gemfile-audit 1.0.0

data/lib/gemfile_audit/measurement.rb

@@ -0,0 +1,637 @@
+# Measures one Ruby process of the test run: line coverage of the project's
+# own files, ActiveSupport deprecations, RSpec or Minitest counts and the
+# database server version. At exit it writes one JSON file into the audit
+# folder. Loaded by loader.rb only when the audit folder and root are set.
+#
+# Rules for this file, because it runs inside other people's processes:
+# standard library only, Ruby 2.3 syntax and APIs, never print, never raise
+# into the app and never change the app's behaviour, warnings or exit status.
+module GemfileAudit
+  module Measurement
+    COVERAGE_EXCLUDED = %w(vendor/ node_modules/ tmp/ spec/ test/ features/ db/).freeze
+    LOCATION_EXCLUDED = %w(vendor/ node_modules/ tmp/).freeze
+    MAX_DEPRECATIONS = 5000
+    MAX_FRAMES = 200
+    MODULE_NAME = Module.instance_method(:name)
+    JSON_ESCAPES = {
+      "\"" => "\\\"", "\\" => "\\\\", "\b" => "\\b", "\f" => "\\f",
+      "\n" => "\\n", "\r" => "\\r", "\t" => "\\t"
+    }.freeze
+
+    # Prepended to the Coverage singleton. Keeps a copy of every result the
+    # app takes, so coverage survives tools such as SimpleCov stopping it,
+    # and hands coverage over when the app starts its own measurement.
+    module CoverageHooks
+      def start(*args)
+        GemfileAudit::Measurement.release_coverage
+        super
+      end
+
+      def result(*args)
+        value = super
+        GemfileAudit::Measurement.keep_coverage(value, args)
+        value
+      end
+
+      ruby2_keywords(:start, :result) if respond_to?(:ruby2_keywords, true)
+    end
+
+    # Coverage.setup exists from Ruby 3.1 only.
+    module CoverageSetupHook
+      def setup(*args)
+        GemfileAudit::Measurement.release_coverage
+        super
+      end
+
+      ruby2_keywords(:setup) if respond_to?(:ruby2_keywords, true)
+    end
+
+    # Prepended to the SimpleCov singleton. SimpleCov 0.22 starts coverage
+    # only when it is not running, so hand our measurement over first and
+    # SimpleCov starts its own with the options it wants, such as branches.
+    # Coverage.running? itself always tells the truth: bootsnap relies on it.
+    module SimpleCovHooks
+      def start_coverage_measurement(*args)
+        GemfileAudit::Measurement.release_coverage
+        super
+      end
+      private :start_coverage_measurement
+    end
+
+    # Prepended to ActiveSupport::Deprecation. Records the warning, then
+    # always calls the original with the call stack Rails itself would have
+    # used, so messages and the :raise behaviour stay exactly the same.
+    module DeprecationHooks
+      def warn(message = nil, callstack = nil, *rest)
+        begin
+          if callstack.nil?
+            callstack = GemfileAudit::Measurement.string_callstack? ? caller(2) : caller_locations(2)
+          end
+          GemfileAudit::Measurement.record_deprecation(message, caller_locations(1))
+        rescue StandardError
+          nil
+        end
+        super(message, callstack, *rest)
+      end
+    end
+
+    # Prepended to the Minitest singleton. Adds a counting reporter once
+    # Minitest has set up its own reporters for a run.
+    module MinitestHooks
+      def init_plugins(*args)
+        value = super
+        GemfileAudit::Measurement.add_minitest_counter(self)
+        value
+      end
+    end
+
+    # A Minitest reporter that only counts results. It never fails a run.
+    class MinitestCounter
+      def start
+        GemfileAudit::Measurement.minitest_started
+      rescue StandardError
+        nil
+      end
+
+      def prerecord(_klass, _name)
+        nil
+      end
+
+      def record(result)
+        GemfileAudit::Measurement.minitest_record(result)
+      rescue StandardError
+        nil
+      end
+
+      def report
+        nil
+      end
+
+      def passed?
