still_active 3.1.0 → 3.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1b366f37d158cbf7b8e13c552ead6eefec0ec98270b9f8c511505d39a6299631
-  data.tar.gz: efb7a1a7cb3b12a9a8ec8e8aed8b955ec600ef8a35f455d2fe9185611a41ce6a
+  metadata.gz: 9b11131a38933e905499e2dac823f23e16e688d4675b64b490b9b8afa7e7d070
+  data.tar.gz: 800a1a333158f68e4fbac53e5100856fb916bd656ae3fa99eb8f4aaa321e06f6
 SHA512:
-  metadata.gz: 1dac0f642b896d150070c5d63172cf1102d6a978b6605d45a6e44b80ee548c9ec77e3f3922c1c6865cefee2a2ae576e2059bbee919bf69399709ad09a69b3963
-  data.tar.gz: f76ad2676b526b1819d97051f31da33d690f032d5eb23f352074e6d086668fc9223a460402220f73698023dfd0de10ae2288a222fb88fd2c3981b9a9c11d5b89
+  metadata.gz: 8046b2bbcf962238198e37f27d5851ce6054588d4bfc3ccf56bd895e5e8c584843e4fbec820ab185a187649f7fd49f7a93ec843fbd3d58c2d4b3ca8b0816e80c
+  data.tar.gz: 703060b75de10f048e82102f8c87b59be4cd639b3fba6adc51d2ca9f8ce2338122148ce383c37b232f29cca8a549552944be4b7b36a80124c98d84365fe8fb6e

