still_active 2.0.0 → 3.0.0.rc1

data/lib/still_active/cli.rb

@@ -6,15 +6,19 @@ require_relative "diff"
 require_relative "../helpers/activity_helper"
 require_relative "../helpers/bot_context"
 require_relative "../helpers/bundler_helper"
+require_relative "../helpers/constraint_helper"
 require_relative "../helpers/cyclonedx_helper"
 require_relative "../helpers/diff_markdown_helper"
 require_relative "../helpers/emoji_helper"
 require_relative "../helpers/markdown_helper"
 require_relative "../helpers/sarif_helper"
+require_relative "../helpers/status_helper"
 require_relative "../helpers/summary_helper"
 require_relative "../helpers/terminal_helper"
 require_relative "../helpers/version_helper"
 require_relative "../helpers/vulnerability_helper"
+require_relative "sbom_reader"
+require_relative "sbom_workflow"
 require_relative "workflow"
 
 module StillActive
@@ -28,11 +32,24 @@ module StillActive
       # win over it: CLI flag > env var > config file > default.
       config_data = ConfigFile.load
       ConfigFile.apply(StillActive.config, config_data).each { |warning| $stderr.puts("warning: #{warning}") }
-      options = Options.new.parse!(args)
+      options = begin
+        Options.new.parse!(args)
+      rescue ArgumentError, OptionParser::ParseError => e
+        # Bad CLI input (conflicting flags, a missing file, an unknown flag, a bad
+        # enum value) is a user error: print it and exit 2, matching the SBOM/baseline
+        # paths, rather than letting the raise bubble into a Ruby backtrace.
+        $stderr.puts("error: #{e.message}")
+        exit(2)
+      end
       # After CLI flags resolve, nudge (don't auto-inherit) an un-imported
       # bundler-audit ignore list when the vulnerability gate is on.
       hint = ConfigFile.import_hint(config_data)
       $stderr.puts("hint: #{hint}") if hint
+      # An SBOM audit is cross-ecosystem: it runs the deps.dev/ecosyste.ms lens
+      # over the SBOM's packages, not Bundler over a lockfile. Dispatch before the
+      # Bundler resolution below so a Gemfile is never required (or read).
+      return run_sbom if options[:provided_sbom]
+
       unless options[:provided_gems]
         begin
           StillActive.config.gems = BundlerHelper.gemfile_dependencies
@@ -74,7 +91,12 @@ module StillActive
             summary: SummaryHelper.summarize(result, ruby_info: ruby_info),
             # Surface the derived verdict so a machine/LLM consumer reads it
             # directly instead of re-deriving it from the raw dates.
-            gems: result.transform_values { |data| data.merge(activity_level: ActivityHelper.activity_level(data)) },
+            gems: result.transform_values do |data|
+              data.merge(
+                activity_level: ActivityHelper.activity_level(data),
+                status: StatusHelper.gem_status(data),
+              )
+            end,
           }
           output[:ruby] = ruby_info if ruby_info
           output[:pr_context] = pr_context if pr_context
@@ -92,6 +114,103 @@ module StillActive
 
