gemfilelint 0.2.0 → 0.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ed679ee045c3d39a031c54a7bc7b17a5912920975a46fbf4d8919a99c6216008
-  data.tar.gz: cdfd4a5b93dc1c6c2eee7917b11f3000e82f5604223cde31c067b5b433a33729
+  metadata.gz: 9a2060f4fc9182c112139acb209f01d2e33912b25508f0685f75b78733daad2b
+  data.tar.gz: bf61bd673a5163aecf6f1dd2d150379fc809ecdf6a9e0067ce62473e0cf2d657
 SHA512:
-  metadata.gz: be1de4b80eee06591d4bd0b85faf0ed50208f5d7f8de04f8dc7a95a339202629ce0bd5b0c81bee750581025bcdbabab1768afc307ac036c8e30c06f04ee2a433
-  data.tar.gz: 694bf077b0ef17a588bccb615ddce0ce865d6e1131fe01d20589a7098748d41c4fe170b22b83b532b2f3fce453b7eeefc535330c2468f8398c1f4eca8337924d
+  metadata.gz: 4130ead8d9a8b793b1cece83a2bfdae070225c5495370857acd5dc06adab2f4dae6af93bb74ee5dfe16415b82b8bc0d13887b6d6be5f0574e0e79c7fb3d58e42
+  data.tar.gz: c46f5cdaace8230cd21c1c1b981a42031db5a93bacc0f788e366a990b63bc35cb91033c8f38649820a52a670e8ffefeb9957fda699c9ed1a78c59d516a062e22

data/.github/dependabot.yml

@@ -0,0 +1,6 @@
+version: 2
+updates:
+  - package-ecosystem: "bundler"
+    directory: "/"
+    schedule:
+      interval: "daily"

data/.github/workflows/main.yml

@@ -1,23 +1,34 @@
 name: Main
-on: push
+on:
+- push
+- pull_request_target
 jobs:
   ci:
     name: CI
     runs-on: ubuntu-latest
+    env:
+      CI: true
     steps:
     - uses: actions/checkout@master
     - uses: ruby/setup-ruby@v1
       with:
-        ruby-version: 2.7
-    - uses: actions/cache@v1
+        ruby-version: 3.0
+        bundler-cache: true
+    - name: Lint and test
+      run: |
+        bundle exec rubocop --parallel
+        bundle exec rake test
+  automerge:
+    name: AutoMerge
+    needs: ci
+    runs-on: ubuntu-latest
+    if: github.event_name == 'pull_request_target' && (github.actor == github.repository_owner || github.actor == 'dependabot[bot]')
+    steps:
+    - uses: actions/github-script@v3
       with:
-        path: vendor/bundle
-        key: ${{ runner.os }}-gems-${{ hashFiles('**/Gemfile.lock') }}
-        restore-keys: |
-          ${{ runner.os }}-gems-
-    - run: bundle config path vendor/bundle
-    - run: bundle install --jobs 4 --retry 3
-    - run: bundle exec rubocop --parallel
-    - run: bundle exec rake test
-      env:
-        CI: true
+        script: |
+          github.pulls.merge({
+            owner: context.payload.repository.owner.login,
+            repo: context.payload.repository.name,
+            pull_number: context.payload.pull_request.number
+          })

data/.rubocop.yml

@@ -2,11 +2,22 @@ AllCops:
   DisplayCopNames: true
   DisplayStyleGuide: true
   TargetRubyVersion: 2.7
+  NewCops: enable
+  SuggestExtensions: false
   Exclude:
   - 'vendor/**/*'
 
+Gemspec/RequiredRubyVersion:
+  Enabled: false
+
 Style/Documentation:
   Enabled: false
 
+Style/ExplicitBlockArgument:
+  Enabled: false
+
+Style/StringLiterals:
+  EnforcedStyle: double_quotes
+
 Style/StructInheritance:
   Enabled: false

data/CHANGELOG.md

@@ -6,6 +6,30 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/) a
 
 ## [Unreleased]
 
+## [0.4.0] - 2021-09-15
+
+### Added
+
+- Support the `--ignore` option for removing false positives from the lint run.
+
+## [0.3.0] - 2021-03-29
+
+### Changed
+
+- Support the renamed rubygems source instance variable.
+
+## [0.2.2] - 2020-04-23
+
+### Changed
+
+- Lower the threshold so we don't get so many false positives.
+
+## [0.2.1] - 2020-02-24
+
+### Changed
+
+- Fix invocation when not specifying path to gemfile.
+
 ## [0.2.0] - 2020-02-20
 
 ### Added
@@ -18,5 +42,10 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/) a
 
 - 🎉 Initial release.
 
