rails_preflight 0.1.2 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 18c100a721d1de1301b776d720f280062ca59598fdd5c54e07dde7719669e9d4
-  data.tar.gz: ad762983e63966629008b296c177b004ae2fea2782da1640046f4ae3d97a8f10
+  metadata.gz: 5116d66e0950679bf5a2c02c21220a866955d6e309c611899e23413572e3139c
+  data.tar.gz: 5c55311682aaff5b5865fb81d7e461cf7a42713c782a3f3165c406a4d5f692b2
 SHA512:
-  metadata.gz: 2ad46f48a8c223d95e8e130ad05a85d8f00ccb5601633f347c41e0e5fb09a4ebb6f1644faa19a9bb3be11d21bf8cc17fe4946c9dd5b37797d8e2c0e294cbb880
-  data.tar.gz: 9ff337a9512221c2720d637b6444f880a2dc4250ad08344383eec45ac7d4148e13a0723aed05d6cf133b796b22e1c1a235cdc76c6d6067b73ddc9d89d610101f
+  metadata.gz: ec6b19914d2de83e4fcb6b96689612ab6365302a4e58a44ad406ee958c6045b6f8a96eb1b42c07ff1395e70f431d17c03ce7489cbcafaaf0f926d1c86acdd987
+  data.tar.gz: f5bf7047615dc677b4a4a1d454d0450e9114797476bc04e098b186a428968e7a2efc47d9ba6b88cefb89b96eb5bdcdae6c0c597f8c11093cbf12f9f34885ee6e

data/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 0.2.0 (2026-10-30)
+
+- Each step links to its RailsDiff and reminds you to run `bin/rails app:update`; JSON steps carry the link as `railsdiff` (#29)
+- Dual boot: a tip to set it up when there's none, and a tip to add a CI job when CI doesn't run it (#30)
+- A warning when `.ruby-version`, the Dockerfile and CI config disagree on Ruby (#30)
+- Secrets committed in config YAML are flagged by file and key, never the value, outside the development and test sections (#31)
+- A production `secret_key_base` in `config/secrets.yml` is flagged, as a blocker when the target is Rails 7.2 or later, which stops reading that file; one read from `ENV["SECRET_KEY_BASE"]` isn't (#31)
+- The `STATS_DIRECTORIES` message shows its replacement as one code span (#33)
+
 ## 0.1.2 (2026-10-13)
 
 - Code inside Packwerk packs (`packs/<name>/app`, `lib`, `spec`, ...) is scanned like the app root, and rules scoped to `app/helpers` or `spec` apply inside packs too (#22, thanks @JuanVqz)

data/README.md

@@ -44,6 +44,8 @@ The audit analyzes your project for common Rails upgrade risk factors:
 - Docker runtime risks (EOL base image, locale, tzdata, OpenSSL mismatch)
 - Database schema risks (charset, integer IDs)
 - Missing or outdated `config.load_defaults`
+- Secrets committed in config YAML, by file and key, never the value; a production `secret_key_base` in `config/secrets.yml`, which Rails 7.2 stops reading
+- Dual boot (`Gemfile.next`, `next?` in the Gemfile, bootboot) and whether CI runs it, and a Ruby version that `.ruby-version`, the Dockerfile and CI config disagree on
 
 The output is a **single HTML report** designed to be:
 
@@ -103,7 +105,7 @@ The tool will analyze:
 - `db/schema.rb` (if present; an app on `db/structure.sql` gets a note that the schema checks were skipped)
 - `config/application.rb` and `config/**/*.yml`
 - `.rb`, `.erb`, `.haml`, `.slim` and `.rake` files under `app/`, `config/`, `db/`, `lib/`, `test/` and `spec/`, at the root and in each Packwerk pack (`packs/<name>/app/`, ...)
-- Scripts and CI config (`bin/`, `script/`, Procfiles, Makefiles, CI workflows) for removed rake tasks
+- Scripts and CI config (`bin/`, `script/`, Procfiles, Makefiles, CI workflows) for removed rake tasks, and CI config for dual boot and its Ruby version
 
 And generate:
 
@@ -165,7 +167,7 @@ It's a checklist per step, with `file:line` and the matched line under each find
 ```markdown
 ## Step 3: 6.1 to 7.0
 
-Needs Ruby 2.7.0–3.2: 2.7.2 works.
