pronto-bundler_audit 0.5.0 → 0.5.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: dfd045795800e3a9d915819c4d0f3fb1bf8a33fe809621a181b90596b06c0337
-  data.tar.gz: 47fb28f8cae54edd5b17bb9f487a079d0a46664a081dd59e4b9d5e41be0c987c
+  metadata.gz: 63349abd213ac458a9949296e1ca83d99518cb74dda60eef2c043f49d4020352
+  data.tar.gz: 271978a3b61cd6f9b9cc53bc4610d8226959194539c3087344fe7f37ffb758f5
 SHA512:
-  metadata.gz: c07df77c524372667979fa43d5500d76ef92586833f37e23e13e1240001ca042634afa626d0c512528fc35224f5c0d1d7039e21834533619767d7799c1eab43e
-  data.tar.gz: cf3e5d64dc3583a35ff2a5b8a32c982a9ce9336fca06a169039e3207a33af4633f65bfebfc19dbccabff9ce705ae2166e330565b82a1ab44c619eebe31ce3dd2
+  metadata.gz: cc71c4b6d16ae1d9f3461c4ab03cdda9bbaae9c99b85354e50332f3481e54d2c190ba5880374a6bd6de58dfd7f67eab3ad5bfd1a92b9eee170d81e76c446ba01
+  data.tar.gz: 10bce0f64508e85154408a878449deccbd7176e8cb5b7ed668038b746b998f5e14ab13ed693527f9370fd12bec1a6db95460df8a81fff99f25d8466b580d870b

data/CHANGELOG.md

@@ -1,3 +1,9 @@
+### 0.5.1 - 2019-10-24
+- Fix Pronto -> GitHub reporting errors
+  - If Gemfile.lock is not in the PR then Pronto would fail when attempting to create a comment on the Gemfile.lock file withing the PR.
+    - Note: This issue isn't fully fixed yet, but at least doesn't fail flat out.
+      - To fully fix: would like to still add a PR-level comment with CVE issue(s) instead of requiring the user to dig into their CI output to see the CVE issue(s).
+
 ### 0.5.0 - 2019-07-31
 - Fix Pronto -> GitHub reporting errors
   - Thanks to Inestor for the [bug report](https://github.com/pdobb/pronto-bundler_audit/issues/2).

data/Gemfile.lock

@@ -1,15 +1,15 @@
 PATH
   remote: .
   specs:
-    pronto-bundler_audit (0.5.0)
+    pronto-bundler_audit (0.5.1)
       bundler-audit (~> 0)
       pronto (~> 0)
 
 GEM
   remote: https://rubygems.org/
   specs:
-    addressable (2.6.0)
-      public_suffix (>= 2.0.2, < 4.0)
+    addressable (2.7.0)
+      public_suffix (>= 2.0.2, < 5.0)
     ansi (1.5.0)
     ast (2.4.0)
     builder (3.2.3)
@@ -19,20 +19,20 @@ GEM
     byebug (11.0.1)
     coderay (1.1.2)
     docile (1.3.2)
-    faraday (0.15.4)
+    faraday (0.17.0)
       multipart-post (>= 1.2, < 3)
     gitlab (4.12.0)
       httparty (~> 0.14, >= 0.14.0)
       terminal-table (~> 1.5, >= 1.5.1)
-    httparty (0.17.0)
+    httparty (0.17.1)
       mime-types (~> 3.0)
       multi_xml (>= 0.5.2)
     jaro_winkler (1.5.3)
     json (2.2.0)
     method_source (0.9.2)
-    mime-types (3.2.2)
+    mime-types (3.3)
       mime-types-data (~> 3.2015)
-    mime-types-data (3.2019.0331)
+    mime-types-data (3.2019.1009)
     minitest (5.11.3)
     minitest-reporters (1.3.6)
       ansi
@@ -60,7 +60,7 @@ GEM
     pry-byebug (3.7.0)
       byebug (~> 11.0)
       pry (~> 0.10)
-    public_suffix (3.1.1)
+    public_suffix (4.0.1)
     rainbow (3.0.0)
     rake (12.3.3)
     rubocop (0.73.0)
@@ -71,7 +71,7 @@ GEM
       ruby-progressbar (~> 1.7)
       unicode-display_width (>= 1.4.0, < 1.7)
     ruby-progressbar (1.10.1)
-    rugged (0.28.2)
+    rugged (0.28.3.1)
     sawyer (0.8.2)
       addressable (>= 2.3.5)
       faraday (> 0.8, < 2.0)