     private
 
+    # The --sbom path: assess a CycloneDX SBOM's packages cross-ecosystem via
+    # EcosystemLens, then emit a JSON report shaped like the native audit's but
+    # keyed "ecosystem/name@version" and carrying an `unassessable` list of every
+    # dep we couldn't assess (reader-level: unsupported ecosystem, no version/PURL;
+    # or assessment-level: the lens call raised) rather than silently dropping it.
+    def run_sbom
+      path = StillActive.config.sbom_path
+      require_parseable_sbom(path)
+      # deps.dev is the SBOM path's sole vulnerability source and an alpha API; a
+      # field rename would silently zero every vuln count. Canary the schema once
+      # and warn loudly so a degraded run never reads as an authoritative all-clear.
+      unless DepsDevClient.advisory_schema_ok?
+        $stderr.puts("warning: deps.dev vulnerability schema check failed (its `advisoryKeys` field may have changed, or the API is unreachable); vulnerability counts may be understated -- a clean result is NOT authoritative")
+      end
+      sbom = SbomReader.parse(path)
+      outcome = if $stderr.tty?
+        SbomWorkflow.call(sbom) { |done, total| $stderr.print("\rAssessing #{done}/#{total} dependencies...") }
+      else
+        SbomWorkflow.call(sbom)
+      end
+      $stderr.print("\r\e[K") if $stderr.tty?
+
+      # A reader-level gap (unsupported ecosystem, no version/PURL) and an
+      # assessment-time failure (a raised lens call) both mean "not assessed":
+      # surface them together so neither is a silent hole in the reported coverage.
+      unassessable = sbom.unassessable + outcome.failures
+      emit_sbom_json(outcome.assessed, unassessable)
+      warn_unassessable(unassessable)
+      check_exit_status(outcome.assessed)
+    end
+
+    # SbomReader never raises (a malformed file degrades to an empty result), which
+    # is right for the library entrypoint but wrong for the explicit --sbom flag:
+    # the user pointed at a file to audit, so a truncated/wrong-format one must
+    # error, not flow through to an empty "all clear" report with exit 0.
+    def require_parseable_sbom(path)
+      doc = JSON.parse(File.read(path))
+      return if doc.is_a?(Hash) && doc["components"].is_a?(Array)
+
+      # Matches SbomReader's own parse contract (a `components` array is what it
+      # reads). A metadata-only CycloneDX has nothing to audit, so the message
+      # names the missing array rather than over-claiming "not CycloneDX".
+      $stderr.puts("error: #{path} has no CycloneDX `components` array to audit")
+      exit(2)
+    rescue JSON::ParserError
+      $stderr.puts("error: #{path} is not valid JSON")
+      exit(2)
+    rescue SystemCallError => e
+      # Options checked the path exists, not that it's readable (a permission
+      # denial, or a directory). Exit cleanly instead of crashing with a trace.
+      $stderr.puts("error: cannot read SBOM file #{path}: #{e.message}")
+      exit(2)
+    end
+
+    # SBOM output deliberately omits the Ruby audit's `$schema`: the shape differs
+    # (composite keys, an unassessable list, no Ruby/PR-context blocks), so it
+    # would be a false claim to point at that contract. schema_version stays 1.
+    def emit_sbom_json(result, unassessable)
+      output = {
+        schema_version: 1,
+        tool: { name: "still_active", version: StillActive::VERSION },
+        generated_at: Time.now.utc.iso8601,
+        summary: sbom_summary(result, unassessable),
+        dependencies: result.transform_values do |data|
+          data.merge(
+            activity_level: ActivityHelper.activity_level(data),
+            status: StatusHelper.gem_status(data),
+          )
+        end,
+        unassessable:,
+      }
+      puts iso8601_times(output).to_json
+    end
+
+    def sbom_summary(result, unassessable)
+      statuses = result.each_value.map { |data| StatusHelper.gem_status(data) }
+      {
+        total_assessed: result.size,
+        unassessable_count: unassessable.size,
+        # The single worst per-dependency verdict, so a consumer reads one
+        # project-level posture without scanning every dependency.
+        status: StatusHelper.project_status(result),
+        status_counts: statuses.tally,
+      }
+    end
+
+    # Unassessable deps are already in the JSON; echo a one-line count to stderr so
+    # a human running interactively sees the coverage gap without parsing stdout.
+    def warn_unassessable(unassessable)
+      return if unassessable.empty?
+
+      noun = unassessable.size == 1 ? "dependency" : "dependencies"
+      $stderr.puts("warning: #{unassessable.size} #{noun} could not be assessed " \
+        "(a private/alternative registry, unsupported ecosystem, missing version, no package URL, or a lookup failure); " \
+        "see \"unassessable\" in the JSON output")
+    end
+
     # Dates live in the result as real Time objects (the activity/libyear math
     # needs them), but the JSON contract is ISO8601 UTC strings, matching
     # generated_at. Normalize at the serialization boundary only, so the
@@ -185,8 +304,9 @@ module StillActive
       current = current_snapshot(result, ruby_info)
       baseline = JSON.parse(File.read(baseline_path))
       diff = Diff.call(baseline: baseline, current: current)
+      accepted = partition_accepted_regressions!(diff)
       puts "> **#{BotContext.summary(pr_context)}**\n\n" if pr_context
-      puts DiffMarkdownHelper.render(diff)
+      puts DiffMarkdownHelper.render(diff, accepted: accepted)
       exit(1) if diff.regressions.any?
     rescue JSON::ParserError => e
       $stderr.puts("error: --baseline file is not valid JSON: #{e.message}")
@@ -199,6 +319,27 @@ module StillActive
       exit(2)
     end
 