-[unreleased]: https://github.com/kddeisz/gemfilelint/compare/v0.1.0...HEAD
-[0.1.0]: https://github.com/kddeisz/gemfilelint/compare/935da5...v0.1.0
+[unreleased]: https://github.com/kddnewton/gemfilelint/compare/v0.4.0...HEAD
+[0.4.0]: https://github.com/kddnewton/gemfilelint/compare/v0.3.0...v0.4.0
+[0.3.0]: https://github.com/kddnewton/gemfilelint/compare/v0.2.2...v0.3.0
+[0.2.2]: https://github.com/kddnewton/gemfilelint/compare/v0.2.1...v0.2.2
+[0.2.1]: https://github.com/kddnewton/gemfilelint/compare/v0.2.0...v0.2.1
+[0.2.0]: https://github.com/kddnewton/gemfilelint/compare/v0.1.0...v0.2.0
+[0.1.0]: https://github.com/kddnewton/gemfilelint/compare/935da5...v0.1.0

data/CODE_OF_CONDUCT.md

@@ -55,7 +55,7 @@ further defined and clarified by project maintainers.
 ## Enforcement
 
 Instances of abusive, harassing, or otherwise unacceptable behavior may be
-reported by contacting the project team at kevin.deisz@gmail.com. All
+reported by contacting the project team at kddnewton@gmail.com. All
 complaints will be reviewed and investigated and will result in a response that
 is deemed necessary and appropriate to the circumstances. The project team is
 obligated to maintain confidentiality with regard to the reporter of an incident.

data/Gemfile

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
-source 'https://rubygems.org'
+source "https://rubygems.org"
 
 gemspec

data/Gemfile.lock

@@ -1,34 +1,38 @@
 PATH
   remote: .
   specs:
-    gemfilelint (0.2.0)
+    gemfilelint (0.4.0)
       bundler
 
 GEM
   remote: https://rubygems.org/
   specs:
-    ast (2.4.0)
-    jaro_winkler (1.5.4)
-    minitest (5.14.0)
-    parallel (1.19.1)
-    parser (2.7.0.2)
-      ast (~> 2.4.0)
+    ast (2.4.2)
+    minitest (5.14.4)
+    parallel (1.21.0)
+    parser (3.0.2.0)
+      ast (~> 2.4.1)
     rainbow (3.0.0)
-    rake (12.3.3)
-    rexml (3.2.4)
-    rubocop (0.80.0)
-      jaro_winkler (~> 1.5.1)
+    rake (13.0.6)
+    regexp_parser (2.1.1)
+    rexml (3.2.5)
+    rubocop (1.21.0)
       parallel (~> 1.10)
-      parser (>= 2.7.0.1)
+      parser (>= 3.0.0.0)
       rainbow (>= 2.2.2, < 4.0)
+      regexp_parser (>= 1.8, < 3.0)
       rexml
+      rubocop-ast (>= 1.9.1, < 2.0)
       ruby-progressbar (~> 1.7)
-      unicode-display_width (>= 1.4.0, < 1.7)
-    ruby-progressbar (1.10.1)
-    unicode-display_width (1.6.1)
+      unicode-display_width (>= 1.4.0, < 3.0)
+    rubocop-ast (1.11.0)
+      parser (>= 3.0.1.1)
+    ruby-progressbar (1.11.0)
+    unicode-display_width (2.1.0)
 
 PLATFORMS
-  ruby
+  x86_64-darwin-19
+  x86_64-linux
 
 DEPENDENCIES
   gemfilelint!
@@ -37,4 +41,4 @@ DEPENDENCIES
   rubocop
 
 BUNDLED WITH
-   2.1.2
+   2.2.15

data/LICENSE

@@ -1,6 +1,6 @@
 The MIT License (MIT)
 
