
+
+The extra steps never fail your build.
+
+## GitLab
+
+Put these lines after Ruby is available in the job:
+
+```yaml
+test:
+  script:
+    - 'gem install gemfile-audit --no-document || echo "gemfile-audit: could not install the gem. Your build is not affected."'
+    - if command -v gemfile-audit >/dev/null 2>&1; then gemfile-audit run -- bundle exec rspec; else bundle exec rspec; fi
+```
+
+## CircleCI
+
+Put these steps after Ruby is available in the job:
+
+```yaml
+- run: 'gem install gemfile-audit --no-document || echo "gemfile-audit: could not install the gem. Your build is not affected."'
+- run: if command -v gemfile-audit >/dev/null 2>&1; then gemfile-audit run -- bundle exec rspec; else bundle exec rspec; fi
+```
+
+## Bitbucket
+
+Put these lines after Ruby is available in the step:
+
+```yaml
+script:
+  - 'gem install gemfile-audit --no-document || echo "gemfile-audit: could not install the gem. Your build is not affected."'
+  - if command -v gemfile-audit >/dev/null 2>&1; then gemfile-audit run -- bundle exec rspec; else bundle exec rspec; fi
+```
+
+## Any other CI
+
+Run these after Ruby is installed:
+
+```sh
+gem install gemfile-audit --no-document || echo "gemfile-audit: could not install the gem. Your build is not affected."
+if command -v gemfile-audit >/dev/null 2>&1; then gemfile-audit run -- bundle exec rspec; else bundle exec rspec; fi
+```
+
+The command exits with the status of your test command, so a failing test still fails the build and a passing one still passes.
+
+Merge request and pull request pipelines are not uploaded. A run there prints "not uploaded".
+
+## On your laptop
+
+```sh
+gem install gemfile-audit
+gemfile-audit run -- bundle exec rspec
+```
+
+Run it from your app folder. The preview is labelled as a local run.
+
+## See what would be sent
+
+Add `--dry-run` to print the upload instead of sending it:
+
+```sh
+gemfile-audit run --dry-run -- bundle exec rspec
+```
+
+## Requirements
+
+- Ruby 2.3 or newer.
+- Rails 4.2 or newer.
+- Tests that run with one command.
+
+## Privacy
+
+There is no account and no access to your GitHub. Unpaid previews are deleted after 7 days. Paid reports are kept for 30 days and sent to you by email.

data/exe/gemfile-audit

@@ -0,0 +1,5 @@
+#!/usr/bin/env ruby
+
+require "gemfile_audit"
+
+exit GemfileAudit::CLI.new(ARGV).call

data/lib/gemfile_audit/ci.rb

@@ -0,0 +1,85 @@
+module GemfileAudit
+  # Works out which repository, ref, commit and kind of run this is, from the
+  # variables a CI service sets or, on a laptop, from git.
+  module CI
+    Info = Struct.new(:repository, :ref, :sha, :event, :skip_reason)
+
+    PULL_REQUEST = "pull requests are not uploaded".freeze
+    NO_REMOTE = "no git remote named origin, so the run cannot be named".freeze
+    NO_COMMIT = "no git commit found, so the run cannot be named".freeze
+
+    def self.detect(env = ENV, root:)
+      if present?(env["GITHUB_ACTIONS"])
+        github(env)
+      elsif present?(env["GITLAB_CI"])
+        build(env["CI_PROJECT_PATH"], env["CI_COMMIT_REF_NAME"], env["CI_COMMIT_SHA"], "ci",
+              %w(merge_request_event external_pull_request_event).include?(env["CI_PIPELINE_SOURCE"]) ? PULL_REQUEST : nil)
+      elsif present?(env["CIRCLECI"])
+        build("#{env['CIRCLE_PROJECT_USERNAME']}/#{env['CIRCLE_PROJECT_REPONAME']}", env["CIRCLE_BRANCH"],
+              env["CIRCLE_SHA1"], "ci", present?(env["CIRCLE_PULL_REQUEST"]) ? PULL_REQUEST : nil)
+      elsif present?(env["BITBUCKET_BUILD_NUMBER"])
+        build(env["BITBUCKET_REPO_FULL_NAME"], env["BITBUCKET_BRANCH"], env["BITBUCKET_COMMIT"], "ci",
+              present?(env["BITBUCKET_PR_ID"]) ? PULL_REQUEST : nil)
+      elsif env["CI"].to_s.downcase == "true" || present?(env["JENKINS_URL"]) || present?(env["TF_BUILD"])
+        from_git(root, "ci")
+      else
+        from_git(root, "local")
+      end
+    end
+
+    def self.github(env)
+      event = env["GITHUB_EVENT_NAME"].to_s
+      skip = if event == "pull_request" || event == "pull_request_target"
+               PULL_REQUEST
+             elsif event != "push" && event != "workflow_dispatch"
+               "only pushes and manual runs are uploaded"
+             end
+      build(env["GITHUB_REPOSITORY"], env["GITHUB_REF"], env["GITHUB_SHA"], event, skip)
+    end
+
+    def self.build(repository, ref, sha, event, skip_reason)
+      name = normalise(repository)
+      skip_reason ||= "the repository name is not available" if name.nil?
