still_active 1.4.0 → 1.4.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: be6f4e86c6afb3564385acfaf5733cecc38845c300a8a2ef624d0b267cc93a94
-  data.tar.gz: ec381b31257189f8f171bb5bdc4f318dfd0edd03cba957dd58b3400935ab5898
+  metadata.gz: 32a0544a8668d86b73edc4296a246b875e3c5bfbc5016544ea2b1133e1332bb8
+  data.tar.gz: bdbbaa17281dac2425cbe96a386164ae608566b3a4dd594e7e8d3d262a10f206
 SHA512:
-  metadata.gz: dcb580e83cedb482f05fe6a2cfebc91190050339dfb4a0986075d4cc28c6f9788d96efa86a66a7a28c22d248e6b15305d78f2e7f7bcd09c82ad0e9fbbed5fd0f
-  data.tar.gz: df4d1a5980ddb05e8cdb5c781ee72941ba4477fa71c101db6b03e089d0ffd2c8571803590467d8796841214d2fda6f9c40865ea7c16c58fcb89d632efd825cdc
+  metadata.gz: a63140b613dc6eb0f7fe618a4845db833524993c00ab6773699dbbd150fead81ff5f74fad283444d6d84d5aa07ef79f8cba7ab055ae3e81d720bcbeaee52f800
+  data.tar.gz: 00f898a6edefc7405e4e5d9a35b37c803b185b1e4e7edcbb76c8faf7eb9e93ef3e18660b1719b9db5b6d9961a4300dc1c3b017cd366bb195f6ea3e33b0f584bc

data/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## [1.4.2] - 2026-05-22
+
+### Fixed
+
+- Replaced an opaque `NoMethodError` on `nil.specs` with `StillActive::MissingLockfileError` and a clear "run `bundle lock` first" message when a Gemfile exists but no `Gemfile.lock` is reachable. Caught during the still_active-action self-test wiring.
+
+## [1.4.1] - 2026-05-22
+
+### Fixed
+
+- `still_active --gems=X` (or any invocation that doesn't need a Gemfile) crashed with `Bundler::GemfileNotFound` when run from a directory without a Gemfile in the tree. `Config#initialize` eagerly called `Bundler.default_gemfile`. Now `gemfile_path` resolves lazily on first read and falls back to `./Gemfile` when none is reachable.
+
 ## [1.4.0] - 2026-05-22
 
 ### Added

data/README.md

@@ -5,6 +5,7 @@
 `bundle outdated` tells you version drift. `bundler-audit` catches known CVEs. Neither tells you whether anyone is still working on the thing. `still_active` checks maintenance activity, version freshness, security scores, vulnerabilities, libyear drift, and archived repos for every gem in your Gemfile.
 
 [![Gem Version](https://badge.fury.io/rb/still_active.svg)](https://badge.fury.io/rb/still_active)
+[![GitHub Action](https://img.shields.io/badge/Marketplace-still__active--action-2ea44f?logo=github)](https://github.com/marketplace/actions/still_active)
 ![Code Quality analysis](https://github.com/SeanLF/still_active/actions/workflows/codeql-analysis.yml/badge.svg)
 ![RSpec](https://github.com/SeanLF/still_active/actions/workflows/rspec.yml/badge.svg)
 ![Rubocop analysis](https://github.com/SeanLF/still_active/actions/workflows/rubocop-analysis.yml/badge.svg)
@@ -186,13 +187,15 @@ still_active --markdown
 
 Emit findings as SARIF 2.1.0 — they show up in the GitHub Security tab and as inline annotations on `Gemfile.lock` in pull requests.
 
+> **See it live:** this repo audits itself on every push. Browse the live findings in the [Code Scanning Security tab](https://github.com/SeanLF/still_active/security/code-scanning?query=tool%3Astill_active+is%3Aopen) — currently 2× `SA005` (low OpenSSF Scorecard).
+
 ```bash
 still_active --sarif                       # writes still_active.sarif.json
 still_active --sarif=path/to/out.sarif.json
 still_active --sarif=-                     # stdout
 ```
 
-Wire it up in a workflow with `github/codeql-action/upload-sarif`:
+**Easy mode** — use the [`still_active-action`](https://github.com/SeanLF/still_active-action) wrapper:
 
 ```yaml
 permissions:
@@ -205,14 +208,25 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - uses: ruby/setup-ruby@v1
+        with: { ruby-version: '3.4' }
+      - uses: SeanLF/still_active-action@v0
         with:
-          ruby-version: "3.4"
-          bundler-cache: true
+          github-token: ${{ github.token }}
+          sarif: still_active.sarif.json
+      - uses: github/codeql-action/upload-sarif@v3
+        if: always()
+        with: { sarif_file: still_active.sarif.json }
+```
+
+**Plain bundle exec** if you'd rather pin still_active in your Gemfile:
+
+```yaml
       - run: bundle exec still_active --sarif
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
       - uses: github/codeql-action/upload-sarif@v3
         if: always()
-        with:
-          sarif_file: still_active.sarif.json
+        with: { sarif_file: still_active.sarif.json }
 ```
 
