schema_reaper 1.0.16 → 2.0.1

data/lib/generators/schema_reaper/install/install_generator.rb

@@ -0,0 +1,194 @@
+# frozen_string_literal: true
+
+require "rails/generators"
+require "securerandom"
+
+module SchemaReaper
+  module Generators
+    # `rails generate schema_reaper:install` -- one-time setup for unattended
+    # production scanning: an initializer for where reports go, a scheduled
+    # job (whenever or sidekiq-cron, whichever the app already uses), and a
+    # token-protected manual-trigger route. See the plan this implements:
+    # production automation with zero ongoing DevOps dependency -- a normal
+    # `git commit` + deploy is the only step after this generator runs.
+    class InstallGenerator < Rails::Generators::Base
+      source_root File.expand_path("templates", __dir__)
+
+      def create_initializer
+        template "initializer.rb.tt", "config/initializers/schema_reaper.rb"
+      end
+
+      def create_manual_trigger
+        template "schema_reaper_controller.rb.tt", "app/controllers/schema_reaper_controller.rb"
+
+        # `route` (unlike `template`/`create_file`) has no conflict
+        # detection of its own -- it unconditionally injects, so re-running
+        # this generator would duplicate the line every time without this
+        # guard.
+        routes_path = File.join(destination_root, "config/routes.rb")
+        if File.exist?(routes_path) && File.read(routes_path).include?("schema_reaper#trigger")
+          say_status :skip, "config/routes.rb already routes to schema_reaper#trigger -- not duplicating it", :yellow
+        else
+          route "post '/internal/schema_scan', to: 'schema_reaper#trigger'"
+        end
+      end
+
+      def add_schedule
+        case detected_scheduler
+        when :whenever then add_whenever_schedule
+        when :sidekiq_cron then add_sidekiq_cron_schedule
+        else
+          say_status :skip, "no `whenever` or `sidekiq-cron` gem detected -- add a cron entry yourself " \
+                            "that runs `rake schema_reaper:alert` on whatever cadence you want", :yellow
+        end
+      end
+
+      def warn_if_dev_scoped
+        return unless gemfile_scopes_schema_reaper_to_dev?
+
+        say_status :warning,
+                   "schema_reaper is Gemfile-scoped to group: :development. Most production deploy " \
+                   "pipelines strip dev/test groups (`BUNDLE_WITHOUT=development:test`), so " \
+                   "the scheduled scan will not run in production until you remove that restriction.",
+                   :red
+      end
+
+      def warn_if_no_mailer_from
+        return if mailer_from_configured?
+
+        say_status :warning,
+                   "no ApplicationMailer default `from:` detected (nor config.action_mailer.default_options). " \
+                   "SchemaReaper::Mailer falls back to a " \
+                   "placeholder sender in that case, which most real SMTP relays reject or spam-flag -- " \
+                   "email reports would silently fail to arrive. If you plan to use the email channel " \
+                   "(config.emails in the initializer this generator just wrote), set " \
+                   "`default from: \"...\"` on ApplicationMailer first.",
+                   :red
+      end
+
+      def print_token_instructions
+        token = "#{app_identifier}-#{SecureRandom.hex(32)}"
+
+        say ""
+        say "Manual trigger token (shown once -- store it now):", :green
+        say "  #{token}"
+        say ""
+        say "This is genuinely sensitive (it authorizes a production action), so it does not go in a " \
+            "committed file. Store it in encrypted credentials instead:"
+        say ""
+        say "  rails credentials:edit"
+        say ""
+        say "and add:"
+        say ""
+        say "  schema_reaper:"
+        say "    trigger_token: #{token}"
+        say ""
+        say "Trigger a scan on demand with:"
+        say ""
+        say "  curl -X POST https://your-app.example.com/internal/schema_scan \\"
+        say "    -H \"Authorization: Bearer #{token}\""
