still_active 1.6.0 → 3.0.0.rc1

data/lib/still_active/config_file.rb

@@ -0,0 +1,207 @@
+# frozen_string_literal: true
+
+require "yaml"
+require_relative "suppressions"
+require_relative "../helpers/constraint_helper"
+require_relative "../helpers/vulnerability_helper"
+
+module StillActive
+  # Loads a committed .still_active.yml and applies it to the config as the layer
+  # below env vars and CLI flags (CLI flag > env var > config file > default).
+  # Mirrors the policy flags (gates, thresholds, output, alternatives, scope)
+  # and the granular suppression list; deliberately NOT secrets (tokens) or
+  # invocation-specific paths (--gemfile/--gems/--baseline/output paths), which
+  # stay CLI/env-only so a committed file never carries a credential.
+  module ConfigFile
+    FILENAME = ".still_active.yml"
+    BUNDLER_AUDIT_FILE = ".bundler-audit.yml"
+
+    extend self
+
+    def load(dir: Dir.pwd)
+      path = File.join(dir, FILENAME)
+      return {} unless File.file?(path)
+
+      data = YAML.safe_load_file(path, permitted_classes: [Date, Time])
+      return {} if data.nil?
+
+      unless data.is_a?(Hash)
+        $stderr.puts("warning: #{FILENAME} must be a mapping of settings; ignoring it")
+        return {}
+      end
+
+      data
+    rescue Psych::Exception => e
+      # Covers a syntax error and a disallowed tag (e.g. !ruby/object); either
+      # way the committed file must never take the audit down with it.
+      $stderr.puts("warning: #{FILENAME} could not be loaded (#{e.message}); ignoring it")
+      {}
+    end
+
+    # Applies data to config and returns an array of warning strings (unknown
+    # keys, invalid values, suppression/import problems). Booleans/numbers are
+    # passed through as the gate expects them.
+    def apply(config, data, base_dir: Dir.pwd)
+      warnings = []
+      ignore_entries = Array(data["ignore"])
+
+      data.each do |key, value|
+        case key
+        when "fail_if_critical" then set_boolean(config, :fail_if_critical=, value, key, warnings)
+        when "fail_if_warning" then set_boolean(config, :fail_if_warning=, value, key, warnings)
+        when "fail_if_poison" then apply_fail_if_poison(config, value, warnings)
+        when "fail_if_language_ceiling" then apply_fail_if_language_ceiling(config, value, warnings)
+        when "alternatives" then set_boolean(config, :alternatives=, value, key, warnings)
+        when "unreleased_commits" then set_boolean(config, :unreleased_commits=, value, key, warnings)
+        when "direct_only" then set_boolean(config, :direct_only=, value, key, warnings)
+        when "safe_range_end" then set_number(config, :no_warning_range_end=, value, key, warnings)
+        when "warning_range_end" then set_number(config, :warning_range_end=, value, key, warnings)
+        when "fail_if_outdated" then apply_fail_if_outdated(config, value, warnings)
+        when "parallelism" then apply_parallelism(config, value, warnings)
+        when "fail_if_vulnerable" then apply_fail_if_vulnerable(config, value, warnings)
+        when "output" then apply_output(config, value, warnings)
+        when "ignore" then nil # handled below, after imports are gathered
+        when "import" then ignore_entries.concat(import_advisories(value, base_dir, warnings))
+        else warnings << "#{FILENAME}: unknown setting #{key.inspect}, ignoring it"
+        end
+      end
+
+      suppressions = Suppressions.from(ignore_entries)
+      warnings.concat(suppressions.warnings)
+      config.suppressions = suppressions
+      warnings
+    end
+
+    # Suggests honouring an existing bundler-audit ignore list rather than
+    # silently inheriting it. Auto-importing another tool's suppressions would
+    # hide vulnerabilities the user only accepted in bundler-audit's context,
+    # with no reason/expiry and no explicit opt-in here, the exact over-broad
+    # muting this feature exists to replace. So nudge, don't absorb, and only
+    # when the vulnerability gate is on (suppression is otherwise moot) and the
+    # file isn't already imported. Returns the hint string or nil.
+    def import_hint(data, config: StillActive.config, dir: Dir.pwd)
+      return unless config.fail_if_vulnerable
+      return if Array(data["import"]).include?(BUNDLER_AUDIT_FILE)
+
+      path = File.join(dir, BUNDLER_AUDIT_FILE)
+      return unless File.file?(path)
+
+      count = bundler_audit_ignore_count(path)
+      return unless count.positive?
+
+      noun = count == 1 ? "advisory" : "advisories"
+      "#{BUNDLER_AUDIT_FILE} lists #{count} accepted #{noun}; add `import: [#{BUNDLER_AUDIT_FILE}]` to #{FILENAME} to honour them in still_active's --fail-if-vulnerable gate too"
+    end
+