+      Info.new(name, ref.to_s, sha.to_s, event, skip_reason)
+    end
+
+    def self.from_git(root, event)
+      url = git(root, "remote", "get-url", "origin")
+      repository = url && repository_from_url(url)
+      sha = git(root, "rev-parse", "HEAD")
+      ref = git(root, "rev-parse", "--abbrev-ref", "HEAD")
+      skip = if repository.nil?
+               NO_REMOTE
+             elsif sha.nil?
+               NO_COMMIT
+             end
+      Info.new(repository, ref.to_s, sha.to_s, event, skip)
+    end
+
+    # owner/name from SSH or HTTPS remote URLs, whatever the host.
+    def self.repository_from_url(url)
+      path = url.strip.sub(%r{\A[a-z][a-z0-9+.-]*://}i, "").sub(/\A[^@\/]*@/, "")
+      path = path.sub(%r{\A[^/:]+[/:]}, "")
+      normalise(path)
+    end
+
+    # The last two parts of a path, without a .git ending.
+    def self.normalise(path)
+      parts = path.to_s.sub(/\.git\z/, "").split("/").reject(&:empty?)
+      return nil if parts.size < 2
+      parts.last(2).join("/")
+    end
+
+    def self.git(root, *args)
+      value = Shell.capture("git", *args, chdir: root.to_s)
+      value = value.to_s.strip
+      value.empty? ? nil : value
+    end
+
+    def self.present?(value)
+      !value.nil? && !value.to_s.empty? && value.to_s != "false"
+    end
+
+    private_class_method :github, :build, :from_git, :git, :present?
+  end
+end

data/lib/gemfile_audit/cli.rb

@@ -0,0 +1,267 @@
+require "fileutils"
+require "json"
+require "shellwords"
+require "tmpdir"
+
+module GemfileAudit
+  # The gemfile-audit command: start, finish and run. Only start and run can
+  # change the environment; finish and run never change the exit status of
+  # the customer's test command.
+  class CLI
+    LOADER_REQUIRE = "gemfile_audit/loader".freeze
+
+    HELP = <<-TEXT.gsub(/^ {6}/, "").freeze
+      gemfile-audit #{GemfileAudit::VERSION}
+
+      Measures your test run for a gemfile.io automated audit.
+
+      Usage:
+        gemfile-audit start                          Prepare the environment. In a shell, run: eval "$(gemfile-audit start)"
+        gemfile-audit finish [--dry-run]             Collect the run and upload it
+        gemfile-audit run [--dry-run] -- <command>   Run a command, measure it and upload the run
+        gemfile-audit --version                      Print the version
+        gemfile-audit help                           Print this text
+
+      With --dry-run the upload is printed and nothing is sent.
+      The endpoint can be changed with GEMFILE_AUDIT_URL.
+    TEXT
+
+    def initialize(argv, env: ENV, out: $stdout, err: $stderr, dir: Dir.pwd)
+      @argv = argv.dup
+      @env = env.to_h
+      @out = out
+      @err = err
+      @dir = dir
+    end
+
+    def call
+      command = @argv.first
+      rest = @argv.drop(1)
+      case command
+      when "start" then start
+      when "finish" then finish(rest)
+      when "run" then run(rest)
+      when "--version", "-v", "version" then print_line(@out, GemfileAudit::VERSION)
+      when "help", "--help", "-h" then print_help
+      else
+        usage_error(command ? "unknown command #{command}" : "no command given")
+      end
+    end
+
+    private
+
+    def print_line(stream, text)
+      stream.puts(text)
+      0
+    end
+
+    def print_help
+      @out.puts(HELP)
+      0
+    end
+
+    def warn_line(message)
+      @err.puts("gemfile-audit: #{message}")
+    end
+
+    def usage_error(message)
+      @err.puts("gemfile-audit: #{message}.")