data/CHANGELOG.md

@@ -2,6 +2,33 @@
 
 ## [Unreleased]
 
+## [3.2.0] - 2026-09-24
+
+**Upgrading from 3.1:** a few runs that passed can now fail, each where 3.1 read an unanswered question as "clean". `--fail-if-vulnerable` fails on a dependency whose advisories no source could answer for (`vulnerabilities_checked: false`), and `--fail-if-critical` / `--fail-if-warning` on one whose repository check failed (`repository_check: "failed"`); each names the dependency, a rerun usually clears it, and a suppression accepts it. Statuses that used to read `ok` for a dependency still_active couldn't check (no repository link, Google's go.googlesource.com, a private or deleted repository) now read `unknown`, without failing any gate. JSON gains fields and never loses one; the `--sbom` JSON now names its schema.
+
+### Added
+
+- **The SBOM audit reads GitLab and Codeberg repositories.** It only asked about github.com repositories before, so a GitLab or Codeberg project in an SBOM never got an archived signal. Both audits now resolve repositories through one shared lookup, and the JSON's new `repository_source` says which service answered (`github`, `ecosyste.ms`, `gitlab`, `codeberg`).
+- **A JSON Schema for the `--sbom` output**, `docs/still_active.sbom.schema.json`, which the output now names in `$schema`. Fields shared with the Gemfile audit reference its schema rather than copying it, and the suite validates real output against it. Writing it caught a gap: the Go toolchain's advisories carry `source: "osv"`, which the shared vulnerability definition didn't allow; it does now.
+- **An on-disk cache of public sources' answers.** A rerun, or the baseline and current audits of one CI job, no longer ask the same questions twice: on a 300-component SBOM a second run made a handful of requests instead of hundreds and took half the time, with identical output. Each kind of answer is kept only as long as it holds (which advisories affect a version an hour, latest versions and advisory scores six hours, a published version's metadata a week; see `docs/configuration.md`), so a new advisory can surface up to an hour late, and `--no-cache` skips it. Nothing credentialed, no failure and no 404 is cached, and neither are the answers that must be current: OSV's check of which advisories really affect a version (it can drop a finding), the source-health canaries, and a malformed version record.
+- **A source-health check before every audit, on both paths.** deps.dev is an alpha API and the advisory source for nearly everything, so still_active now checks once that it answers in shape (the advisory canary, which the Gemfile audit never ran before) and, per audited ecosystem, that its index is current: one of a small set of packages that publish often (`next`, `boto3`, `aws-partitions`, ...) must show a version published in the last 30 days. The sets were picked by replaying two years of deps.dev history, where the longest quiet stretch for any set is 10 days. Where either fails, deps.dev's advisories for that ecosystem count as unchecked (so `--fail-if-vulnerable` fails closed on them), a warning says why, and both JSON outputs carry a `source_health` block. ruby-advisory-db and the Go toolchain's OSV lookup still answer on their own. It costs one request plus about one per ecosystem. It can't catch a single stale package in a live index.
+
+### Changed
+
+- **Internal: every dependency's assessment is now a typed `StillActive::Assessment`.** Both audits build it once all their passes are done. An unknown field is reported (and dropped) rather than read as a silent `nil`, and the answers that decide "clean or unknown" (`vulnerabilities_checked`, `repository_check`) can no longer be missing: a dependency whose assessment stopped part-way reads unchecked and failed, never fine. Output is unchanged (verified byte-for-byte, JSON, terminal, markdown and SARIF).
+- **A third fewer requests to deps.dev.** Every dependency's version record now comes from one batch request before the audit starts, instead of one request each: on a 300-component SBOM, 705 deps.dev requests became 475. Anything the batch doesn't answer cleanly is looked up one at a time as before, so it can't change a result. It doesn't make the run faster; it's less load on a free API.
+- **About 30% faster on an SBOM, from reusing connections.** Every request used to open its own TLS connection; HttpHelper now keeps one open per host and reuses it. On a 300-component, four-ecosystem SBOM, connections to deps.dev went from 705 to 12 and the run from about 24s to 17s, with identical output. A rate limit that says when to come back (a 429 or 503 with `Retry-After` of 10 seconds or less) now gets one retry after that wait instead of failing the lookup.