+Needs Ruby 2.7.0–3.2: 2.7.2 works. Run `bin/rails app:update` and compare with [RailsDiff](https://railsdiff.org/6.1.0/7.0.0).
 
 - [ ] **Blocker:** annotate 3.1.1 requires activerecord >= 3.2, < 7.0, so it doesn't install on Rails 7.0. Upgrade it to a release that allows 7.0, or replace it.
 - [ ] **Blocker:** `ActionMailer::DeliveryJob` and `ActionMailer::Parameterized::DeliveryJob` were removed in Rails 7.0. Mail is delivered by `ActionMailer::MailDeliveryJob`. ([source](https://guides.rubyonrails.org/7_0_release_notes.html#action-mailer-removals))
@@ -181,12 +183,13 @@ Needs Ruby 2.7.0–3.2: 2.7.2 works.
 rails-preflight --format json --stdout 7.2 /path/to/your/app | jq '.counts'
 ```
 
-The top level holds `schema`, `tool`, `app`, `current_rails`, `target_rails`, `ruby`, `offline`, `verdict` and `counts`, then the findings in `before` (before the first step), `steps` (each with `from`, `version`, its Ruby note and `findings`), `ahead` (keyed by the Rails version that removes them) and `cant_see`. There's no timestamp, so the same app gives the same output. Schema 1 may still change before 1.0; the number goes up when it does. A step from the same run, shortened ([full sample](docs/sample-report.json)):
+The top level holds `schema`, `tool`, `app`, `current_rails`, `target_rails`, `ruby`, `offline`, `verdict` and `counts`, then the findings in `before` (before the first step), `steps` (each with `from`, `version`, its Ruby note, `railsdiff` and `findings`), `ahead` (keyed by the Rails version that removes them) and `cant_see`. There's no timestamp, so the same app gives the same output. Schema 1 may still change before 1.0; the number goes up when it does. A step from the same run, shortened ([full sample](docs/sample-report.json)):
 
 ```json
 {
   "from": "6.1",
   "version": "7.0",
+  "railsdiff": "https://railsdiff.org/6.1.0/7.0.0",
   "findings": [
     {
       "section": "Gem Compatibility",
@@ -227,7 +230,7 @@ rails-preflight --offline --format json --fail-on blockers 7.2
 
 ## Roadmap
 
-For a detailed list of current features and future plans, please see [ROADMAP.md](ROADMAP.md).
+What's planned is in [ROADMAP.md](ROADMAP.md).
 
 ## Philosophy
 
@@ -248,6 +251,14 @@ bundle exec rake
 
 CI runs the suite on every Ruby from 2.7 to 4.0.
 
+## Support the project ❤️
+
+RailsPreFlight is independently developed and maintained. If it helps you assess an upgrade, identify risks, or save engineering time, consider [sponsoring its development](https://github.com/sponsors/aslam).
+
+Sponsorship helps support ongoing maintenance, compatibility updates, and improvements.
+
+Contributions, bug reports, and sharing the project are equally appreciated.
+
 ## License
 
 MIT

data/database/deprecations.yml

@@ -103,7 +103,8 @@ deprecations:
     recategorization: "Rails 7.1 -> 7.2"
     fix_effort: low
   - id: fixture_path_assignment
-    pattern: "\\bfixture_path\\s*="
+    # Ruby reads a bare `fixture_path = x` as a local variable; the removed setter always has a receiver
+    pattern: "\\.fixture_path\\s*=(?!=)"
     message: "'fixture_path' was removed in Rails 7.2. Assign 'fixture_paths' instead, which takes an array."
     removed_in: "7.2"
     severity: error
@@ -228,7 +229,7 @@ deprecations:
     fix_effort: medium
   - id: stats_directories
     pattern: "\\bSTATS_DIRECTORIES\\b"
-    message: "'STATS_DIRECTORIES' was removed in Rails 8.1. Register extra directories with Rails::CodeStatistics.register_directory('Services', 'app/services')."