+    private
+
+    def bundler_audit_ignore_count(path)
+      data = YAML.safe_load_file(path, permitted_classes: [Date, Time])
+      data.is_a?(Hash) ? Array(data["ignore"]).size : 0
+    rescue Psych::Exception
+      0
+    end
+
+    # A malformed value must warn and leave the default in place, never silently
+    # flip a gate off (`!!""` is false) or crash the audit (`false.to_f` raises,
+    # since `&.` guards only nil). Validate before assigning, like the gates do.
+    def set_boolean(config, setter, value, key, warnings)
+      if [true, false].include?(value)
+        config.public_send(setter, value)
+      else
+        warnings << "#{FILENAME}: #{key} must be true or false (got #{value.inspect}), ignoring it"
+      end
+    end
+
+    def set_number(config, setter, value, key, warnings)
+      if value.is_a?(Numeric)
+        config.public_send(setter, value.to_f)
+      else
+        warnings << "#{FILENAME}: #{key} must be a number (got #{value.inspect}), ignoring it"
+      end
+    end
+
+    def apply_fail_if_outdated(config, value, warnings)
+      case value
+      when nil, false then config.fail_if_outdated = nil # gate off
+      when Numeric then config.fail_if_outdated = value.to_f
+      else warnings << "#{FILENAME}: fail_if_outdated must be a number or false (got #{value.inspect}), ignoring it"
+      end
+    end
+
+    def apply_parallelism(config, value, warnings)
+      if value.is_a?(Integer) && value.positive?
+        config.parallelism = value
+      else
+        warnings << "#{FILENAME}: parallelism must be a positive integer (got #{value.inspect}), ignoring it"
+      end
+    end
+
+    # true/false, or a severity tier (note|warning|critical). Mirrors the CLI
+    # flag: bare `true` fails at :warning, a tier sets an explicit threshold.
+    def apply_fail_if_poison(config, value, warnings)
+      if value == true || value == false
+        config.fail_if_poison = value
+      elsif ConstraintHelper::SEVERITY.map(&:to_s).include?(value.to_s)
+        config.fail_if_poison = value.to_sym
+      else
+        warnings << "#{FILENAME}: fail_if_poison must be true/false or one of #{ConstraintHelper::SEVERITY.join(", ")} (got #{value.inspect}), ignoring it"
+      end
+    end
+
+    # true/false, or a severity tier (note|warning|critical). Mirrors the CLI
+    # flag: bare `true` fails at :warning, a tier sets an explicit threshold.
+    def apply_fail_if_language_ceiling(config, value, warnings)
+      if value == true || value == false
+        config.fail_if_language_ceiling = value
+      elsif ConstraintHelper::SEVERITY.map(&:to_s).include?(value.to_s)
+        config.fail_if_language_ceiling = value.to_sym
+      else
+        warnings << "#{FILENAME}: fail_if_language_ceiling must be true/false or one of #{ConstraintHelper::SEVERITY.join(", ")} (got #{value.inspect}), ignoring it"
+      end
+    end
+
+    def apply_fail_if_vulnerable(config, value, warnings)
+      if value == true || value == false
+        config.fail_if_vulnerable = value || nil
+      elsif VulnerabilityHelper::SEVERITY_ORDER.include?(value)
+        config.fail_if_vulnerable = value
+      else
+        warnings << "#{FILENAME}: fail_if_vulnerable severity must be one of #{VulnerabilityHelper::SEVERITY_ORDER.join(", ")} (got #{value.inspect}), ignoring it"
+      end
+    end
+
+    def apply_output(config, value, warnings)
+      format = value.to_s.to_sym
+      if [:terminal, :markdown, :json].include?(format)
+        config.output_format = format
+      else
+        warnings << "#{FILENAME}: output must be terminal, markdown, or json (got #{value.inspect}), ignoring it"
+      end
+    end
+
+    # Reads each referenced bundler-audit config and converts its ignore list of
+    # advisory ids into advisory-scoped (gem-agnostic) suppression entries, so a
+    # team keeps one ignore list instead of two.
+    def import_advisories(paths, base_dir, warnings)
+      Array(paths).flat_map do |rel|
+        path = File.expand_path(rel, base_dir)
+        unless File.file?(path)
+          warnings << "#{FILENAME}: import target #{rel} not found, skipping it"
+          next []
+        end
+
+        imported = YAML.safe_load_file(path, permitted_classes: [Date, Time]) || {}
+        unless imported.is_a?(Hash)
+          warnings << "#{FILENAME}: import target #{rel} is not a mapping, skipping it"
+          next []
+        end
+
+        Array(imported["ignore"]).map { |advisory| { "advisory" => advisory, "reason" => "imported from #{rel}" } }
+      rescue Psych::Exception => e
+        warnings << "#{FILENAME}: import target #{rel} could not be loaded (#{e.message}), skipping it"
+        []
+      end
+    end
+  end
+end