+- **A failed advisory lookup is no longer reported as "0 vulnerabilities".** Before, a deps.dev timeout, 5xx or 429 on a dependency's version record read exactly like a clean one, so a network blip could pass `--fail-if-vulnerable` with a vulnerable dependency in the tree. Now the lookup is retried once, and if no source answers (including a version record with no `advisoryKeys` list, which is what deps.dev schema drift looks like) the dependency carries `vulnerabilities_checked: false`, as does one whose assessment raised part-way: its status reads `unknown` rather than `ok` or `legacy` (the two verdicts that claim clean), the terminal and markdown show `?`, both JSON summaries count `vulnerabilities_unchecked`, the enriched CycloneDX marks it, **`--fail-if-vulnerable` fails closed on it** with a warning naming it, and the `--baseline` diff reports a bump to an unchecked version as a regression instead of "closed vulns". A 404 is still an answer (a private package deps.dev has never seen stays checked), and on the native path a loaded ruby-advisory-db answers on its own. If this turns a run red, rerun it, or `--ignore` the dependency.
+- **One fewer runtime dependency: `gems` is gone.** Its two rubygems.org calls now go through the same HTTP layer as every other source, so they get the same timeouts, body cap and redirect rules. That also fixes a crash path: a 5xx or 429 from rubygems.org's gem-info endpoint escaped as an exception and cost the gem every signal, not just its repository link. Artifactory's copy of the same API shares the client.
+
+### Fixed
+
+- **A deprecated Go module reads as deprecated whichever version is pinned, and its real latest version is reported.** Go deprecates a module, not a version: a `// Deprecated:` comment in the latest `go.mod` covers every version, which is what `go list -m -u` shows, but deps.dev flags only the versions whose `go.mod` carries it. still_active read the pinned version's flag, so an older pin looked fine; and it skipped deprecated versions when picking the latest (right for npm, where one bad release gets deprecated), so for a deprecated Go module it reported a years-old version as the latest and an old pin as up to date. `github.com/golang/protobuf@v1.3.5` now reads deprecated, latest `v1.5.4`, with Go's own message. A retracted Go version (deps.dev flags it the same way, as "Version retracted: ...") still marks only that version and is never reported as the latest.
+- **Without a GitHub token, a repository ecosyste.ms hasn't crawled no longer reads as "not archived".** ecosyste.ms answers first in that mode, and about one repository in twenty isn't in it; that "don't know" used to read as "not archived". GitHub is now asked about those, without a token (60 requests an hour), and one neither service knows reads `unknown` (`repository_check: "unknowable"`), never "not archived". Private-source repositories are no longer sent to ecosyste.ms, with or without a token.
+- **A repository no service could check no longer reads as "not archived".** When GitHub's API refused a repository lookup (a burst of concurrent requests trips its secondary rate limit, even with a token), `archived` came back blank, and a blank `archived` read as "not archived": in a real run, two archived repositories came out `ok` and `stale`. GitHub and ecosyste.ms, which mirrors the same fields, now back each other up, so a rate limit alone no longer loses the signal (verified on a 300-component SBOM with every GitHub call refused: the same repositories read archived). Each dependency now carries `repository_check`: `answered`; `failed` (a service couldn't answer; a rerun may help, so **`--fail-if-critical` / `--fail-if-warning` fail closed on it**, with a warning naming it, and an `activity` suppression accepts it); or `unknowable` (no service can say: no repository link, a host with no archived state such as Google's go.googlesource.com, or every service asked didn't know it, which is how a private or deleted repository looks; a rerun won't change it, so it doesn't fail the gates). Anything not answered turns an `ok` or `legacy` status into `unknown` and shows `?` in the terminal and markdown; the JSON summaries tally `repository_checks`, CycloneDX marks it, and the `--baseline` diff reports a dependency that was answered and no longer is. A dependency whose assessment failed part-way counts as `failed`.
+- **The Go toolchain (`pkg:golang/stdlib`) is assessed from endoflife.date and OSV, not deps.dev.** deps.dev keys it `go1.27.1` where the purl says `1.27.1`, its index stops at go1.25.5, and its advisory list is the same for every version, so stdlib read as behind a stale "latest" and **every stdlib pin reported zero advisories**. It now reads its latest release from endoflife.date, its advisories from OSV for that exact version, and an end-of-life release line as deprecated, naming the line to move to. If OSV can't answer, its advisories are marked unchecked (see below) and a warning says so.
+- **No more HTTP 400 warnings for repositories deps.dev doesn't index.** deps.dev keys projects under github.com, gitlab.com and bitbucket.org only, so every `golang.org/x/*` module (hosted on go.googlesource.com), and anything on Codeberg or a self-hosted GitLab, printed a warning for a lookup that could never succeed. still_active no longer makes that request. A `GitHub.com` or `www.github.com` repository link is normalized, so those now get their scorecard.
+
 ## [3.1.0] - 2026-09-07
 
