rails_preflight 0.1.0 → 0.1.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 02fcbcfa3f7d98bbc550334fcf9bd65919fbb2eb5266088823b87c0fd7465ae3
-  data.tar.gz: 42c66fa2d33b67e47fed5a36a7127eba476c34b57705d0f3c2591dea9fa1f5eb
+  metadata.gz: 18c100a721d1de1301b776d720f280062ca59598fdd5c54e07dde7719669e9d4
+  data.tar.gz: ad762983e63966629008b296c177b004ae2fea2782da1640046f4ae3d97a8f10
 SHA512:
-  metadata.gz: ab95dfb109b6fee6cd50d1014792f85d4e941ba7871734766b834844bea2a2bfb15e526e426f7a19a97be7abd58339141bfea037365d9e0b34a3e6f5063b8226
-  data.tar.gz: 1606dfaa001672ed19d45469592f212979228c2efb6500b9e7f8b8017d9977817e1814b25045f79b3ada23a9d3d9fe32b09fbe71e74c3b606e5e69e761ea7731
+  metadata.gz: 2ad46f48a8c223d95e8e130ad05a85d8f00ccb5601633f347c41e0e5fb09a4ebb6f1644faa19a9bb3be11d21bf8cc17fe4946c9dd5b37797d8e2c0e294cbb880
+  data.tar.gz: 9ff337a9512221c2720d637b6444f880a2dc4250ad08344383eec45ac7d4148e13a0723aed05d6cf133b796b22e1c1a235cdc76c6d6067b73ddc9d89d610101f

data/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## 0.1.2 (2026-10-13)
+
+- Code inside Packwerk packs (`packs/<name>/app`, `lib`, `spec`, ...) is scanned like the app root, and rules scoped to `app/helpers` or `spec` apply inside packs too (#22, thanks @JuanVqz)
+- `BUNDLE_GEMFILE=Gemfile.next rails-preflight` reads that Gemfile and its lockfile, so a dual-boot app can audit its next boot; one outside the app, as `bundle exec` sets it, is ignored (#23, #24, thanks @JuanVqz)
+- A compiled binary under `bin/` no longer aborts the run, and scanned files are read as UTF-8 whatever the locale, so a file with non-ASCII characters no longer crashes the scan under `LANG=C` (#21, thanks @JuanVqz)
+
+## 0.1.1 (2026-10-09)
+
+- rubygems.org lookups also trust the certificates RubyGems ships for rubygems.org, so they work wherever `gem install` does, even when Ruby's OpenSSL can't find the system certificates
+- Failed lookups are reported once per distinct error, under their own "rubygems.org lookup" entry with the gem names listed once, instead of the same error repeated for every gem under a second "Private Gems" card
+- A certificate failure says what to do: behind a VPN or proxy that inspects HTTPS, point `SSL_CERT_FILE` at a bundle that includes its root certificate, or pass `--offline`
+- The terminal warns when lookups fail
+
 ## 0.1.0 (2026-10-09)
 
 First release. Point it at a Rails 5.0 – 8.1 app and a target version: it writes a report into the app as HTML, Markdown or JSON, plus a short terminal summary. Read-only and static.

data/README.md

@@ -97,12 +97,12 @@ It knows Rails 5.0 to 8.1 (`database/compatibility.yml`); the default target is
 
 The tool will analyze:
 
-- `Gemfile` and `Gemfile.lock`
+- `Gemfile` and `Gemfile.lock`, or the Gemfile `BUNDLE_GEMFILE` names and its lockfile (`BUNDLE_GEMFILE=Gemfile.next` for a dual-boot app)
 - `.ruby-version`
 - `Dockerfile` (if present)
 - `db/schema.rb` (if present; an app on `db/structure.sql` gets a note that the schema checks were skipped)
 - `config/application.rb` and `config/**/*.yml`
-- `.rb`, `.erb`, `.haml`, `.slim` and `.rake` files under `app/`, `config/`, `db/`, `lib/`, `test/` and `spec/`
+- `.rb`, `.erb`, `.haml`, `.slim` and `.rake` files under `app/`, `config/`, `db/`, `lib/`, `test/` and `spec/`, at the root and in each Packwerk pack (`packs/<name>/app/`, ...)
 - Scripts and CI config (`bin/`, `script/`, Procfiles, Makefiles, CI workflows) for removed rake tasks
 