+      @err.puts(HELP)
+      2
+    end
+
+    # start
+
+    def start
+      variables = audit_environment
+      if @env["GITHUB_ACTIONS"] == "true" && !@env["GITHUB_ENV"].to_s.empty?
+        File.open(@env["GITHUB_ENV"], "a") do |file|
+          variables.each { |name, value| file.puts("#{name}=#{value}") }
+          # Later steps inherit RUBYOPT and RUBYLIB, so finish puts them back.
+          file.puts("GEMFILE_AUDIT_ORIGINAL_RUBYOPT=#{@env['RUBYOPT']}")
+          file.puts("GEMFILE_AUDIT_ORIGINAL_RUBYLIB=#{@env['RUBYLIB']}")
+        end
+      else
+        variables.each { |name, value| @out.puts("export #{name}=#{Shellwords.escape(value)}") }
+      end
+      0
+    rescue StandardError => error
+      warn_line("could not prepare the run: #{sentence(error.message)} Your build is not affected.")
+      0
+    end
+
+    # No path ever goes into RUBYOPT, because Ruby splits it on spaces: the
+    # gem's lib folder goes on RUBYLIB and RUBYOPT only names the loader.
+    def audit_environment
+      variables = {
+        "GEMFILE_AUDIT_DIR" => Dir.mktmpdir("gemfile-audit"),
+        "GEMFILE_AUDIT_ROOT" => File.expand_path(@dir),
+        "GEMFILE_AUDIT_STARTED_AT" => Time.now.to_i.to_s,
+        "DISABLE_SPRING" => "1"
+      }
+      lib = GemfileAudit.lib_path
+      if lib.include?(File::PATH_SEPARATOR)
+        warn_line("the gem is installed in a folder whose name contains #{File::PATH_SEPARATOR}, so this run is not measured.")
+        return variables
+      end
+      libraries = @env["RUBYLIB"].to_s.split(File::PATH_SEPARATOR)
+      libraries.unshift(lib) unless libraries.include?(lib)
+      variables["RUBYLIB"] = libraries.join(File::PATH_SEPARATOR)
+      option = "-r#{LOADER_REQUIRE}"
+      rubyopt = @env["RUBYOPT"].to_s
+      rubyopt = "#{rubyopt} #{option}".strip unless rubyopt.split(" ").include?(option)
+      variables["RUBYOPT"] = rubyopt
+      variables
+    end
+
+    # finish
+
+    def finish(args)
+      dry_run = args.include?("--dry-run")
+      ignore_unknown(args - ["--dry-run"])
+      finish_run(@env, dry_run)
+    ensure
+      restore_github_environment
+    end
+
+    # On GitHub, start wrote RUBYOPT and RUBYLIB for every later step. Put
+    # the values from before start back, whatever happened while finishing.
+    def restore_github_environment
+      path = @env["GITHUB_ENV"].to_s
+      return unless @env["GITHUB_ACTIONS"] == "true" && !path.empty?
+      return unless @env.key?("GEMFILE_AUDIT_ORIGINAL_RUBYOPT") || @env.key?("GEMFILE_AUDIT_ORIGINAL_RUBYLIB")
+      File.open(path, "a") do |file|
+        file.puts("RUBYOPT=#{@env['GEMFILE_AUDIT_ORIGINAL_RUBYOPT']}")
+        file.puts("RUBYLIB=#{@env['GEMFILE_AUDIT_ORIGINAL_RUBYLIB']}")
+      end
+    rescue StandardError
+      nil
+    end
+
+    def finish_run(env, dry_run)
+      dir = env["GEMFILE_AUDIT_DIR"].to_s
+      root = env["GEMFILE_AUDIT_ROOT"].to_s
+      if dir.empty? || root.empty?
+        dir = nil
+        raise "The start command has not been run, so there is nothing to collect."