+    message: "'STATS_DIRECTORIES' was removed in Rails 8.1. Register extra directories with 'Rails::CodeStatistics.register_directory(\"Services\", \"app/services\")'."
     removed_in: "8.1"
     severity: error
     confidence: "High"

data/lib/rails_preflight/config_analyzer.rb

@@ -1,10 +1,21 @@
 # lib/rails_preflight/config_analyzer.rb
+require_relative 'deprecation_analyzer'
+
 module RailsPreflight
   class ConfigAnalyzer
-    def initialize(root_path = Dir.pwd, current_rails = nil)
+    # `key: value` in YAML, key quoted or not, with the value up to a trailing comment.
+    YAML_PAIR = /^\s*-?\s*["']?([\w-]+)["']?\s*:\s*(.*?)\s*(?:\s#.*)?$/
+    # Values, unquoted, that hold nothing secret: ERB, aliases, anchors, flow collections, booleans, null, numbers.
+    NOT_LITERAL = /\A(?:<%|[*&{\[]|(?:true|false|yes|no|null|~|-?\d+(?:\.\d+)?)\z)/i
+    # Top-level sections whose values never reach production.
+    LOCAL_ENVS = %w[development test].freeze
+    SECRETS_REMOVED = "https://guides.rubyonrails.org/7_2_release_notes.html#railties-removals"
+
+    def initialize(root_path = Dir.pwd, current_rails = nil, target_rails: nil)
       @root_path = root_path
       # load_defaults takes a minor version ("7.1"), so compare at that level
       @current_rails = Gem::Version.new(current_rails.to_s.split(".").first(2).join(".")) if current_rails
+      @target_rails = Gem::Version.new(target_rails) if target_rails && Gem::Version.correct?(target_rails)
     end
 
     def run
@@ -17,6 +28,9 @@ module RailsPreflight
         result[:checks] << { message: "config/application.rb not found.", status: :warning, kind: :unknown }
       end
 
+      check_committed_secrets(result[:checks])
+      check_secrets_secret_key_base(result[:checks])
+
       if result[:checks].any?
         result[:status] = :warning
       else
@@ -42,5 +56,48 @@ module RailsPreflight
         checks << { message: message, status: :warning, fix_effort: :medium }
       end
     end
+
+    # Secret-named keys with a literal value, outside the development and test sections. Shows the key, never the value.
+    def check_committed_secrets(checks)
+      hits = yaml_pairs(Dir.glob(File.join(@root_path, "config", "**", "*.{yml,yml.erb}")).reject { |file| file.include?("/locales/") })
+             .select { |_, _, section, key, value| key.match?(DeprecationAnalyzer::SECRET_NAME) && literal?(value) && !LOCAL_ENVS.include?(section) }
+      return if hits.empty?
+
+      them = hits.one? ? "it" : "them"
+      checks << { message: "#{hits.one? ? 'A secret is' : "#{hits.size} secrets are"} committed in config YAML, where anyone with the repository can read #{them}. Rotate #{them}, and read #{them} from credentials or ENV instead.",
+                  status: :warning, fix_effort: :medium, files: hits.map { |file, line, _, key| { file: file, line: line, snippet: "#{key}: [hidden]" } } }
+    end
+
+    # Rails 7.2 stops reading config/secrets.yml, so a production secret_key_base set there is lost; one read from
+    # ENV["SECRET_KEY_BASE"] still works, since 7.2 reads that variable itself.
+    def check_secrets_secret_key_base(checks)
+      return if @current_rails && @current_rails >= Gem::Version.new("7.2")
+
+      hit = yaml_pairs([File.join(@root_path, "config", "secrets.yml")]).find do |_, _, section, key, value|
+        %w[production shared].include?(section) && key == "secret_key_base" && !value.empty? && !value.match?(/ENV(?:\[|\.fetch\(\s*)["']SECRET_KEY_BASE["']/)
+      end
+      return unless hit
+
+      checks << { message: "'config/secrets.yml' sets 'secret_key_base' for production, and Rails 7.2 no longer reads 'config/secrets.yml'. Move the same value to credentials or 'SECRET_KEY_BASE' first: a new one invalidates sessions and signed cookies.",
+                  status: @target_rails && @target_rails >= Gem::Version.new("7.2") ? :failed : :warning, removed_in: "7.2", fix_effort: :medium,
+                  source: SECRETS_REMOVED, files: [{ file: hit[0], line: hit[1], snippet: "secret_key_base: [hidden]" }] }
+    end
+
+    def literal?(value)
+      value = value.sub(/\A(["'])(.*)\1\z/, '\2')
+      !value.empty? && !value.match?(NOT_LITERAL)
+    end
+
+    # [file, line, top-level section, key, value] for each `key: value` line in the files that exist.