data/lib/still_active/deps_dev_client.rb

@@ -8,19 +8,73 @@ module StillActive
 
     BASE_URI = URI("https://api.deps.dev/")
 
-    def version_info(gem_name:, version:)
+    # A known-vulnerable package used to canary the `advisoryKeys` schema. deps.dev
+    # is an explicitly ALPHA API (v3alpha), and every cross-ecosystem vulnerability
+    # count flows through the `advisoryKeys` field with a field-level degrade to
+    # `[]` -- so a rename or drop of that field would silently turn every count to
+    # 0 and read a known-vulnerable package as clean (exit 0). django 3.0.0 carries
+    # 30+ permanent advisories; if the canary returns none, the schema drifted.
+    ADVISORY_CANARY = { system: "pypi", name: "django", version: "3.0.0" }.freeze
+
+    # Is deps.dev still returning advisories in the shape we parse? False when the
+    # canary comes back empty (schema drift) or unreachable (can't confirm). The
+    # caller warns loudly rather than presenting a possibly-understated "all clear".
+    def advisory_schema_ok?
+      info = version_info(gem_name: ADVISORY_CANARY[:name], version: ADVISORY_CANARY[:version], system: ADVISORY_CANARY[:system])
+      !(info.nil? || info[:advisory_keys].empty?)
+    end
+
+    # `system` is the deps.dev package system, lowercased: rubygems, npm, pypi,
+    # cargo, go, maven, nuget. It matches the ecosystem symbol SbomReader emits,
+    # so a cross-ecosystem caller threads it straight through. An unknown system
+    # 404s and degrades to nil (HttpHelper swallows 404), never raising.
+    def version_info(gem_name:, version:, system: :rubygems)
       return if gem_name.nil? || version.nil?
 
-      path = "/v3alpha/systems/rubygems/packages/#{encode(gem_name)}/versions/#{encode(version)}"
+      path = "/v3alpha/systems/#{encode(system)}/packages/#{encode(gem_name)}/versions/#{encode(version)}"
       body = HttpHelper.get_json(BASE_URI, path)
       return if body.nil?
 
       {
         advisory_keys: body.dig("advisoryKeys")&.map { |a| a["id"] } || [],
         project_id: extract_project_id(body),
+        # The locked version's release date -- the cross-ecosystem libyear input
+        # (paired with the package's latest-release date). Already in this response,
+        # so no extra fetch; nil when the feed omits it.
+        published_at: body["publishedAt"],
       }
     end
 