+    # Drops regressions a committed .still_active.yml accepts from the CI-failable
+    # set (mutating diff.regressions in place) and returns them as accepted
+    # entries so the render can show them as knowingly-suppressed rather than
+    # silently vanishing. Mirrors the audit/SARIF gates, which already honour the
+    # same suppression list; the diff was the only gate that ignored it.
+    def partition_accepted_regressions!(diff)
+      suppressions = StillActive.config.suppressions
+      accepted = []
+      diff.regressions = diff.regressions.reject do |reg|
+        signal = Diff.suppressible_signal(reg.kind)
+        next false unless signal
+
+        entry = suppressions.match(gem: reg.gem, signal: signal)
+        next false unless entry
+
+        accepted << Diff::Accepted.new(regression: reg, reason: entry.reason)
+        true
+      end
+      accepted
+    end
+
     def current_snapshot(result, ruby_info)
       snapshot = {
         "schema_version" => 1,
@@ -234,6 +375,10 @@ module StillActive
 
         puts MarkdownHelper.markdown_table_body_line(gem_name: name, data: gem_data)
       end
+      poison = MarkdownHelper.poison_section(result)
+      puts poison unless poison.empty?
+      language_ceiling = MarkdownHelper.language_ceiling_section(result)
+      puts language_ceiling unless language_ceiling.empty?
       alternatives = MarkdownHelper.alternatives_section(result)
       puts alternatives unless alternatives.empty?
       transitive = MarkdownHelper.transitive_section(result)
@@ -246,11 +391,35 @@ module StillActive
 
     def check_exit_status(result)
       config = StillActive.config
-      return unless config.fail_if_critical || config.fail_if_warning || config.fail_if_vulnerable || config.fail_if_outdated
+      return unless config.fail_if_critical || config.fail_if_warning || config.fail_if_vulnerable || config.fail_if_outdated || config.fail_if_poison || config.fail_if_language_ceiling
 
+      warn_unknown_severity_gate(result, config)
       exit(1) if result.any? { |name, data| gate_failed?(name, data, config) }
     end
 