+    def yaml_pairs(files)
+      files.select { |file| File.file?(file) }.sort.flat_map do |file|
+        section = nil
+        File.foreach(file, encoding: "UTF-8").with_index(1).filter_map do |line, number|
+          section = $1 if line =~ /^([\w-]+):/
+          next unless (pair = line.match(YAML_PAIR))
+          [file.delete_prefix(File.join(@root_path, "")), number, section, pair[1], pair[2]]
+        end
+      end
+    end
   end
 end

data/lib/rails_preflight/deprecation_analyzer.rb

@@ -71,7 +71,7 @@ module RailsPreflight
       # Rubocop Advisory Check
       if check_rubocop_rails
         result[:checks] << { 
-          message: "rubocop-rails is installed. Run `bundle exec rubocop -a` to auto-fix more deprecations.",
+          message: "rubocop-rails is installed. Run 'bundle exec rubocop -a' to auto-fix more deprecations.",
           status: :passed 
         }
       else

data/lib/rails_preflight/dual_boot_analyzer.rb

@@ -0,0 +1,79 @@
+# lib/rails_preflight/dual_boot_analyzer.rb
+require_relative 'docker_analyzer'
+
+module RailsPreflight
+  # Before the first step: can the app boot both Rails versions, does CI test both, and do the places
+  # that name a Ruby agree on it.
+  class DualBootAnalyzer
+    CI_GLOBS = %w[.github/workflows/*.{yml,yaml} .circleci/config.yml .gitlab-ci.yml .travis.yml].freeze
+    NEXT_RAILS = "https://github.com/fastruby/next_rails"
+    # next_rails runs the next boot with BUNDLE_GEMFILE=Gemfile.next; bootboot with DEPENDENCIES_NEXT=1.
+    CI_RUNS_NEXT = /Gemfile\.next|BUNDLE_GEMFILE|DEPENDENCIES_NEXT/
+    # setup-ruby's `ruby-version: 3.3`, and image tags such as `ruby:3.3` or `cimg/ruby:3.3.5`. A matrix
+    # (`ruby-version: ${{ matrix.ruby }}`) isn't resolved, so it's never compared.
+    CI_RUBY = /(?:ruby-version:\s*["']?|\bruby:)(\d+\.\d+(?:\.\d+)?)/
+
+    def initialize(root_path = Dir.pwd)
+      @root_path = root_path
+    end
+
+    def run
+      result = { title: "Dual Boot", status: :passed, checks: [], confidence: :medium }
+      ci = Dir.glob(CI_GLOBS.map { |glob| File.join(@root_path, glob) }).sort.to_h { |file| [relative(file), File.read(file, encoding: "UTF-8")] }
+
+      if (setup = dual_boot)
+        if ci.any? && ci.values.none? { |content| content.match?(CI_RUNS_NEXT) }
+          result[:checks] << { message: "Dual boot is set up (#{setup}), but CI only runs the current Gemfile. Add a CI job with 'BUNDLE_GEMFILE=Gemfile.next', so each step is tested on the next Rails before it ships.",
+                               status: :passed, kind: :tip, fix_effort: :low, source: NEXT_RAILS }
+        else
+          result[:checks] << { message: "Dual boot is set up (#{setup}).", status: :passed }
+        end
+      else
+        result[:checks] << { message: "No dual boot found (no 'Gemfile.next' or 'next?' in the Gemfile). Set it up first, e.g. with next_rails, so the app and its tests run on the current and the next Rails while each step is in progress.",
+                             status: :passed, kind: :tip, fix_effort: :low, source: NEXT_RAILS }
+      end
+
+      check_ruby_versions(ci, result)
+      result
+    end
+
+    private
+
+    def dual_boot
+      gemfile = File.join(@root_path, "Gemfile")
+      if File.exist?(File.join(@root_path, "Gemfile.next")) then "'Gemfile.next'"
+      elsif File.exist?(File.join(@root_path, "Gemfile_next.lock")) then "'Gemfile_next.lock'"
+      elsif File.exist?(gemfile) && File.read(gemfile, encoding: "UTF-8").match?(/^\s*def\s+next\?/) then "'next?' in the Gemfile"
+      end
+    end
+
+    # .ruby-version and the Dockerfile name the Ruby the app runs on, so they must agree. CI only has to test
+    # that Ruby somewhere: a matrix or a side workflow (docs, linting) on another Ruby is fine.