+    # The package's default version and its release date: { version:,
+    # published_at: }, or nil. deps.dev's default version is the latest stable;
+    # when none is flagged (all pre-release), the newest publishedAt stands in so
+    # a still-active package isn't mis-read as dormant. The version is exposed (not
+    # just the date) so a caller can recover the package's repo link from it when
+    # an exact locked version isn't indexed (yanked/normalization mismatch).
+    def default_version_info(name:, system: :rubygems)
+      return if name.nil?
+
+      path = "/v3alpha/systems/#{encode(system)}/packages/#{encode(name)}"
+      body = HttpHelper.get_json(BASE_URI, path)
+      return if body.nil?
+
+      versions = body["versions"]
+      return unless versions.is_a?(Array) && !versions.empty?
+
+      entry = versions.find { |v| v.is_a?(Hash) && v["isDefault"] } || newest_version(versions)
+      return if entry.nil?
+
+      { version: entry.dig("versionKey", "version"), published_at: entry["publishedAt"] }
+    end
+
+    # The package's most recent release date (ISO8601 string), or nil. This is
+    # the cross-ecosystem freshness signal, and deps.dev's publishedAt is more
+    # reliable than ecosyste.ms's latest_release_published_at, which can lag badly
+    # (mpmath: 2023 vs 2026).
+    def latest_release_date(name:, system: :rubygems)
+      default_version_info(name: name, system: system)&.dig(:published_at)
+    end
+
     def project_scorecard(project_id:)
       return if project_id.nil?
 
@@ -34,6 +88,11 @@ module StillActive
       {
         score: scorecard["overallScore"],
         date: scorecard["date"],
+        # The "Maintained" sub-check (0-10) scores recent commit and issue
+        # activity directly -- still_active's core question -- so we surface it
+        # alongside the aggregate. nil when the check is absent (never 0, which
+        # would read as "unmaintained" rather than "not measured").
+        maintained: maintained_check_score(scorecard),
       }
     end
 
@@ -48,7 +107,9 @@ module StillActive
         id: body.dig("advisoryKey", "id"),
         url: body["url"],
         title: body["title"],
-        aliases: body["aliases"]&.map { |a| a["id"] } || [],
+        # deps.dev's v3alpha returns aliases as bare id strings (["CVE-..."]);
+        # tolerate the legacy object shape ({"id":...}) too since it's an alpha API.
+        aliases: Array(body["aliases"]).filter_map { |a| normalize_alias(a) },
         cvss3_score: body["cvss3Score"],
         cvss3_vector: body["cvss3Vector"],
         cvss2_score: body["cvss2Score"],
@@ -58,19 +119,89 @@ module StillActive
 
     private
 
-    # Extracts "host/owner/repo" from the SOURCE_REPO link URL.
-    # URLs may have trailing slashes or extra path segments (e.g. /tree/v1.0).
+    # Coerce an advisory alias to a string id. A BARE non-string alias is deps.dev
+    # ALPHA-API schema drift: coerce it (a non-string alias makes the advisory-merge
+    # sort raise, which strips a gem of ALL its signals and reads a vulnerable gem
+    # clean) but warn once so the drift surfaces rather than passing invisibly, the
+    # same "loud on schema drift" stance as the advisory-count canary.
+    def normalize_alias(raw)
+      return raw["id"]&.to_s if raw.is_a?(Hash)
+      return raw if raw.is_a?(String) || raw.nil?
+
+      warn_alias_drift(raw)
+      raw.to_s
+    end
+
+    # Warn once per run (not per alias), matching CvssHelper's warn-once stance.
+    def warn_alias_drift(raw)
+      return if @alias_drift_warned
+
+      @alias_drift_warned = true
+      $stderr.puts("warning: deps.dev returned a non-string advisory alias (#{raw.class}); the ALPHA API schema may have drifted")
+    end
+
+    # The OpenSSF "Maintained" check score (0-10), or nil when it's absent. A
+    # malformed (non-array) `checks` payload also yields nil rather than raising:
+    # this is a best-effort enrichment and must never crash the per-gem audit and
+    # vanish the gem from the output via the workflow's rescue.
+    def maintained_check_score(scorecard)
+      Array(scorecard["checks"]).find { |c| c.is_a?(Hash) && c["name"] == "Maintained" }&.dig("score")
+    end
+
+    # Builds a deps.dev project id ("host/owner/repo", or a deeper path for
+    # GitLab subgroups) from the SOURCE_REPO link URL. GitHub/Bitbucket projects
+    # are always host/owner/repo, but GitLab namespaces nest arbitrarily
+    # (host/group/subgroup/.../project), so we can't just keep three segments.
     def extract_project_id(body)
       url = body.dig("links")&.find { |l| l["label"] == "SOURCE_REPO" }&.dig("url")
       return if url.nil?
 