data/lib/formatter/github_pull_request_review_formatter.rb

@@ -0,0 +1,34 @@
+module Pronto
+  module Formatter
+    # Pronto::Formatter::GithubPullRequestReviewFormatter comes from the
+    # Pronto gem itself.
+    #
+    # The methods below are a feature overrides to:
+    #   1. prevent the {#line_number} class from failing if none of the patches
+    #      contain the `message.line.new_lineno` value found. Which can happen
+    #      in the context of this pronto-bundler audit gem since we aren't
+    #      necessarily altering the Gemfile.lock file within a PR at the time of
+    #      finding an issue in the Gemfile.lock file.
+    #   2. FIXME: Prevent a POST error due to an unknown file path in the
+    #      traditional Pull Request Review comment style.
+    class GithubPullRequestReviewFormatter
+      def submit_comments(client, comments)
+        client.create_pull_request_review(comments)
+      rescue Octokit::UnprocessableEntity, HTTParty::Error => e
+        # If Gemfile.lock doesn't exist in the PR, then attempt a non-review
+        # style comment instead (which doesn't attempt to reference a file
+        # path and line number).
+        begin
+          comments.each { |comment| client.create_pull_comment(comment) }
+        rescue Octokit::UnprocessableEntity, HTTParty::Error => e
+          $stderr.puts "Failed to post: #{e.message}"
+        end
+      end
+
+      def line_number(message, patches)
+        line = patches.find_line(message.full_path, message.line.new_lineno)
+        line&.position || message.line.new_lineno
+      end
+    end
+  end
+end

data/lib/pronto/bundler_audit.rb

@@ -1,6 +1,10 @@
 # frozen_string_literal: true
 
 require "pronto"
+
+# Pronto gem overrides (use sparingly):
+require "formatter/github_pull_request_review_formatter"
+
 require "bundler/audit/database"
 require "bundler/audit/scanner"
 

data/lib/pronto/bundler_audit/results/pronto_messages_adapter.rb

@@ -40,7 +40,7 @@ module Pronto
             @path = path
           end
 
-          # Since we're not passing a commit SHA into ::Proton::Message.new,
+          # Since we're not passing a commit SHA into ::Pronto::Message.new,
           # Pronto will try calling #commit_sha on the (this) Line object.
           def commit_sha
             nil

data/lib/pronto/bundler_audit/version.rb

@@ -3,6 +3,6 @@
 module Pronto
   # Pronto::BundlerAuditVersion
   module BundlerAuditVersion
-    VERSION = "0.5.0"
+    VERSION = "0.5.1"
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: pronto-bundler_audit
 version: !ruby/object:Gem::Version
-  version: 0.5.0
+  version: 0.5.1
 platform: ruby
 authors:
 - Paul Dobbins
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2019-08-01 00:00:00.000000000 Z
+date: 2019-10-24 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler-audit
@@ -207,6 +207,7 @@ files:
 - images/github-check.png
 - images/github-comment-compact.png
 - images/github-comment-verbose.png
+- lib/formatter/github_pull_request_review_formatter.rb
 - lib/pronto/bundler_audit.rb
 - lib/pronto/bundler_audit/advisory_formatters/base_advisory_formatter.rb
 - lib/pronto/bundler_audit/advisory_formatters/compact.rb
@@ -239,7 +240,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.4
+rubygems_version: 3.0.6
 signing_key: 
 specification_version: 4
 summary: Pronto runner for bundler-audit, patch-level verification for bundler.