+    # --fail-if-vulnerable=<threshold> fails closed on an advisory with no CVSS
+    # score (it could exceed the threshold; fresh CVEs often lack a score). Say so
+    # per gem, so failing a =high gate on an "unknown" severity reads as a
+    # deliberate conservative call the user can review and fix or suppress, not a
+    # mystery. Only for the thresholded form; bare --fail-if-vulnerable fails on
+    # every advisory regardless of severity, so there's nothing to explain.
+    def warn_unknown_severity_gate(result, config)
+      threshold = config.fail_if_vulnerable
+      return unless threshold.is_a?(String)
+
+      suppressions = config.suppressions
+      result.each do |name, data|
+        next if config.ignored_gems.include?(name)
+
+        unknown = live_advisories(name, data, suppressions).select { |vuln| VulnerabilityHelper.unknown_severity?(vuln) }
+        next if unknown.empty?
+
+        ids = unknown.filter_map { |vuln| vuln[:id] }.join(", ")
+        labelled = ids.empty? ? "" : " (#{ids})"
+        $stderr.puts("warning: #{name} has an advisory of unknown severity#{labelled}; failing --fail-if-vulnerable=#{threshold} because it can't be ruled out below the threshold (review, then fix or suppress it in .still_active.yml)")
+      end
+    end
+
     # A gem fails the run when it trips an enabled gate that is neither
     # whole-gem --ignore'd nor covered by a granular .still_active.yml
     # suppression. Each signal is checked independently so accepting one finding
@@ -261,7 +430,32 @@ module StillActive
       suppressions = config.suppressions
       failed_activity?(name, data, config, suppressions) ||
         failed_vulnerability?(name, data, config, suppressions) ||
-        failed_outdated?(name, data, config, suppressions)
+        failed_outdated?(name, data, config, suppressions) ||
+        failed_poison?(name, data, config, suppressions) ||
+        failed_language_ceiling?(name, data, config, suppressions)
+    end
+
+    def failed_poison?(name, data, config, suppressions)
+      return false unless config.fail_if_poison
+      return false if suppressions.suppressed?(gem: name, signal: :poison)
+
+      # Bare --fail-if-poison fails at :warning and above (a 1-behind :note is FYI,
+      # not a build breaker); --fail-if-poison=TIER sets an explicit threshold.
+      threshold = config.fail_if_poison == true ? :warning : config.fail_if_poison
+      ConstraintHelper.severity_at_or_above?(data[:poison_severity], threshold)
+    end
+
+    def failed_language_ceiling?(name, data, config, suppressions)
+      return false unless config.fail_if_language_ceiling
+      return false if suppressions.suppressed?(gem: name, signal: :language_ceiling)
+
+      # Ceiling findings are only ever :critical (EOL-forced) or :note
+      # (latest-not-yet) -- there is no :warning tier for this signal -- so the
+      # bare flag defaults to :critical (the genuine blocker: no supported runtime
+      # is reachable). A latest-not-yet :note is an FYI/contribution lead that gates
+      # only when the user explicitly opts in with =note.
+      threshold = config.fail_if_language_ceiling == true ? :critical : config.fail_if_language_ceiling
+      ConstraintHelper.severity_at_or_above?(data.dig(:language_ceiling, :severity), threshold)
     end
 
     def failed_activity?(name, data, config, suppressions)
@@ -276,16 +470,25 @@ module StillActive
     def failed_vulnerability?(name, data, config, suppressions)
       setting = config.fail_if_vulnerable
       return false unless setting
-      return false unless data[:vulnerability_count]&.positive?
 
-      live = Array(data[:vulnerabilities]).reject do |vuln|
-        suppressions.suppressed?(gem: name, signal: :vulnerability, advisory: vuln[:id], aliases: Array(vuln[:aliases]))
-      end
+      # Reason over the live advisory array (not vulnerability_count) so the gate
+      # and warn_unknown_severity_gate share one source of truth: a warning that
+      # says "failing" can never disagree with whether exit(1) actually fires.
+      live = live_advisories(name, data, suppressions)
       return false if live.empty?
 
       setting == true || VulnerabilityHelper.severity_at_or_above?(live, setting)
     end
 
+    # The gem's advisories minus those an explicit .still_active.yml suppression
+    # accepts (by advisory id or alias). Shared by the vulnerability gate and the
+    # unknown-severity warning so both reason over the same live set.
+    def live_advisories(name, data, suppressions)
+      Array(data[:vulnerabilities]).reject do |vuln|
+        suppressions.suppressed?(gem: name, signal: :vulnerability, advisory: vuln[:id], aliases: Array(vuln[:aliases]))
+      end
+    end
+
     def failed_outdated?(name, data, config, suppressions)
       threshold = config.fail_if_outdated
       return false unless threshold

data/lib/still_active/config.rb

@@ -7,7 +7,8 @@ require_relative "suppressions"
 