-      path = url.delete_prefix("https://").delete_prefix("http://")
-      segments = path.split("/")
-      segments[0..2].join("/") if segments.length >= 3
+      # deps.dev returns SOURCE_REPO in many shapes: `https://`, but also `git://`,
+      # `git+https://`, `git+ssh://git@...`, `ssh://git@...`. Strip the `git+` prefix,
+      # any `scheme://`, and ssh userinfo (`git@`) so what remains is host/owner/repo.
+      # Left unnormalized, a git-scheme URL mis-parses (host becomes `git:`), which
+      # 400s the projects lookup and drops the repo signals.
+      cleaned = url.strip.delete_prefix("git+").sub(%r{\A[a-z][a-z0-9+.-]*://}i, "").sub(%r{\A[^/@]+@}, "")
+      # scp-style git remotes separate host from path with a colon (`host:owner/repo`)
+      # rather than a slash. Convert it so the split yields host/owner/repo, but leave
+      # a real port (`host:443/...`) alone -- a colon before a digit isn't a path.
+      cleaned = cleaned.sub(%r{\A([^/:]+):(?=\D)}, '\1/')
+      host, *segments = cleaned.split("/")
+      segments = repo_path_segments(host, segments)
+      return if host.nil? || segments.empty?
+
+      [host, *segments].join("/")
+    end
+
+    # Trims a repo URL's path to just the project. On GitLab the project path
+    # ends at the "/-/" separator (before tree/blob/etc) and may be nested;
+    # elsewhere it's owner/repo. Drops trailing slashes and a ".git" suffix.
+    def repo_path_segments(host, segments)
+      segments = segments.reject(&:empty?)
+
+      if host.to_s.start_with?("gitlab.")
+        separator = segments.index("-")
+        segments = segments[0...separator] if separator
+      else
+        segments = segments.first(2)
+      end
+
+      segments[-1] = segments[-1].delete_suffix(".git") unless segments.empty?
+      segments
+    end
+
+    # The version with the newest publishedAt, used only when no version is
+    # flagged default. Versions without a publishedAt are dropped; the rest
+    # compare lexicographically (deps.dev returns RFC3339 UTC, so string order
+    # is chronological), and a dated release always wins over an undated one.
+    def newest_version(versions)
+      versions
+        .select { |v| v.is_a?(Hash) && v["publishedAt"] }
+        .max_by { |v| v["publishedAt"].to_s }
     end
 
     def encode(value)
-      URI.encode_www_form_component(value)
+      URI.encode_www_form_component(value.to_s)
     end
   end
 end

data/lib/still_active/diff.rb

@@ -15,6 +15,19 @@ module StillActive
     NEW_GEM_LIBYEAR_THRESHOLD = 0.5     # added gems already this far behind regress
     LIBYEAR_DELTA_THRESHOLD = 0.01      # floating-point fuzz
 
+    # Maps a maintenance regression kind to the .still_active.yml signal that
+    # accepts it, so a committed suppression mutes the diff exactly as it already
+    # mutes the audit and SARIF gates. Only kinds a bare gem+signal entry can
+    # cover appear here: vulnerability regressions require an explicit advisory id
+    # (which the diff regression doesn't carry) and stay CI-failable, and
+    # scorecard/yanked/ruby-EOL are not gateable signals.
+    SUPPRESSIBLE_REGRESSION_SIGNALS = {
+      new_gem_archived: :activity,
+      archived: :activity,
+      new_gem_stale: :libyear,
+      libyear_worsened: :libyear,
+    }.freeze
+
     class UnsupportedSchemaError < StandardError; end
 