 And generate:

data/bin/rails-preflight

@@ -16,6 +16,7 @@ if %w[-h --help].include?(ARGV[0])
   puts "--format markdown|json: write rails_preflight_report.md or .json into the app instead of the HTML report."
   puts "--stdout: print the report instead of writing it (progress goes to stderr), for pipes and coding agents."
   puts "--fail-on blockers: exit 1 when anything blocks the upgrade or is already broken. --fail-on broken: only when something is already broken."
+  puts "BUNDLE_GEMFILE=Gemfile.next: read that Gemfile and its lockfile instead, for a dual-boot app. Ignored when it's outside APP_PATH."
   exit
 end
 
@@ -38,7 +39,8 @@ abort "Target must be a Rails version such as 7.2 (got #{target.inspect})." if t
 project_path = ARGV[0] || Dir.pwd
 
 begin
-  summary = RailsPreflight::UpgradeAnalyzer.new(target, project_path, offline: offline, format: format, stdout: stdout).run
+  summary = RailsPreflight::UpgradeAnalyzer.new(target, project_path, offline: offline, format: format, stdout: stdout,
+                                                gemfile: ENV["BUNDLE_GEMFILE"]).run
 rescue RailsPreflight::Error => e
   abort e.message
 end

data/lib/rails_preflight/deprecation_analyzer.rb

@@ -4,6 +4,8 @@ module RailsPreflight
     DATA_PATH = File.expand_path('../../database/deprecations.yml', __dir__)
     SCAN_DIRS = %w[app config db lib test spec].freeze
     SCAN_EXTS = %w[.rb .erb .rake .haml .slim].freeze
+    # Packwerk packs (`packs/<name>/app`, `packs/<name>/spec`, ...) hold app code outside the root's SCAN_DIRS.
+    PACKS_DIR = 'packs'.freeze
     # Lines that never run, by file type: [line comment, silent comment]. A silent comment hides the lines indented
     # under it too (HAML `-#`, Slim `/`); an HTML comment (HAML `/`, Slim `/!` or `/[if IE]`) is text, but the lines
     # under it still render and run. In templates `#main` is an element id, not a comment.
@@ -22,8 +24,9 @@ module RailsPreflight
     # Snippets go into a report people print and share: on a line that names a secret, values are hidden.
     SECRET_NAME = /secret|token|passw(?:or)?d|api_?key|access_?key|private_?key|credential/i
 
-    def initialize(root_path = Dir.pwd, database_path = DATA_PATH, target_rails: nil, current_rails: nil)
+    def initialize(root_path = Dir.pwd, database_path = DATA_PATH, target_rails: nil, current_rails: nil, lockfile_path: nil)
       @root_path = root_path
+      @lockfile_path = lockfile_path || File.join(root_path, "Gemfile.lock")
       @rules = YAML.load_file(database_path)
       @target_rails = target_rails
       @current_rails = current_rails
@@ -87,7 +90,8 @@ module RailsPreflight
       found = []
       compiled = rules.map { |rule| [Regexp.new(rule['pattern']), rule] }
 
-      files = Dir.glob(File.join(@root_path, "{#{SCAN_DIRS.join(',')}}/**/*")).select { |file| SCAN_EXTS.include?(File.extname(file)) }.to_h { |file| [file, 'code'] }
+      code_globs = ["", "#{PACKS_DIR}/*/"].map { |prefix| File.join(@root_path, "#{prefix}{#{SCAN_DIRS.join(',')}}/**/*") }
+      files = Dir.glob(code_globs).select { |file| SCAN_EXTS.include?(File.extname(file)) }.to_h { |file| [file, 'code'] }
       FILE_GLOBS.each do |kind, globs|
         Dir.glob(globs.map { |glob| File.join(@root_path, glob) }).each { |file| files[file] ||= kind }
       end
@@ -96,15 +100,19 @@ module RailsPreflight
         next if File.directory?(file)
 
         relative_path = Pathname.new(file).relative_path_from(Pathname.new(@root_path)).to_s
-        test = relative_path.start_with?('test/', 'spec/')
+        # A pack is laid out like the app root, so rules see `packs/billing/app/models/x.rb` as `app/models/x.rb`.
+        app_path = relative_path.sub(%r{\A#{PACKS_DIR}/[^/]+/}, '')
+        test = app_path.start_with?('test/', 'spec/')
 
