still_active 1.4.1 → 1.4.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cb7cc442ab86e0411ca2de3926014c92e952cd5d7fdd4fb1bd555b6432346b8b
-  data.tar.gz: 91c4e617d7fd8d53127a49d896c107c9b716dfa5608dd9b0d7b3c7d607f67eba
+  metadata.gz: 32a0544a8668d86b73edc4296a246b875e3c5bfbc5016544ea2b1133e1332bb8
+  data.tar.gz: bdbbaa17281dac2425cbe96a386164ae608566b3a4dd594e7e8d3d262a10f206
 SHA512:
-  metadata.gz: a30d5038b09709f8f85b2c341f5f21d12a7637315a85bcd138a1a2f7944927c7f6adcb9388f68bf0dc7b2bd4aec250dc14eb54dc394218d00560434f88627144
-  data.tar.gz: 0ce06926d425612d825b17cbd3f84c4e3f0ff6a4ab700f0114df712b00bb6f61acbe90de30c6c1a971348ff8a063621a38a7d5e851586de1972bced2f8a4803f
+  metadata.gz: a63140b613dc6eb0f7fe618a4845db833524993c00ab6773699dbbd150fead81ff5f74fad283444d6d84d5aa07ef79f8cba7ab055ae3e81d720bcbeaee52f800
+  data.tar.gz: 00f898a6edefc7405e4e5d9a35b37c803b185b1e4e7edcbb76c8faf7eb9e93ef3e18660b1719b9db5b6d9961a4300dc1c3b017cd366bb195f6ea3e33b0f584bc

data/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## [1.4.2] - 2026-05-22
+
+### Fixed
+
+- Replaced an opaque `NoMethodError` on `nil.specs` with `StillActive::MissingLockfileError` and a clear "run `bundle lock` first" message when a Gemfile exists but no `Gemfile.lock` is reachable. Caught during the still_active-action self-test wiring.
+
 ## [1.4.1] - 2026-05-22
 
 ### Fixed

data/README.md

@@ -5,6 +5,7 @@
 `bundle outdated` tells you version drift. `bundler-audit` catches known CVEs. Neither tells you whether anyone is still working on the thing. `still_active` checks maintenance activity, version freshness, security scores, vulnerabilities, libyear drift, and archived repos for every gem in your Gemfile.
 
 [![Gem Version](https://badge.fury.io/rb/still_active.svg)](https://badge.fury.io/rb/still_active)
+[![GitHub Action](https://img.shields.io/badge/Marketplace-still__active--action-2ea44f?logo=github)](https://github.com/marketplace/actions/still_active)
 ![Code Quality analysis](https://github.com/SeanLF/still_active/actions/workflows/codeql-analysis.yml/badge.svg)
 ![RSpec](https://github.com/SeanLF/still_active/actions/workflows/rspec.yml/badge.svg)
 ![Rubocop analysis](https://github.com/SeanLF/still_active/actions/workflows/rubocop-analysis.yml/badge.svg)
@@ -186,13 +187,15 @@ still_active --markdown
 
 Emit findings as SARIF 2.1.0 — they show up in the GitHub Security tab and as inline annotations on `Gemfile.lock` in pull requests.
 
+> **See it live:** this repo audits itself on every push. Browse the live findings in the [Code Scanning Security tab](https://github.com/SeanLF/still_active/security/code-scanning?query=tool%3Astill_active+is%3Aopen) — currently 2× `SA005` (low OpenSSF Scorecard).
+
 ```bash
 still_active --sarif                       # writes still_active.sarif.json
 still_active --sarif=path/to/out.sarif.json
 still_active --sarif=-                     # stdout
 ```
 