-Copyright (c) 2020-present Kevin Deisz
+Copyright (c) 2020-present Kevin Newton
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

data/README.md

@@ -1,6 +1,21 @@
 # Gemfile lint
 
-Lint your Gemfile! This will find common spelling mistakes in gems and remote sources so that you don't accidentally download code from places that you don't mean to.
+[![Build Status](https://github.com/kddnewton/gemfilelint/workflows/Main/badge.svg)](https://github.com/kddnewton/gemfilelint/actions)
+[![Gem Version](https://img.shields.io/gem/v/gemfilelint.svg)](https://github.com/kddnewton/gemfilelint)
+
+Lint your Gemfile! This will find common spelling mistakes in gems and remote sources so that you don't accidentally download code from places that you don't mean to. For example, if you have a Gemfile with the contents:
+
+```ruby
+source 'https://rubyems.org'
+
+gem 'rails'
+gem 'puma'
+gem 'pg'
+```
+
+You might not be able to see the immediate issue, but there's a typo in your source declaration. While this will generally be harmless, as it will likely error, it's also possible that someone could register that domain and provide gems with modified content to execute their own code on your production system.
+
+`gemfilelint` is a utility that you can run against your Gemfile that will check all of your listed sources against known trusted sources and all of your listed gems against the most commonly downloaded gems according to rubygems. This can give you some peace of mind that if you make a spelling mistake you won't accidentally open yourself up to RCE without knowing it.
 
 ## Installation
 
@@ -20,7 +35,25 @@ Or install it yourself as:
 
 ## Usage
 
-Run the `gemfilelint` executable either in the root of your repository that contains a Gemfile or specify a path to one.
+Run the `gemfilelint` executable either in the root of your repository:
+
+```
+$ bundle exec gemfilelint
+```
+
+Or run the executable pointing to any number of gemfiles:
+
+```
+$ bundle exec gemfilelint gemfiles/*.gemfile
+```
+
+### --ignore
+
+If you're receiving false positives because you're using a gem that is named similarly to a very popular gem, then you can pass the `--ignore` option to the CLI. This should be a comma-delimited list of gem names that should be ignored when linting. For example:
+
+```
+$ bundle exec gemfilelint --ignore rr
+```
 
 ## Development
 
@@ -30,7 +63,7 @@ To install this gem onto your local machine, run `bundle exec rake install`. To
 
 ## Contributing
 
-Bug reports and pull requests are welcome on GitHub at https://github.com/kddeisz/gemfilelint. This project is intended to be a safe, welcoming space for collaboration, and contributors are expected to adhere to the [code of conduct](https://github.com/kddeisz/gemfilelint/blob/master/CODE_OF_CONDUCT.md).
+Bug reports and pull requests are welcome on GitHub at https://github.com/kddnewton/gemfilelint. This project is intended to be a safe, welcoming space for collaboration, and contributors are expected to adhere to the [code of conduct](https://github.com/kddnewton/gemfilelint/blob/master/CODE_OF_CONDUCT.md).
 
 ## License
 
@@ -38,4 +71,4 @@ The gem is available as open source under the terms of the [MIT License](https:/
 
 ## Code of Conduct
 
-Everyone interacting in the Gemfilelint project's codebases, issue trackers, chat rooms and mailing lists is expected to follow the [code of conduct](https://github.com/kddeisz/gemfilelint/blob/master/CODE_OF_CONDUCT.md).
+Everyone interacting in the Gemfilelint project's codebases, issue trackers, chat rooms and mailing lists is expected to follow the [code of conduct](https://github.com/kddnewton/gemfilelint/blob/master/CODE_OF_CONDUCT.md).

data/Rakefile

@@ -1,12 +1,12 @@
 # frozen_string_literal: true
 
-require 'bundler/gem_tasks'
-require 'rake/testtask'
+require "bundler/gem_tasks"
+require "rake/testtask"
 
 Rake::TestTask.new(:test) do |t|
-  t.libs << 'test'
-  t.libs << 'lib'
-  t.test_files = FileList['test/**/*_test.rb']
+  t.libs << "test"
+  t.libs << "lib"
+  t.test_files = FileList["test/**/*_test.rb"]
 end
 
 task default: :test

data/bin/console

@@ -1,8 +1,8 @@
 #!/usr/bin/env ruby
 # frozen_string_literal: true
 
-require 'bundler/setup'
-require 'gemfilelint'
+require "bundler/setup"
+require "gemfilelint"
 
