still_active 3.0.0.rc4 → 3.0.0.rc5

data/lib/still_active/workflow.rb

@@ -1,6 +1,8 @@
 # frozen_string_literal: true
 
 require_relative "artifactory_client"
+require_relative "compact_index_client"
+require_relative "source_credentials"
 require_relative "ceiling_reconciler"
 require_relative "deps_dev_client"
 require_relative "osv_client"
@@ -46,8 +48,8 @@ module StillActive
         ruby_range =
           begin
             RubyHelper.supported_ruby_range
-          rescue StandardError => e
-            $stderr.puts("warning: Ruby support window lookup failed: #{e.class} (#{e.message}); skipping language-ceiling checks")
+          rescue => e
+            warn("warning: Ruby support window lookup failed: #{e.class} (#{e.message}); skipping language-ceiling checks")
             nil
           end
         # Resolve the GitHub token once here, single-fibered, before the fan-out:
@@ -79,14 +81,14 @@ module StillActive
               advisory_db: advisory_db,
               catalog: catalog,
               constraint_cache: constraint_cache,
-              ruby_range: ruby_range,
+              ruby_range: ruby_range
             )
           rescue Octokit::TooManyRequests
             $stderr.print("\r\e[K") if on_progress
-            $stderr.puts("rate limited checking #{gem[:name]}: set GITHUB_TOKEN to increase your limit")
-          rescue StandardError => e
+            warn("rate limited checking #{gem[:name]}: set GITHUB_TOKEN to increase your limit")
+          rescue => e
             $stderr.print("\r\e[K") if on_progress
-            $stderr.puts("error occurred for #{gem[:name]}: #{e.class}\n\t#{e.message}")
+            warn("error occurred for #{gem[:name]}: #{e.class}\n\t#{e.message}")
           ensure
             completed += 1
             on_progress&.call(completed, total)
@@ -115,7 +117,7 @@ module StillActive
     private
 
     def gem_info(gem_name:, result_object:, gem_version: nil, source_type: :rubygems, source_uri: nil, direct: true, dependency_path: nil, advisory_db: nil, catalog: nil, constraint_cache: {}, ruby_range: nil)
-      result_object[gem_name] = { source_type: source_type, direct: direct }
+      result_object[gem_name] = {source_type: source_type, direct: direct}
       result_object[gem_name][:dependency_path] = dependency_path if dependency_path
       result_object[gem_name][:version_used] = gem_version if gem_version
 
@@ -129,7 +131,7 @@ module StillActive
           result_object: result_object,
           source_uri: source_uri,
           advisory_db: advisory_db,
-          ruby_range: ruby_range,
+          ruby_range: ruby_range
         )
       end
 
@@ -148,19 +150,19 @@ module StillActive
       signals = repo_signals(
         source: repo_info[:source],
         repository_owner: repo_info[:owner],
-        repository_name: repo_info[:name],
+        repository_name: repo_info[:name]
       )
       commit_date = signals[:last_commit_date]
       archived = signals[:archived]
       last_release = VersionHelper.find_version(versions: vs, pre_release: false)
       last_pre_release = VersionHelper.upcoming_pre_release(
         pre_release: VersionHelper.find_version(versions: vs, pre_release: true),
-        release: last_release,
+        release: last_release
       )
       deps_dev = fetch_deps_dev_info(
         gem_name: gem_name,
         version: gem_version || VersionHelper.gem_version(version_hash: last_release),
-        advisory_db: advisory_db,
+        advisory_db: advisory_db
       )
       result_object[gem_name].merge!({
         latest_version: VersionHelper.gem_version(version_hash: last_release),
@@ -172,10 +174,14 @@ module StillActive
         repository_url: repo_info[:url],
         last_commit_date: commit_date,
         archived: archived,
-        **deps_dev,
+        **deps_dev
       })
 
-      unless vs.empty?
+      # Only a gem that actually lives on public rubygems.org gets a rubygems.org
+      # page link. For a private source, rubygems.org/gems/<name> is a public
+      # name collision (for sidekiq-pro, the 0.0.3 squat-warning decoy), not the
+      # gem the user resolves -- the same #43 substitution the repo-URL guard blocks.
+      unless vs.empty? || unqueryable_private_source?(source_uri)
         result_object[gem_name][:ruby_gems_url] = "https://rubygems.org/gems/#{gem_name}"
       end
 