-Wire it up in a workflow with `github/codeql-action/upload-sarif`:
+**Easy mode** — use the [`still_active-action`](https://github.com/SeanLF/still_active-action) wrapper:
 
 ```yaml
 permissions:
@@ -205,14 +208,25 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - uses: ruby/setup-ruby@v1
+        with: { ruby-version: '3.4' }
+      - uses: SeanLF/still_active-action@v0
         with:
-          ruby-version: "3.4"
-          bundler-cache: true
+          github-token: ${{ github.token }}
+          sarif: still_active.sarif.json
+      - uses: github/codeql-action/upload-sarif@v3
+        if: always()
+        with: { sarif_file: still_active.sarif.json }
+```
+
+**Plain bundle exec** if you'd rather pin still_active in your Gemfile:
+
+```yaml
       - run: bundle exec still_active --sarif
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
       - uses: github/codeql-action/upload-sarif@v3
         if: always()
-        with:
-          sarif_file: still_active.sarif.json
+        with: { sarif_file: still_active.sarif.json }
 ```
 
 Rule reference (SA001–SA007) and how to suppress: see [`docs/rules.md`](docs/rules.md).

data/bin/still_active

@@ -3,7 +3,7 @@
 
 $LOAD_PATH.unshift(File.join(File.dirname(__FILE__), "../lib"))
 
-require "still_active/cli"
 require "still_active"
+require "still_active/cli"
 
 StillActive::CLI.new.run(ARGV)

data/lib/helpers/bundler_helper.rb

@@ -5,11 +5,16 @@ module StillActive
     extend self
 
     def gemfile_dependencies(gemfile_path: StillActive.config.gemfile_path)
-      ::Bundler::SharedHelpers.set_env("BUNDLE_GEMFILE", File.expand_path(gemfile_path))
+      absolute_gemfile = File.expand_path(gemfile_path)
+      ::Bundler::SharedHelpers.set_env("BUNDLE_GEMFILE", absolute_gemfile)
       gemfile_gems = ::Bundler.definition.dependencies.map(&:name)
-      Bundler
-        .definition
-        .locked_gems
+      locked_gems = ::Bundler.definition.locked_gems
+      if locked_gems.nil?
+        raise MissingLockfileError,
+          "no lockfile next to #{absolute_gemfile} — run `bundle lock` (or `bundle install`) first"
+      end
+
+      locked_gems
         .specs
         .select { |spec| gemfile_gems.include?(spec.name) }
         .uniq(&:name)

data/lib/still_active/cli.rb

@@ -18,7 +18,12 @@ module StillActive
     def run(args)
       options = Options.new.parse!(args)
       unless options[:provided_gems]
-        StillActive.config.gems = BundlerHelper.gemfile_dependencies
+        begin
+          StillActive.config.gems = BundlerHelper.gemfile_dependencies
+        rescue MissingLockfileError => e
+          $stderr.puts("error: #{e.message}")
+          exit(2)
+        end
       end
 
       result = if $stderr.tty?

data/lib/still_active/errors.rb

@@ -0,0 +1,6 @@
+# frozen_string_literal: true
+
+module StillActive
+  class Error < StandardError; end
+  class MissingLockfileError < Error; end
+end

data/lib/still_active/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module StillActive
-  VERSION = "1.4.1"
+  VERSION = "1.4.2"
 end

data/lib/still_active.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require_relative "still_active/version"
+require_relative "still_active/errors"
 require_relative "still_active/config"
 require_relative "still_active/cli"
 
@@ -9,8 +10,6 @@ require_relative "still_active/cli"
 require "faraday/retry"
 
 module StillActive
-  class Error < StandardError; end
-
   class << self
     def config
       @config ||= Config.new

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: still_active
 version: !ruby/object:Gem::Version
-  version: 1.4.1
+  version: 1.4.2
 platform: ruby
 authors:
 - Sean Floyd
@@ -216,6 +216,7 @@ files:
 - lib/still_active/core_ext.rb
 - lib/still_active/deps_dev_client.rb
 - lib/still_active/diff.rb
+- lib/still_active/errors.rb
 - lib/still_active/gitlab_client.rb
 - lib/still_active/options.rb
 - lib/still_active/repository.rb