-        under = ->(paths) { paths.any? { |path| relative_path == path || relative_path.start_with?("#{path}/") } }
+        under = ->(paths) { paths.any? { |path| app_path == path || app_path.start_with?("#{path}/") } }
         # A rule with `paths:` only applies under those directories or to those files.
         applicable = compiled.select do |_regex, rule|
           rule.fetch('files', ['code']).include?(kind) && (rule['paths'].nil? || under.(rule['paths']))
         end
         next if applicable.empty?
-        content = File.read(file)
+        # UTF-8 whatever the locale (LANG=C reads US-ASCII); a compiled binary under bin/ (e.g. a Rust CLI) isn't text to scan.
+        content = File.read(file, encoding: "UTF-8")
+        next unless content.valid_encoding?
         # Only `x.errors` counts under `needs_receiver_in:` (a bare `errors` in a helper or view is a local), and in a
         # file that assigns `errors` or takes it as a parameter (`skip_bare_if_local:`), where the bare name is that local.
         # ponytail: file-wide, so a model with an `errors` local in one method loses bare hits in the others.
@@ -207,7 +215,7 @@ module RailsPreflight
     end
 
     def lockfile
-      @lockfile ||= File.exist?(File.join(@root_path, "Gemfile.lock")) ? File.read(File.join(@root_path, "Gemfile.lock")) : ""
+      @lockfile ||= File.exist?(@lockfile_path) ? File.read(@lockfile_path) : ""
     end
 
   end

data/lib/rails_preflight/report_generator.rb

@@ -280,7 +280,7 @@ module RailsPreflight
             <div class="limits">
               <% @summary.fetch(:cant_see, []).each do |entry| %>
                 <div class="limit">
-                  <h3><%= h(entry[:section]) %></h3>
+                  <h3><%= h(entry[:title] || entry[:section]) %></h3>
                   <p><%= code_html(entry[:message]) %></p>
                   <% names = Array(entry[:names]) %>
                   <% if names.any? %><p class="names"><%= h(names.join(" · ")) %></p><% end %>
@@ -477,7 +477,10 @@ module RailsPreflight
       h(text).gsub(/(?<![\w&;])&#39;(.+?)&#39;(?![\w&])/) { "<code>#{$1}</code>" }
     end
 
+    # A titled entry (the rubygems.org lookup) says what to do in its own message.
     def cant_see_next(entry)
+      return if entry[:title]
+
       case entry[:section]
       when "Private Gems" then "Check each gemspec's Rails dependency, and bump them in the same step."
       when "Gem Compatibility"

data/lib/rails_preflight/upgrade_analyzer.rb

@@ -16,14 +16,19 @@ module RailsPreflight
     # format: :html, :markdown or :json, written into the app as rails_preflight_report.<ext>.
     # stdout: print the report instead of writing it, with progress on stderr, for pipes and coding agents.
     # run returns the summary (nil when there's nothing to upgrade to), so the caller can set the exit code.
-    def initialize(target_rails = nil, project_path = Dir.pwd, offline: false, format: :html, stdout: false)
+    def initialize(target_rails = nil, project_path = Dir.pwd, offline: false, format: :html, stdout: false, gemfile: nil)
       @target_rails = target_rails
       @offline = offline
       @format = format
       @stdout = stdout
       @out = stdout ? $stderr : $stdout
       @project_path = project_path
-      @lockfile_path = File.join(project_path, "Gemfile.lock")
+      # gemfile: another Gemfile, as BUNDLE_GEMFILE names it (Gemfile.next for dual boot); its lockfile sits next to it.
+      # Only one inside the app counts: `bundle exec` sets BUNDLE_GEMFILE to the Gemfile of wherever it was run.
+      gemfile = File.expand_path(gemfile, project_path) if gemfile
+      inside = gemfile&.start_with?(File.join(File.expand_path(project_path), ""))
+      @gemfile_path = inside ? gemfile : File.expand_path("Gemfile", project_path)
+      @lockfile_path = "#{@gemfile_path}.lock"
       @rules = YAML.load_file(DATA_PATH)
     end
 
@@ -52,7 +57,8 @@ module RailsPreflight
       results << DockerAnalyzer.new(@project_path, checked_ruby: @eol_checked_ruby).run
       results << GemAnalyzer.new(@project_path, lockfile_specs, hops: upgrade_hops.map { |hop| hop[:version] }, direct: lockfile&.dependencies&.keys || [],
                                  last_releases: (@last_releases || {} unless @offline), target_released: target_rails_rules&.dig('released')).run
-      results << DeprecationAnalyzer.new(@project_path, target_rails: @target_rails, current_rails: current_rails&.to_s).run
+      results << DeprecationAnalyzer.new(@project_path, target_rails: @target_rails, current_rails: current_rails&.to_s,
+                                         lockfile_path: @lockfile_path).run
       results << ConfigAnalyzer.new(@project_path, current_rails).run
       results << DatabaseAnalyzer.new(@project_path, database_rules).run
 