+        true
+      end
+    end
+
+    @active = false
+
+    class << self
+      def start(dir, root)
+        return false if @active
+        @active = true
+        @dir = File.expand_path(dir)
+        @pid = Process.pid
+        use_root(root, Dir.pwd)
+        @deprecations = []
+        @deprecations_pid = @pid
+        @minitest_counts = nil
+        @minitest_mutex = Mutex.new
+        @coverage_kept_pid = @pid
+        @lookup_running = false
+        @simplecov_hooked = false
+        @coverage_kept = {}
+        @own_coverage = false
+        @deprecation_hooked = false
+        @minitest_hooked = false
+        @trace = nil
+        start_coverage
+        watch_for_frameworks
+        at_exit { finish }
+        true
+      rescue StandardError, ScriptError
+        false
+      end
+
+      def use_root(root, cwd)
+        @cwd = cwd
+        @roots = path_forms(root)
+        @gem_dirs = nil
+        @gem_dirs_with_bundler = nil
+      end
+
+      # Coverage
+
+      def start_coverage
+        require "coverage"
+        begin
+          if RUBY_VERSION >= "2.5"
+            Coverage.start(lines: true)
+          else
+            Coverage.start
+          end
+          @own_coverage = true
+        rescue StandardError
+          @own_coverage = false
+        end
+        hooks = Coverage.singleton_class
+        hooks.send(:prepend, CoverageHooks)
+        hooks.send(:prepend, CoverageSetupHook) if Coverage.respond_to?(:setup)
+      end
+
+      # The app is starting coverage itself while ours runs: take our counts
+      # and stop, so the app gets the fresh measurement it asked for.
+      def release_coverage
+        return unless @own_coverage
+        @own_coverage = false
+        begin
+          Coverage.result
+        rescue StandardError
+          nil
+        end
+      end
+
+      def keep_coverage(value, args)
+        options = args.last.is_a?(Hash) ? args.last : {}
+        stop = options.key?(:stop) ? options[:stop] : true
+        clear = options.key?(:clear) ? options[:clear] : true
+        return unless stop || clear
+        @own_coverage = false if stop
+        unless @coverage_kept_pid == Process.pid
+          @coverage_kept = {}
+          @coverage_kept_pid = Process.pid
+        end
+        add_coverage(@coverage_kept, project_coverage(value))
+      rescue StandardError
+        nil
+      end
+
+      def collected_coverage
+        total = {}
+        add_coverage(total, @coverage_kept) if @coverage_kept_pid == Process.pid
+        current = begin
+          Coverage.peek_result
+        rescue StandardError
+          nil
+        end
+        add_coverage(total, project_coverage(current)) if current
+        # A forked child starts with cleared counters: files it never ran
+        # carry no information of its own.
+        total.reject { |_path, lines| lines.none? { |count| count.is_a?(Integer) && count > 0 } }
+      end
+
+      # Turns either coverage format into { path => [count or nil per line] }:
+      # Ruby 2.3 and 2.4 give an array per file, later versions a hash.
+      def normalise_coverage(raw)
+        result = {}
+        raw.each do |path, data|
+          lines = line_counts(data)
+          result[path] = lines if lines
+        end
+        result
+      end
+
+      def line_counts(data)
+        if data.is_a?(Array)
+          data.dup
+        elsif data.is_a?(Hash) && data[:lines].is_a?(Array)
+          data[:lines].dup
+        elsif data.is_a?(Hash) && data[:oneshot_lines].is_a?(Array)
+          lines = []
+          data[:oneshot_lines].each { |number| lines[number - 1] = 1 if number.is_a?(Integer) && number > 0 }
+          lines
+        end
+      end
+
+      def project_coverage(raw)
+        result = {}
+        return result unless raw.is_a?(Hash)
+        normalise_coverage(raw).each do |path, lines|
+          next unless path.is_a?(String) && path.end_with?(".rb")
+          relative = project_path(path, COVERAGE_EXCLUDED)
+          add_lines(result, relative, lines) if relative
+        end
+        result
+      end
+
+      def add_coverage(total, coverage)
+        coverage.each { |path, lines| add_lines(total, path, lines) }
+        total
+      end
+
+      def add_lines(total, path, lines)
+        existing = total[path]
+        unless existing
+          total[path] = lines.dup
+          return
+        end
+        size = existing.size > lines.size ? existing.size : lines.size
+        merged = Array.new(size) do |index|
+          left = existing[index]
+          right = lines[index]
+          if left.nil?
