rails-quality-assurance 1.3.3 → 1.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fb90801ffefa028ae7b9173e04f759fa64e59bf88db9d92131c263a8844ff144
-  data.tar.gz: 149747d49baeeaf03ddb88407d29cd90df3c9fb1032bea8168faa542d9862d04
+  metadata.gz: 1fcf911cee6d30d85ec3b99396996aeb1a1d3192ae1a1d85e07c0d5232a9b280
+  data.tar.gz: 1c8436b501b9cd4f7861befcd96900050a02295f481041507ba436049c749cb8
 SHA512:
-  metadata.gz: b2b7465cd190e164e9979b8a8e770c38ad1eb77fbf97a11dfeafb53d5311a301c1c8b2dfda141d2583e554883c5a6ae6919b58412b9d73b9e1dd028d53e62506
-  data.tar.gz: 116c20f50206b7552e99926897c41583036b163ce5b9768dea97a2f127e96adfaa2bee56eca389807fbed7efa1f6fb0a8f774e2fa63bf1e9e4ba0fe7bf8d3330
+  metadata.gz: dd463e5d322299dc1991d91bda054973a8ca22dc04e507d7dc9e8bf4678dd109efdc38b43e412f978bf21af51f85dfcd831e78a4476f5525131a461dcde79272
+  data.tar.gz: 578bffb5e87ef384c881d485746da5c1ae48e1c25e642cec0ef2956d68b7572a1091ed41e1ca23c94bc015e5efca3e8dadc5ff0b448140963e5689fe4c433779

data/CHANGELOG.md

@@ -5,6 +5,17 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.4.0] - 2026-09-15
+
+### Added
+
+- `qa:audit:gems` and `qa:audit:importmap` tasks. `qa:audit` runs the gem
+  audit, `qa:audit:importmap` audits pinned importmap packages when the app
+  has `config/importmap.rb` (skipped otherwise), and `qa:lint` runs both.
+- `RailsQualityAssurance.importmap_audit_command` resolves the importmap audit
+  command: the app `bin/importmap` binstub when present, otherwise a
+  dependency-light `importmap-rails` invocation that does not boot Rails.
+
 ## [1.2.0] - 2026-09-14
 
 ### Added

data/README.md

@@ -18,6 +18,10 @@ Opinionated quality assurance kit for Ruby on Rails applications.
 
 - **Brakeman**: Static analysis security vulnerability scanner.
 - **Bundler Audit**: Vulnerability scanner for gem dependencies.
+- **Importmap Audit**: Vulnerability scanner for pinned importmap packages. Runs
+  only when the app has `config/importmap.rb`, using the app `bin/importmap`
+  binstub when present and a dependency-light `importmap-rails` invocation
+  otherwise.
 
 ### 3. Testing & Coverage
 
@@ -127,9 +131,11 @@ bin/run bin/ci
 The gem also provides tasks if you prefer `rake`:
 
 ```bash
-bin/rails qa:lint          # Runs RuboCop, Reek, Flay, Brakeman, bundler-audit
-bin/rails qa:frontend      # Runs Biome and Stylelint
-bin/rails spec:parallel    # Runs RSpec in parallel with system specs isolated
+bin/rails qa:lint                # Runs RuboCop, Reek, Flay, Brakeman, bundler-audit, importmap-audit
+bin/rails qa:audit               # Runs bundler-audit
+bin/rails qa:audit:importmap     # Runs the importmap audit when config/importmap.rb exists
+bin/rails qa:frontend            # Runs Biome and Stylelint
+bin/rails spec:parallel          # Runs RSpec in parallel with system specs isolated
 ```
 
 ---

data/lib/generators/rails_quality_assurance/ci/templates/config_ci.rb.erb

@@ -11,6 +11,7 @@ CI.run do
   step 'Style: Flay', 'bin/rails qa:flay'
 
   step 'Security: Gem audit', 'bin/rails qa:audit'
+  step 'Security: Importmap audit', 'bin/rails qa:audit:importmap' if File.exist?('config/importmap.rb')
   step 'Security: Brakeman', 'bin/rails qa:brakeman'
 
   step 'Frontend: Biome', 'bin/rails qa:lint:biome' if File.exist?('biome.json')

data/lib/rails_quality_assurance/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module RailsQualityAssurance
-  VERSION = '1.3.3'
+  VERSION = '1.4.0'
 end

data/lib/rails_quality_assurance.rb

@@ -25,6 +25,14 @@ module RailsQualityAssurance
   def self.stylelint_config_path
     File.join(root, 'config/stylelint-default.json')
   end
+
+  def self.importmap_audit_command
+    return nil unless File.exist?('config/importmap.rb')
+    return 'bin/importmap audit' if File.exist?('bin/importmap')
+
+    'bundle exec ruby -e \'require "importmap-rails"; require "importmap/map"; ' \
+      'ARGV.replace(["audit"]); require "importmap/commands"\''
+  end
 end
 
 require 'rails_quality_assurance/railtie'

data/lib/tasks/quality_assurance.rake

@@ -13,8 +13,8 @@ rescue JSON::ParserError
 end
 
 namespace :qa do
-  desc 'Run all quality assurance checks (RuboCop, Reek, Flay, Brakeman, bundler-audit)'
-  task lint: %w[qa:rubocop qa:reek qa:flay qa:brakeman qa:audit]
+  desc 'Run all quality assurance checks (RuboCop, Reek, Flay, Brakeman, bundler-audit, importmap-audit)'
+  task lint: %w[qa:rubocop qa:reek qa:flay qa:brakeman qa:audit qa:audit:importmap]
 
   desc 'Run RuboCop'
   task :rubocop do
@@ -40,11 +40,22 @@ namespace :qa do
     sh 'bundle exec brakeman --quiet --no-pager --exit-on-warn --exit-on-error'
   end
 
-  desc 'Run Bundler Audit for vulnerable gems'
-  task :audit do
-    sh 'bundle exec bundle audit check --update'
+  namespace :audit do
+    desc 'Run Bundler Audit for vulnerable gems'
+    task :gems do
+      sh 'bundle exec bundle audit check --update'
+    end
+
+    desc 'Run Importmap Audit for vulnerable npm packages'
+    task :importmap do
+      command = RailsQualityAssurance.importmap_audit_command
+      sh command if command
+    end
   end
 
+  desc 'Run Bundler Audit for vulnerable gems'
+  task audit: 'qa:audit:gems'
+
   namespace :lint do
     desc 'Run BiomeJS on JS/TS/JSON'
     task :biome do

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rails-quality-assurance
 version: !ruby/object:Gem::Version
-  version: 1.3.3
+  version: 1.4.0
 platform: ruby
 authors:
 - Mauricio Zaffari