 module StillActive
   class Config
-    attr_writer :github_oauth_token, :gitlab_token, :forgejo_token, :artifactory_token, :artifactory_host, :gemfile_path
+    attr_writer :github_oauth_token, :gitlab_token, :forgejo_token, :artifactory_token, :artifactory_host, :gemfile_path, :ecosystems_email
+    attr_accessor :sbom_path
     attr_accessor :alternatives,
       :unreleased_commits,
       :direct_only,
@@ -16,6 +17,8 @@ module StillActive
       :cyclonedx_path,
       :cyclonedx_version,
       :fail_if_critical,
+      :fail_if_poison,
+      :fail_if_language_ceiling,
       :fail_if_warning,
       :futurist_emoji,
       :gems,
@@ -37,6 +40,8 @@ module StillActive
       @unreleased_commits = false
       @direct_only = false
       @fail_if_critical = false
+      @fail_if_poison = false
+      @fail_if_language_ceiling = false
       @fail_if_outdated = nil
       @fail_if_vulnerable = nil
       @fail_if_warning = false
@@ -49,6 +54,7 @@ module StillActive
       @forgejo_token = nil
       @artifactory_token = nil
       @artifactory_host = nil
+      @ecosystems_email = nil
 
       @parallelism = 10
 
@@ -78,7 +84,21 @@ module StillActive
     end
 
     def github_oauth_token
+      # Cache the resolution including a nil result: the token can't change
+      # mid-run, and provider selection now reads this per gem, so a plain ||=
+      # (which doesn't memoize nil) would re-shell `gh auth token` for every gem
+      # in a no-token run.
+      return @github_oauth_token if @github_oauth_token_resolved
+
+      # Assign before flipping the flag: gh_cli_token shells out and yields the
+      # async reactor, so a concurrent fiber must never see resolved=true while
+      # the value is still nil (it would wrongly route a tokened gem to the
+      # ecosyste.ms fallback). Worst case under contention is a few extra `gh`
+      # calls, never a premature nil; Workflow.call also resolves this once before
+      # the fan-out so the contended path isn't normally hit.
       @github_oauth_token ||= presence(ENV["GITHUB_TOKEN"]) || presence(ENV["GH_TOKEN"]) || gh_cli_token
+      @github_oauth_token_resolved = true
+      @github_oauth_token
     end
 
     def gitlab_token
@@ -89,6 +109,13 @@ module StillActive
     # gh/glab), so it's env-var only. Anonymous works for public repos; a token
     # only raises the rate limit. CODEBERG_TOKEN is accepted as a convenience
     # alias for the codeberg.org default host.
+    # Optional contact email for ecosyste.ms's "polite pool" (sent as a mailto
+    # query param), which raises the anonymous rate limit and lets them reach
+    # out. Nil by default -- anonymous is plenty for a typical lockfile.
+    def ecosystems_email
+      @ecosystems_email ||= presence(ENV["STILL_ACTIVE_ECOSYSTEMS_EMAIL"]&.strip)
+    end
+
     def forgejo_token
       @forgejo_token ||= presence(ENV["STILL_ACTIVE_FORGEJO_TOKEN"]) || presence(ENV["CODEBERG_TOKEN"])
     end

data/lib/still_active/config_file.rb

@@ -2,6 +2,7 @@
 
 require "yaml"
 require_relative "suppressions"
+require_relative "../helpers/constraint_helper"
 require_relative "../helpers/vulnerability_helper"
 
 module StillActive
@@ -48,6 +49,8 @@ module StillActive
         case key
         when "fail_if_critical" then set_boolean(config, :fail_if_critical=, value, key, warnings)
         when "fail_if_warning" then set_boolean(config, :fail_if_warning=, value, key, warnings)
+        when "fail_if_poison" then apply_fail_if_poison(config, value, warnings)
+        when "fail_if_language_ceiling" then apply_fail_if_language_ceiling(config, value, warnings)
         when "alternatives" then set_boolean(config, :alternatives=, value, key, warnings)
         when "unreleased_commits" then set_boolean(config, :unreleased_commits=, value, key, warnings)
         when "direct_only" then set_boolean(config, :direct_only=, value, key, warnings)
@@ -134,6 +137,30 @@ module StillActive
       end
     end
 