 Rule reference (SA001–SA007) and how to suppress: see [`docs/rules.md`](docs/rules.md).

data/bin/still_active

@@ -3,7 +3,7 @@
 
 $LOAD_PATH.unshift(File.join(File.dirname(__FILE__), "../lib"))
 
-require "still_active/cli"
 require "still_active"
+require "still_active/cli"
 
 StillActive::CLI.new.run(ARGV)

data/lib/helpers/bundler_helper.rb

@@ -5,11 +5,16 @@ module StillActive
     extend self
 
     def gemfile_dependencies(gemfile_path: StillActive.config.gemfile_path)
-      ::Bundler::SharedHelpers.set_env("BUNDLE_GEMFILE", File.expand_path(gemfile_path))
+      absolute_gemfile = File.expand_path(gemfile_path)
+      ::Bundler::SharedHelpers.set_env("BUNDLE_GEMFILE", absolute_gemfile)
       gemfile_gems = ::Bundler.definition.dependencies.map(&:name)
-      Bundler
-        .definition
-        .locked_gems
+      locked_gems = ::Bundler.definition.locked_gems
+      if locked_gems.nil?
+        raise MissingLockfileError,
+          "no lockfile next to #{absolute_gemfile} — run `bundle lock` (or `bundle install`) first"
+      end
+
+      locked_gems
         .specs
         .select { |spec| gemfile_gems.include?(spec.name) }
         .uniq(&:name)

data/lib/still_active/cli.rb

@@ -18,7 +18,12 @@ module StillActive
     def run(args)
       options = Options.new.parse!(args)
       unless options[:provided_gems]
-        StillActive.config.gems = BundlerHelper.gemfile_dependencies
+        begin
+          StillActive.config.gems = BundlerHelper.gemfile_dependencies
+        rescue MissingLockfileError => e
+          $stderr.puts("error: #{e.message}")
+          exit(2)
+        end
       end
 
       result = if $stderr.tty?

data/lib/still_active/config.rb

@@ -6,13 +6,12 @@ require "open3"
 
 module StillActive
   class Config
-    attr_writer :github_oauth_token, :gitlab_token
+    attr_writer :github_oauth_token, :gitlab_token, :gemfile_path
     attr_accessor :baseline_path,
       :critical_warning_emoji,
       :fail_if_critical,
       :fail_if_warning,
       :futurist_emoji,
-      :gemfile_path,
       :gems,
       :fail_if_outdated,
       :fail_if_vulnerable,
@@ -31,7 +30,7 @@ module StillActive
       @fail_if_outdated = nil
       @fail_if_vulnerable = nil
       @fail_if_warning = false
-      @gemfile_path = Bundler.default_gemfile.to_s
+      @gemfile_path = nil
       @gems = []
       @ignored_gems = []
       @github_oauth_token = nil
@@ -66,6 +65,16 @@ module StillActive
       @gitlab_token ||= presence(ENV["GITLAB_TOKEN"]) || glab_cli_token
     end
 
+    # Lazy so that running with --gems=... (no Gemfile needed) doesn't crash
+    # when invoked from a directory without a Gemfile in the tree.
+    def gemfile_path
+      @gemfile_path ||= begin
+        Bundler.default_gemfile.to_s
+      rescue Bundler::GemfileNotFound
+        File.join(Dir.pwd, "Gemfile")
+      end
+    end
+
     private
 
     def gh_cli_token

data/lib/still_active/errors.rb

@@ -0,0 +1,6 @@
+# frozen_string_literal: true
+
+module StillActive
+  class Error < StandardError; end
+  class MissingLockfileError < Error; end
+end

data/lib/still_active/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module StillActive
-  VERSION = "1.4.0"
+  VERSION = "1.4.2"
 end

data/lib/still_active.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require_relative "still_active/version"
+require_relative "still_active/errors"
 require_relative "still_active/config"
 require_relative "still_active/cli"
 
@@ -9,8 +10,6 @@ require_relative "still_active/cli"
 require "faraday/retry"
 
 module StillActive
-  class Error < StandardError; end
-
   class << self
     def config
       @config ||= Config.new

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: still_active
 version: !ruby/object:Gem::Version
-  version: 1.4.0
+  version: 1.4.2
 platform: ruby
 authors:
 - Sean Floyd
@@ -216,6 +216,7 @@ files:
 - lib/still_active/core_ext.rb
 - lib/still_active/deps_dev_client.rb
 - lib/still_active/diff.rb
+- lib/still_active/errors.rb
 - lib/still_active/gitlab_client.rb
 - lib/still_active/options.rb
 - lib/still_active/repository.rb