rails-quality-assurance 1.7.0 → 1.7.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f52f428147c9b6186b1d4735c142d16d07900a4eb7cf1097aff884e7d4b4e49e
-  data.tar.gz: 0d62a47056131d8265e883a7a04d94fdaa24fc4f0cd79b46c591831edd2504dc
+  metadata.gz: 782a8a0b2a96c1f8f6ca996bb3cc430fd61b7e608ae66048381c7f21061911a2
+  data.tar.gz: 9534e6865a81f390402c3a66733de5f1519886e2a37d21a4ee91928c370b46d2
 SHA512:
-  metadata.gz: dea1ee0b6979d55237692d7a12bd93d65045fe4c975e4fba754e7cdd134c1d21647e41ce6618c5f76311798507133c5ed71b7b4db97b5300df73662f7d7aedad
-  data.tar.gz: 6dccf18a6b969790e5939859616e5aedc1b69be0012b26b103bf98a5c15a1e24333e84a6c0f871575d5968948f0f9a0e54f13e39a57418fb19ce6ec08f43b584
+  metadata.gz: 5b55b2d169882320d118318d5e119967763e4e0d9c2fa64712e75a8fa414b12570445b313e413206467bb2e1da4c53bf6b36a356ff084a064528a72befea382e
+  data.tar.gz: 32a0e9207e7cfd4422080498269269984184733250a04a82a2c69df75f859155efbe532b52f068e743986e989871b10f5607acdd42a06049c5e58a65d8912f38

data/CHANGELOG.md

@@ -5,6 +5,26 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.7.2] - 2026-10-03
+
+### Changed
+
+- `qa:audit:npm` audits production dependencies only: `npm audit --omit=dev`,
+  `yarn audit --groups dependencies`, and `pnpm audit --prod`. Dev-only tooling
+  such as markdownlint and stylelint pulls transitive advisories that never
+  ship, and some have no available fix (`braces`), so the gate failed CI and
+  blocked deploys on vulnerabilities no user could reach. Apps that need dev
+  dependencies audited can run the audit command directly.
+
+## [1.7.1] - 2026-10-01
+
+### Fixed
+
+- The generated pre-commit hook resolves Reek per project shape: `bin/rails
+  qa:reek` for apps, `bundle exec rake -f spec/dummy/Rakefile qa:reek` for gems
+  and engines with a dummy app, and `bundle exec reek` for a plain gem with a
+  `.reek.yml`. Projects without any of these skip Reek instead of failing.
+
 ## [1.7.0] - 2026-10-01
 
 ### Added

data/README.md

@@ -24,7 +24,10 @@ Opinionated quality assurance kit for Ruby on Rails applications.
   otherwise.
 - **JavaScript Audit**: Vulnerability scanner for npm packages. Resolves the
   command from the lockfile (`package-lock.json`, `yarn.lock`, or
-  `pnpm-lock.yaml`) and fails on **high and critical** advisories.
+  `pnpm-lock.yaml`) and fails on **high and critical** advisories in
+  **production dependencies only**. Dev-only tooling (linters, test runners)
+  never ships, and its transitive advisories, some with no available fix, would
+  otherwise block CI and deploys.
 
 ### 3. Testing & Coverage
 
@@ -227,6 +230,10 @@ generator aborts instead of installing a hook that would never run.
 Each check runs only when relevant files are staged (Ruby files for RuboCop and
 Reek, spec files for RSpec). Bypass a commit with `git commit --no-verify`.
 
+Reek is resolved per project shape: `bin/rails qa:reek` in an app,
+`bundle exec rake -f spec/dummy/Rakefile qa:reek` in a gem or engine with a
+dummy app, and `bundle exec reek` in a plain gem with a `.reek.yml`.
+
 ### 6. Rake Tasks (Optional)
 