@@ -184,7 +190,7 @@ module StillActive
           source: repo_info[:source],
           repository_owner: repo_info[:owner],
           repository_name: repo_info[:name],
-          version: VersionHelper.gem_version(version_hash: last_release),
+          version: VersionHelper.gem_version(version_hash: last_release)
         )
       end
 
@@ -194,7 +200,7 @@ module StillActive
           up_to_date: VersionHelper.up_to_date(
             version_used: version_used,
             latest_version: last_release,
-            latest_pre_release_version: last_pre_release,
+            latest_pre_release_version: last_pre_release
           ),
 
           version_used_release_date: VersionHelper.release_date(version_hash: version_used),
@@ -202,8 +208,8 @@ module StillActive
           license: VersionHelper.license(version_hash: version_used),
           libyear: LibyearHelper.gem_libyear(
             version_used_release_date: VersionHelper.release_date(version_hash: version_used),
-            latest_version_release_date: VersionHelper.release_date(version_hash: last_release),
-          ),
+            latest_version_release_date: VersionHelper.release_date(version_hash: last_release)
+          )
         })
       end
 
@@ -218,7 +224,7 @@ module StillActive
           used_ruby_requirement: canonical_ruby_requirement(vs, version_used),
           latest_ruby_requirement: canonical_ruby_requirement(vs, last_release),
           pinned: !version_used.nil?,
-          ruby_range: ruby_range,
+          ruby_range: ruby_range
         )
       end
     end
@@ -297,7 +303,7 @@ module StillActive
         repository_url: repo_info[:url],
         last_commit_date: signals[:last_commit_date],
         archived: signals[:archived],
-        **deps_dev,
+        **deps_dev
       })
     end
 
@@ -311,7 +317,7 @@ module StillActive
 
       leads = AlternativesHelper.leads_for(gem_name: gem_name, index: catalog)
       result_object[gem_name][:alternatives] = leads unless leads.empty?
-    rescue StandardError
+    rescue
       nil # cosmetic best-effort: lead-fetching must never break the core audit
     end
 
@@ -373,7 +379,7 @@ module StillActive
       # drop the advisory and read a known-vulnerable gem as clean, so an
       # un-enriched key still contributes a minimal advisory (mirrors EcosystemLens;
       # ruby-advisory-db then fills the score on merge when it also carries it).
-      deps_dev_vulns = advisory_keys.map { |id| DepsDevClient.advisory_detail(advisory_id: id) || { id: id, source: "deps.dev" } }
+      deps_dev_vulns = advisory_keys.map { |id| DepsDevClient.advisory_detail(advisory_id: id) || {id: id, source: "deps.dev"} }
       radb_vulns = RubyAdvisoryDb.advisories_for(database: advisory_db, gem_name: gem_name, version: version)
       vulnerabilities = VulnerabilityHelper.merge_advisories(deps_dev: deps_dev_vulns, ruby_advisory_db: radb_vulns)
       # Enrich with OSV: a real GHSA severity label (deps.dev can't score a CVSS-4-only
@@ -384,7 +390,7 @@ module StillActive
         scorecard_score: scorecard&.dig(:score),
         scorecard_maintained: scorecard&.dig(:maintained),
         vulnerability_count: vulnerabilities.length,
-        vulnerabilities: vulnerabilities,
+        vulnerabilities: vulnerabilities
       }
     end
 
@@ -394,8 +400,7 @@ module StillActive
       elsif ArtifactoryClient.artifactory_uri?(source_uri)
         ArtifactoryClient.versions(gem_name: gem_name, source_uri: source_uri)
       elsif unqueryable_private_source?(source_uri)
-        warn_unqueryable_private_source(gem_name: gem_name, source_uri: source_uri)
-        []
+        private_source_versions(gem_name: gem_name, source_uri: source_uri)
       else
         Gems.versions(gem_name)
       end
@@ -409,7 +414,7 @@ module StillActive
     # best-effort feature must not be able to degrade an unrelated gem's core data:
     # degrade to "no versions known" here, exactly like Gems::NotFound.
     rescue Gems::GemError, *HttpHelper::TRANSPORT_ERRORS => e
-      $stderr.puts("warning: rubygems.org versions lookup failed for #{gem_name}: #{e.class} (#{e.message})")
+      warn("warning: rubygems.org versions lookup failed for #{gem_name}: #{e.class} (#{e.message})")
       []
     end
 
