still_active 3.0.0 → 3.2.0

data/lib/still_active/github_client.rb

@@ -2,6 +2,7 @@
 
 require "time"
 require "octokit"
+require_relative "errors"
 
 module StillActive
   # Repo signals (archived?, last commit date) for github.com-hosted gems.
@@ -20,19 +21,37 @@ module StillActive
     # object's pushed_at (last push) stands in for the last-commit date: it
     # matches the default-branch commit date to the day in practice, and folding
     # the two signals into one call halves the per-gem GitHub requests. Returns
-    # {} when the repo can't be read, so the caller leaves both signals blank.
+    # {} when GitHub says the repo doesn't exist; raises RepoAccessDenied when it
+    # refuses the token, and RepoSignalsUnavailable when it can't answer (a rate
+    # limit past its short wait, an error status, a network failure).
+    # RepositorySignals decides what to ask next.
     def repo_signals(owner:, name:)
       return {} if owner.nil? || name.nil?
 
       repo = with_rate_limit_retry("repo #{owner}/#{name}") do
         StillActive.config.github_client.repository("#{owner}/#{name}")
       end
-      return {} unless repo
+      raise RepoSignalsUnavailable, "#{owner}/#{name}: rate limited" if repo == :rate_limited
 
       {archived: repo.archived, last_commit_date: as_time(repo.pushed_at, owner, name)}
+    rescue Octokit::NotFound
+      {}
+    # Permanent "don't know", like a 404: a name Octokit refuses up front (an
+    # ArgumentError), a repository GitHub has blocked, or one withheld for legal
+    # reasons. A rerun won't change them, so they're not a failure.
+    rescue Octokit::InvalidRepository, Octokit::RepositoryUnavailable, Octokit::UnavailableForLegalReasons
+      {}
+    # Rate limits are Forbidden subclasses in Octokit (a 403), but they say
+    # nothing about the repository being private, so they don't stop the chain.
+    rescue Octokit::TooManyRequests, Octokit::AbuseDetected, Octokit::TooManyLoginAttempts => e
+      warn("warning: repo signals failed for #{owner}/#{name}: #{e.class}")
+      raise RepoSignalsUnavailable, "#{owner}/#{name}: #{e.class}"
+    rescue Octokit::Unauthorized, Octokit::Forbidden => e
+      warn("warning: repo signals failed for #{owner}/#{name}: #{e.class}")
+      raise RepoAccessDenied, "#{owner}/#{name}: #{e.class}"
     rescue Octokit::Error, Faraday::Error => e
       warn("warning: repo signals failed for #{owner}/#{name}: #{e.class}")
-      {}
+      raise RepoSignalsUnavailable, "#{owner}/#{name}: #{e.class}"
     end
 
     # Commits on the default branch since the latest release's tag: the
@@ -48,7 +67,8 @@ module StillActive
 
       repo = "#{owner}/#{name}"
       ["v#{version}", version.to_s].each do |tag|
-        return with_rate_limit_retry("unreleased-commits #{repo}") { StillActive.config.github_client.compare(repo, tag, "HEAD").ahead_by }
+        ahead = with_rate_limit_retry("unreleased-commits #{repo}") { StillActive.config.github_client.compare(repo, tag, "HEAD").ahead_by }
+        return (ahead == :rate_limited) ? nil : ahead
       rescue Octokit::NotFound
         # this tag form doesn't exist; fall through to try the next one
       end
@@ -60,6 +80,9 @@ module StillActive
 
     private
 
+    # Only an answer that says whether the repo is archived counts: ecosyste.ms
+    # 404s a repo it hasn't crawled, and after GitHub failed that is nobody
+    # answering.
     # Pause-and-retry on a rate-limit response when the reset is near, so a
     # transient secondary/burst limit (which GitHub's concurrent fan-out can
     # trip even with a token) self-heals instead of dropping the gem's signal.
@@ -76,7 +99,7 @@ module StillActive
           # Surface the one actionable hint rather than a generic class name,
           # then return nil so this signal is simply absent for the gem.
           warn("rate limited on #{label}; set GITHUB_TOKEN to raise your limit, or run less often")
-          return
+          return :rate_limited
         end
 
         retried = true

data/lib/still_active/gitlab_client.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "time"
+require_relative "errors"
 require_relative "helpers/http_helper"
 
 module StillActive
@@ -17,10 +18,13 @@ module StillActive
       return {} if owner.nil? || name.nil?
 
       path = "/api/v4/projects/#{encode_project(owner, name)}"
-      body = HttpHelper.get_json(BASE_URI, path, headers: auth_headers)
+      # {} for a 404 (an answer); RepoSignalsUnavailable when GitLab couldn't answer.
+      body = HttpHelper.get_json(BASE_URI, path, headers: auth_headers, strict: true)
       return {} if body.nil?
 