 ### Changed

data/README.md

@@ -130,6 +130,8 @@ Point `--sbom` at a CycloneDX SBOM (from [Syft](https://github.com/anchore/syft)
 | Language-runtime ceiling (SA009) | Ruby | Python |
 | Ruby EOL (SA006), yanked (SA007) | Yes | n/a |
 
+The Go toolchain (`stdlib`) isn't a module deps.dev can serve, so it's read from endoflife.date and OSV instead, and an end-of-life Go release line is reported as deprecated (SA010). A deprecated Go module (`// Deprecated:` in its latest `go.mod`) is deprecated whichever version is pinned, as `go list -m -u` reports it.
+
 Full rule detail in [`docs/rules.md`](docs/rules.md).
 </details>
 
@@ -219,7 +221,7 @@ Full semantics, thresholds, and transitive behaviour: [`docs/configuration.md`](
 
 ## Data sources
 
-Release dates and licenses from [RubyGems](https://rubygems.org) / [GitHub Packages](https://docs.github.com/en/packages) / [Artifactory](https://jfrog.com/artifactory/); repo activity from the [GitHub](https://docs.github.com/en/rest) / [GitLab](https://docs.gitlab.com/ee/api/) / [Codeberg](https://forgejo.org/docs/latest/user/api-usage/) API, or [ecosyste.ms](https://ecosyste.ms) tokenless ([CC-BY-SA 4.0](https://creativecommons.org/licenses/by-sa/4.0/)); OpenSSF Scorecard and CVSS from [deps.dev](https://deps.dev); advisory severities and fixed-version ranges from [OSV](https://osv.dev), scored with [`cvss-suite`](https://rubygems.org/gems/cvss-suite) when deps.dev has no number (CVSS 4.0); extra advisories from [ruby-advisory-db](https://github.com/rubysec/ruby-advisory-db); runtime EOL from [endoflife.date](https://endoflife.date).
+Release dates and licenses from [RubyGems](https://rubygems.org) / [GitHub Packages](https://docs.github.com/en/packages) / [Artifactory](https://jfrog.com/artifactory/); repo activity from the [GitHub](https://docs.github.com/en/rest) API and [ecosyste.ms](https://ecosyste.ms) ([CC-BY-SA 4.0](https://creativecommons.org/licenses/by-sa/4.0/)), each the other's fallback (GitHub first with a token), and from the [GitLab](https://docs.gitlab.com/ee/api/) / [Codeberg](https://forgejo.org/docs/latest/user/api-usage/) API, on both audits; a repository no service can check reads `unknown`, never "not archived" (`repository_check`); OpenSSF Scorecard and CVSS from [deps.dev](https://deps.dev); advisory severities and fixed-version ranges from [OSV](https://osv.dev), scored with [`cvss-suite`](https://rubygems.org/gems/cvss-suite) when deps.dev has no number (CVSS 4.0); extra advisories from [ruby-advisory-db](https://github.com/rubysec/ruby-advisory-db); runtime EOL from [endoflife.date](https://endoflife.date). Public sources' answers are cached under `~/.cache/still_active/http`, each for as long as it holds (advisories an hour); `--no-cache` skips it.
 
 ## Development
 

data/lib/still_active/artifactory_client.rb

@@ -1,7 +1,6 @@
 # frozen_string_literal: true
 
 require "bundler"
-require "cgi"
 require "json"
 require "uri"
 require_relative "helpers/http_helper"
@@ -32,7 +31,7 @@ module StillActive
       compact = CompactIndexClient.versions(gem_name: gem_name, source_uri: source_uri, headers: headers)
       return dated(compact, gem_name: gem_name, source_uri: source_uri, headers: headers) unless compact.empty?
 
-      vs = RubygemsClient.versions(gem_name: gem_name, source_uri: source_uri, headers: headers)
+      vs = StillActive::RubygemsClient.versions(gem_name, base: URI(source_uri.chomp("/")), headers: headers)
       return vs unless vs.empty?
 
       AqlClient.versions(gem_name: gem_name, source_uri: source_uri, headers: headers)
@@ -49,7 +48,7 @@ module StillActive
     def dated(versions, gem_name:, source_uri:, headers:)
       return versions if versions.all? { |version| version["created_at"] }
 
-      published = RubygemsClient.versions(gem_name: gem_name, source_uri: source_uri, headers: headers)
+      published = StillActive::RubygemsClient.versions(gem_name, base: URI(source_uri.chomp("/")), headers: headers)
       return versions unless published.is_a?(Array)
 
       by_number = published.grep(Hash).to_h { |version| [version["number"], version] }
@@ -93,23 +92,6 @@ module StillActive
       SourceCredentials.auth_header(credentials(gem_name: gem_name, source_uri: source_uri))
     end
 
-    # Artifactory's Rubygems-compatible API
-    module RubygemsClient
-      extend self
-
-      def versions(gem_name:, source_uri:, headers: {})
-        base = URI(source_uri.chomp("/"))
-        path = "#{base.path}/api/v1/versions/#{encode(gem_name)}.json"
-        HttpHelper.get_json(base, path, headers: headers) || []
-      end
-
-      private
-
-      def encode(value)
-        CGI.escape(value)
-      end
-    end
-
     # AQL stands for Artifactory Query Language
     # https://docs.jfrog.com/artifactory/docs/artifactory-query-language
     module AqlClient