@@ -437,11 +442,32 @@ module StillActive
       false
     end
 
+    # Any Bundler-compatible private host (Contribsys, Gemstash, Gemfury, a private
+    # mirror) serves the RubyGems compact index, since that is how `bundle install`
+    # resolves from it. So try that agnostic rail before declaring the source
+    # unqueryable: it covers the whole class with no per-host client, and falls
+    # through to the same warning when a host does not serve it. Auth is Bundler's
+    # own host-keyed credential only; still_active's ambient --artifactory-token is
+    # never sent to a lockfile-derived host this way (that stays ArtifactoryClient's,
+    # behind its host allowlist). The repo-signal path is untouched, so #43 still
+    # blocks a public name-collision's repo data from standing in for the private gem.
+    def private_source_versions(gem_name:, source_uri:)
+      versions = CompactIndexClient.versions(
+        gem_name: gem_name,
+        source_uri: source_uri,
+        headers: SourceCredentials.headers_for(source_uri)
+      )
+      return versions unless versions.empty?
+
+      warn_unqueryable_private_source(gem_name: gem_name, source_uri: source_uri)
+      []
+    end
+
     def warn_unqueryable_private_source(gem_name:, source_uri:)
       host = URI(source_uri).host
-      $stderr.puts(
+      warn(
         "warning: #{gem_name} resolves from a private source (#{host}) still_active cannot query; " \
-          "reporting no version/latest/libyear data for it rather than substituting public rubygems.org data",
+          "reporting no version/latest/libyear data for it rather than substituting public rubygems.org data"
       )
     end
 
@@ -450,7 +476,7 @@ module StillActive
       namespace_path = base.path
       path = "#{namespace_path}/api/v1/gems/#{CGI.escape(gem_name)}/versions.json"
       token = StillActive.config.github_oauth_token
-      headers = token ? { "Authorization" => "Bearer #{token}" } : {}
+      headers = token ? {"Authorization" => "Bearer #{token}"} : {}
       HttpHelper.get_json(base, path, headers: headers) || []
     end
 
@@ -471,7 +497,7 @@ module StillActive
     # deps.dev scorecards index github.com and gitlab.com only. A Forgejo/Codeberg
     # repo has no deps.dev project, so leave its project_id nil rather than minting
     # a bogus github.com/owner/name that would fetch the wrong (or no) scorecard.
-    DEPS_DEV_HOST_BY_SOURCE = { github: "github.com", gitlab: "gitlab.com" }.freeze
+    DEPS_DEV_HOST_BY_SOURCE = {github: "github.com", gitlab: "gitlab.com"}.freeze
 
     def deps_dev_project_id(repo)
       host = DEPS_DEV_HOST_BY_SOURCE[repo[:source]]
@@ -505,7 +531,7 @@ module StillActive
 
       [
         info.metadata&.dig("source_code_uri"),
-        info.homepage,
+        info.homepage
       ].compact.uniq
     end
 
@@ -521,7 +547,7 @@ module StillActive
 
       [
         info["homepage_uri"],
-        info["source_code_uri"],
+        info["source_code_uri"]
       ].compact.uniq
     rescue Gems::NotFound
       []

data/still_active.gemspec

@@ -3,14 +3,14 @@
 require_relative "lib/still_active/version"
 
 Gem::Specification.new do |spec|
-  spec.name          = "still_active"
-  spec.version       = StillActive::VERSION
-  spec.authors       = ["Sean Floyd"]
-  spec.email         = ["contact@seanfloyd.dev"]
+  spec.name = "still_active"
+  spec.version = StillActive::VERSION
+  spec.authors = ["Sean Floyd"]
+  spec.email = ["contact@seanfloyd.dev"]
 
-  spec.summary       = "Audit your dependencies for maintenance health, abandonment, and below-the-fix vulnerabilities. " \
+  spec.summary = "Audit your dependencies for maintenance health, abandonment, and below-the-fix vulnerabilities. " \
     "Ruby gems natively; npm, PyPI, Cargo, Go, Maven, and NuGet via a CycloneDX SBOM."
-  spec.description   = "Analyses your Gemfile.lock for dependency health across the full transitive graph: " \
+  spec.description = "Analyses your Gemfile.lock for dependency health across the full transitive graph: " \
     "whether each gem is actively maintained (last activity on GitHub, GitLab, or Codeberg/Forgejo, plus " \
     "release recency), outdated versions, archived repos, OpenSSF Scorecard scores, known vulnerabilities " \
     "(deps.dev and OSV, merged with ruby-advisory-db, flagging advisories with no fix and pins that sit below " \
@@ -24,9 +24,14 @@ Gem::Specification.new do |spec|
     "with granular, committed suppression via .still_active.yml. " \
     "Complements bundle outdated, bundler-audit, and libyear-bundler by adding the maintenance signal they " \
     "don't, and folds their version, CVE, and libyear checks into one report."
-  spec.homepage      = "https://github.com/SeanLF/still_active"
-  spec.license       = "MIT"
+  spec.homepage = "https://github.com/SeanLF/still_active"
+  spec.license = "MIT"
   spec.required_ruby_version = ">= 3.3.0"
+  # Gem::Resolver::APISet::GemParser, which parses the RubyGems compact index for
+  # the Artifactory client, first shipped in RubyGems 3.2.3. Ruby 3.3.0 bundles
+  # 3.5.3, so this is documentation of the real dependency rather than a bound
+  # anyone can trip.
+  spec.required_rubygems_version = ">= 3.2.3"
 