+    def check_ruby_versions(ci, result)
+      ruby_version_file = File.join(@root_path, ".ruby-version")
+      app = [[".ruby-version", File.exist?(ruby_version_file) && File.read(ruby_version_file)[/\d+\.\d+(?:\.\d+)?/]],
+             ["Dockerfile", DockerAnalyzer.new(@root_path).detect_ruby_version]].select(&:last)
+      return if app.empty?
+
+      ci_rubies = ci.flat_map { |file, content| content.scan(CI_RUBY).flatten.uniq.map { |version| [file, version] } }
+      app_ruby = app.first.last
+      differ = app.map(&:last).any? { |version| !same?(version, app_ruby) } ||
+               (ci_rubies.any? && ci_rubies.none? { |_, version| same?(version, app_ruby) })
+      return unless differ
+
+      result[:status] = :warning
+      result[:checks] << { message: "The Ruby version differs between files: #{(app + ci_rubies).map { |source, version| "#{source} #{version}" }.join(', ')}. Make them match, so CI tests the Ruby that runs in production.",
+                           status: :warning, fix_effort: :low }
+    end
+
+    # 3.3 and 3.3.5 agree; 3.3 and 3.4 don't.
+    def same?(a, b)
+      a, b = [a, b].map { |version| version.split(".") }
+      a.first(b.size) == b.first(a.size)
+    end
+
+    def relative(file)
+      file.delete_prefix(File.join(@root_path, ""))
+    end
+  end
+end

data/lib/rails_preflight/json_report.rb

@@ -26,7 +26,7 @@ module RailsPreflight
         counts: %i[broken blockers to_fix unknowns].to_h { |key| [key, @summary.fetch(key, []).size] },
         before: @summary.fetch(:before, []).map { |entry| finding(entry) },
         steps: @summary.fetch(:steps, []).map do |step|
-          step.slice(:from, :version, :ruby, :ruby_upgrade).merge(findings: step[:checks].map { |entry| finding(entry) })
+          step.slice(:from, :version, :ruby, :ruby_upgrade, :railsdiff).merge(findings: step[:checks].map { |entry| finding(entry) })
         end,
         ahead: @summary.fetch(:ahead, {}).transform_values { |entries| entries.map { |entry| finding(entry) } },
         cant_see: @summary.fetch(:cant_see, []).map { |entry| finding(entry) }

data/lib/rails_preflight/markdown_report.rb

@@ -22,7 +22,8 @@ module RailsPreflight
       out << section("Before you start#{" (on Rails #{@data[:current_rails]})" if @data[:current_rails]}", before) if before.any?
       @summary.fetch(:steps, []).each.with_index(1) do |step, i|
         title = "Step #{i}: #{step[:from] ? "#{step[:from]} to #{step[:version]}" : "Rails #{step[:version]}"}"
-        out << section(title, step[:checks], "#{step[:ruby]}.")