 The gem also provides tasks if you prefer `rake`:
@@ -235,7 +242,7 @@ The gem also provides tasks if you prefer `rake`:
 bin/rails qa:lint                # Runs RuboCop, Reek, Flay, Brakeman, bundler-audit, importmap-audit, npm-audit
 bin/rails qa:audit               # Runs bundler-audit
 bin/rails qa:audit:importmap     # Runs the importmap audit when config/importmap.rb exists
-bin/rails qa:audit:npm           # Runs npm/yarn/pnpm audit for the lockfile in use, failing on high and critical
+bin/rails qa:audit:npm           # Runs npm/yarn/pnpm audit on production dependencies, failing on high and critical
 bin/rails qa:frontend            # Runs Biome and Stylelint
 bin/rails spec:parallel          # Runs RSpec in parallel with system specs isolated
 ```

data/lib/generators/rails_quality_assurance/pre_commit/pre_commit_generator.rb

@@ -14,6 +14,7 @@ module RailsQualityAssurance
       def install_hook
         guard_hooks_path
 
+        @reek_command = reek_command
         template 'pre_commit.erb', '.githooks/pre-commit'
         chmod '.githooks/pre-commit', 0o755
         install_launcher
@@ -21,6 +22,22 @@ module RailsQualityAssurance
 
       private
 
+      # Reek runs through the gem's Rake task. Apps expose it via `bin/rails`;
+      # gems and engines expose it through their dummy app's Rakefile. A plain
+      # gem with its own `.reek.yml` falls back to bare Reek; otherwise the
+      # check is skipped rather than failing on a missing task.
+      def reek_command
+        return 'bin/rails qa:reek' if exist?('bin/rails')
+        return 'bundle exec rake -f spec/dummy/Rakefile qa:reek' if exist?('spec/dummy/Rakefile')
+        return 'bundle exec reek' if exist?('.reek.yml')
+
+        nil
+      end
+
+      def exist?(path)
+        File.exist?(File.join(destination_root, path))
+      end
+
       # Git ignores `.git/hooks` entirely when `core.hooksPath` is set, so the
       # launcher would never run. Fail loudly instead of installing a no-op.
       def guard_hooks_path

data/lib/generators/rails_quality_assurance/pre_commit/templates/pre_commit.erb

@@ -23,11 +23,13 @@ if [ -n "$(staged '*.rb' '*.rake' '*.gemspec' 'Gemfile' 'Rakefile' 'config.ru' '
   if ! bundle exec rubocop; then
     fail 'RuboCop offenses detected' 'Fix the offenses before committing, or run: bundle exec rubocop -A'
   fi
+<%- if @reek_command -%>
 
   echo 'Checking Reek...'
-  if ! bin/rails qa:reek; then
+  if ! <%= @reek_command %>; then
     fail 'Reek code smells detected' 'Fix the code smells before committing.'
   fi
+<%- end -%>
 fi
 
 if [ -n "$(staged 'spec/**/*_spec.rb' 'spec/**/*.rb')" ]; then

data/lib/rails_quality_assurance/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module RailsQualityAssurance
-  VERSION = '1.7.0'
+  VERSION = '1.7.2'
 end

data/lib/rails_quality_assurance.rb

@@ -37,16 +37,19 @@ module RailsQualityAssurance
   end
 
   # Resolves the JavaScript security audit command from the lockfile in use,
-  # gating on high and critical advisories. Returns nil when none is present.
+  # gating on high and critical advisories. Audits production dependencies only:
+  # dev tooling carries advisories that never ship, and blocking a deploy on
+  # them is noise. Returns nil when the app has no lockfile.
   def self.npm_audit_command
     if File.exist?('package-lock.json')
-      'npm audit --audit-level=high'
+      'npm audit --audit-level=high --omit=dev'
     elsif File.exist?('yarn.lock')
       # Yarn 1 ignores --level for its exit code and returns a severity bitmask
       # (info 1, low 2, moderate 4, high 8, critical 16), so mask high|critical.
-      'yarn audit; status=$?; [ $((status & 24)) -eq 0 ]'
+      # --groups dependencies limits the audit to production dependencies.
+      'yarn audit --groups dependencies; status=$?; [ $((status & 24)) -eq 0 ]'
     elsif File.exist?('pnpm-lock.yaml')
-      'pnpm audit --audit-level high'
+      'pnpm audit --audit-level high --prod'
     end
   end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rails-quality-assurance
 version: !ruby/object:Gem::Version
-  version: 1.7.0
+  version: 1.7.2
 platform: ruby
 authors:
 - Mauricio Zaffari