+        say ""
+      end
+
+      private
+
+      def detected_scheduler
+        return :whenever if gem_locked?("whenever")
+        return :sidekiq_cron if gem_locked?("sidekiq-cron")
+
+        nil
+      end
+
+      def gem_locked?(name)
+        Bundler.locked_gems&.specs&.any? { |s| s.name == name } || false
+      rescue StandardError
+        false
+      end
+
+      def add_whenever_schedule
+        path = "config/schedule.rb"
+        marker = 'rake "schema_reaper:alert"'
+        entry = <<~RUBY
+
+          every 3.months do
+            #{marker}
+          end
+        RUBY
+
+        full_path = File.join(destination_root, path)
+        if File.exist?(full_path) && File.read(full_path).include?(marker)
+          say_status :skip, "#{path} already has a schema_reaper entry -- not duplicating it", :yellow
+        elsif File.exist?(full_path)
+          append_to_file path, entry
+        else
+          # No `require "whenever"` here -- real wheneverize-generated files
+          # don't have one; whenever's own CLI evaluates this file through
+          # its DSL, not as a plain script that needs to load itself.
+          create_file path, entry.sub("\n\n", "")
+        end
+      end
+
+      def add_sidekiq_cron_schedule
+        path = "config/schedule.yml"
+        marker = "schema_reaper_scan:"
+        entry = <<~YAML
+
+          #{marker}
+            cron: "0 4 1 */3 *" # 4am on the 1st, every 3 months
+            class: "SchemaReaper::ScanJob"
+            queue: default
+            active_job: true # explicit, not relying on class-ancestry auto-detection
+        YAML
+
+        full_path = File.join(destination_root, path)
+        if File.exist?(full_path) && File.read(full_path).include?(marker)
+          say_status :skip, "#{path} already has a schema_reaper_scan entry -- not duplicating it", :yellow
+        elsif File.exist?(full_path)
+          append_to_file path, entry
+        else
+          create_file path, entry.sub("\n\n", "")
+        end
+      end
+
+      # `gem "schema_reaper", group: :development` (or the equivalent
+      # `group :development do ... end` block form) in the app's own Gemfile
+      # -- see README's current install snippet. A dev-scoped gem is absent
+      # from `BUNDLE_WITHOUT=development:test` installs, which most
+      # production deploy pipelines run, so the scheduled scan silently
+      # never runs.
+      #
+      # Parsed with Bundler's own DSL rather than line-scanning for
+      # "group: :development" -- a regex over raw lines misses the block
+      # form entirely (the gem's own line never mentions :development; the
+      # `group :development do` line above it does), and that block form is
+      # the more common style in practice, not an edge case.
+      def gemfile_scopes_schema_reaper_to_dev?
+        gemfile = File.join(destination_root, "Gemfile")
+        return false unless File.exist?(gemfile)
+
+        dep = Bundler::Dsl.evaluate(gemfile, nil, {}).dependencies.find { |d| d.name == "schema_reaper" }
+        dep && !dep.groups.include?(:default)
+      rescue StandardError
+        false # a Gemfile we can't parse shouldn't block the rest of the generator
+      end
+
+      # Checked against the class SchemaReaper::Mailer will inherit from --
+      # ApplicationMailer when the app has one, ActionMailer::Base otherwise
+      # (where `config.action_mailer.default_options = { from: ... }` lands).
+      # At generate time the app is already booted, so this reads the same
+      # `default_params[:from]` chain Mailer itself will see.
+      def mailer_from_configured?
+        parent = defined?(::ApplicationMailer) ? ::ApplicationMailer : ::ActionMailer::Base
+        parent.default_params[:from].present?
+      rescue StandardError
+        true # can't determine -- don't nag over something we're unsure about
+      end
+
+      def app_identifier
+        Rails.application.class.module_parent_name.underscore
+      rescue StandardError
+        "app"
+      end
+    end
+  end
+end

