gemfile-audit 1.0.0

data/lib/gemfile_audit/collector.rb

@@ -0,0 +1,295 @@
+require "json"
+require "coverage"
+
+module GemfileAudit
+  # Turns the files the measured processes wrote into one version 1 upload.
+  # Only paths with line counts, deprecation messages with a file and line,
+  # versions, test counts and the lockfile go in. Source code is read here to
+  # count lines and is never sent.
+  class Collector
+    class Missing < StandardError; end
+
+    MAX_FILES = 20_000
+    MAX_DEPRECATIONS = 2_000
+    MAX_LINES_IN_MESSAGE = 4
+    MAX_MESSAGE_LENGTH = 1_000
+    UNLISTED_FOLDERS = %w(vendor/ node_modules/ tmp/ spec/ test/ features/ db/).freeze
+    LISTED_FOLDERS = %w(app lib).freeze
+    PATH_PATTERN = %r{\A[\w@+.-]+(/[\w@+.-]+)*\z}
+    VERSION_PATTERN = /\A\d+(\.\d+){0,3}\z/
+    TEST_KEYS = %w(run passed failed skipped).freeze
+
+    def initialize(dir:, root:, ci:, env: ENV)
+      @dir = dir.to_s
+      @root = File.expand_path(root.to_s)
+      @ci = ci
+      @env = env
+    end
+
+    def upload
+      lockfile = read_lockfile
+      processes = read_processes
+      {
+        "version" => 1,
+        "repository" => @ci.repository,
+        "ref" => @ci.ref,
+        "sha" => @ci.sha,
+        "event" => @ci.event,
+        "lockfile" => lockfile,
+        "tests" => tests(processes),
+        "coverage" => coverage(processes),
+        "deprecations" => deprecations(processes),
+        "runtimes" => runtimes(processes)
+      }
+    end
+
+    private
+
+    def read_lockfile
+      candidates = []
+      gemfile = @env["BUNDLE_GEMFILE"]
+      candidates << File.join(File.dirname(File.expand_path(gemfile, @root)), "Gemfile.lock") if gemfile && !gemfile.empty?
+      candidates << File.join(@root, "Gemfile.lock")
+      path = candidates.find { |candidate| File.file?(candidate) }
+      raise Missing, "No Gemfile.lock found in #{@root}." unless path
+      text = File.read(path, mode: "rb").force_encoding(Encoding::UTF_8)
+      text = text.scrub("?") unless text.valid_encoding?
+      raise Missing, "No Gemfile.lock found in #{@root}." if text.strip.empty?
+      text
+    end
+
+    def read_processes
+      Dir.glob(File.join(@dir, "process-*.json")).sort.map do |path|
+        begin
+          data = JSON.parse(File.read(path))
+          data.is_a?(Hash) ? data : nil
+        rescue StandardError
+          nil
+        end
+      end.compact
+    end
+
+    # Coverage
+
+    def coverage(processes)
+      merged = merge_coverage(processes)
+      return nil if merged.empty?
+      files = merged.map { |path, counts| coverage_entry(path, counts) }.compact
+      seen = real_paths(merged.keys)
+      listed_on_disk.each do |path|
+        next if merged.key?(path)
+        real = real_path(path)
+        next if real && seen[real]
+        seen[real] = true if real
+        entry = unloaded_entry(path)
+        files << entry if entry
+      end
+      files = files.sort_by { |entry| [-entry["lines"], entry["path"]] }.first(MAX_FILES)
+      { "files" => files }
+    end
+
+    def merge_coverage(processes)
+      merged = {}
+      processes.each do |process|
+        files = process["coverage"]
+        next unless files.is_a?(Hash)
+        files.each do |path, counts|
+          next unless counts.is_a?(Array) && valid_path?(path)
+          merged[path] = max_counts(merged[path], counts)
+        end
+      end
+      merged
+    end
+
+    def max_counts(left, right)
+      return right.dup unless left
+      size = left.size > right.size ? left.size : right.size
+      Array.new(size) do |index|
+        a = left[index]
+        b = right[index]
+        if !a.is_a?(Integer)
+          b
+        elsif !b.is_a?(Integer)
+          a
+        else
+          a > b ? a : b
+        end
+      end
+    end
+
+    def coverage_entry(path, counts)
+      relevant = counts.select { |count| count.is_a?(Integer) }
+      return nil if relevant.empty?
+      { "path" => path, "lines" => relevant.size, "covered" => relevant.count { |count| count > 0 } }
+    end
+
+    # Ruby files under app and lib on disk, as paths relative to the root.
+    def listed_on_disk
+      real_root = begin
+        File.realpath(@root)
+      rescue StandardError
+        @root
+      end
+      paths = []
+      LISTED_FOLDERS.each do |folder|
+        Dir.glob(File.join(@root, folder, "**", "*.rb")).sort.each do |absolute|
+          relative = absolute[(@root.size + 1)..-1]
+          next if UNLISTED_FOLDERS.any? { |prefix| relative.start_with?(prefix) }
+          next unless valid_path?(relative) && File.file?(absolute)
+          next unless inside?(real_root, absolute)
+          paths << relative
+        end
+      end
+      paths
+    rescue StandardError
+      []
+    end
+
+    def real_paths(paths)
+      seen = {}
+      paths.each do |path|
+        real = real_path(path)
+        seen[real] = true if real
+      end
+      seen
+    end
+
+    def real_path(path)
+      File.realpath(File.join(@root, path))
+    rescue StandardError
+      nil
+    end
+
+    def inside?(real_root, absolute)
+      File.realpath(absolute).start_with?(real_root + "/")