@@ -100,12 +106,12 @@ module RailsPreflight
       if current_rails.nil?
         result[:status] = :warning
         result[:confidence] = :low
-        result[:checks] << { message: "Could not read current Rails version from Gemfile.lock.", status: :warning, kind: :unknown, fix_effort: :low }
+        result[:checks] << { message: "Could not read current Rails version from #{lockfile_name}.", status: :warning, kind: :unknown, fix_effort: :low }
       elsif Gem::Version.new(current_rails.segments.first(2).join(".")) >= Gem::Version.new(@target_rails)
         result[:status] = :warning
         result[:checks] << { message: "Already on Rails #{current_rails}: #{@target_rails} is not an upgrade.", status: :passed }
       else
-        result[:checks] << { message: "Rails #{current_rails} (Gemfile.lock) → #{@target_rails}", status: :passed, fix_effort: :low }
+        result[:checks] << { message: "Rails #{current_rails} (#{lockfile_name}) → #{@target_rails}", status: :passed, fix_effort: :low }
       end
 
       result
@@ -169,7 +175,7 @@ module RailsPreflight
       return [File.read(ruby_version_file), ".ruby-version"] if File.exist?(ruby_version_file)
 
       lock_ruby = File.exist?(@lockfile_path) && File.read(@lockfile_path)[/^RUBY VERSION\s+ruby (\S+)/, 1]
-      return [lock_ruby, "Gemfile.lock"] if lock_ruby
+      return [lock_ruby, lockfile_name] if lock_ruby
 
       docker_ruby = DockerAnalyzer.new(@project_path).detect_ruby_version
       [docker_ruby, "Dockerfile"] if docker_ruby
@@ -204,7 +210,7 @@ module RailsPreflight
         result[:status] = :warning
         result[:confidence] = :medium
         result[:checks] << {
-          message: "No Gemfile.lock found. Skipping gem compatibility checks.",
+          message: "No #{lockfile_name} found. Skipping gem compatibility checks.",
           status: :warning,
           kind: :unknown,
           fix_effort: :low
@@ -231,7 +237,7 @@ module RailsPreflight
       end
 
       if mixed_gems.any? && @offline
-        message = "#{mixed_gems.size} gems come from one Gemfile.lock section that lists rubygems.org and #{mixed_remotes.join(', ')}; can't tell which are private with --offline"
+        message = "#{mixed_gems.size} gems come from one #{lockfile_name} section that lists rubygems.org and #{mixed_remotes.join(', ')}; can't tell which are private with --offline"
         result[:checks] << { message: message, status: :warning, kind: :unknown, names: mixed_gems, fix_effort: :unknown }
         result[:status] = :warning
       end
@@ -244,11 +250,20 @@ module RailsPreflight
         private_gems.concat(mixed_gems.select { |name| found[name] == false })
         @last_releases = dated_gems.filter_map { |name| [name, found[name]['version_created_at']] if found[name].is_a?(Hash) && found[name]['version_created_at'] }.to_h
         if mixed_gems.any?
-          result[:checks] << { message: "Looked up #{mixed_gems.size} gems on rubygems.org, since Gemfile.lock lists them under both rubygems.org and #{mixed_remotes.join(', ')}. Pass --offline to skip.", status: :passed, fix_effort: :low }
+          result[:checks] << { message: "Looked up #{mixed_gems.size} gems on rubygems.org, since #{lockfile_name} lists them under both rubygems.org and #{mixed_remotes.join(', ')}. Pass --offline to skip.", status: :passed, fix_effort: :low }
         end
-        if inconclusive.any?
-          names = inconclusive.map { |name, error| "#{name} (#{error})" }
-          result[:checks] << { message: "Could not verify #{inconclusive.size} gems against rubygems.org", status: :warning, kind: :unknown, names: names, fix_effort: :unknown }
+        # One entry per distinct error: a missing certificate fails every lookup the same way.
+        inconclusive.group_by { |_, error| error }.each do |error, failed|
+          gems = failed.map(&:first).sort
+          @out.puts "Couldn't reach rubygems.org for #{gems.size} gems (#{error}). See \"Couldn't check\" in the report."
+          # A VPN or proxy that inspects HTTPS re-signs certificates with a root the OS trusts but Ruby's OpenSSL doesn't read.
+          advice = if error.include?("certificate verify failed")
+                     "Behind a VPN or proxy that inspects HTTPS, point SSL_CERT_FILE at a certificate bundle that includes its root certificate, or pass --offline."
+                   else
+                     "Run it again once rubygems.org is reachable, or pass --offline."
+                   end
+          result[:checks] << { message: "Couldn't reach rubygems.org for #{gems.size} #{gems.size == 1 ? 'gem' : 'gems'} (#{error}), so whether #{gems.size == 1 ? "it's private and when it was" : "they're private and when they were"} last released is unknown. #{advice}",
+                               title: "rubygems.org lookup", status: :warning, kind: :unknown, names: gems, fix_effort: :unknown }
           result[:status] = :warning
         end
       end
@@ -272,6 +287,7 @@ module RailsPreflight
       found = {}
       inconclusive = {}
       lock = Mutex.new
+      store = rubygems_cert_store
 