data/lib/generators/schema_reaper/install/templates/initializer.rb.tt

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+# schema_reaper production automation.
+#
+# Neither of these is a secret -- leaking a teammate's email address or a
+# webhook URL isn't a meaningful security event -- so this file is meant to
+# be committed to git directly. The manual-trigger token is not: see the
+# instructions `rails generate schema_reaper:install` printed for that one
+# (it lives in Rails.application.credentials, not here).
+#
+# Uncomment and fill in at least one of these to start receiving reports.
+# Both fire on every scheduled run when both are set -- this isn't a
+# fallback, it's two audiences: a dev-facing chat channel and a formal inbox
+# record for people who don't watch chat.
+SchemaReaper::AlertConfig.configure do |config|
+  # config.emails = %w[dev1@example.com dev2@example.com]
+  # config.webhook_url = "https://hooks.slack.com/services/T000/B000/XXXX"
+end

data/lib/generators/schema_reaper/install/templates/schema_reaper_controller.rb.tt

@@ -0,0 +1,69 @@
+# frozen_string_literal: true
+
+# Manual, on-demand trigger for the production schema_reaper scan -- enqueues
+# the exact same job the schedule uses, so there is one code path to keep
+# correct. Protected by a bearer token stored in encrypted credentials
+# (config/credentials.yml.enc, key schema_reaper.trigger_token) rather than a
+# DevOps-provisioned ENV var -- every Rails app already has the
+# RAILS_MASTER_KEY needed to decrypt it, so this introduces zero new
+# production configuration.
+#
+# Trigger it with (the token is printed once by the install generator --
+# store it somewhere your team can find it, e.g. a password manager. It is
+# deliberately NOT embedded in the scheduled report itself: that report goes
+# to Slack/email, and a bearer token that authorizes a production action
+# doesn't belong in either):
+#
+#   curl -X POST https://your-app.example.com/internal/schema_scan \
+#     -H "Authorization: Bearer <token>"
+class SchemaReaperController < ActionController::Base
+  # This is a token-authenticated API endpoint, not a session-backed form --
+  # Rails' CSRF protection is meant for the latter. Deliberately does NOT
+  # inherit from ::ApplicationController, and explicitly skips the
+  # authenticity-token check (`raise: false` so this doesn't itself blow up
+  # on an app where default_protect_from_forgery is off and the callback was
+  # never registered). Without this, a plain curl POST is rejected with
+  # ActionController::InvalidAuthenticityToken before the token check below
+  # even runs -- Rails wires `protect_from_forgery with: :exception` onto
+  # ActionController::Base itself for every app using Rails' post-5.2
+  # defaults, so every subclass inherits it, this one included.
+  skip_before_action :verify_authenticity_token, raise: false
+
+  # A valid (or leaked) token could otherwise be POSTed repeatedly, each hit
+  # enqueueing a full schema introspection against production. This is not
+  # per-caller rate limiting -- it's a single shared cooldown so a burst of
+  # triggers (accidental double-click, a leaked token being hammered) can't
+  # stack up scans faster than they can plausibly be useful. Rails.cache is
+  # whatever the app already has configured; on the default NullStore (no
+  # caching configured at all) this is a no-op, same as before this guard
+  # existed -- configure a real cache store to get actual protection.
+  TRIGGER_COOLDOWN = 5.minutes
+
+  def trigger
+    return head(:unauthorized) unless token_valid?
+    return head(:too_many_requests) unless acquire_trigger_lock
+
+    SchemaReaper::ScanJob.perform_later
+    head :accepted
+  end
+
+  private
+
+  def acquire_trigger_lock
+    Rails.cache.write("schema_reaper:manual_trigger_lock", true, unless_exist: true, expires_in: TRIGGER_COOLDOWN)
+  end
+
+  def token_valid?
+    expected = Rails.application.credentials.dig(:schema_reaper, :trigger_token)
+    return false if expected.blank?
+
+    provided = request.headers["Authorization"].to_s.delete_prefix("Bearer ").strip
+    return false if provided.empty?
+
+    ActiveSupport::SecurityUtils.secure_compare(provided, expected)
+  rescue ActiveSupport::EncryptedFile::MissingKeyError, ActiveSupport::MessageEncryptor::InvalidMessage
+    # RAILS_MASTER_KEY absent or credentials undecryptable in this
+    # environment -- fail closed (unauthorized), don't 500.
+    false
+  end
+end