+    rescue StandardError
+      false
+    end
+
+    def unloaded_entry(path)
+      lines = relevant_lines(File.join(@root, path))
+      lines > 0 ? { "path" => path, "lines" => lines, "covered" => 0 } : nil
+    rescue StandardError
+      nil
+    end
+
+    # Coverage.line_stub where Ruby has it, otherwise the lines that are
+    # neither blank nor comments.
+    def relevant_lines(absolute)
+      if Coverage.respond_to?(:line_stub)
+        begin
+          verbose = $VERBOSE
+          $VERBOSE = nil
+          return Coverage.line_stub(absolute).count { |entry| !entry.nil? }
+        rescue StandardError, ScriptError
+          nil
+        ensure
+          $VERBOSE = verbose
+        end
+      end
+      File.read(absolute, mode: "rb").force_encoding(Encoding::BINARY).each_line.count do |line|
+        stripped = line.strip
+        !stripped.empty? && !stripped.start_with?("#")
+      end
+    end
+
+    def valid_path?(path)
+      path.is_a?(String) && path.length <= 512 && PATH_PATTERN =~ path &&
+        !path.split("/").include?("..")
+    end
+
+    # Deprecations
+
+    def deprecations(processes)
+      counts = Hash.new(0)
+      order = []
+      processes.each do |process|
+        items = process["deprecations"]
+        next unless items.is_a?(Array)
+        items.each do |item|
+          next unless item.is_a?(Hash) && item["message"].is_a?(String)
+          key = [shorten(item["message"]), deprecation_file(item["file"]), deprecation_line(item["line"])]
+          order << key unless counts.key?(key)
+          counts[key] += 1
+        end
+      end
+      ranked = order.each_with_index.sort_by { |key, index| [-counts[key], index] }.first(MAX_DEPRECATIONS)
+      ranked.map do |key, _index|
+        { "message" => key[0], "file" => key[1], "line" => key[2], "count" => counts[key] }
+      end
+    end
+
+    def shorten(message)
+      message.split(/\R/).first(MAX_LINES_IN_MESSAGE).join("\n")[0, MAX_MESSAGE_LENGTH]
+    end
+
+    def deprecation_file(file)
+      valid_path?(file) ? file : nil
+    end
+
+    def deprecation_line(line)
+      line.is_a?(Integer) && line > 0 ? line : nil
+    end
+
+    # Tests
+
+    def tests(processes)
+      totals = nil
+      processes.each do |process|
+        counts = process["tests"]
+        next unless counts.is_a?(Hash)
+        totals ||= Hash[TEST_KEYS.map { |key| [key, 0] }]
+        TEST_KEYS.each { |key| totals[key] += counts[key] if counts[key].is_a?(Integer) && counts[key] >= 0 }
+      end
+      return nil unless totals
+      totals["duration_seconds"] = duration_seconds
+      totals
+    end
+
+    def duration_seconds
+      started = Integer(@env["GEMFILE_AUDIT_STARTED_AT"].to_s, 10)
+      seconds = Time.now.to_i - started
+      seconds < 0 ? 0 : seconds
+    rescue ArgumentError
+      0
+    end
+
+    # Runtimes
+
+    def runtimes(processes)
+      found = {}
+      found["ruby"] = first_version(processes) { |process| process["ruby"] }
+      found["bundler"] = first_version(processes) { |process| process["bundler"] }
+      found["postgresql"] = first_version(processes) { |process| database_version(process, "postgresql") }
+      found["mysql"] = first_version(processes) { |process| database_version(process, "mysql") }
+      found["node"] = clean_version(command_output("node", "--version"))
+      found["redis"] = clean_version(command_output("redis-server", "--version")[/v=(\d+(?:\.\d+)*)/, 1])
+      found.reject { |_name, version| version.nil? }
+    end
+
+    def first_version(processes)
+      processes.each do |process|
+        version = clean_version(yield(process))
+        return version if version
+      end
+      nil
+    end
+
+    def database_version(process, adapter)
+      database = process["database"]
+      database.is_a?(Hash) && database["adapter"] == adapter ? database["version"] : nil
+    end
+
+    # Keeps at most four numeric parts, the most the server accepts.
+    def clean_version(value)
+      number = value.to_s.strip.sub(/\Av/, "")[/\A\d+(\.\d+)*/]
+      return nil unless number
+      number = number.split(".").first(4).join(".")
+      VERSION_PATTERN =~ number ? number : nil
+    end
+
+    def command_output(*command)
+      Shell.capture(*command).to_s
+    end
+  end
+end

data/lib/gemfile_audit/loader.rb

@@ -0,0 +1,16 @@
+# Required into every Ruby process of the test run through RUBYOPT, before
+# Bundler and the app load. It does nothing at all unless GEMFILE_AUDIT_DIR
+# and GEMFILE_AUDIT_ROOT both name folders. Standard library only and Ruby 2.3
+# syntax, because it runs inside other people's processes.
+gemfile_audit_dir = ENV["GEMFILE_AUDIT_DIR"]
+gemfile_audit_root = ENV["GEMFILE_AUDIT_ROOT"]
+
+if gemfile_audit_dir && !gemfile_audit_dir.empty? && File.directory?(gemfile_audit_dir) &&
+   gemfile_audit_root && !gemfile_audit_root.empty? && File.directory?(gemfile_audit_root)
+  begin
+    require File.expand_path("measurement.rb", __dir__)
+    GemfileAudit::Measurement.start(gemfile_audit_dir, gemfile_audit_root)
+  rescue StandardError, ScriptError
+    nil
+  end
+end