data/lib/still_active/assessment.rb

@@ -0,0 +1,85 @@
+# frozen_string_literal: true
+
+module StillActive
+  # One dependency's assessment, as every consumer (status, gates, renderers)
+  # reads it. Both audit paths assemble a hash field by field, then build this
+  # once every pass over it is done, so what reaches a consumer is complete:
+  #
+  # - Every field is declared here. An unknown one, when building or reading, is
+  #   an error in the specs (strict, set by spec_helper) and a warning in a
+  #   user's run, where it's dropped: the build happens after every lookup is
+  #   paid for, and one stray field mustn't cost the whole audit's output.
+  # - The answers that decide "clean or unknown" are never missing. A hash that
+  #   never had its advisories looked up is vulnerabilities_checked: false; one
+  #   that never reached its repository is repository_check: "failed". A missing
+  #   key used to read as "fine" wherever a consumer tested it for false.
+  #
+  # to_h gives back only the fields the path set (and the decided answers), so
+  # the JSON output keeps its shape: a field absent from it stays absent.
+  class Assessment < Data.define(
+    :ecosystem, :name, :purl, :source_type, :production, :direct, :dependency_path,
+    :version_used, :version_used_release_date, :version_yanked, :version_unresolved,
+    :latest_version, :latest_version_release_date,
+    :latest_pre_release_version, :latest_pre_release_version_release_date,
+    :up_to_date, :libyear, :license, :deprecated, :deprecation_reason,
+    :repository_url, :repository_source, :repository_check, :last_commit_date, :archived,
+    :ruby_gems_url, :unreleased_commits, :scorecard_score, :scorecard_maintained,
+    :vulnerability_count, :vulnerabilities_checked, :vulnerabilities,
+    :constraints, :poison, :poison_severity, :poison_security_relevant, :poison_below_fix,
+    :language_ceiling, :alternatives,
+    :given
+  )
+    FIELDS = (members - [:given]).freeze
+    REPOSITORY_CHECKS = ["answered", "failed", "unknowable", "not_applicable"].freeze
+
+    class << self
+      attr_accessor :strict
+
+      def from(hash)
+        unknown = hash.keys - FIELDS
+        unless unknown.empty?
+          unknown_field!(ArgumentError, "unknown assessment field(s): #{unknown.join(", ")}")
+          hash = hash.slice(*FIELDS)
+        end
+
+        # Only an explicit answer counts: missing, nil or unrecognised is not one.
+        decided = {
+          vulnerabilities_checked: hash[:vulnerabilities_checked] == true,
+          repository_check: REPOSITORY_CHECKS.include?(hash[:repository_check]) ? hash[:repository_check] : "failed"
+        }
+        values = FIELDS.to_h { [_1, nil] }.merge(hash, decided)
+        new(**values, given: (hash.keys | decided.keys).freeze)
+      end
+
+      def unknown_field!(error, message)
+        raise error, message if strict
+
+        warn("warning: #{message} (an internal bug; please report it)")
+      end
+    end
+
+    def [](field)
+      unless FIELDS.include?(field)
+        self.class.unknown_field!(KeyError, "unknown assessment field: #{field.inspect}")
+        return
+      end
+
+      public_send(field)
+    end
+
+    def dig(field, *rest)
+      value = self[field]
+      (rest.empty? || value.nil?) ? value : value.dig(*rest)
+    end
+
+    # Whether the path set this field (it may still be nil).
+    def key?(field) = given.include?(field)
+    alias_method :has_key?, :key?
+
+    def to_h = given.to_h { [_1, public_send(_1)] }
+
+    def to_json(*args) = to_h.to_json(*args)
+
+    def with(**changes) = super(**changes, given: (given | changes.keys).freeze)
+  end
+end

data/lib/still_active/cli.rb

@@ -12,6 +12,7 @@ require_relative "helpers/dependency_helper"
 require_relative "helpers/diff_markdown_helper"
 require_relative "helpers/emoji_helper"
 require_relative "helpers/markdown_helper"
+require_relative "helpers/repository_check"
 require_relative "helpers/sarif_helper"
 require_relative "helpers/status_helper"
 require_relative "helpers/summary_helper"
@@ -19,6 +20,7 @@ require_relative "helpers/terminal_helper"
 require_relative "helpers/version_helper"
 require_relative "helpers/vulnerability_helper"
 require_relative "sbom_reader"
+require_relative "assessment"
 require_relative "sbom_workflow"
 require_relative "workflow"
 