data/lib/schema_reaper/alert_config.rb

@@ -0,0 +1,55 @@
+# frozen_string_literal: true
+
+module SchemaReaper
+  # Where the production scan's report goes. Set once from a Rails
+  # initializer (config/initializers/schema_reaper.rb), typically written by
+  # `rails generate schema_reaper:install`:
+  #
+  #   SchemaReaper::AlertConfig.configure do |config|
+  #     config.emails = %w[dev1@example.com dev2@example.com]
+  #     config.webhook_url = "https://hooks.slack.com/services/T000/B000/XXXX"
+  #   end
+  #
+  # Neither field is a secret -- leaking a teammate's email address or a
+  # webhook URL isn't a meaningful security event -- so this is meant to be
+  # committed to git directly. The manual-trigger token is not: that one
+  # lives in Rails.application.credentials (see the install generator).
+  class AlertConfig
+    class << self
+      def configure
+        yield instance
+      end
+
+      def instance
+        @instance ||= new
+      end
+
+      # Test helper -- config set in one example must not leak into the next.
+      def reset!
+        @instance = new
+      end
+    end
+
+    attr_accessor :emails, :webhook_url
+
+    def initialize
+      @emails = []
+      @webhook_url = nil
+    end
+
+    def emails?
+      !emails.to_a.empty?
+    end
+
+    def webhook?
+      !webhook_url.to_s.strip.empty?
+    end
+
+    # Whether Notifier has anywhere to send a report. A generator-scaffolded
+    # but unfilled-in config (both fields left commented out) is a safe
+    # no-op, not an error.
+    def configured?
+      emails? || webhook?
+    end
+  end
+end

data/lib/schema_reaper/analyzers/dead_column.rb

@@ -4,12 +4,12 @@ module SchemaReaper
   module Analyzers
     # Flags columns present in the schema but never referenced in code. When a
     # runtime usage log is supplied, its signal is fused in: a column unseen in
-    # BOTH code and >= 14 observed days of runtime reaches high confidence.
+    # BOTH code and at least `min_age_days` (default 14) observed days of
+    # runtime reaches high confidence.
     class DeadColumn < Base
       Registry.register(self)
 
-      STATIC_ONLY_CAP  = 0.6
-      RUNTIME_MIN_DAYS = 14
+      STATIC_ONLY_CAP = 0.6
 
       def call
         schema.tables.reject { |t| config.ignore_tables.include?(t.name) }
@@ -48,7 +48,7 @@ module SchemaReaper
       end
 
       def confidence_for(col)
-        if runtime.present? && runtime.observed_days >= RUNTIME_MIN_DAYS
+        if runtime.present? && runtime.observed_days >= min_runtime_days
           col.null ? 0.9 : 0.8
         else
           base = col.null ? 0.5 : 0.4
@@ -56,6 +56,12 @@ module SchemaReaper
         end
       end
 
+      # How many days of runtime data it takes before "never read at runtime"
+      # is trusted. A config built without the key (nil) keeps the default.
+      def min_runtime_days
+        config.min_age_days || Config::DEFAULTS["min_age_days"]
+      end
+
       def evidence_for(table, col)
         ev = ["no `#{col.name}` reference found in scanned code"]
         ev << "column is nullable" if col.null

data/lib/schema_reaper/introspect/postgres.rb

@@ -1,7 +1,18 @@
 # frozen_string_literal: true
 
 module SchemaReaper
+  # Reads a live database's schema and statistics. PostgreSQL only for now.
   module Introspect
+    # `pg` is deliberately not a runtime dependency -- the host app already
+    # bundles its own (every Rails + PostgreSQL app does), and pinning a second
+    # version here would fight it. Without this rescue a missing gem surfaces
+    # as a baffling NameError instead.
+    def self.require_pg!
+      require "pg"
+    rescue LoadError
+      raise Error, "schema_reaper needs the `pg` gem to talk to PostgreSQL -- add `gem \"pg\"` to your Gemfile"
+    end
+
     # Reads live schema + planner statistics from PostgreSQL using the `pg` gem
     # directly, so the host app does not need to boot Rails.
     class Postgres
@@ -22,12 +33,10 @@ module SchemaReaper
       COLUMN_SEPARATOR = 31.chr
 
       def initialize(url)
-        require "pg" # load first so the PG::Error rescue below can resolve
+        Introspect.require_pg!
         raise Error, NO_URL if url.nil? || url.empty?
 