+        note = ["#{step[:ruby]}.", ("Run `bin/rails app:update` and compare with [RailsDiff](#{step[:railsdiff]})." if step[:railsdiff])]
+        out << section(title, step[:checks], note.compact.join(" "))
       end
       @summary.fetch(:ahead, {}).each do |version, entries|
         out << section("Ahead: removed in #{version}, not needed for #{@data[:target_rails]}", entries)

data/lib/rails_preflight/report_generator.rb

@@ -251,6 +251,7 @@ module RailsPreflight
               <article class="step" id="<%= step_id(step[:version]) %>">
                 <div class="step-head"><h3><%= h(step[:from] ? "#{step[:from]} → #{step[:version]}" : "Rails #{step[:version]}") %></h3><span class="tag"><%= h(blocker_tag(step[:checks])) %></span></div>
                 <div class="rubynote"><span class="k">Ruby</span><span><%= h(step[:ruby]) %></span></div>
+                <% if step[:railsdiff] %><div class="rubynote"><span class="k">Config</span><span>Run <code>bin/rails app:update</code> and compare with <a href="<%= h(step[:railsdiff]) %>">RailsDiff</a></span></div><% end %>
                 <% if step[:checks].any? %>
                   <ul class="rows"><% step[:checks].each do |entry| %><%= row_html(entry) %><% end %></ul>
                 <% end %>

data/lib/rails_preflight/summary_calculator.rb

@@ -97,7 +97,7 @@ module RailsPreflight
       max_now = @current_max_ruby
       @hops.map do |hop|
         note, upgraded = ruby_note(hop, ruby, max_now)
-        step = { version: hop[:version], from: from, ruby: note, ruby_upgrade: upgraded,
+        step = { version: hop[:version], from: from, ruby: note, ruby_upgrade: upgraded, railsdiff: railsdiff(from, hop[:version]),
                  checks: in_order(in_steps.select { |entry| step_for(entry) == hop[:version] }) }
         ruby = upgraded || ruby
         from = hop[:version]
@@ -106,6 +106,11 @@ module RailsPreflight
       end
     end
 
+    # The generated-app diff between the two minors, which is what `bin/rails app:update` brings in.
+    def railsdiff(from, to)
+      from && "https://railsdiff.org/#{from.split('.').first(2).join('.')}.0/#{to}.0"
+    end
+
     # An API removed in one of the step versions is fixed as part of that step. A Ruby too old or too new for
     # the target is checked against the target, so it sits in the last step, next to its Ruby note.
     def step_for(entry)

data/lib/rails_preflight/upgrade_analyzer.rb

@@ -55,11 +55,12 @@ module RailsPreflight
       results << check_ruby_version
       results << scan_gems
       results << DockerAnalyzer.new(@project_path, checked_ruby: @eol_checked_ruby).run
+      results << DualBootAnalyzer.new(@project_path).run
       results << GemAnalyzer.new(@project_path, lockfile_specs, hops: upgrade_hops.map { |hop| hop[:version] }, direct: lockfile&.dependencies&.keys || [],
                                  last_releases: (@last_releases || {} unless @offline), target_released: target_rails_rules&.dig('released')).run
       results << DeprecationAnalyzer.new(@project_path, target_rails: @target_rails, current_rails: current_rails&.to_s,
                                          lockfile_path: @lockfile_path).run
-      results << ConfigAnalyzer.new(@project_path, current_rails).run
+      results << ConfigAnalyzer.new(@project_path, current_rails, target_rails: @target_rails).run
       results << DatabaseAnalyzer.new(@project_path, database_rules).run
 
       report_data = {

data/lib/rails_preflight/version.rb

@@ -1,3 +1,3 @@
 module RailsPreflight
-  VERSION = "0.1.2"
+  VERSION = "0.2.0"
 end

data/lib/rails_preflight.rb

@@ -1,6 +1,7 @@
 require "rails_preflight/version"
 require "rails_preflight/upgrade_analyzer"
 require "rails_preflight/docker_analyzer"
+require "rails_preflight/dual_boot_analyzer"
 require "rails_preflight/deprecation_analyzer"
 require "rails_preflight/gem_analyzer"
 require "rails_preflight/config_analyzer"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rails_preflight
 version: !ruby/object:Gem::Version
-  version: 0.1.2
+  version: 0.2.0
 platform: ruby
 authors:
 - Syed Aslam
@@ -35,6 +35,7 @@ files:
 - lib/rails_preflight/database_analyzer.rb
 - lib/rails_preflight/deprecation_analyzer.rb
 - lib/rails_preflight/docker_analyzer.rb
+- lib/rails_preflight/dual_boot_analyzer.rb
 - lib/rails_preflight/gem_analyzer.rb
 - lib/rails_preflight/json_report.rb
 - lib/rails_preflight/markdown_report.rb