+            right
+          elsif right.nil?
+            left
+          else
+            left + right
+          end
+        end
+        total[path] = merged
+      end
+
+      # Paths
+
+      def path_forms(path)
+        forms = [File.expand_path(path)]
+        begin
+          forms << File.realpath(path)
+        rescue StandardError
+          nil
+        end
+        forms.uniq.map { |form| form.end_with?("/") ? form : "#{form}/" }
+      end
+
+      # The path relative to the project root, or nil when the file is outside
+      # it, inside an installed gem or under one of the excluded folders.
+      def project_path(path, excluded)
+        absolute = File.expand_path(path.to_s, @cwd)
+        return nil if in_gem_dirs?(absolute)
+        relative = relative_to_root(absolute)
+        if relative.nil?
+          real = begin
+            File.realpath(absolute)
+          rescue StandardError
+            nil
+          end
+          return nil if real.nil? || in_gem_dirs?(real)
+          relative = relative_to_root(real)
+          return nil if relative.nil?
+        end
+        return nil if excluded.any? { |prefix| relative.start_with?(prefix) }
+        relative
+      end
+
+      def relative_to_root(absolute)
+        @roots.each do |root|
+          return absolute[root.size..-1] if absolute.start_with?(root)
+        end
+        nil
+      end
+
+      def in_gem_dirs?(absolute)
+        gem_dirs.any? { |dir| absolute.start_with?(dir) }
+      end
+
+      def gem_dirs
+        with_bundler = defined?(::Bundler) ? true : false
+        return @gem_dirs if @gem_dirs && @gem_dirs_with_bundler == with_bundler
+        dirs = []
+        if defined?(::Gem)
+          dirs << safely(nil) { ::Gem.dir }
+          dirs.concat(safely([]) { ::Gem.path })
+        end
+        if with_bundler && ::Bundler.respond_to?(:bundle_path)
+          dirs << safely(nil) { ::Bundler.bundle_path.to_s }
+        end
+        dirs.concat(ruby_library_dirs)
+        forms = dirs.compact.map(&:to_s).reject(&:empty?).uniq.map { |dir| path_forms(dir) }.flatten.uniq
+        # A gem folder that holds the whole project must not hide the project.
+        forms = forms.reject { |dir| @roots.any? { |root| root.start_with?(dir) } }
+        @gem_dirs_with_bundler = with_bundler
+        @gem_dirs = forms
+      end
+
+      # Ruby's own library, which is never the customer's code.
+      def ruby_library_dirs
+        %w(rubylibdir rubyarchdir sitelibdir vendorlibdir).map do |key|
+          safely(nil) { ::RbConfig::CONFIG[key] }
+        end.compact.reject { |dir| dir.to_s.empty? }
+      end
+
+      # Deprecations and Minitest, hooked as soon as their classes exist
+
+      def watch_for_frameworks
+        hook_deprecation(::ActiveSupport::Deprecation) if defined?(::ActiveSupport::Deprecation)
+        hook_minitest(::Minitest) if defined?(::Minitest)
+        hook_simplecov(::SimpleCov) if defined?(::SimpleCov)
+        return if all_hooked?
