inline_forms 8.1.21 → 8.1.42

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: dcda1708a5210f445c14024312d495fe28821927ccc6fb816f410110c47190e0
-  data.tar.gz: 7d47792cc13d0423639152ee2005287b369f4e1cf542e4195e4b92b027e5bf93
+  metadata.gz: 11df5d86221aad276d5bf2d4878702ce6651b595bd84f4911534922da817e07a
+  data.tar.gz: 14ac9ad9346af55d6573926f46f8fd907bf7d86e9eb695887d45e9abd5f67e58
 SHA512:
-  metadata.gz: 7ba52c31b810465c24b2c5e4d63cee7aaca6e424a1a436ead90d2c7e90a4a13fcfb9c67fbd9cb3f04459c5be9ec4b5604088491fdc8b92f909df32f973c6bc37
-  data.tar.gz: d96895cd2923769b62a597c5ad7bf26446180cfd8b2d2bfafa17c6c48cfa2f6f564063cd1b15e2340a94026c6d360db423f14244389d3d60b831c9a9d4fdc258
+  metadata.gz: 5f5b578c9c304f90509dc7fc1fe5a226b6f1b954eb11a451053f5107c474278caecc7fcf456f339794b34014078c38205a30ad786acd426d269ef6cff9096614
+  data.tar.gz: af1a4a4a228b4b3be79e5d71ab0b2ef6f2f02fb662032bad0b9ba40b285de548abbcb31c8adb501e990dd0d02ac3532819e3acee09334cc83f4899d8f42f8fc7

data/.forgejo/workflows/ci.yml

@@ -0,0 +1,63 @@
+# CI for Forgejo Actions (runner on dev02, jobs run in Docker containers).
+# Mirrors the Papiamentu setup: runner label `docker`, shared CI image
+# `papiamentu-ci:ruby-4.0.4-node20` (same Ruby as these gems; node for the
+# checkout/cache actions). See stuff/2026-07-06-forgejo-ci-rubocop-brakeman.md.
+#
+# GitHub deliberately has NO workflows (.github/workflows was removed in
+# 8.1.34): pushing to GitHub triggers nothing; CI runs only on Forgejo.
+name: CI
+
+# Push triggers on EVERY branch (stuff/prompt/workflow.md: "every commit runs
+# through CI") — feature branches were silently skipping CI when this was
+# `branches: [master]`.
+on:
+  push:
+  pull_request:
+
+jobs:
+  test:
+    runs-on: docker
+    container:
+      image: papiamentu-ci:ruby-4.0.4-node20
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          path: inline_forms
+
+      # The dev Gemfile points at the validation_hints sibling
+      # (gem "validation_hints", path: "../validation_hints"). The job's
+      # automatic token is scoped to this repo only and validation_hints is
+      # private, so the repo secret VALIDATION_HINTS (a token with read
+      # access to ace/validation_hints) authorizes the checkout.
+      - uses: actions/checkout@v4
+        with:
+          repository: ace/validation_hints
+          token: ${{ secrets.VALIDATION_HINTS }}
+          path: validation_hints
+
+      - name: Cache gems
+        uses: actions/cache@v4
+        with:
+          path: inline_forms/vendor/bundle
+          key: gems-inline_forms-${{ hashFiles('inline_forms/Gemfile', 'inline_forms/inline_forms.gemspec') }}
+          restore-keys: gems-inline_forms-
+
+      - name: Install gems
+        working-directory: inline_forms
+        run: |
+          bundle config set --local path vendor/bundle
+          bundle install --jobs 4
+
+      - name: Tests (unit + dummy-app integration harness)
+        working-directory: inline_forms
+        run: bundle exec rake test
+
+      - name: RuboCop
+        working-directory: inline_forms
+        run: bundle exec rubocop
+
+      - name: bundler-audit
+        working-directory: inline_forms
+        run: |
+          gem install bundler-audit --no-document
+          bundle-audit check --update