@@ -27,6 +29,7 @@ module StillActive
     # The committed JSON Schema for the --json output. Emitted as `$schema` so
     # the output is self-describing and a consumer can validate it.
     SCHEMA_URL = "https://raw.githubusercontent.com/SeanLF/still_active/main/docs/still_active.schema.json"
+    SBOM_SCHEMA_URL = "https://raw.githubusercontent.com/SeanLF/still_active/main/docs/still_active.sbom.schema.json"
 
     def run(args)
       # Apply the committed .still_active.yml first so CLI flags (parsed next)
@@ -65,11 +68,12 @@ module StillActive
       end
 
       warn_stale_suppressions
+      health = checked_source_health([:rubygems])
 
       result = if $stderr.tty?
-        Workflow.call { |done, total| $stderr.print("\rChecking #{done}/#{total} gems...") }
+        Workflow.call(health: health) { |done, total| $stderr.print("\rChecking #{done}/#{total} gems...") }
       else
-        Workflow.call
+        Workflow.call(health: health)
       end
       $stderr.print("\r\e[K") if $stderr.tty?
 
@@ -96,7 +100,7 @@ module StillActive
             # Surface the derived verdict so a machine/LLM consumer reads it
             # directly instead of re-deriving it from the raw dates.
             gems: result.transform_values do |data|
-              data.merge(
+              data.to_h.merge(
                 activity_level: ActivityHelper.activity_level(data),
                 status: StatusHelper.gem_status(data)
               )
@@ -104,6 +108,7 @@ module StillActive
           }
           output[:ruby] = ruby_info if ruby_info
           output[:pr_context] = pr_context if pr_context
+          output[:source_health] = health.as_json
           puts iso8601_times(output).to_json
         when :terminal
           puts BotContext.summary(pr_context) if pr_context
@@ -118,6 +123,13 @@ module StillActive
 
     private
 
+    # deps.dev is an alpha API and the advisory source for almost everything, so
+    # check once, before the audit, that it answers in shape and is current for
+    # these ecosystems; a degraded check makes its advisories count as unchecked.
+    def checked_source_health(ecosystems)
+      SourceHealth.check(ecosystems: ecosystems).tap { |health| health.warnings.each { warn("warning: #{_1}") } }
+    end
+
     # The --sbom path: assess a CycloneDX SBOM's packages cross-ecosystem via
     # EcosystemLens, then emit a JSON report shaped like the native audit's but
     # keyed "ecosystem/name@version" and carrying an `unassessable` list of every
@@ -131,17 +143,12 @@ module StillActive
       # produce a result that was then thrown away.
       unsupported_sbom_format!("--baseline") if StillActive.config.baseline_path
       require_parseable_sbom(path)
-      # deps.dev is the SBOM path's sole vulnerability source and an alpha API; a
-      # field rename would silently zero every vuln count. Canary the schema once
-      # and warn loudly so a degraded run never reads as an authoritative all-clear.
-      unless DepsDevClient.advisory_schema_ok?
-        warn("warning: deps.dev vulnerability schema check failed (its `advisoryKeys` field may have changed, or the API is unreachable); vulnerability counts may be understated -- a clean result is NOT authoritative")
-      end
       sbom = restrict_to_direct(SbomReader.parse(path))
+      health = checked_source_health(sbom.dependencies.map { _1[:ecosystem] }.uniq)
       outcome = if $stderr.tty?
-        SbomWorkflow.call(sbom) { |done, total| $stderr.print("\rAssessing #{done}/#{total} dependencies...") }
+        SbomWorkflow.call(sbom, health: health) { |done, total| $stderr.print("\rAssessing #{done}/#{total} dependencies...") }
       else
-        SbomWorkflow.call(sbom)
+        SbomWorkflow.call(sbom, health: health)
       end
       $stderr.print("\r\e[K") if $stderr.tty?
 