+        @trace = TracePoint.new(:end) { |point| module_closed(point.self) }
+        @trace.enable
+      end
+
+      def module_closed(mod)
+        name = MODULE_NAME.bind(mod).call
+        if name == "ActiveSupport::Deprecation"
+          hook_deprecation(mod)
+        elsif name == "Minitest"
+          hook_minitest(mod)
+        elsif name == "SimpleCov"
+          hook_simplecov(mod)
+        end
+        @trace.disable if @trace && all_hooked?
+      rescue StandardError
+        nil
+      end
+
+      def hook_deprecation(klass)
+        return if @deprecation_hooked || !klass.is_a?(Module)
+        klass.send(:prepend, DeprecationHooks)
+        @deprecation_hooked = true
+      end
+
+      def hook_minitest(mod)
+        return if @minitest_hooked || !mod.is_a?(Module)
+        mod.singleton_class.send(:prepend, MinitestHooks)
+        @minitest_hooked = true
+      end
+
+      def hook_simplecov(mod)
+        return if @simplecov_hooked || !mod.is_a?(Module)
+        mod.singleton_class.send(:prepend, SimpleCovHooks)
+        @simplecov_hooked = true
+      end
+
+      def all_hooked?
+        @deprecation_hooked && @minitest_hooked && @simplecov_hooked ? true : false
+      end
+
+      # Rails 4 builds its call stack with caller, Rails 5 and later with
+      # caller_locations.
+      def string_callstack?
+        defined?(::ActiveSupport::VERSION::MAJOR) && ::ActiveSupport::VERSION::MAJOR.to_i < 5 ? true : false
+      rescue StandardError
+        false
+      end
+
+      def record_deprecation(message, callstack)
+        return if @lookup_running
+        unless @deprecations_pid == Process.pid
+          @deprecations = []
+          @deprecations_pid = Process.pid
+        end
+        return if @deprecations.size >= MAX_DEPRECATIONS
+        file, line = project_location(callstack)
+        @deprecations << { "message" => message.to_s, "file" => file, "line" => line }
+      end
+
+      def project_location(callstack)
+        Array(callstack).first(MAX_FRAMES).each do |frame|
+          if frame.is_a?(String)
+            match = /\A(.+?):(\d+)/.match(frame)
+            next unless match
+            path = match[1]
+            line = match[2].to_i
+          else
+            path = frame.absolute_path || frame.path
+            line = frame.lineno
+          end
+          next unless path
+          relative = project_path(path, LOCATION_EXCLUDED)
+          return [relative, line] if relative
+        end
+        [nil, nil]
+      end
+
+      def add_minitest_counter(minitest)
+        reporter = minitest.reporter if minitest.respond_to?(:reporter)
+        reporter << MinitestCounter.new if reporter.respond_to?(:<<)
+      rescue StandardError
+        nil
+      end
+
+      def minitest_started
+        @minitest_mutex.synchronize do
+          return if @minitest_counts && @minitest_counts["pid"] == Process.pid
+          @minitest_counts = { "pid" => Process.pid, "run" => 0, "passed" => 0, "failed" => 0, "skipped" => 0 }
+        end
+      end
+
+      def minitest_record(result)
+        outcome = if result.respond_to?(:skipped?) && result.skipped?
+                    "skipped"
+                  elsif result.respond_to?(:passed?) && result.passed?
+                    "passed"
+                  else
+                    "failed"
+                  end
+        @minitest_mutex.synchronize do
+          counts = @minitest_counts
+          return unless counts && counts["pid"] == Process.pid
+          counts["run"] += 1
+          counts[outcome] += 1
+        end
+      end
+
+      # At exit
+
+      def finish
+        report = build_report
+        write_report(@dir, report) if report
+      rescue Exception
+        nil
+      end
+
+      def build_report
+        coverage = safely({}) { collected_coverage }
+        deprecations = safely([]) { @deprecations_pid == Process.pid ? @deprecations : [] }
+        tests = safely(nil) { test_counts }
+        return nil if coverage.empty? && deprecations.empty? && tests.nil?