-        @conn = PG.connect(url)
-      rescue PG::Error => e
-        raise Error, "could not connect to the database: #{e.message.strip}"
+        @conn = connect(url)
       end
 
       def call
@@ -39,6 +48,15 @@ module SchemaReaper
 
       private
 
+      # Kept out of #initialize: a `rescue PG::Error` there is evaluated for
+      # *any* exception, including require_pg!'s, and would itself raise NameError
+      # when pg is the thing that failed to load.
+      def connect(url)
+        PG.connect(url)
+      rescue PG::Error => e
+        raise Error, "could not connect to the database: #{e.message.strip}"
+      end
+
       # Cluster-wide cumulative index scans. Lets the unused-index analyzer tell
       # "this index is never used" apart from "this database has no query
       # history", which look identical at the level of a single idx_scan = 0.

data/lib/schema_reaper/mailer.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+module SchemaReaper
+  # Inherits ApplicationMailer when the host app defines one (the normal
+  # case), so it picks up the app's own `default from:`, layout and delivery
+  # settings automatically -- "reuse the app's already-configured mailer,
+  # don't require a new SMTP setup" is the whole point of the email channel.
+  # Falls back to ActionMailer::Base directly for apps that don't.
+  class Mailer < (defined?(::ApplicationMailer) ? ::ApplicationMailer : ActionMailer::Base)
+    # Only applied when nothing upstream (ApplicationMailer or its own
+    # ancestors) already set one. Without this, `mail()` raises "SMTP From
+    # address may not be blank" -- and Notifier's rescue never sees it:
+    # deliver_later only enqueues, the actual render/from-validation happens
+    # later inside ActionMailer::MailDeliveryJob#perform, so an app that
+    # hits this path gets a bare, unbranded ActiveJob failure with no
+    # `[schema_reaper]` log line anywhere near it. This placeholder isn't a
+    # real deliverable address -- most SMTP relays will still reject or
+    # spam-flag mail from an unconfigured sender -- it only turns a hard
+    # crash into a normal delivery failure. The install generator warns at
+    # setup time when this fallback would apply, so the real fix (configure
+    # a `default from:`) doesn't have to be discovered from a stack trace.
+    default from: "schema_reaper@localhost" unless default_params[:from]
+
+    def report_email(to:, report:)
+      @report = report
+      mail(to: to, subject: "[schema_reaper] scan report") do |format|
+        format.text { render plain: @report }
+      end
+    end
+  end
+end