+    # true/false, or a severity tier (note|warning|critical). Mirrors the CLI
+    # flag: bare `true` fails at :warning, a tier sets an explicit threshold.
+    def apply_fail_if_poison(config, value, warnings)
+      if value == true || value == false
+        config.fail_if_poison = value
+      elsif ConstraintHelper::SEVERITY.map(&:to_s).include?(value.to_s)
+        config.fail_if_poison = value.to_sym
+      else
+        warnings << "#{FILENAME}: fail_if_poison must be true/false or one of #{ConstraintHelper::SEVERITY.join(", ")} (got #{value.inspect}), ignoring it"
+      end
+    end
+
+    # true/false, or a severity tier (note|warning|critical). Mirrors the CLI
+    # flag: bare `true` fails at :warning, a tier sets an explicit threshold.
+    def apply_fail_if_language_ceiling(config, value, warnings)
+      if value == true || value == false
+        config.fail_if_language_ceiling = value
+      elsif ConstraintHelper::SEVERITY.map(&:to_s).include?(value.to_s)
+        config.fail_if_language_ceiling = value.to_sym
+      else
+        warnings << "#{FILENAME}: fail_if_language_ceiling must be true/false or one of #{ConstraintHelper::SEVERITY.join(", ")} (got #{value.inspect}), ignoring it"
+      end
+    end
+
     def apply_fail_if_vulnerable(config, value, warnings)
       if value == true || value == false
         config.fail_if_vulnerable = value || nil

data/lib/still_active/deps_dev_client.rb

@@ -8,19 +8,73 @@ module StillActive
 
     BASE_URI = URI("https://api.deps.dev/")
 
-    def version_info(gem_name:, version:)
+    # A known-vulnerable package used to canary the `advisoryKeys` schema. deps.dev
+    # is an explicitly ALPHA API (v3alpha), and every cross-ecosystem vulnerability
+    # count flows through the `advisoryKeys` field with a field-level degrade to
+    # `[]` -- so a rename or drop of that field would silently turn every count to
+    # 0 and read a known-vulnerable package as clean (exit 0). django 3.0.0 carries
+    # 30+ permanent advisories; if the canary returns none, the schema drifted.
+    ADVISORY_CANARY = { system: "pypi", name: "django", version: "3.0.0" }.freeze
+
+    # Is deps.dev still returning advisories in the shape we parse? False when the
+    # canary comes back empty (schema drift) or unreachable (can't confirm). The
+    # caller warns loudly rather than presenting a possibly-understated "all clear".
+    def advisory_schema_ok?
+      info = version_info(gem_name: ADVISORY_CANARY[:name], version: ADVISORY_CANARY[:version], system: ADVISORY_CANARY[:system])
+      !(info.nil? || info[:advisory_keys].empty?)
+    end
+
+    # `system` is the deps.dev package system, lowercased: rubygems, npm, pypi,
+    # cargo, go, maven, nuget. It matches the ecosystem symbol SbomReader emits,
+    # so a cross-ecosystem caller threads it straight through. An unknown system
+    # 404s and degrades to nil (HttpHelper swallows 404), never raising.
+    def version_info(gem_name:, version:, system: :rubygems)
       return if gem_name.nil? || version.nil?
 
-      path = "/v3alpha/systems/rubygems/packages/#{encode(gem_name)}/versions/#{encode(version)}"
+      path = "/v3alpha/systems/#{encode(system)}/packages/#{encode(gem_name)}/versions/#{encode(version)}"
       body = HttpHelper.get_json(BASE_URI, path)
       return if body.nil?
 
       {
         advisory_keys: body.dig("advisoryKeys")&.map { |a| a["id"] } || [],
         project_id: extract_project_id(body),
+        # The locked version's release date -- the cross-ecosystem libyear input
+        # (paired with the package's latest-release date). Already in this response,
+        # so no extra fetch; nil when the feed omits it.
+        published_at: body["publishedAt"],
       }
     end
 