       {archived: body["archived"] == true, last_commit_date: parse_time(body["last_activity_at"], owner, name)}
+    rescue HttpHelper::Unavailable => e
+      raise RepoSignalsUnavailable, e.message
     end
 
     private

data/lib/still_active/go_toolchain.rb

@@ -0,0 +1,75 @@
+# frozen_string_literal: true
+
+require_relative "osv_client"
+require_relative "helpers/endoflife_helper"
+
+module StillActive
+  # The Go toolchain, which Syft emits as the module `stdlib` (pkg:golang/stdlib@1.27.1).
+  # It is a runtime, and deps.dev can't serve it: it keys versions `go1.27.1` so the
+  # purl's version 404s, its index stops at go1.25.5, and its advisory list is the same
+  # for every version (verified 2026-09-24). So the release lines come from
+  # endoflife.date and the advisories from OSV by version, the sources the Ruby
+  # runtime check already trusts.
+  module GoToolchain
+    extend self
+
+    MODULE = "stdlib"
+
+    def toolchain?(ecosystem, name)
+      ecosystem == :go && name == MODULE
+    end
+
+    # Syft writes 1.27.1, a component version often go1.27.1, Trivy v1.27.1.
+    def release(version)
+      version.to_s.delete_prefix("go").delete_prefix("v")
+    end
+
+    # The same { info:, default:, vulnerabilities:, vulnerabilities_checked:,
+    # project_id:, version_unresolved: }
+    # EcosystemLens builds from deps.dev for any other package.
+    def signals(version:)
+      release = release(version)
+      cycles = EndoflifeHelper.fetch_cycles("/api/go.json")
+      cycles = nil unless cycles.is_a?(Array) && cycles.all?(Hash) && !cycles.empty?
+      latest = cycles&.first
+      cycle = cycles&.find { |c| c["cycle"] == release.split(".").first(2).join(".") }
+      # Only a plain release (1.20 and earlier shipped as go1.20): OSV writes Go
+      # prereleases as 1.27.0-rc.1, so a `1.27rc1` query would come back empty and
+      # read as clean.
+      vulnerabilities = OsvClient.advisories(ecosystem: :go, name: MODULE, version: release) if release.match?(/\A\d+\.\d+(\.\d+)?\z/)
+      warn("warning: go/#{MODULE}@#{release} advisories not checked (not a plain release, or OSV gave no complete answer); treat it as unknown, not clean") if vulnerabilities.nil?
+
+      {
+        info: cycle && {published_at: release_date(cycle, release), licenses: [], **end_of_life(cycle, latest)},
+        default: latest && {version: latest["latest"], published_at: latest["latestReleaseDate"]},
+        vulnerabilities: vulnerabilities || [],
+        vulnerabilities_checked: !vulnerabilities.nil?,
+        project_id: nil,
+        # The feed is up but doesn't know this release line.
+        version_unresolved: !cycles.nil? && cycle.nil?
+      }
+    end
+
+    private
+
+    # The feed dates each line's first and latest release only.
+    def release_date(cycle, release)
+      if release == cycle["latest"]
+        cycle["latestReleaseDate"]
+      elsif [cycle["cycle"], "#{cycle["cycle"]}.0"].include?(release)
+        cycle["releaseDate"]
+      end
+    end
+
+    # Go supports its two newest lines. Past that the Go team has said a line gets no
+    # more fixes, which is the maintainer's deprecation this field already carries.
+    def end_of_life(cycle, latest)
+      return {deprecated: false, deprecation_reason: nil} unless EndoflifeHelper.eol_reached?(cycle["eol"])
+
+      # Worded as what the Go team did, since output labels it the maintainer's note.
+      on = EndoflifeHelper.parse_eol(cycle["eol"])&.strftime(" on %Y-%m-%d")
+      upgrade = latest && " Upgrade to #{latest["latest"]}."
+      {deprecated: true, deprecation_reason: "The Go team ended the #{cycle["cycle"]} release line#{on}; it gets no further security fixes.#{upgrade}"}
+    end
+  end
+end