data/lib/schema_reaper/notifier.rb

@@ -0,0 +1,106 @@
+# frozen_string_literal: true
+
+require "net/http"
+require "json"
+require "stringio"
+require_relative "reporters/markdown"
+
+module SchemaReaper
+  # Delivers a completed scan's findings through whichever channels are
+  # configured in AlertConfig -- a Slack-compatible webhook POST and/or email
+  # via the host app's own ActionMailer setup. Both fire when both are
+  # configured; this isn't a fallback chain (schema reports aren't critical
+  # enough to need one), it's reaching two different audiences: a dev-facing
+  # chat channel and a more formal inbox record for people who don't watch
+  # chat.
+  #
+  # Delivery failures are logged, never raised -- a webhook endpoint being
+  # briefly down should not fail the scan job or retry-storm it.
+  class Notifier
+    # `mailer:` defaults to :auto rather than nil so an explicit
+    # `mailer: nil` (forcing "no mailer available", e.g. to test that path,
+    # or because a caller genuinely wants email delivery skipped) is
+    # respected rather than silently falling back to the auto-detected
+    # SchemaReaper::Mailer via `||`.
+    #
+    # `mail_delivery:` is :later (enqueue via ActiveJob, the normal case) or
+    # :now -- for a caller that is itself running inline in a short-lived
+    # process, where an in-process queue would be torn down before the mail
+    # job ever ran (see the schema_reaper:alert rake task).
+    def initialize(findings, config: AlertConfig.instance, http: Net::HTTP, mailer: :auto, mail_delivery: :later)
+      @findings = findings
+      @config = config
+      @http = http
+      @mailer = mailer == :auto ? default_mailer : mailer
+      @mail_delivery = mail_delivery
+    end
+
+    def deliver
+      return unless @config.configured?
+
+      deliver_webhook if @config.webhook?
+      deliver_email if @config.emails?
+    end
+
+    private
+
+    # Mailer is autoloaded (see lib/schema_reaper.rb), and it can only be
+    # defined when ActionMailer is present -- check that, not Mailer itself.
+    def default_mailer
+      defined?(::ActionMailer::Base) ? Mailer : nil
+    end
+
+    def report_text
+      @report_text ||= begin
+        io = StringIO.new
+        Reporters::Markdown.new(@findings, io: io).render
+        io.string
+      end
+    end
+
+    # Slack's incoming-webhook shape ({"text": ...}) is the most common
+    # receiver in practice; Discord's legacy webhook path also accepts a
+    # plain "content" body but that's a different key, and structured-alert
+    # services like PagerDuty need an entirely different schema (their
+    # Events API v2, not a text webhook) -- those need a different endpoint,
+    # not this one.
+    def deliver_webhook
+      uri = URI.parse(@config.webhook_url)
+      request = Net::HTTP::Post.new(uri)
+      request["Content-Type"] = "application/json"
+      request.body = JSON.generate(text: report_text)
+
+      client = @http.new(uri.host, uri.port)
+      client.use_ssl = uri.scheme == "https"
+      # A background job blocking indefinitely on a dead webhook host would
+      # back up the queue behind it -- bound the wait instead of relying on
+      # Net::HTTP's own (version-dependent) defaults.
+      client.open_timeout = 10
+      client.read_timeout = 10
+      client.request(request)
+    rescue StandardError => e
+      log_error("webhook delivery failed", e)
+    end
+
+    def deliver_email
+      unless @mailer
+        log_error("email delivery skipped", "SchemaReaper::Mailer is not loaded (ActionMailer not present?)")
+        return
+      end
+
+      message = @mailer.report_email(to: @config.emails, report: report_text)
+      @mail_delivery == :now ? message.deliver_now : message.deliver_later
+    rescue StandardError => e
+      log_error("email delivery failed", e)
+    end
+
+    def log_error(message, error)
+      detail = error.is_a?(Exception) ? "#{error.class}: #{error.message}" : error.to_s
+      if defined?(Rails) && Rails.respond_to?(:logger) && Rails.logger
+        Rails.logger.error("[schema_reaper] #{message}: #{detail}")
+      else
+        warn("[schema_reaper] #{message}: #{detail}")
+      end
+    end
+  end
+end

data/lib/schema_reaper/scan_job.rb

@@ -0,0 +1,39 @@
+# frozen_string_literal: true
+
+module SchemaReaper
+  # Runs a scan and delivers the report through whatever channels AlertConfig
+  # has configured. Enqueued two ways: on the schedule an app generates via
+  # `rails generate schema_reaper:install` (whenever/sidekiq-cron), and
+  # on-demand by the generated manual-trigger controller -- same job either
+  # way, so there is exactly one code path to keep correct.
+  class ScanJob < ActiveJob::Base
+    queue_as :default
+
+    # Rails' :async adapter (the default until Rails 8 unless an app sets up
+    # a real backend) runs jobs on a thread pool inside the enqueueing
+    # process. Fine in a web server; fatal in a one-shot `rake` process,
+    # which exits the moment the task returns and takes the queued job with
+    # it -- the scheduled scan would silently never run.
+    def self.in_process_queue?
+      queue_adapter.instance_of?(::ActiveJob::QueueAdapters::AsyncAdapter)
+    end
+
+    # What the scheduled cron entry (`rake schema_reaper:alert`) calls:
+    # enqueue normally, but on an in-process queue run inline instead --
+    # email included -- so the scan isn't lost when the process exits.
+    def self.run_scheduled
+      return perform_later unless in_process_queue?
+
+      puts "[schema_reaper] ActiveJob adapter is :async -- running the scan inline"
+      perform_now(deliver_mail_now: true)
+    end
+
+    # `deliver_mail_now:` is for running inline from a process about to exit
+    # (see the schema_reaper:alert rake task) -- a deliver_later there would
+    # be lost for the same reason as above.
+    def perform(deliver_mail_now: false)
+      findings = Runner.new.run
+      Notifier.new(findings, mail_delivery: deliver_mail_now ? :now : :later).deliver
+    end
+  end
+end

