license_patrol 1.0.0 → 1.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6d2e13b85fa48187c33aa76ef484cbdf3022e10551286d94ad79e5e53811d6a2
-  data.tar.gz: d763c2015d71fa8f20ba67258151e013886ed057c6a4c1c8e1831ec27f43106c
+  metadata.gz: 4654e0d8c8444ded245bd4960a0897b7ec961ac6329751ae545cefbf907adbd2
+  data.tar.gz: c7b5677df462576bd56bc82f3114052cbd136afba270effcf19427d8621b5e9f
 SHA512:
-  metadata.gz: a011b12567263048cdba247fc4cd8270e2183a8ba6baf314c0342e65ca15cb73d0c12ab83c8bbd2f0cdc30d39823e3dc3ec409379f7433fe27d969e22e794cda
-  data.tar.gz: 5eafee911a325c2fa65263deaceb81159a198f495d543c0cccdcb0a0782a99cc3bd66762307521f927ec04ffec8f1999d37480e035efcbc3795d50814ba0adc3
+  metadata.gz: 01cd7fd00cacc1e8e150294fcdd43abc35261fe2da6e82138e5cc6a335d3503120df25ce0728888bd30cbabae39cd0c81df1c427a7c0b681ef2b4c97f2b8f5e3
+  data.tar.gz: aed4baf70fad953b9c6fdf6a851e5c1cb0dc6f501f115b9676771b7c82967fd1c40776b36635805961e24ce37896c128436939f80be9ac6acbcb930afa1d6652

data/CHANGELOG.md

@@ -1,4 +1,9 @@
-# [1.0.0] / Unreleased
+# [1.1.0] / 2026-10-21
+
+### Added
+* `bundler_gemfiles` option to scan many gemfiles, such as Appraisal's `gemfiles/*.gemfile`, in one run - [5d7e1372](https://github.com/powerhome/license_patrol/commit/5d7e1372) - Carlos Palhares
+
+# [1.0.0] / 2026-10-21
 
 First release as `license_patrol`, forked from LicenseFinder 7.2.1. Earlier entries are LicenseFinder's history.
 
@@ -1068,3 +1073,5 @@ Bugfixes:
 [7.1.0]: https://github.com/pivotal/LicenseFinder/compare/v7.0.1...v7.1.0
 [7.2.0]: https://github.com/pivotal/LicenseFinder/compare/v7.1.0...v7.2.0
 [7.2.1]: https://github.com/pivotal/LicenseFinder/compare/v7.2.0...v7.2.1
+[1.0.0]: https://github.com/powerhome/license_patrol/releases/tag/v1.0.0
+[1.1.0]: https://github.com/powerhome/license_patrol/compare/v1.0.0...v1.1.0

data/README.md

@@ -466,6 +466,18 @@ If you store rebar dependencies in a custom directory (by setting `deps_dir` in
 You can also invoke a custom Mix script `remix` with `--mix_command remix` and
 set `--mix_deps_dir` to fetch Mix dependencies from a custom directory.
 
+By default, `bundler` dependencies are read from the gemfile in `BUNDLE_GEMFILE`,
+or from `Gemfile`. If your project locks dependencies in more than one gemfile
+(e.g. when using [Appraisal](https://github.com/thoughtbot/appraisal)), pass all
+of them to `--bundler_gemfiles`, relative to the project path. Glob patterns are
+accepted, as long as they are quoted:
+
+```
+$ license_patrol --bundler_gemfiles Gemfile 'gemfiles/*.gemfile'
+```
+
+Every gem locked by any of the gemfiles will be reported, once per version.
+
 ### Narrow down Package Manager
 
 By default, license_patrol will check for all supported package managers,
@@ -492,6 +504,9 @@ rebar_command: './rebarw'
 rebar_deps_dir: './rebar_deps'
 mix_command: './mixw'
 mix_deps_dir: './mix_deps'
+bundler_gemfiles:
+  - Gemfile
+  - gemfiles/*.gemfile
 enabled_package_managers:
   - bundler
   - gradle

data/VERSION

@@ -1 +1 @@
-1.0.0
+1.1.0

data/lib/license_patrol/cli/base.rb

@@ -40,6 +40,7 @@ module LicensePatrol
           :project_path,
           :decisions_file,
           :enabled_package_managers,
+          :bundler_gemfiles,
           :go_full_version,
           :gradle_command,
           :gradle_include_groups,

data/lib/license_patrol/cli/main.rb

@@ -24,6 +24,10 @@ module LicensePatrol
         'junit' => JunitReport
       }.freeze
 