   spec.metadata["homepage_uri"] = spec.homepage
   spec.metadata["source_code_uri"] = spec.homepage
@@ -36,23 +41,14 @@ Gem::Specification.new do |spec|
   spec.metadata["rubygems_mfa_required"] = "true"
 
   spec.files = Dir.chdir(File.expand_path(__dir__)) do
-    %x(git ls-files -z).split("\x0").select do |f|
+    `git ls-files -z`.split("\x0").select do |f|
       f.start_with?("lib/", "bin/still_active") || f.match?(/\A(LICENSE|README|CHANGELOG|still_active\.gemspec)\b/)
     end
   end
-  spec.bindir        = "bin"
-  spec.executables   = spec.files.grep(%r{\Abin/still_active}) { |f| File.basename(f) }
+  spec.bindir = "bin"
+  spec.executables = spec.files.grep(%r{\Abin/still_active}) { |f| File.basename(f) }
   spec.require_paths = ["lib"]
 
-  spec.add_development_dependency("bundler-audit")
-  spec.add_development_dependency("debug")
-  spec.add_development_dependency("faker")
-  spec.add_development_dependency("json_schemer")
-  spec.add_development_dependency("rubocop")
-  spec.add_development_dependency("rubocop-performance")
-  spec.add_development_dependency("rubocop-rspec")
-  spec.add_development_dependency("rubocop-shopify")
-
   # 2.0/2.1 ship a scheduler that breaks our fan-out (io_read); 2.2 is the
   # verified floor (checked against Ruby 3.3 in Docker). octokit/faraday-retry/
   # gems work down to ancient versions, so they stay unpinned rather than

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: still_active
 version: !ruby/object:Gem::Version
-  version: 3.0.0.rc4
+  version: 3.0.0.rc5
 platform: ruby
 authors:
 - Sean Floyd
@@ -9,118 +9,6 @@ bindir: bin
 cert_chain: []
 date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
-- !ruby/object:Gem::Dependency
-  name: bundler-audit
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-- !ruby/object:Gem::Dependency
-  name: debug
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-- !ruby/object:Gem::Dependency
-  name: faker
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-- !ruby/object:Gem::Dependency
-  name: json_schemer
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-- !ruby/object:Gem::Dependency
-  name: rubocop
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-- !ruby/object:Gem::Dependency
-  name: rubocop-performance
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-- !ruby/object:Gem::Dependency
-  name: rubocop-rspec
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-- !ruby/object:Gem::Dependency
-  name: rubocop-shopify
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
 - !ruby/object:Gem::Dependency
   name: async
   requirement: !ruby/object:Gem::Requirement
@@ -281,6 +169,7 @@ files:
 - lib/still_active/artifactory_client.rb
 - lib/still_active/ceiling_reconciler.rb
 - lib/still_active/cli.rb
+- lib/still_active/compact_index_client.rb
 - lib/still_active/config.rb
 - lib/still_active/config_file.rb
 - lib/still_active/core_ext.rb
@@ -300,6 +189,7 @@ files:
 - lib/still_active/sarif/rules.rb
 - lib/still_active/sbom_reader.rb
 - lib/still_active/sbom_workflow.rb
+- lib/still_active/source_credentials.rb
 - lib/still_active/suppressions.rb
 - lib/still_active/version.rb
 - lib/still_active/workflow.rb
@@ -326,9 +216,9 @@ required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '0'
+      version: 3.2.3
 requirements: []
-rubygems_version: 4.0.10
+rubygems_version: 4.0.16
 specification_version: 4
 summary: Audit your dependencies for maintenance health, abandonment, and below-the-fix
   vulnerabilities. Ruby gems natively; npm, PyPI, Cargo, Go, Maven, and NuGet via