data/.forgejo/workflows/full-gate.yml

@@ -0,0 +1,77 @@
+# The full release gate as a CI job: build all three gems, install them,
+# generate the example app (which runs its own 150+ test suite as part of
+# `inline_forms create`), then run Brakeman against the generated app.
+#
+# Brakeman is aimed at Rails *applications*; scanning the generated MyApp
+# covers the engine's controllers/views in their real app context plus
+# everything the installer writes — scanning the bare engine repo would
+# skip most checks. bundler-audit for the engine runs in ci.yml.
+#
+# Heavy (~3-4 min: rails new + bundle + migrations + tests), so it runs on
+# demand and weekly, not per push. Requires network access to rubygems.org
+# from the runner (same as Papiamentu's bundle install).
+name: Full gate
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "17 4 * * 1"  # Mondays 04:17
+
+jobs:
+  full-gate:
+    runs-on: docker
+    container:
+      image: papiamentu-ci:ruby-4.0.4-node20
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          path: inline_forms
+
+      - uses: actions/checkout@v4
+        with:
+          repository: ace/validation_hints
+          token: ${{ secrets.VALIDATION_HINTS }}
+          path: validation_hints
+
+      - name: Build the four gems
+        run: |
+          cd validation_hints && gem build validation_hints.gemspec && cd ..
+          cd inline_forms && gem build inline_forms.gemspec && gem build inline_forms_installer.gemspec
+          cd inline_forms_schema_edit && gem build inline_forms_schema_edit.gemspec
+
+      - name: Install built gems
+        run: |
+          gem install --no-document \
+            validation_hints/validation_hints-*.gem \
+            inline_forms/inline_forms-*.gem \
+            inline_forms/inline_forms_installer-*.gem \
+            inline_forms/inline_forms_schema_edit/inline_forms_schema_edit-*.gem
+
+      # The installer git-inits the generated app and makes an initial commit
+      # (installer_core.rb: `git add .` + `git commit`); a bare container has
+      # no git identity and the commit — and with it the whole create — fails
+      # ("unable to auto-detect email address", seen in run 3).
+      - name: Git identity for the installer's initial commit
+        run: |
+          git config --global user.email "forgejo-ci@dev02.invalid"
+          git config --global user.name "Forgejo CI"
+
+      # The installer's example gate runs `bundle exec rails test` itself and
+      # aborts (non-zero) on any failure — this step IS the release gate.
+      # HOME keeps Rails/Bundler caches inside the workspace container.
+      - name: Generate example app (runs its own test suite)
+        run: |
+          mkdir -p apps
+          cd apps
+          inline_forms create MyApp -d sqlite --example --no-rvm
+
+      - name: Brakeman against the generated app
+        run: |
+          gem install brakeman --no-document
+          cd apps/MyApp
+          # Default check set is ENFORCING (baseline triaged 2026-07-06:
+          # 0 warnings; the one ForceSSL finding was fixed in 8.1.36).
+          brakeman --no-pager
+          # Pedantic full set stays informational: it includes checks that
+          # can fire on perfectly reasonable future code.
+          brakeman --run-all-checks --no-pager || true

data/.gitignore

@@ -21,11 +21,16 @@ pkg
 # Builds
 *.gem
 
+# Scratch / local notes and secrets (e.g. stuff/forgejo-token). Kept in-repo
+# .gitignore on purpose: the global excludes file that also ignores this is
+# per-machine and is absent on the release box, which let stuff/ leak into
+# `gem build`. Do not rely on the global ignore alone.
+stuff/
+
 Gemfile.lock
 
-# Local notes / analysis (not tracked)
-stuff/
 
-# Local sample images for the example app (not tracked; copied into
-# generated MyApp by the installer when --example is used)
-pics/
+
+# test/dummy runtime artifacts (in-memory DB; only logs/tmp may appear)
+test/dummy/log/
+test/dummy/tmp/

data/.rubocop.yml

@@ -0,0 +1,31 @@
+# RuboCop with the Rails "omakase" preset (same recipe as Papiamentu).
+# All heredoc-free files are clean. The remaining violations (grandfathered in
+# .rubocop_todo.yml) live in files with heredocs that emit generated-app code
+# (installer core, generators, form-element helpers); those files are left
+# untouched on purpose — autocorrect near heredocs risks changing emitted code.
+# Run with: bundle exec rubocop
+inherit_gem:
+  rubocop-rails-omakase: rubocop.yml
+
+inherit_from: .rubocop_todo.yml
+
+AllCops:
+  # The engine targets Ruby >= 4.0 (gemspec).
+  TargetRubyVersion: 3.3
+  Exclude:
+    - "pkg/**/*"
+    - "inline_forms_schema_edit/pkg/**/*"
+    - "vendor/**/*"
+    - "archived/**/*"            # frozen historical code; linting defeats the purpose
+    - "lib/installer_templates/**/*" # templates for *generated apps*, not engine style
+    - "lib/vagrant/**/*"
+    - "lib/otherstuff/**/*"
+    - "stuff/**/*"
+    - "test/dummy/log/**/*"
+    - "test/dummy/tmp/**/*"
+    - "script/**/*"              # one-off maintainer migration script
+
+# Heredoc bodies are generated-file content (installer/form-element templates);
+# whitespace there is part of the emitted output and is never auto-fixed.
+Layout/TrailingWhitespace:
+  AllowInHeredoc: true