+      class_option :bundler_gemfiles,
+                   type: :array,
+                   desc: "Gemfiles to be scanned, relative to the project path. Accepts glob patterns (e.g. 'gemfiles/*.gemfile' for Appraisal).
+                          Only meaningful if used with a Ruby/bundler project. Defaults to BUNDLE_GEMFILE, or 'Gemfile'."
       class_option :go_full_version, desc: 'Whether dependency version should include full version. Only meaningful if used with a Go project. Defaults to false.'
       class_option :gradle_include_groups, desc: 'Whether dependency name should include group id. Only meaningful if used with a Java/gradle project. Defaults to false.'
       class_option :gradle_command,

data/lib/license_patrol/configuration.rb

@@ -77,6 +77,10 @@ module LicensePatrol
       get(:gradle_command)
     end
 
+    def bundler_gemfiles
+      get(:bundler_gemfiles)
+    end
+
     def go_full_version
       get(:go_full_version)
     end

data/lib/license_patrol/core.rb

@@ -95,6 +95,7 @@ module LicensePatrol
         log_directory: File.join(config.log_directory, project_name),
         ignored_groups: decisions.ignored_groups,
         enabled_package_manager_ids: config.enabled_package_manager_ids,
+        bundler_gemfiles: config.bundler_gemfiles,
         go_full_version: config.go_full_version,
         gradle_command: config.gradle_command,
         gradle_include_groups: config.gradle_include_groups,

data/lib/license_patrol/package_managers/bundler.rb

@@ -2,23 +2,22 @@
 
 require 'bundler'
 require 'securerandom'
+require 'shellwords'
 
 module LicensePatrol
   class Bundler < PackageManager
     def initialize(options = {})
       super
       @ignored_groups = options[:ignored_groups]
+      @gemfiles = Array(options[:bundler_gemfiles]) unless options[:bundler_gemfiles].nil?
       @definition = options[:definition] # dependency injection for tests
     end
 
     def current_packages
-      with_gemfile do
-        logger.debug self.class, "including groups #{included_groups.inspect}"
-        details.map do |gem_detail, bundle_detail|
-          BundlerPackage.new(gem_detail, bundle_detail, logger: logger).tap do |package|
-            log_package_dependencies package
-          end
-        end
+      packages = existing_gemfile_paths.flat_map { |gemfile_path| current_packages_for(gemfile_path) }
+
+      packages.group_by { |package| [package.name, package.version] }.map do |_, same_packages|
+        merge_groups(same_packages)
       end
     end
 
@@ -32,68 +31,81 @@ module LicensePatrol
       gem_path = "lf-bundler-gems-#{SecureRandom.uuid}"
       logger.info self.class, "Running bundle install for #{Dir.pwd} with path #{gem_path}", color: :blue
 
-      "bundle install #{ignored_groups_argument} --path #{gem_path}".strip
+      return "bundle install #{ignored_groups_argument} --path #{gem_path}".strip if existing_gemfile_paths.size <= 1
+
+      existing_gemfile_paths.map do |gemfile_path|
+        gemfile_argument = "--gemfile #{Shellwords.escape(relative_to_project(gemfile_path))}"
+        "bundle install #{gemfile_argument} #{ignored_groups_argument} --path #{gem_path}".squeeze(' ')
+      end.join(' && ')
     end
 
     def possible_package_paths
-      [gemfile_path]
+      gemfile_paths
     end
 
     private
 
     attr_reader :ignored_groups
 
-    def definition
-      return @definition if @definition
+    def current_packages_for(gemfile_path)
+      with_gemfile(gemfile_path) do
+        definition = definition_for(gemfile_path)
+        included_groups = definition.groups - ignored_groups.map(&:to_sym)
+        logger.debug self.class, "including groups #{included_groups.inspect} from #{gemfile_path}"
 
-      @definition = ::Bundler::Definition.build(detected_package_path, lockfile_path, nil) if detected_package_path
+        details(definition, included_groups, gemfile_path).map do |gem_detail, bundle_detail|
+          BundlerPackage.new(gem_detail, bundle_detail, logger: logger).tap do |package|
+            log_package_dependencies package
+          end
+        end
+      end
     end
 