data/lib/still_active/helpers/alternatives_helper.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require "gems"
+require_relative "../rubygems_client"
 
 module StillActive
   # Turns a gem's catalog siblings into ranked "leads" -- the most-downloaded
@@ -33,7 +33,7 @@ module StillActive
     private
 
     def downloads(gem_name)
-      info = Gems.info(gem_name)
+      info = RubygemsClient.info(gem_name)
       info && info["downloads"]
     rescue
       nil

data/lib/still_active/helpers/cvss_helper.rb

@@ -1,63 +1,29 @@
 # frozen_string_literal: true
 
+require "cvss_suite"
+
 module StillActive
-  # Computes a CVSS score from a vector string, across v2/v3/v4. deps.dev stores only
-  # CVSS 3.x, so a CVSS-4-only advisory (the flagship protobuf case) arrives with no
-  # numeric score; OSV carries the v4 vector, and this turns it into the number the
+  # Computes a CVSS base score from a vector string, across v2/v3/v4. deps.dev stores
+  # only CVSS 3.x, so a CVSS-4-only advisory (the flagship protobuf case) arrives with
+  # no numeric score; OSV carries the v4 vector, and this turns it into the number the
   # SARIF security-severity and CycloneDX rating want.
   #
-  # cvss-suite is an OPTIONAL, undeclared dependency: it over-constrains its own deps
-  # (an exact `bundler` pin, a `bigdecimal ~> 3.1` cap), the poison-pill pattern
-  # still_active itself flags, so hard-requiring it would force that liability on every
-  # user and trip our own audit. CvssHelper soft-requires it; install cvss-suite (or run
-  # the distribution that bundles it) to light it up.
-  #
-  # Returns cvss-suite's `overall_score`: for the base-only vectors OSV publishes that
-  # IS the base score, but a vector carrying threat/environmental metrics would fold
-  # those in -- which is why the severity band floors at the authoritative GHSA label
-  # (VulnerabilityHelper.advisory_severity) and this number never lowers it: the label
-  # drives gating and SARIF level, the number only sharpens display. Fails safe: an
-  # absent gem or an absent/unparseable vector yields nil, never a crash.
+  # Returns the BASE score, not cvss-suite's overall_score: a vector carrying threat or
+  # environmental metrics folds those into overall_score (E:U alone turns a 9.3 into
+  # an 8.1), while NVD and GHSA publish the base score. The severity band still floors
+  # at the authoritative GHSA label (VulnerabilityHelper.advisory_severity) because
+  # labels are assigned by people and can sit off the FIRST band edge; the label drives
+  # gating and SARIF level, the number sharpens display. Fails safe: an absent or
+  # unparseable vector yields nil, never a crash.
   module CvssHelper
     extend self
 
     def score(vector)
-      return unless available?
       return if vector.nil? || vector.to_s.empty?
 
-      cvss = CvssSuite.new(vector.to_s)
-      cvss.valid? ? cvss.overall_score : nil
-    rescue => e
-      # We only reach here with cvss-suite loaded (available?), so a raise is the
-      # installed gem failing this call site -- an incompatible version, a renamed
-      # `overall_score` -- not a bad vector, which cvss-suite reports via valid?.
-      # Fail safe to nil (the number is display-only, never gates), but don't
-      # swallow it: an opted-in-but-broken scorer that emitted nothing would read
-      # as "no advisories are scored". Warn once per run (not per advisory),
-      # matching OsvClient.enrich rather than staying silent.
-      warn_scorer_failed(e)
+      CvssSuite.parse(vector.to_s).base_score
+    rescue CvssSuite::Error
       nil
     end
-
-    # Memoized soft-require: true once cvss-suite loads, false when it isn't installed.
-    def available?
-      return @available unless @available.nil?
-
-      @available = begin
-        require "cvss_suite"
-        true
-      rescue LoadError
-        false
-      end
-    end
-
-    private
-
-    def warn_scorer_failed(error)
-      return if @warned
-
-      @warned = true
-      warn("warning: cvss-suite scoring failed: #{error.class} (#{error.message}); CVSS numbers unavailable this run, check your cvss-suite version")
-    end
   end
 end