+    # The package's default version and its release date: { version:,
+    # published_at: }, or nil. deps.dev's default version is the latest stable;
+    # when none is flagged (all pre-release), the newest publishedAt stands in so
+    # a still-active package isn't mis-read as dormant. The version is exposed (not
+    # just the date) so a caller can recover the package's repo link from it when
+    # an exact locked version isn't indexed (yanked/normalization mismatch).
+    def default_version_info(name:, system: :rubygems)
+      return if name.nil?
+
+      path = "/v3alpha/systems/#{encode(system)}/packages/#{encode(name)}"
+      body = HttpHelper.get_json(BASE_URI, path)
+      return if body.nil?
+
+      versions = body["versions"]
+      return unless versions.is_a?(Array) && !versions.empty?
+
+      entry = versions.find { |v| v.is_a?(Hash) && v["isDefault"] } || newest_version(versions)
+      return if entry.nil?
+
+      { version: entry.dig("versionKey", "version"), published_at: entry["publishedAt"] }
+    end
+
+    # The package's most recent release date (ISO8601 string), or nil. This is
+    # the cross-ecosystem freshness signal, and deps.dev's publishedAt is more
+    # reliable than ecosyste.ms's latest_release_published_at, which can lag badly
+    # (mpmath: 2023 vs 2026).
+    def latest_release_date(name:, system: :rubygems)
+      default_version_info(name: name, system: system)&.dig(:published_at)
+    end
+
     def project_scorecard(project_id:)
       return if project_id.nil?
 
@@ -34,6 +88,11 @@ module StillActive
       {
         score: scorecard["overallScore"],
         date: scorecard["date"],
+        # The "Maintained" sub-check (0-10) scores recent commit and issue
+        # activity directly -- still_active's core question -- so we surface it
+        # alongside the aggregate. nil when the check is absent (never 0, which
+        # would read as "unmaintained" rather than "not measured").
+        maintained: maintained_check_score(scorecard),
       }
     end
 
@@ -48,7 +107,9 @@ module StillActive
         id: body.dig("advisoryKey", "id"),
         url: body["url"],
         title: body["title"],
-        aliases: body["aliases"]&.filter_map { |a| a["id"] } || [],
+        # deps.dev's v3alpha returns aliases as bare id strings (["CVE-..."]);
+        # tolerate the legacy object shape ({"id":...}) too since it's an alpha API.
+        aliases: Array(body["aliases"]).filter_map { |a| normalize_alias(a) },
         cvss3_score: body["cvss3Score"],
         cvss3_vector: body["cvss3Vector"],
         cvss2_score: body["cvss2Score"],
@@ -58,6 +119,35 @@ module StillActive
 
     private
 
+    # Coerce an advisory alias to a string id. A BARE non-string alias is deps.dev
+    # ALPHA-API schema drift: coerce it (a non-string alias makes the advisory-merge
+    # sort raise, which strips a gem of ALL its signals and reads a vulnerable gem
+    # clean) but warn once so the drift surfaces rather than passing invisibly, the
+    # same "loud on schema drift" stance as the advisory-count canary.
+    def normalize_alias(raw)
+      return raw["id"]&.to_s if raw.is_a?(Hash)
+      return raw if raw.is_a?(String) || raw.nil?
+
+      warn_alias_drift(raw)
+      raw.to_s
+    end
+
+    # Warn once per run (not per alias), matching CvssHelper's warn-once stance.
+    def warn_alias_drift(raw)
+      return if @alias_drift_warned
+
+      @alias_drift_warned = true
+      $stderr.puts("warning: deps.dev returned a non-string advisory alias (#{raw.class}); the ALPHA API schema may have drifted")
+    end
+
+    # The OpenSSF "Maintained" check score (0-10), or nil when it's absent. A
+    # malformed (non-array) `checks` payload also yields nil rather than raising:
+    # this is a best-effort enrichment and must never crash the per-gem audit and
+    # vanish the gem from the output via the workflow's rescue.
+    def maintained_check_score(scorecard)
+      Array(scorecard["checks"]).find { |c| c.is_a?(Hash) && c["name"] == "Maintained" }&.dig("score")
+    end
+
     # Builds a deps.dev project id ("host/owner/repo", or a deeper path for
     # GitLab subgroups) from the SOURCE_REPO link URL. GitHub/Bitbucket projects
     # are always host/owner/repo, but GitLab namespaces nest arbitrarily
@@ -66,7 +156,17 @@ module StillActive
       url = body.dig("links")&.find { |l| l["label"] == "SOURCE_REPO" }&.dig("url")
       return if url.nil?
 