     Added = Struct.new(:name, :data, keyword_init: true)
@@ -22,10 +35,19 @@ module StillActive
     Bumped = Struct.new(:name, :before_version, :after_version, :kind, :before, :after, keyword_init: true)
     SignalChange = Struct.new(:name, :changes, :before, :after, keyword_init: true)
     Regression = Struct.new(:kind, :gem, :detail, keyword_init: true)
+    # A regression a committed .still_active.yml knowingly accepts: carried out of
+    # the CI-failable set so the diff render can show it as suppressed-with-reason.
+    Accepted = Struct.new(:regression, :reason, keyword_init: true)
     Result = Struct.new(:added, :removed, :bumped, :signal_changes, :regressions, :ruby, keyword_init: true)
 
     extend self
 
+    # The suppression signal that accepts this regression kind, or nil when the
+    # kind is not suppressible by a bare gem+signal .still_active.yml entry.
+    def suppressible_signal(kind)
+      SUPPRESSIBLE_REGRESSION_SIGNALS[kind]
+    end
+
     def call(baseline:, current:)
       validate_schema!(baseline, "baseline")
       validate_schema!(current, "current")
@@ -74,10 +96,67 @@ module StillActive
     end
 
     def validate_schema!(snapshot, role)
+      # A user can point --baseline at any JSON file. Reject a wrong shape here
+      # as an UnsupportedSchemaError (which emit_diff turns into a clean exit 2)
+      # rather than letting snapshot["..."] / gems.keys raise a raw stack trace.
+      unless snapshot.is_a?(Hash)
+        raise UnsupportedSchemaError, "#{role} is not a still_active JSON object (got #{snapshot.class})"
+      end
+
       version = snapshot["schema_version"]
-      return if SUPPORTED_SCHEMA_VERSIONS.include?(version)
+      unless SUPPORTED_SCHEMA_VERSIONS.include?(version)
+        raise UnsupportedSchemaError, "#{role} has schema_version=#{version.inspect}; supported: #{SUPPORTED_SCHEMA_VERSIONS.join(", ")}"
+      end
 
-      raise UnsupportedSchemaError, "#{role} has schema_version=#{version.inspect}; supported: #{SUPPORTED_SCHEMA_VERSIONS.join(", ")}"
+      ruby = snapshot["ruby"]
+      unless ruby.nil? || ruby.is_a?(Hash)
+        raise UnsupportedSchemaError, "#{role} has a malformed ruby section (expected an object, got #{ruby.class})"
+      end
+
+      gems = snapshot["gems"]
+      return if gems.nil?
+
+      unless gems.is_a?(Hash)
+        raise UnsupportedSchemaError, "#{role} has a malformed gems section (expected an object, got #{gems.class})"
+      end
+
+      gems.each { |name, data| validate_gem!(role, name, data) }
+    end
+
+    # The diff dereferences gem fields with type-sensitive operations: a non-Hash
+    # value crashes the intersection branch, an arithmetic field that isn't
+    # numeric crashes (libyear/scorecard) or silently fabricates a count
+    # (vulnerability_count via .to_i), and a non-array vulnerabilities silently
+    # drops advisory ids. The baseline is untrusted user input, so validate the
+    # shape the diff requires here and let the rest of the code assume it.
+    NUMERIC_GEM_FIELDS = ["vulnerability_count", "scorecard_score", "libyear"].freeze
+
+    def validate_gem!(role, name, data)
+      unless data.is_a?(Hash)
+        raise UnsupportedSchemaError, "#{role} gem #{name.inspect} is malformed (expected an object, got #{data.class})"
+      end
+
+      NUMERIC_GEM_FIELDS.each do |field|
+        value = data[field]
+        next if value.nil? || value.is_a?(Numeric)
+
+        raise UnsupportedSchemaError, "#{role} gem #{name.inspect} has a non-numeric #{field} (got #{value.class})"
+      end
+
+      vulns = data["vulnerabilities"]
+      return if vulns.nil?
+
+      unless vulns.is_a?(Array)
+        raise UnsupportedSchemaError, "#{role} gem #{name.inspect} has a malformed vulnerabilities list (expected an array, got #{vulns.class})"
+      end
+
+      # advisory_ids dereferences each entry as a hash (entry["id"]); a scalar
+      # element would crash there, so reject non-object entries up front.
+      vulns.each do |entry|
+        next if entry.is_a?(Hash)
+
+        raise UnsupportedSchemaError, "#{role} gem #{name.inspect} has a malformed vulnerability entry (expected an object, got #{entry.class})"
+      end
     end
 
     # Categorises a version bump: