still_active 3.0.0.rc3 → 3.0.0.rc4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 48cf9cbac0c507c9de0eae6930aac65686f32893d1e330c19d0392ccc5a3a824
-  data.tar.gz: 0a1370fc970a0b03e7a5663a4c320322f4ac7788d161d144405cb8c703b005b5
+  metadata.gz: e74ec3ec40686e3eab640b852270c36278b33c82b54fdc85fe7bbb43ce551455
+  data.tar.gz: 7304228ba4411b50474cba46dec421c3ce4ff9e53911ea256bef623874d0910c
 SHA512:
-  metadata.gz: 85e0df44ac6e16fe28023c5dedf5e7a08466c045f5e36558b91d42e71949d159df10262a894139916fc6dc5c744d5c15ec159630297a734104c17e1e60b2826e
-  data.tar.gz: 4da6ad45492f57b76a1ec2f3e0f486be5aa7765cd2a4b956de0cf02c66af61c2d21ae0ff278aaf77a33a0e38b18a7d72a1a61bcd9b91d46259fac4d3a266b57b
+  metadata.gz: 6879718004e7d7a8765c7666f3d68686323873825ddb26240f929ee4b89a3337b0f7880373a34e669a72e545422dbf7a227a8142c9fede87f186e7f40fccfc3a
+  data.tar.gz: 2ed322c87a224e7e0bf2ea644dca8cdb341349b6985c251a47cf4abc62fcb9cef24d3dd6642d78789190aa7d64e1401814d4c1fa2fac7647746d4fef49657794

data/CHANGELOG.md

@@ -33,6 +33,8 @@ The new `--fail-if-poison[=TIER]` and `--fail-if-language-ceiling[=TIER]` gates
 
 ### Fixed
 
+- **SARIF `tool.driver` version fields are populated and spec-correct.** `version` was null, so a consumer reading `tool.driver.version` (rather than `semanticVersion`) saw nothing, and `semanticVersion` carried the RubyGems version verbatim (`3.0.0.rc4`), which is not valid SemVer 2.0.0 for a prerelease. Now `version` carries the free-form gem version and `semanticVersion` the SemVer form (`3.0.0-rc4`); final releases like `3.0.0` were already valid.
+- **Cross-ecosystem SARIF no longer reads as a Ruby audit.** The `--sbom` path emitted the native Gemfile audit's Ruby-worded SARIF rule catalog, so a Go/npm/pypi repo's GitHub Code Scanning alerts were titled "Gem source repository is archived", advised `bundle update <gem>`, and referenced `Gemfile.lock`/RubyGems in the rule detail. The catalog now has an ecosystem-neutral flavour for SBOM runs (titles and guidance say "package"/"dependency"), and the native-only SA006 (Ruby runtime EOL), which the cross-ecosystem path can never emit, is dropped from the SBOM catalog rather than advertised in a non-Ruby repo. Per-result finding messages were already neutral; this fixes the rule metadata GitHub renders as the alert title and detail. The native Gemfile SARIF is unchanged (still `gem`-worded, SA006 present).
 - **A stale pre-release no longer corrupts the up-to-date signal.** A pre-release older than the latest stable (an `8.1.0.rc1` still listed after `8.1.2` shipped, or a decade-old `rc` on a gem long past it) was treated as a live upgrade target: `up_to_date` compares the version in hand against it, so any current version read as up to date and a gem that was actually behind got the "futurist" marker, while the pre-release column filled with superseded rcs. The latest pre-release is now kept only when strictly newer than the latest stable (or when there is no stable release at all, where it is the only signal), so the column, the `up_to_date` field, and the emoji agree. Genuine upcoming pre-releases still surface. On a real bundle this was mislabelling roughly twenty gems.
 - **`--baseline` now honours a committed `.still_active.yml`.** The PR-diff gate was the only gate that ignored the suppression list: a maintenance regression the audit and SARIF gates already accept still tripped `--baseline` the moment the dependency was added, with no way to accept it short of merging it to the baseline first. An accepted regression is now moved out of the CI-failable set and shown under an "Accepted (suppressed via `.still_active.yml`)" section with its reason, so the acceptance stays visible rather than silently vanishing. Only maintenance kinds a bare gem+signal entry can cover are accepted (archived/staleness map to `activity`/`libyear`); a newly introduced vulnerability still fails, since suppressing one needs an explicit advisory id the diff regression doesn't carry.
 - **The fail-open on the vulnerability gate is closed on both paths.** `--fail-if-vulnerable=<severity>` no longer passes a confirmed advisory that carries no CVSS score (an unscored advisory read as "below threshold" and cleared the gate, worst for a freshly disclosed CVE); it now fails closed with a per-gem stderr note (see Upgrading). And the native path no longer drops a confirmed advisory when its deps.dev detail fetch fails (429/timeout/5xx); it previously `filter_map`'d the failure away and zeroed `vulnerability_count`, it now keeps a minimal advisory so the finding survives and the fail-closed logic applies.

data/lib/helpers/sarif_helper.rb

@@ -8,6 +8,7 @@ require_relative "lockfile_indexer"
 require_relative "activity_helper"
 require_relative "dependency_helper"
 require_relative "constraint_helper"
+require_relative "version_helper"
 
 module StillActive
   # Renders a still_active workflow result as a SARIF 2.1.0 document.
@@ -42,7 +43,7 @@ module StillActive
         lockfile_uri: lockfile_uri,
       )
 
-      JSON.pretty_generate(document(results: results, tool_version: tool_version))
+      JSON.pretty_generate(document(results: results, tool_version: tool_version, flavour: :ruby))
     end
 
     # The SBOM path emits the same rule set and document, but there is no lockfile
@@ -50,6 +51,9 @@ module StillActive
     # ruby_info is nil (Ruby EOL / SA006 is a native-only signal). Findings are
     # named ecosystem/name (each gem_data carries :ecosystem and :name), so a
     # cross-ecosystem alert reads "npm/left-pad ..." rather than a bare gem name.
+    # A polyglot SBOM has no single ecosystem, so the rule catalog uses the
+    # ecosystem-neutral wording (`flavour: :neutral`) rather than the native "gem"
+    # idiom, so a Go/npm/pypi repo's Code Scanning UI doesn't read as a Ruby audit.
     #
     # result: SbomWorkflow assessed hash ("ecosystem/name@version" => gem_data)
     # source_uri: the SBOM file to point findings at (basename)
@@ -63,12 +67,19 @@ module StillActive
         lockfile_uri: source_uri,
       )
 
-      JSON.pretty_generate(document(results: results, tool_version: tool_version))
+      JSON.pretty_generate(document(results: results, tool_version: tool_version, flavour: :neutral))
     end
 
     private
 
-    def document(results:, tool_version:)
+    def document(results:, tool_version:, flavour:)
+      # The catalog is the single source of truth for BOTH the driver rule list and
+      # each result's ruleIndex (its position in that list). The SBOM (:neutral)
+      # catalog drops the native-only SA006, so a result's ruleIndex must be looked
+      # up against the same-flavour catalog, not the ruby default, or SA007/8/9 would
+      # index the wrong driver rule. Stamping it here keeps the two in lockstep.
+      catalog = Sarif::Rules.all(flavour)
+      index_by_id = catalog.each_with_index.to_h { |rule, i| [rule[:id], i] }
       {
         "$schema" => SARIF_SCHEMA,
         "version" => "2.1.0",
@@ -76,20 +87,29 @@ module StillActive
           "tool" => {
             "driver" => {
               "name" => TOOL_NAME,
-              "semanticVersion" => tool_version,
+              # `version` is the free-form native version string (the RubyGems
+              # version verbatim); `semanticVersion` MUST be SemVer 2.0.0, so a
+              # prerelease like "3.0.0.rc4" is rendered as "3.0.0-rc4". Both derive
+              # from StillActive::VERSION. GitHub Code Scanning only needs `name`,
+              # but some SARIF consumers read either version field.
+              "version" => tool_version,
+              "semanticVersion" => VersionHelper.to_semver(tool_version),
               "informationUri" => TOOL_URI,
-              "rules" => sarif_rules,
+              "rules" => catalog.map { |r| sarif_rule(r) },
             },
           },
           "originalUriBaseIds" => { "%SRCROOT%" => { "uri" => "file:///" } },
-          "results" => results,
+          "results" => results.map { |res| stamp_rule_index(res, index_by_id) },
           "columnKind" => "utf16CodeUnits",
         }],
       }
     end
 
-    def sarif_rules
-      Sarif::Rules.all.map { |r| sarif_rule(r) }
+    # SARIF ruleIndex is optional; omit it rather than emit nil when the rule isn't
+    # in this run's catalog (can't happen today, but never point at a bogus index).
+    def stamp_rule_index(result, index_by_id)
+      index = index_by_id[result["ruleId"]]
+      index ? result.merge("ruleIndex" => index) : result
     end
 
     def sarif_rule(r)
@@ -333,7 +353,6 @@ module StillActive
       latest_part = ruby_info[:latest_version] ? " Latest is #{ruby_info[:latest_version]}." : ""
       base = {
         "ruleId" => "SA006",
-        "ruleIndex" => rule_index("SA006"),
         "level" => "error",
         "message" => { "text" => "Ruby #{version} has reached end-of-life#{eol_part}.#{latest_part}" },
         "locations" => [{
@@ -350,7 +369,6 @@ module StillActive
       level ||= Sarif::Rules.find(rule_id)[:level]
       base = {
         "ruleId" => rule_id,
-        "ruleIndex" => rule_index(rule_id),
         "level" => level,
         "message" => { "text" => message },
         "locations" => [location],
@@ -379,10 +397,6 @@ module StillActive
       Digest::SHA256.hexdigest(["v1", rule_id, gem_name, advisory_id].compact.join("|"))[0, 16]
     end
 
-    def rule_index(rule_id)
-      Sarif::Rules.all.index { |r| r[:id] == rule_id }
-    end
-
     def format_date(value)
       t = ActivityHelper.parse_time(value)
       t ? t.utc.strftime("%Y-%m-%d") : value.to_s

data/lib/helpers/version_helper.rb

@@ -60,6 +60,28 @@ module StillActive
       to_gem_version(version_string)
     end
 
+    # Renders a MAJOR.MINOR.PATCH[.prerelease] RubyGems version as SemVer 2.0.0,
+    # for fields that require it (SARIF's tool.driver.semanticVersion). A gem
+    # prerelease joins its prerelease identifiers to the release with a ".", SemVer
+    # with a "-": "3.0.0.rc4" -> "3.0.0-rc4", "1.2.3.pre.5" -> "1.2.3-pre.5". A
+    # plain release ("3.0.0") is already SemVer and passes through, and a short
+    # numeric release is padded to MAJOR.MINOR.PATCH. A string that doesn't start
+    # with a numeric segment is returned unchanged rather than coerced into a bogus
+    # version. Scoped to the tool's own version scheme: a 4+-segment numeric
+    # release (e.g. a gem like "6.1.7.6") is NOT converted to valid SemVer.
+    def to_semver(version_string)
+      return version_string if version_string.nil? || version_string.empty?
+
+      parts = version_string.split(".")
+      release = parts.take_while { |part| part.match?(/\A\d+\z/) }
+      return version_string if release.empty?
+
+      prerelease = parts.drop(release.length)
+      release << "0" while release.length < 3
+      base = release.join(".")
+      prerelease.empty? ? base : "#{base}-#{prerelease.join(".")}"
+    end
+
     def gem_version(version_hash:)
       version_hash&.dig("number")
     end

data/lib/still_active/sarif/rules.rb

@@ -38,6 +38,15 @@ module StillActive
         format("%.1f", score)
       end
 
+      # Each rule's canonical wording is Ruby-flavoured (the native Gemfile path is
+      # the tool's origin). A rule that can fire on the cross-ecosystem SBOM path
+      # also carries `neutral:` overrides for the strings that name "gem"/Ruby, so a
+      # polyglot SBOM run (Go/npm/pypi/...) emits an ecosystem-agnostic catalog. The
+      # catalog is emitted once per run, so wording is chosen per-run (native vs
+      # SBOM), not per-result. SA006 (Ruby EOL) is genuinely Ruby-only
+      # (`native_only: true`): the SBOM path can never emit it, so the neutral
+      # catalog drops it entirely rather than advertise a "Ruby runtime EOL" rule in,
+      # say, a Go repo's Code Scanning tab.
       RAW_RULES = [
         {
           id: "SA001",
@@ -48,6 +57,11 @@ module StillActive
           level: "error",
           security_severity: "7.5",
           tags: ["security", "supply-chain", "external/cwe/cwe-1357"],
+          neutral: {
+            short: "Package's source repository is archived",
+            full: "The package's upstream repository has been marked archived. No further fixes, including security patches, should be expected.",
+            help_text: "Look for a maintained fork or alternative. If you must keep the package, vendor or fork it so you can apply patches yourself.",
+          },
         },
         {
           id: "SA002",
@@ -58,6 +72,11 @@ module StillActive
           level: "warning",
           security_severity: nil,
           tags: ["maintenance"],
+          neutral: {
+            short: "Package has had no release for over 3 years",
+            full: "The package's latest release is over 3 years old. Not formally archived, but a strong abandonment signal: a consumer cannot pull fixes that were never released. For a package with no releases at all (e.g. git-sourced), the last commit date is used instead.",
+            help_text: "Verify the package still works on your supported runtime and consider a maintained alternative.",
+          },
         },
         {
           id: "SA003",
@@ -68,6 +87,9 @@ module StillActive
           level: "error",
           security_severity: "7.0", # default; per-result override from CVSS
           tags: ["security", "vulnerability", "external/cwe/cwe-1104"],
+          neutral: {
+            short: "Package has known vulnerabilities (via deps.dev / OSV)",
+          },
         },
         {
           id: "SA004",
@@ -78,6 +100,10 @@ module StillActive
           level: "warning",
           security_severity: nil,
           tags: ["maintenance", "libyear"],
+          neutral: {
+            short: "Package is significantly behind the latest release",
+            help_text: "Schedule an upgrade to the latest release.",
+          },
         },
         {
           id: "SA005",
@@ -88,6 +114,9 @@ module StillActive
           level: "note",
           security_severity: nil,
           tags: ["supply-chain", "openssf"],
+          neutral: {
+            short: "Package's OpenSSF Scorecard is low",
+          },
         },
         {
           id: "SA006",
@@ -98,6 +127,7 @@ module StillActive
           level: "error",
           security_severity: "8.5",
           tags: ["security", "runtime", "external/cwe/cwe-1104"],
+          native_only: true,
         },
         {
           id: "SA007",
@@ -108,6 +138,11 @@ module StillActive
           level: "error",
           security_severity: "8.0",
           tags: ["security", "supply-chain", "external/cwe/cwe-1104"],
+          neutral: {
+            short: "Resolved package version has been yanked from its registry",
+            full: "The resolved version has been yanked by the package owner, typically for a serious bug or vulnerability.",
+            help_text: "Update to a non-yanked version immediately.",
+          },
         },
         {
           id: "SA008",
@@ -118,12 +153,17 @@ module StillActive
           level: "warning",
           security_severity: nil, # maintenance/resolvability, not a CVE (as SA002/SA004/SA005)
           tags: ["maintenance", "supply-chain", "external/cwe/cwe-1104"],
+          neutral: {
+            short: "Dormant package caps a dependency below its latest major",
+            full: "A dormant (abandoned or archived) package declares a runtime constraint that caps one of its dependencies below that dependency's current latest major. Because nobody is shipping the package, the cap will never lift, and it grows more constraining as the capped dependency releases new majors: the tree is held below a ceiling no upstream release will raise.",
+            help_text: "Replace or fork the dormant package, or vendor a version that relaxes the constraint. For a transitive pill, target the direct dependency that pulls it in.",
+          },
         },
         {
           id: "SA009",
           name: "RuntimeCeiling",
           short: "Resolved package version caps its language runtime",
-          full: "A resolved package version's declared runtime constraint (Ruby `ruby_version`, Python `requires_python`) caps the language runtime you can run: either below every still-supported release (stranding you on an end-of-life runtime with no security patches) or below the latest stable (a compatibility ceiling to plan around). The default level is note; an EOL-forcing cap is raised to error per result.",
+          full: "A resolved package version's declared runtime constraint (Ruby `ruby_version`, Python `requires_python`, .NET target framework) caps the language runtime you can run: either below every still-supported release (stranding you on an end-of-life runtime with no security patches) or below the latest stable (a compatibility ceiling to plan around). The default level is note; an EOL-forcing cap is raised to error per result.",
           help_text: "If a newer release of the package lifts the cap, upgrade it. Otherwise replace or fork the package, or contribute support for the newer runtime upstream.",
           level: "note",
           security_severity: nil, # maintenance/compatibility, not a CVE (as SA002/SA004/SA005/SA008)
@@ -131,19 +171,34 @@ module StillActive
         },
       ].freeze
 
-      CATALOG = RAW_RULES.map do |r|
-        r.merge(
-          tags: r[:tags].dup.freeze,
-          help_markdown: "#{r[:help_text]}\n\nSee [#{r[:id]} docs](#{help_uri(r[:id])}) for full guidance.",
-        ).freeze
-      end.freeze
+      # Builds a frozen catalog for one wording flavour. `:neutral` applies each
+      # rule's `neutral:` overrides (ecosystem-agnostic wording for the SBOM path);
+      # any other flavour keeps the canonical Ruby wording. help_markdown is derived
+      # from the resolved help_text so it tracks the flavour. The neutral (SBOM)
+      # catalog omits `native_only:` rules, which the cross-ecosystem path can never
+      # emit (SA006, Ruby runtime EOL).
+      def build_catalog(flavour)
+        neutral = flavour == :neutral
+        rules = neutral ? RAW_RULES.reject { |r| r[:native_only] } : RAW_RULES
+        rules.map do |r|
+          resolved = neutral && r[:neutral] ? r.merge(r[:neutral]) : r
+          resolved.except(:neutral, :native_only).merge(
+            tags: r[:tags].dup.freeze,
+            help_markdown: "#{resolved[:help_text]}\n\nSee [#{r[:id]} docs](#{help_uri(r[:id])}) for full guidance.",
+          ).freeze
+        end.freeze
+      end
+
+      CATALOG = build_catalog(:ruby)
+      NEUTRAL_CATALOG = build_catalog(:neutral)
 
-      def all
-        CATALOG
+      # flavour: :ruby (default, native Gemfile path) or :neutral (SBOM path).
+      def all(flavour = :ruby)
+        flavour == :neutral ? NEUTRAL_CATALOG : CATALOG
       end
 
-      def find(id)
-        CATALOG.find { |r| r[:id] == id }
+      def find(id, flavour = :ruby)
+        all(flavour).find { |r| r[:id] == id }
       end
     end
   end

data/lib/still_active/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module StillActive
-  VERSION = "3.0.0.rc3"
+  VERSION = "3.0.0.rc4"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: still_active
 version: !ruby/object:Gem::Version
-  version: 3.0.0.rc3
+  version: 3.0.0.rc4
 platform: ruby
 authors:
 - Sean Floyd