data/.rubocop_todo.yml

@@ -0,0 +1,151 @@
+# This configuration was generated by
+# `rubocop --auto-gen-config --auto-gen-only-exclude --exclude-limit 60 --no-auto-gen-timestamp`
+# using RuboCop version 1.88.1.
+# The point is for the user to remove these configuration records
+# one by one as the offenses are removed from the code base.
+# Note that changes in the inspected code, or installation of new
+# versions of RuboCop, may require this file to be generated again.
+
+# Offense count: 1
+# This cop supports safe autocorrection (--autocorrect).
+# Configuration parameters: EnforcedStyle, IndentOneStep, IndentationWidth.
+# SupportedStyles: case, end
+Layout/CaseIndentation:
+  Exclude:
+    - 'lib/generators/inline_forms_generator.rb'
+
+# Offense count: 3
+# This cop supports safe autocorrection (--autocorrect).
+Layout/ElseAlignment:
+  Exclude:
+    - 'lib/inline_forms_installer/installer_core.rb'
+
+# Offense count: 37
+# This cop supports safe autocorrection (--autocorrect).
+Layout/EmptyLineAfterMagicComment:
+  Exclude:
+    - 'lib/generators/inline_forms_addto_generator.rb'
+    - 'lib/generators/inline_forms_generator.rb'
+    - 'lib/inline_forms/form_elements/audio_field_helper.rb'
+    - 'lib/inline_forms/form_elements/check_box_helper.rb'
+    - 'lib/inline_forms/form_elements/check_list_helper.rb'
+    - 'lib/inline_forms/form_elements/color_field_helper.rb'
+    - 'lib/inline_forms/form_elements/date_helper.rb'
+    - 'lib/inline_forms/form_elements/decimal_field_helper.rb'
+    - 'lib/inline_forms/form_elements/devise_password_field_helper.rb'
+    - 'lib/inline_forms/form_elements/dropdown_helper.rb'
+    - 'lib/inline_forms/form_elements/dropdown_with_integers_helper.rb'
+    - 'lib/inline_forms/form_elements/dropdown_with_other_helper.rb'
+    - 'lib/inline_forms/form_elements/dropdown_with_values_helper.rb'
+    - 'lib/inline_forms/form_elements/dropdown_with_values_with_stars_helper.rb'
+    - 'lib/inline_forms/form_elements/file_field_helper.rb'
+    - 'lib/inline_forms/form_elements/header_helper.rb'
+    - 'lib/inline_forms/form_elements/image_field_helper.rb'
+    - 'lib/inline_forms/form_elements/info_helper.rb'
+    - 'lib/inline_forms/form_elements/info_list_helper.rb'
+    - 'lib/inline_forms/form_elements/integer_field_helper.rb'
+    - 'lib/inline_forms/form_elements/money_field_helper.rb'
+    - 'lib/inline_forms/form_elements/month_select_helper.rb'
+    - 'lib/inline_forms/form_elements/month_year_picker_helper.rb'
+    - 'lib/inline_forms/form_elements/multi_image_field_helper.rb'
+    - 'lib/inline_forms/form_elements/pdf_link_helper.rb'
+    - 'lib/inline_forms/form_elements/plain_text_area_helper.rb'
+    - 'lib/inline_forms/form_elements/plain_text_helper.rb'
+    - 'lib/inline_forms/form_elements/radio_button_helper.rb'
+    - 'lib/inline_forms/form_elements/rich_text_helper.rb'
+    - 'lib/inline_forms/form_elements/scale_with_integers_helper.rb'
+    - 'lib/inline_forms/form_elements/scale_with_values_helper.rb'
+    - 'lib/inline_forms/form_elements/simple_file_field_helper.rb'
+    - 'lib/inline_forms/form_elements/slider_with_values_helper.rb'
+    - 'lib/inline_forms/form_elements/text_area_helper.rb'
+    - 'lib/inline_forms/form_elements/text_field_helper.rb'
+    - 'lib/inline_forms/form_elements/time_helper.rb'
+    - 'lib/inline_forms_installer/create_log.rb'
+
+# Offense count: 1
+# This cop supports safe autocorrection (--autocorrect).
+# Configuration parameters: EnforcedStyle.
+# SupportedStyles: empty_lines, empty_lines_except_namespace, empty_lines_special, no_empty_lines, beginning_only, ending_only
+Layout/EmptyLinesAroundClassBody:
+  Exclude:
+    - 'lib/generators/inline_forms_generator.rb'
+
+# Offense count: 2
+# This cop supports safe autocorrection (--autocorrect).
+# Configuration parameters: EnforcedStyleAlignWith.
+# SupportedStylesAlignWith: keyword, variable, start_of_line
+Layout/EndAlignment:
+  Exclude:
+    - 'lib/inline_forms_installer/installer_core.rb'
+
+# Offense count: 1
+# This cop supports safe autocorrection (--autocorrect).
+# Configuration parameters: AllowDoxygenCommentStyle, AllowGemfileRubyComment, AllowRBSInlineAnnotation, AllowSteepAnnotation.
+Layout/LeadingCommentSpace:
+  Exclude:
+    - 'lib/inline_forms_installer/installer_core.rb'
+
+# Offense count: 4
+# This cop supports safe autocorrection (--autocorrect).
+Layout/SpaceAfterComma:
+  Exclude:
+    - 'lib/inline_forms_installer/installer_core.rb'
+
+# Offense count: 2
+# This cop supports safe autocorrection (--autocorrect).
+# Configuration parameters: EnforcedStyle, EnforcedStyleForEmptyBrackets.
+# SupportedStyles: space, no_space, compact
+# SupportedStylesForEmptyBrackets: space, no_space
+Layout/SpaceInsideArrayLiteralBrackets:
+  Exclude:
+    - 'lib/inline_forms_installer/create_log.rb'
+
+# Offense count: 1
+# This cop supports safe autocorrection (--autocorrect).
+Lint/RedundantStringCoercion:
+  Exclude:
+    - 'lib/generators/inline_forms_generator.rb'
+
+# Offense count: 8
+# This cop supports safe autocorrection (--autocorrect).
+# Configuration parameters: EnforcedStyle, EnforcedShorthandSyntax, UseHashRocketsWithSymbolValues, PreferHashRocketsForNonAlnumEndingSymbols.
+# SupportedStyles: ruby19, hash_rockets, no_mixed_keys, ruby19_no_mixed_keys
+# SupportedShorthandSyntax: always, never, either, consistent, either_consistent
+Style/HashSyntax:
+  Exclude:
+    - 'lib/generators/inline_forms_generator.rb'
+    - 'lib/inline_forms_installer/installer_core.rb'
+
+# Offense count: 2
+# This cop supports safe autocorrection (--autocorrect).
+# Configuration parameters: PreferredDelimiters.
+Style/PercentLiteralDelimiters:
+  Exclude:
+    - 'lib/inline_forms_installer/installer_core.rb'
+
+# Offense count: 131
+# This cop supports safe autocorrection (--autocorrect).
+# Configuration parameters: EnforcedStyle, ConsistentQuotesInMultiline.
+# SupportedStyles: single_quotes, double_quotes
+Style/StringLiterals:
+  Exclude:
+    - 'lib/generators/inline_forms_generator.rb'
+    - 'lib/inline_forms_installer/installer_core.rb'
+    - 'test/inline_forms_addto_generator_test.rb'
+    - 'test/inline_forms_generator_test.rb'
+
+# Offense count: 1
+# This cop supports safe autocorrection (--autocorrect).
+# Configuration parameters: EnforcedStyleForMultiline.
+# SupportedStylesForMultiline: comma, consistent_comma, diff_comma, no_comma
+Style/TrailingCommaInArrayLiteral:
+  Exclude:
+    - 'lib/inline_forms_installer/installer_core.rb'
+
+# Offense count: 2
+# This cop supports safe autocorrection (--autocorrect).
+# Configuration parameters: EnforcedStyleForMultiline.
+# SupportedStylesForMultiline: comma, consistent_comma, diff_comma, no_comma
+Style/TrailingCommaInHashLiteral:
+  Exclude:
+    - 'lib/inline_forms_installer/installer_core.rb'