-require 'irb'
+require "irb"
 IRB.start(__FILE__)

data/exe/gemfilelint

@@ -1,15 +1,31 @@
 #!/usr/bin/env ruby
 # frozen_string_literal: true
 
-$LOAD_PATH.unshift(File.expand_path(File.join('..', 'lib'), __dir__))
-require 'gemfilelint'
+$LOAD_PATH.unshift(File.expand_path(File.join("..", "lib"), __dir__))
 
-gemfiles = ARGV.any? ? ARGV : './Gemfile'
+require "gemfilelint"
+require "optparse"
 
+options = {}
+OptionParser.new do |opts|
+  opts.banner = "Usage: gemfilelint [options] [path/to/Gemfile]*"
+
+  opts.on("-i GEMS", "--ignore GEMS", "Ignore a comma-delimited list of false positives") do |ignore|
+    options[:ignore] = ignore.split(",").map(&:strip)
+  end
+
+  opts.on("-h", "--help", "Prints this help") do
+    puts opts
+    exit
+  end
+end.parse!
+
+gemfiles = ARGV.any? ? ARGV : %w[./Gemfile]
 invalid = gemfiles.reject { |gemfile| File.file?(gemfile) }
+
 if invalid.any?
   warn("Could not find a gemfile at: #{invalid.join(', ')}")
   exit 2
 end
 
-exit Gemfilelint.lint(*gemfiles) ? 0 : 1
+exit Gemfilelint.lint(*gemfiles, **options) ? 0 : 1

data/gemfilelint.gemspec

@@ -1,16 +1,16 @@
 # frozen_string_literal: true
 
-require_relative 'lib/gemfilelint/version'
+require_relative "lib/gemfilelint/version"
 
 Gem::Specification.new do |spec|
-  spec.name          = 'gemfilelint'
+  spec.name          = "gemfilelint"
   spec.version       = Gemfilelint::VERSION
-  spec.authors       = ['Kevin Deisz']
-  spec.email         = ['kevin.deisz@gmail.com']
+  spec.authors       = ["Kevin Newton"]
+  spec.email         = ["kddnewton@gmail.com"]
 
-  spec.summary       = 'Lint your Gemfile!'
-  spec.homepage      = 'https://github.com/kddeisz/gemfilelint'
-  spec.license       = 'MIT'
+  spec.summary       = "Lint your Gemfile!"
+  spec.homepage      = "https://github.com/kddnewton/gemfilelint"
+  spec.license       = "MIT"
 
   spec.files         = Dir.chdir(__dir__) do
     `git ls-files -z`.split("\x0").reject do |f|
@@ -18,13 +18,13 @@ Gem::Specification.new do |spec|
     end
   end
 
-  spec.bindir        = 'exe'
+  spec.bindir        = "exe"
   spec.executables   = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
-  spec.require_paths = ['lib']
+  spec.require_paths = ["lib"]
 
-  spec.add_dependency 'bundler'
+  spec.add_dependency "bundler"
 
-  spec.add_development_dependency 'minitest'
-  spec.add_development_dependency 'rake'
-  spec.add_development_dependency 'rubocop'
+  spec.add_development_dependency "minitest"
+  spec.add_development_dependency "rake"
+  spec.add_development_dependency "rubocop"
 end

data/lib/gemfilelint/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Gemfilelint
-  VERSION = '0.2.0'
+  VERSION = "0.4.0"
 end

data/lib/gemfilelint.rb

@@ -1,12 +1,12 @@
 # frozen_string_literal: true
 
-require 'delegate'
-require 'logger'
+require "delegate"
+require "logger"
 
-require 'bundler'
-require 'bundler/similarity_detector'
+require "bundler"
+require "bundler/similarity_detector"
 
-require 'gemfilelint/version'
+require "gemfilelint/version"
 
 module Gemfilelint
   class SpellChecker
@@ -20,7 +20,7 @@ module Gemfilelint
     def correct(needle)
       return [] if haystack.include?(needle)
 
-      detector.similar_words(needle)
+      detector.similar_words(needle, 2)
     end
   end
 
@@ -52,8 +52,10 @@ module Gemfilelint
 
   module Parser
     class Valid < Struct.new(:path, :dsl)
-      def each_offense
+      def each_offense(ignore: [])
         dependencies.each do |dependency|
+          next if ignore.include?(dependency)
+
           yield dependency_offense_for(dependency)
         end
 