+        {
+          "ruby" => RUBY_VERSION,
+          "bundler" => safely(nil) { defined?(::Bundler::VERSION) ? ::Bundler::VERSION.to_s : nil },
+          "database" => safely(nil) { database },
+          "coverage" => coverage,
+          "deprecations" => deprecations,
+          "tests" => tests
+        }
+      end
+
+      def test_counts
+        counts = @minitest_mutex.synchronize { @minitest_counts && @minitest_counts.dup }
+        if counts && counts["pid"] == Process.pid
+          return {
+            "runner" => "minitest", "run" => counts["run"], "passed" => counts["passed"],
+            "failed" => counts["failed"], "skipped" => counts["skipped"]
+          }
+        end
+        rspec_counts
+      end
+
+      # Reads the reporter RSpec already built. Never creates a configuration
+      # or a reporter, and ignores counts a forked child inherited.
+      def rspec_counts
+        return nil unless Process.pid == @pid && defined?(::RSpec)
+        return nil unless ::RSpec.instance_variable_defined?(:@configuration)
+        configuration = ::RSpec.instance_variable_get(:@configuration)
+        return nil unless configuration && configuration.instance_variable_defined?(:@reporter)
+        reporter = configuration.instance_variable_get(:@reporter)
+        return nil unless reporter.respond_to?(:examples) && reporter.respond_to?(:failed_examples) &&
+                          reporter.respond_to?(:pending_examples)
+        run = reporter.examples.size
+        failed = reporter.failed_examples.size
+        skipped = reporter.pending_examples.size
+        { "runner" => "rspec", "run" => run, "passed" => run - failed - skipped, "failed" => failed, "skipped" => skipped }
+      end
+
+      # Only in the process that started the run: a forked child shares the
+      # parent's database connection and must not use it.
+      # Deprecations raised by the lookup itself are not the app's and are
+      # not recorded.
+      def database
+        return nil unless Process.pid == @pid && defined?(::ActiveRecord::Base)
+        base = ::ActiveRecord::Base
+        return nil unless base.respond_to?(:connected?) && base.connected?
+        @lookup_running = true
+        begin
+          if base.respond_to?(:with_connection)
+            base.with_connection { |connection| database_version(base, connection) }
+          else
+            database_version(base, base.connection)
+          end
+        ensure
+          @lookup_running = false
+        end
+      end
+
+      # Rails 7.2 deprecates ActiveRecord::Base.connection, so with_connection
+      # is used where it exists.
+      def database_version(base, connection)
+        name = connection.adapter_name.to_s.downcase
+        adapter, query = database_query(name)
+        version = query ? quiet_select(base, connection, query) : nil
+        adapter = "mariadb" if adapter == "mysql" && version.to_s.downcase.include?("mariadb")
+        number = version.to_s[/\d+(\.\d+)*/]
+        { "adapter" => adapter, "version" => number }
+      end
+
+      def database_query(name)
+        if name.include?("postg")
+          ["postgresql", "SHOW server_version"]
+        elsif name.include?("mysql") || name.include?("trilogy")
+          ["mysql", "SELECT VERSION()"]
+        elsif name.include?("sqlite")
+          ["sqlite", "SELECT sqlite_version()"]
+        else
+          [name, nil]
+        end
+      end
+
+      # Runs the version query with the app's logger switched off, so the
+      # query never shows up in output the app sends to the terminal.
+      def quiet_select(base, connection, query)
+        logger = base.respond_to?(:logger) ? base.logger : nil
+        swap = logger && base.respond_to?(:logger=)
+        base.logger = nil if swap
+        begin
+          connection.select_value(query)
+        ensure
+          base.logger = logger if swap
+        end
+      end
+
+      # Writing
+
+      # Writes to a hidden temporary name in the same folder, then renames,
+      # so the collector never sees half a file.