-      host, *segments = url.sub(%r{\Ahttps?://}, "").split("/")
+      # deps.dev returns SOURCE_REPO in many shapes: `https://`, but also `git://`,
+      # `git+https://`, `git+ssh://git@...`, `ssh://git@...`. Strip the `git+` prefix,
+      # any `scheme://`, and ssh userinfo (`git@`) so what remains is host/owner/repo.
+      # Left unnormalized, a git-scheme URL mis-parses (host becomes `git:`), which
+      # 400s the projects lookup and drops the repo signals.
+      cleaned = url.strip.delete_prefix("git+").sub(%r{\A[a-z][a-z0-9+.-]*://}i, "").sub(%r{\A[^/@]+@}, "")
+      # scp-style git remotes separate host from path with a colon (`host:owner/repo`)
+      # rather than a slash. Convert it so the split yields host/owner/repo, but leave
+      # a real port (`host:443/...`) alone -- a colon before a digit isn't a path.
+      cleaned = cleaned.sub(%r{\A([^/:]+):(?=\D)}, '\1/')
+      host, *segments = cleaned.split("/")
       segments = repo_path_segments(host, segments)
       return if host.nil? || segments.empty?
 
@@ -90,8 +190,18 @@ module StillActive
       segments
     end
 
+    # The version with the newest publishedAt, used only when no version is
+    # flagged default. Versions without a publishedAt are dropped; the rest
+    # compare lexicographically (deps.dev returns RFC3339 UTC, so string order
+    # is chronological), and a dated release always wins over an undated one.
+    def newest_version(versions)
+      versions
+        .select { |v| v.is_a?(Hash) && v["publishedAt"] }
+        .max_by { |v| v["publishedAt"].to_s }
+    end
+
     def encode(value)
-      URI.encode_www_form_component(value)
+      URI.encode_www_form_component(value.to_s)
     end
   end
 end

data/lib/still_active/diff.rb

@@ -15,6 +15,19 @@ module StillActive
     NEW_GEM_LIBYEAR_THRESHOLD = 0.5     # added gems already this far behind regress
     LIBYEAR_DELTA_THRESHOLD = 0.01      # floating-point fuzz
 
+    # Maps a maintenance regression kind to the .still_active.yml signal that
+    # accepts it, so a committed suppression mutes the diff exactly as it already
+    # mutes the audit and SARIF gates. Only kinds a bare gem+signal entry can
+    # cover appear here: vulnerability regressions require an explicit advisory id
+    # (which the diff regression doesn't carry) and stay CI-failable, and
+    # scorecard/yanked/ruby-EOL are not gateable signals.
+    SUPPRESSIBLE_REGRESSION_SIGNALS = {
+      new_gem_archived: :activity,
+      archived: :activity,
+      new_gem_stale: :libyear,
+      libyear_worsened: :libyear,
+    }.freeze
+
     class UnsupportedSchemaError < StandardError; end
 
     Added = Struct.new(:name, :data, keyword_init: true)
@@ -22,10 +35,19 @@ module StillActive
     Bumped = Struct.new(:name, :before_version, :after_version, :kind, :before, :after, keyword_init: true)
     SignalChange = Struct.new(:name, :changes, :before, :after, keyword_init: true)
     Regression = Struct.new(:kind, :gem, :detail, keyword_init: true)
+    # A regression a committed .still_active.yml knowingly accepts: carried out of
+    # the CI-failable set so the diff render can show it as suppressed-with-reason.
+    Accepted = Struct.new(:regression, :reason, keyword_init: true)
     Result = Struct.new(:added, :removed, :bumped, :signal_changes, :regressions, :ruby, keyword_init: true)
 
     extend self
 
+    # The suppression signal that accepts this regression kind, or nil when the
+    # kind is not suppressible by a bare gem+signal .still_active.yml entry.
+    def suppressible_signal(kind)
+      SUPPRESSIBLE_REGRESSION_SIGNALS[kind]
+    end
+
     def call(baseline:, current:)
       validate_schema!(baseline, "baseline")
       validate_schema!(current, "current")