data/lib/schema_reaper/tasks/schema_reaper.rake

@@ -23,4 +23,9 @@ namespace :schema_reaper do
     history.record(findings)
     pp history.trend
   end
+
+  desc "Run the production scan+alert job (what the scheduled cron entry calls; runs inline on :async)"
+  task alert: :environment do
+    SchemaReaper::ScanJob.run_scheduled
+  end
 end

data/lib/schema_reaper/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module SchemaReaper
-  VERSION = "1.0.16"
+  VERSION = "2.0.1"
 end

data/lib/schema_reaper.rb

@@ -29,6 +29,9 @@ require_relative "schema_reaper/baseline"
 require_relative "schema_reaper/history"
 require_relative "schema_reaper/migration_generator"
 require_relative "schema_reaper/runner"
+require_relative "schema_reaper/alert_config"
+require_relative "schema_reaper/notifier"
+require_relative "schema_reaper/scan_job" if defined?(ActiveJob::Base)
 require_relative "schema_reaper/railtie" if defined?(Rails::Railtie)
 
 # Finds columns, indexes and tables that a Rails/ActiveRecord app no longer
@@ -36,6 +39,17 @@ require_relative "schema_reaper/railtie" if defined?(Rails::Railtie)
 module SchemaReaper
   class Error < StandardError; end
 
+  # Autoloaded, not required: Mailer picks its superclass (the host app's
+  # ApplicationMailer, when there is one) at the moment it is defined. At
+  # gem-require time -- Bundler.require, early in boot -- the app's own
+  # autoloader isn't set up yet, so ApplicationMailer can never be seen and
+  # Mailer would always fall back to ActionMailer::Base, silently losing the
+  # app's `default from:`. Deferring to first reference (when a report is
+  # actually sent, long after boot) fixes that, and still lets a worker
+  # process resolve "SchemaReaper::Mailer" by name when it deserializes the
+  # mail delivery job.
+  autoload :Mailer, File.expand_path("schema_reaper/mailer", __dir__)
+
   REPORTERS = {
     "table" => Reporters::Table,
     "json" => Reporters::Json,

data/schema_reaper.gemspec

@@ -37,7 +37,7 @@ Gem::Specification.new do |spec|
   spec.files = Dir.chdir(__dir__) do
     `git ls-files -z`.split("\x0").reject do |f|
       (File.expand_path(f) == __FILE__) ||
-        f.start_with?(*%w[bin/ test/ spec/ features/ .git .github Gemfile])
+        f.start_with?(*%w[bin/ test/ spec/ features/ docs/ .git .github Gemfile])
     end
   end
   spec.bindir = "exe"
@@ -47,6 +47,10 @@ Gem::Specification.new do |spec|
   spec.add_dependency "prism", ">= 0.19", "< 2.0"
   spec.add_dependency "thor", "~> 1.3"
 
+  spec.add_development_dependency "actionmailer", ">= 6.1", "< 9.0"
+  spec.add_development_dependency "activejob", ">= 6.1", "< 9.0"
   spec.add_development_dependency "activerecord", ">= 6.1", "< 9.0"
   spec.add_development_dependency "pg", "~> 1.5"
+  spec.add_development_dependency "railties", ">= 6.1", "< 9.0"
+  spec.add_development_dependency "simplecov", "~> 0.22"
 end