data/lib/still_active/helpers/cyclonedx_helper.rb

@@ -6,6 +6,7 @@ require "time"
 require_relative "activity_helper"
 require_relative "status_helper"
 require_relative "vulnerability_helper"
+require_relative "repository_check"
 
 module StillActive
   # Renders a still_active workflow result as a CycloneDX SBOM. Emits 1.6 by
@@ -152,6 +153,12 @@ module StillActive
         "still_active:archived" => boolean_property(data[:archived]),
         "still_active:deprecated" => boolean_property(data[:deprecated]),
         "still_active:deprecation_reason" => data[:deprecation_reason],
+        # An empty vulnerabilities list reads as clean downstream; this says whether
+        # anything was actually looked up.
+        "still_active:vulnerabilities_checked" => boolean_property(data[:vulnerabilities_checked]),
+        # Present only when no service answered: a blank archived flag here is
+        # "unknown", not "no".
+        "still_active:repository_check" => (RepositoryCheck.unanswered?(data) ? data[:repository_check] : nil),
         "still_active:scorecard_score" => data[:scorecard_score]&.to_s,
         "still_active:libyear" => data[:libyear]&.to_s,
         "still_active:last_commit_date" => iso8601(data[:last_commit_date])

data/lib/still_active/helpers/diff_markdown_helper.rb

@@ -12,6 +12,7 @@ module StillActive
 
     BUMP_KIND_LABELS = {
       closed_vulns: "closed vulns",
+      advisories_unchecked: "advisories UNCHECKED",
       introduced_vulns: "INTRODUCED vulns",
       fresher: "fresher",
       older_relative: "older relative to latest",
@@ -149,6 +150,10 @@ module StillActive
           "- #{name} — scorecard #{MarkdownEscape.inline(ch[:from])} → #{MarkdownEscape.inline(ch[:to])}#{note}"
         when :version_yanked
           "- #{name} — version yanked from rubygems"
+        when :advisories_unchecked
+          "- #{name} — advisories could not be checked"
+        when :repository_unchecked
+          "- #{name} — repository no longer checked (#{MarkdownEscape.inline(ch[:check])}; may be archived)"
         when :libyear_worsened
           "- #{name} — libyear #{MarkdownEscape.inline(ch[:from])} → #{MarkdownEscape.inline(ch[:to])} (+#{ch[:delta]}y; same pinned version)"
         end

data/lib/still_active/helpers/emoji_helper.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require_relative "activity_helper"
+require_relative "repository_check"
 
 module StillActive
   module EmojiHelper
@@ -8,7 +9,7 @@ module StillActive
 
     def inactive_gem_emoji(result_hash)
       case ActivityHelper.activity_level(result_hash)
-      when :ok then ""
+      when :ok then RepositoryCheck.unanswered?(result_hash) ? StillActive.config.unsure_emoji : ""
       when :stale then StillActive.config.warning_emoji
       when :archived, :critical then StillActive.config.critical_warning_emoji
       when :unknown then StillActive.config.unsure_emoji

data/lib/still_active/helpers/endoflife_helper.rb

@@ -87,12 +87,13 @@ module StillActive
       end
     end
 
-    private
-
+    # The feed's raw cycles, newest first, or nil when it's unavailable.
     def fetch_cycles(feed_path)
       HttpHelper.get_json(ENDOFLIFE_URI, feed_path)
     end
 
+    private
+
     def normalize_cycle(cycle)
       version = cycle["cycle"]
       return unless version && Gem::Version.correct?(version)