+      def write_report(dir, report)
+        json = generate(report)
+        name = "process-#{Process.pid}-#{random_token}"
+        temporary = File.join(dir, ".#{name}.json.tmp")
+        final = File.join(dir, "#{name}.json")
+        begin
+          File.open(temporary, "wb") { |file| file.write(json) }
+          File.rename(temporary, final)
+        rescue Exception
+          begin
+            File.unlink(temporary) if File.exist?(temporary)
+          rescue StandardError
+            nil
+          end
+          raise
+        end
+        final
+      end
+
+      def random_token
+        "#{rand(0x100000000).to_s(36)}#{(Time.now.to_f * 1_000_000).to_i.to_s(36)}"
+      end
+
+      # A small JSON writer, so the loader never loads the json gem into the
+      # app's process.
+      def generate(value)
+        case value
+        when Hash
+          "{" + value.map { |key, item| "#{generate_string(key.to_s)}:#{generate(item)}" }.join(",") + "}"
+        when Array
+          "[" + value.map { |item| generate(item) }.join(",") + "]"
+        when String
+          generate_string(value)
+        when Integer
+          value.to_s
+        when Float
+          value.finite? ? value.to_s : "null"
+        when true
+          "true"
+        when false
+          "false"
+        when nil
+          "null"
+        else
+          generate_string(value.to_s)
+        end
+      end
+
+      def generate_string(string)
+        text = string.dup
+        if text.encoding == Encoding::UTF_8 || text.encoding == Encoding::BINARY || text.encoding == Encoding::US_ASCII
+          text.force_encoding(Encoding::UTF_8)
+        else
+          begin
+            text = text.encode(Encoding::UTF_8, invalid: :replace, undef: :replace, replace: "?")
+          rescue EncodingError
+            # Dummy encodings such as UTF-7 have no converter.
+            text = text.force_encoding(Encoding::UTF_8)
+          end
+        end
+        text = text.scrub("?") unless text.valid_encoding?
+        escaped = text.gsub(/["\\\x00-\x1f]/) { |char| JSON_ESCAPES[char] || format("\\u%04x", char.ord) }
+        "\"#{escaped}\""
+      end
+
+      def safely(default)
+        yield
+      rescue StandardError, ScriptError, SystemStackError
+        default
+      end
+    end
+  end
+end

data/lib/gemfile_audit/shell.rb

@@ -0,0 +1,70 @@
+module GemfileAudit
+  # Runs a short command and returns what it printed, giving up after a
+  # deadline so a stuck tool can never hold the build.
+  module Shell
+    TIMEOUT = 5
+
+    # The standard output of the command, or nil when it failed, was not
+    # found or did not finish in time.
+    def self.capture(*command)
+      options = { :err => File::NULL }
+      options[:chdir] = command.pop[:chdir] if command.last.is_a?(Hash)
+      reader, writer = IO.pipe
+      options[:out] = writer
+      pid = nil
+      begin
+        pid = Process.spawn(*command, options)
+        writer.close
+        read_until(reader, pid, Time.now + TIMEOUT)
+      rescue StandardError
+        stop(pid)
+        nil
+      ensure
+        writer.close unless writer.closed?
+        reader.close unless reader.closed?
+      end
+    end
+
+    def self.read_until(reader, pid, deadline)
+      output = String.new
+      loop do
+        remaining = deadline - Time.now
+        return timed_out(pid) if remaining <= 0
+        return timed_out(pid) unless IO.select([reader], nil, nil, remaining)
+        begin
+          output << reader.read_nonblock(4096)
+        rescue IO::WaitReadable
+          next
+        rescue EOFError
+          break
+        end
+      end
+      until (done = Process.wait2(pid, Process::WNOHANG))
+        return timed_out(pid) if Time.now >= deadline
+        sleep 0.01
+      end
+      done.last.success? ? output : nil
+    end
+
+    def self.timed_out(pid)
+      stop(pid)
+      nil
+    end
+
+    def self.stop(pid)
+      return unless pid
+      begin
+        Process.kill("KILL", pid)
+      rescue StandardError
+        nil
+      end
+      begin
+        Process.wait(pid)
+      rescue StandardError
+        nil
+      end
+    end
+
+    private_class_method :read_until, :timed_out, :stop
+  end
+end