-    def with_gemfile
-      previous_gemfile = ENV['BUNDLE_GEMFILE']
-      ENV['BUNDLE_GEMFILE'] = gemfile_path.to_s
-      yield
-    ensure
-      ENV['BUNDLE_GEMFILE'] = previous_gemfile
+    def definition_for(gemfile_path)
+      @definition || ::Bundler::Definition.build(gemfile_path, lockfile_path(gemfile_path), nil)
     end
 
-    def details
-      gem_details.map do |gem_detail|
+    def details(definition, included_groups, gemfile_path)
+      bundler_details = definition.dependencies
+
+      gem_details(definition, included_groups, gemfile_path).map do |gem_detail|
         bundle_detail = bundler_details.detect { |bundler_detail| bundler_detail.name == gem_detail.name }
         [gem_detail, bundle_detail]
       end
     end
 
-    def gem_details
-      return @gem_details if @gem_details
-
+    def gem_details(definition, included_groups, gemfile_path)
       # clear gem paths before running specs_for
       Gem.clear_paths
-      if bundler_config_path_found
+      if bundler_config_path_found(gemfile_path)
         ::Bundler.reset!
         ::Bundler.configure
       end
-      @gem_details = definition&.specs_for(included_groups) || []
+      definition.specs_for(included_groups)
     end
 
-    def bundler_details
-      @bundler_details ||= definition&.dependencies || []
-    end
-
-    def included_groups
-      definition_groups - ignored_groups.map(&:to_sym)
+    # The same gem (name and version) may be locked by several gemfiles,
+    # in which case it should be reported once, but under all its groups.
+    def merge_groups(packages)
+      packages.first.tap do |package|
+        package.groups.concat(packages.drop(1).flat_map(&:groups)).uniq!
+      end
     end
 
-    def definition_groups
-      definition&.groups || []
+    def with_gemfile(gemfile_path)
+      previous_gemfile = ENV['BUNDLE_GEMFILE']
+      ENV['BUNDLE_GEMFILE'] = gemfile_path.to_s
+      yield
+    ensure
+      ENV['BUNDLE_GEMFILE'] = previous_gemfile
     end
 
-    def lockfile_path
+    def lockfile_path(gemfile_path)
       Pathname("#{gemfile_path}.lock")
     end
 
     # Bundler keeps the config (e.g. BUNDLE_PATH for vendored gems) next to the gemfile
-    def bundler_config_path_found
+    def bundler_config_path_found(gemfile_path)
       config_file = gemfile_path.dirname.join('.bundle/config')
 
       return false unless File.exist?(config_file)
@@ -114,14 +126,41 @@ module LicensePatrol
       end
     end
 
-    def gemfile_path
-      @gemfile_path ||= project_path.join(gemfile)
+    # All the gemfiles to be scanned, from the `bundler_gemfiles` option
+    # (which accepts glob patterns, e.g. `gemfiles/*.gemfile` for Appraisal),
+    # or the one in BUNDLE_GEMFILE, or `Gemfile`, relative to the project path.
+    def gemfile_paths
+      @gemfile_paths ||= gemfiles.flat_map { |gemfile| expand_gemfile(gemfile) }.uniq
+    end
+
+    def existing_gemfile_paths
+      gemfile_paths.select(&:exist?)
+    end
+
+    def gemfiles
+      @gemfiles || [default_gemfile]
+    end
+
+    def relative_to_project(gemfile_path)
+      gemfile_path.expand_path.relative_path_from(project_path.expand_path).to_s
+    end
+
+    def expand_gemfile(gemfile)
+      return [project_path.join(gemfile)] unless glob?(gemfile)
+
+      Dir.glob(gemfile, base: project_path.to_s).sort
+         .reject { |path| path.end_with?('.lock') }
+         .map { |path| project_path.join(path) }
+    end
+
+    def glob?(gemfile)
+      gemfile.match?(/[*?\[{]/)
     end
 
     # BUNDLE_GEMFILE is taken as relative to the project path. Through `bundle exec`
     # it gets expanded to an absolute path, which may point to another project
     # (e.g. when using --project_path), in which case only its basename is kept.
-    def gemfile
+    def default_gemfile
       gemfile = ENV['BUNDLE_GEMFILE']
       return 'Gemfile' if gemfile.nil? || gemfile.empty?
       return gemfile unless Pathname(gemfile).absolute?

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: license_patrol
 version: !ruby/object:Gem::Version
-  version: 1.0.0
+  version: 1.1.0
 platform: ruby
 authors:
 - Ryan Collins