+      end
+      ci = CI.detect(env, root: root)
+      if ci.skip_reason
+        @out.puts("gemfile-audit: not uploaded: #{ci.skip_reason}.")
+        return 0
+      end
+      if Dir.glob(File.join(dir, "process-*.json")).empty?
+        @out.puts("gemfile-audit: not uploaded: no Ruby process was measured. " \
+                  "Run your tests in this job, after gemfile-audit start.")
+        return 0
+      end
+      upload = Collector.new(dir: dir, root: root, ci: ci, env: env).upload
+      if dry_run
+        @out.puts(JSON.pretty_generate(upload))
+        return 0
+      end
+      send_upload(upload, env)
+      0
+    rescue StandardError, ScriptError => error
+      report_error(error.message)
+      0
+    ensure
+      clear(dir) if dir && !dir.empty?
+    end
+
+    def send_upload(upload, env)
+      result = Uploader.post(upload, url: Uploader.url(env))
+      if result.error
+        report_error(result.error)
+      else
+        @out.puts("gemfile-audit: your preview is ready: #{result.preview_url}")
+        @out.puts("gemfile-audit: it is deleted on #{result.expires_on}.")
+        write_summary(result, env)
+      end
+    end
+
+    def write_summary(result, env)
+      path = env["GITHUB_STEP_SUMMARY"].to_s
+      return unless env["GITHUB_ACTIONS"] == "true" && !path.empty?
+      File.open(path, "a") do |file|
+        file.puts("### gemfile.io automated audit")
+        file.puts
+        file.puts("[Open your preview](#{result.preview_url}). It is deleted on #{result.expires_on}.")
+      end
+    rescue StandardError => error
+      reason = error.is_a?(SystemCallError) ? "the file could not be written" : error.message
+      @err.puts("gemfile-audit: could not write the job summary: #{sentence(reason)}")
+    end
+
+    def report_error(message)
+      @err.puts("gemfile-audit: could not upload this run: #{sentence(message)} Your build is not affected.")
+    end
+
+    def sentence(message)
+      text = message.to_s.strip
+      text.end_with?(".") ? text : "#{text}."
+    end
+
+    # Removes the result files and the folder once they are uploaded.
+    def clear(dir)
+      Dir.glob(File.join(dir, "process-*.json")).each { |path| File.unlink(path) }
+      Dir.rmdir(dir)
+    rescue StandardError
+      nil
+    end
+
+    # run
+
+    def run(args)
+      options, command = split_run(args)
+      return usage_error("run needs a command, for example: gemfile-audit run -- bundle exec rspec") if command.empty?
+      dry_run = options.include?("--dry-run")
+      ignore_unknown(options - ["--dry-run"])
+
+      environment = begin
+        @env.merge(audit_environment)
+      rescue StandardError, ScriptError => error
+        warn_line("could not prepare the run: #{sentence(error.message)} Your build is not affected.")
+        nil
+      end
+      status, measured = execute(environment || @env, command)
+      finish_run(environment, dry_run) if environment && measured
+      clear(environment["GEMFILE_AUDIT_DIR"]) if environment && !measured
+      status
+    end
+
+    # Everything after -- is the command. Without --, the command starts at
+    # the first argument that is not an option.
+    def split_run(args)
+      separator = args.index("--")
+      if separator
+        [args[0...separator], args[(separator + 1)..-1]]
+      else
+        start = args.index { |argument| !argument.start_with?("--") } || args.size
+        [args[0...start], args[start..-1]]
+      end
+    end
+
+    def ignore_unknown(options)
+      return if options.empty?
+      @err.puts("gemfile-audit: ignoring unknown #{options.size == 1 ? 'option' : 'options'} #{options.join(' ')}.")
+    end
+
+    def execute(environment, command)
+      @out.flush
+      @err.flush
+      pid = Process.spawn(environment, *command, chdir: @dir, unsetenv_others: true)
+      status = begin
+        Process.wait2(pid).last
+      rescue Interrupt
+        retry
+      end
+      return [128 + status.termsig, false] if status.signaled?
+      [status.exitstatus || 1, true]
+    rescue SystemCallError => error
+      reason = error.is_a?(Errno::ENOENT) ? "#{command.first} was not found" : "#{command.first} could not be run"
+      @err.puts("gemfile-audit: could not start the command: #{reason}.")
+      [127, false]
+    end
+  end
+end