@@ -77,11 +79,12 @@ module Gemfilelint
 
       # Lol wut, there has got to be a better way to do this
       def remotes
-        dsl
-          .instance_variable_get(:@sources)
-          .instance_variable_get(:@rubygems_aggregate)
-          .remotes
-          .map(&:to_s)
+        sources = dsl.instance_variable_get(:@sources)
+        rubygems =
+          sources.instance_variable_get(:@rubygems_aggregate) ||
+          sources.instance_variable_get(:@global_rubygems_source)
+
+        rubygems.remotes.map(&:to_s)
       end
 
       def remote_offense_for(uri)
@@ -93,7 +96,7 @@ module Gemfilelint
     end
 
     class Invalid < Struct.new(:path)
-      def each_offense
+      def each_offense(**)
         yield Offenses::InvalidGemfile.new(path)
       end
     end
@@ -118,9 +121,10 @@ module Gemfilelint
 
     using ANSIColor
 
-    attr_reader :logger
+    attr_reader :ignore, :logger
 
-    def initialize(logger: nil)
+    def initialize(ignore: [], logger: nil)
+      @ignore = ignore
       @logger = logger || make_logger
     end
 
@@ -133,9 +137,9 @@ module Gemfilelint
       each_offense_for(paths) do |offense|
         if offense
           offenses << offense
-          logger.info('W'.colorize(:magenta))
+          logger.info("W".colorize(:magenta))
         else
-          logger.info('.'.colorize(:green))
+          logger.info(".".colorize(:green))
         end
       end
 
@@ -155,14 +159,14 @@ module Gemfilelint
 
     def each_offense_for(paths)
       paths.each do |path|
-        Parser.for(path).each_offense do |offense|
+        Parser.for(path).each_offense(ignore: ignore) do |offense|
           yield offense
         end
       end
     end
 
     def make_logger
-      Logger.new(STDOUT).tap do |creating|
+      Logger.new($stdout).tap do |creating|
         creating.level = :info
         creating.formatter = ->(*, message) { message }
       end
@@ -177,16 +181,16 @@ module Gemfilelint
     def dependencies
       @dependencies ||=
         SpellChecker.new(
-          File.read(File.expand_path('gems.txt', __dir__)).split("\n")
+          File.read(File.expand_path("gems.txt", __dir__)).split("\n")
         )
     end
 
     def remotes
-      @remotes ||= SpellChecker.new(['https://rubygems.org/'])
+      @remotes ||= SpellChecker.new(["https://rubygems.org/"])
     end
 
-    def lint(*paths, logger: nil)
-      Linter.new(logger: logger).lint(*paths)
+    def lint(*paths, ignore: [], logger: nil)
+      Linter.new(ignore: ignore, logger: logger).lint(*paths)
     end
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: gemfilelint
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.4.0
 platform: ruby
 authors:
-- Kevin Deisz
-autorequire: 
+- Kevin Newton
+autorequire:
 bindir: exe
 cert_chain: []
-date: 2020-02-20 00:00:00.000000000 Z
+date: 2021-09-15 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -66,17 +66,17 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-description: 
+description:
 email:
-- kevin.deisz@gmail.com
+- kddnewton@gmail.com
 executables:
 - gemfilelint
 extensions: []
 extra_rdoc_files: []
 files:
+- ".github/dependabot.yml"
 - ".github/workflows/main.yml"
 - ".gitignore"
-- ".mergify.yml"
 - ".rubocop.yml"
 - CHANGELOG.md
 - CODE_OF_CONDUCT.md
@@ -93,11 +93,11 @@ files:
 - lib/gemfilelint.rb
 - lib/gemfilelint/version.rb
 - lib/gems.txt
-homepage: https://github.com/kddeisz/gemfilelint
+homepage: https://github.com/kddnewton/gemfilelint
 licenses:
 - MIT
 metadata: {}
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -112,8 +112,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.1.2
-signing_key: 
+rubygems_version: 3.2.3
+signing_key:
 specification_version: 4
 summary: Lint your Gemfile!
 test_files: []

data/.mergify.yml

@@ -1,10 +0,0 @@
-pull_request_rules:
-  - name: Automatically merge dependencies
-    conditions:
-      - base=master
-      - label=dependencies
-      - status-success=CI
-    actions:
-      merge:
-        strict: true
-      delete_head_branch: {}