data/lib/still_active/helpers/http_cache.rb

@@ -0,0 +1,109 @@
+# frozen_string_literal: true
+
+require "digest"
+require "fileutils"
+require "json"
+
+module StillActive
+  # An on-disk cache of public sources' JSON answers, so a rerun, or the baseline
+  # and current audits of one CI job, don't ask for the same thing twice. Only the
+  # hosts and paths in RULES are cached, each for as long as that data can be
+  # trusted to hold: an answer that carries advisories for an hour, so a new CVE
+  # is at most an hour late (--no-cache for none), a published version's record
+  # for a week, since it doesn't change. Nothing credentialed is cached: those
+  # hosts aren't listed, and a request with an Authorization header is skipped
+  # whatever its host. Failures and 404s aren't cached, only answers.
+  #
+  # OSV's version query is deliberately absent. It is the arbiter that drops a
+  # deps.dev finding the version isn't affected by, so it must never be older
+  # than the deps.dev record it judges; cached separately, it could be, and would
+  # drop an advisory published after it was cached.
+  module HttpCache
+    extend self
+
+    HOUR = 60 * 60
+    DAY = 24 * HOUR
+    WEEK = 7 * DAY
+
+    # [host, path pattern, seconds], first match wins.
+    RULES = [
+      ["api.deps.dev", %r{\A/v3alpha/systems/[^/]+/packages/[^/]+/versions/[^/]+:requirements\z}, WEEK],
+      ["api.deps.dev", %r{\A/v3alpha/systems/[^/]+/packages/[^/]+/versions/}, HOUR], # carries advisoryKeys
+      ["api.deps.dev", %r{\A/v3alpha/systems/[^/]+/packages/[^/]+\z}, 6 * HOUR], # latest version
+      ["api.deps.dev", %r{\A/v3alpha/advisories/}, 6 * HOUR], # CVSS, which the severity gates read
+      ["api.deps.dev", %r{\A/v3alpha/projects/}, DAY],
+      ["api.osv.dev", %r{\A/v1/vulns/}, 6 * HOUR], # severity and fixed versions
+      ["rubygems.org", %r{\A/api/v1/versions/}, 6 * HOUR],
+      ["rubygems.org", %r{\A/api/v1/gems/}, DAY],
+      ["pypi.org", %r{\A/pypi/[^/]+/[^/]+/json\z}, WEEK], # one published version
+      ["packages.ecosyste.ms", %r{/versions/}, WEEK], # one published version's declared deps
+      ["repos.ecosyste.ms", %r{\A/api/v1/hosts/}, DAY],
+      ["endoflife.date", %r{\A/api/}, DAY]
+    ].freeze
+
+    # Entries older than any rule allows are deleted when the cache is first used.
+    MAX_AGE = WEEK
+
+    # Seconds to cache this request's answer for, or nil to not cache it.
+    def ttl(uri, headers)
+      return unless StillActive.config.http_cache
+      return if headers.keys.any? { _1.to_s.casecmp?("Authorization") }
+
+      RULES.find { |host, pattern, _| uri.host == host && uri.path.match?(pattern) }&.last
+    end
+
+    # The cached answer, or :miss.
+    def read(key, ttl)
+      path = path_for(key)
+      return :miss unless File.exist?(path)
+
+      entry = JSON.parse(File.read(path))
+      age = Time.now.to_f - entry.fetch("stored_at")
+      # A future stamp (clock skew, a cache restored from another machine) would
+      # otherwise never expire.
+      return :miss if age.negative? || age > ttl
+
+      entry.fetch("body")
+    rescue JSON::ParserError, KeyError, TypeError, SystemCallError
+      :miss
+    end
+
+    # Best-effort: a cache that can't be written is just a cache miss next time.
+    def write(key, body)
+      sweep_once
+      path = path_for(key)
+      FileUtils.mkdir_p(File.dirname(path))
+      temp = "#{path}.#{Process.pid}.#{rand(1 << 32)}.tmp"
+      File.write(temp, JSON.generate({"stored_at" => Time.now.to_f, "body" => body}))
+      File.rename(temp, path)
+    rescue SystemCallError, IOError
+      File.delete(temp) if temp && File.exist?(temp)
+    end
+
+    def key(method, uri)
+      Digest::SHA256.hexdigest("#{method}\n#{uri}")
+    end
+
+    def directory
+      base = ENV["XDG_CACHE_HOME"]
+      base = File.join(Dir.home, ".cache") if base.nil? || base.empty?
+      File.join(base, "still_active", "http")
+    end
+
+    private
+
+    def path_for(key)
+      File.join(directory, key[0, 2], "#{key}.json")
+    end
+
+    def sweep_once
+      return if @swept
+
+      @swept = true
+      cutoff = Time.now - MAX_AGE
+      Dir.glob(File.join(directory, "*", "*.{json,tmp}")).each { File.delete(_1) if File.mtime(_1) < cutoff }
+    rescue SystemCallError
+      nil
+    end
+  end
+end