       Array.new([names.size, 8].min) do
         Thread.new do
@@ -279,14 +295,16 @@ module RailsPreflight
             begin
               url = URI("https://rubygems.org/api/v1/gems/#{name}.json")
               # Certificate errors are reported as inconclusive, never silently trusted.
-              response = Net::HTTP.start(url.host, url.port, use_ssl: true, open_timeout: 5, read_timeout: 5) do |http|
+              response = Net::HTTP.start(url.host, url.port, use_ssl: true, cert_store: store, open_timeout: 5, read_timeout: 5) do |http|
                 http.request(Net::HTTP::Get.new(url))
               end
               raise "HTTP #{response.code}" unless %w[200 404].include?(response.code) # e.g. 429 when rate limited
               info = response.code == "200" && (JSON.parse(response.body.to_s) rescue {})
               lock.synchronize { found[name] = info }
             rescue StandardError => e
-              lock.synchronize { inconclusive[name] = "#{e.class.name}: #{e.message}" }
+              # The peer address changes per connection; without it, the same failure reads the same for every gem.
+              # The peer address changes per connection; without it, the same failure reads the same for every gem.
+              lock.synchronize { inconclusive[name] = "#{e.class.name}: #{e.message.sub(/ peeraddr=\S+/, '')}" }
             end
           end
         end
@@ -295,6 +313,20 @@ module RailsPreflight
       [found, inconclusive]
     end
 
+    # The system's certificates plus the ones RubyGems ships for rubygems.org, which is why `gem install` works on a
+    # machine whose OpenSSL can't find the system store. Verification stays on.
+    def rubygems_cert_store
+      require 'rubygems/request'
+      OpenSSL::X509::Store.new.tap do |store|
+        store.set_default_paths
+        Gem::Request.get_cert_files.each do |file|
+          store.add_file(file)
+        rescue OpenSSL::X509::StoreError
+          # already in the system store
+        end
+      end
+    end
+
     # From the lockfile: :public, :private (git, path, or only non-rubygems.org remotes), or, when one GEM
     # section lists rubygems.org next to another remote (Bundler before 2.2), whatever the Gemfile says; :mixed if it doesn't.
     def gem_origin(spec)
@@ -333,7 +365,7 @@ module RailsPreflight
         global = []
         scoped = {}
         blocks = [] # source for a `source … do` block, nil for any other block
-        gemfile_lines(File.join(@project_path, "Gemfile")).each do |line|
+        gemfile_lines(@gemfile_path).each do |line|
           source = line[/^\s*source\b\s*\(?\s*(.+?)\s*\)?\s*(?:do\b.*)?$/, 1]&.delete_prefix("\"")&.delete_suffix("\"")&.delete("'")
           name = line[/^\s*gem\s*\(?\s*["']([^"']+)["']/, 1]
           if name
@@ -380,6 +412,10 @@ module RailsPreflight
       @lockfile = File.exist?(@lockfile_path) ? Bundler::LockfileParser.new(File.read(@lockfile_path)) : nil
     end
 
+    def lockfile_name
+      File.basename(@lockfile_path)
+    end
+
     def known_rails_versions
       @rules.fetch('rails_versions', {}).keys.sort_by { |v| Gem::Version.new(v) }
     end
@@ -391,7 +427,7 @@ module RailsPreflight
     # Next known minor after the current Rails (7.1.3 → 7.2), or nil when already on the newest.
     def next_rails
       unless current_rails
-        reason = File.exist?(@lockfile_path) ? "No Rails in #{@lockfile_path}" : "No Gemfile.lock in #{@project_path}"
+        reason = File.exist?(@lockfile_path) ? "No Rails in #{@lockfile_path}" : "No #{lockfile_name} in #{@project_path}"
         raise Error, "#{reason}, so the current Rails version is unknown. Pass a target, e.g. `rails-preflight #{latest_known_rails}`."
       end
       current_minor = Gem::Version.new(current_rails.segments.first(2).join("."))

data/lib/rails_preflight/version.rb

@@ -1,3 +1,3 @@
 module RailsPreflight
-  VERSION = "0.1.0"
+  VERSION = "0.1.2"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rails_preflight
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.1.2
 platform: ruby
 authors:
 - Syed Aslam