@@ -149,9 +156,19 @@ module StillActive
       # assessment-time failure (a raised lens call) both mean "not assessed":
       # surface them together so neither is a silent hole in the reported coverage.
       unassessable = sbom.unassessable + outcome.failures
-      render_sbom_output(outcome.assessed, unassessable, path)
+      render_sbom_output(outcome.assessed, unassessable, path, health)
       warn_unassessable(unassessable)
-      check_exit_status(outcome.assessed)
+      # A dependency whose assessment raised was never checked for advisories, so it
+      # goes through the gates as unchecked rather than dropping out of them.
+      # Reader-level unassessables (a private registry, no version) stay out: those
+      # are known limits of what can be assessed, not failures.
+      failed = outcome.failures.to_h do |failure|
+        fields = failure.slice(:ecosystem, :name, :purl, :production, :direct, :dependency_path)
+        # Never assessed, so Assessment.from reads its advisories unchecked and
+        # its repository check failed.
+        ["#{failure[:ecosystem]}/#{failure[:name]}@#{failure[:version]}", Assessment.from(fields.merge(version_used: failure[:version]))]
+      end
+      check_exit_status(outcome.assessed.merge(failed))
     end
 
     # --direct-only used to be silently ignored on the SBOM path: the flag parsed,
@@ -189,7 +206,7 @@ module StillActive
     # --cyclonedx used to error here too, on the grounds that SBOM-in/SBOM-out
     # would need per-ecosystem PURL reconstruction; it is supported now because it
     # turned out not to need any, the input's own PURLs being threaded through.
-    def render_sbom_output(result, unassessable, sbom_path)
+    def render_sbom_output(result, unassessable, sbom_path, health)
       config = StillActive.config
       # Same precedence as the native path and as active_output_modes, which is
       # what the "using X, ignoring Y" warning reads from: the two flags must not
@@ -202,7 +219,7 @@ module StillActive
         emit_sbom_cyclonedx(result, config.cyclonedx_path)
       else
         case resolve_format
-        when :json then emit_sbom_json(result, unassessable)
+        when :json then emit_sbom_json(result, unassessable, health)
         when :terminal then puts TerminalHelper.render(result)
         when :markdown then render_markdown(result)
         end
@@ -264,22 +281,23 @@ module StillActive
       exit(2)
     end
 
-    # SBOM output deliberately omits the Ruby audit's `$schema`: the shape differs
-    # (composite keys, an unassessable list, no Ruby/PR-context blocks), so it
-    # would be a false claim to point at that contract. schema_version stays 1.
-    def emit_sbom_json(result, unassessable)
+    # The SBOM output names its own schema, not the Ruby audit's: the shape differs
+    # (composite keys, an unassessable list, no Ruby/PR-context blocks).
+    def emit_sbom_json(result, unassessable, health)
       output = {
+        "$schema": SBOM_SCHEMA_URL,
         schema_version: 1,
         tool: {name: "still_active", version: StillActive::VERSION},
         generated_at: Time.now.utc.iso8601,
         summary: sbom_summary(result, unassessable),
         dependencies: result.transform_values do |data|
-          data.merge(
+          data.to_h.merge(
             activity_level: ActivityHelper.activity_level(data),
             status: StatusHelper.gem_status(data)
           )
         end,
-        unassessable:
+        unassessable:,
+        source_health: health.as_json
       }
       puts iso8601_times(output).to_json
     end
@@ -292,7 +310,9 @@ module StillActive
         # The single worst per-dependency verdict, so a consumer reads one
         # project-level posture without scanning every dependency.
         status: StatusHelper.project_status(result),
-        status_counts: statuses.tally
+        status_counts: statuses.tally,
+        vulnerabilities_unchecked: result.count { |_key, data| data[:vulnerabilities_checked] == false },
+        repository_checks: RepositoryCheck.tally(result.values)
       }
     end
 
@@ -450,7 +470,8 @@ module StillActive
       puts "> **#{BotContext.summary(pr_context)}**\n" if pr_context
       puts MarkdownHelper.markdown_table_header_line
       result.keys.sort.each do |name|
-        gem_data = result[name]
+        # The display emoji ride along in a copy; the assessment itself is final.
+        gem_data = result[name].to_h
         gem_data[:last_activity_warning_emoji] = EmojiHelper.inactive_gem_emoji(gem_data)
         gem_data[:up_to_date_emoji] = EmojiHelper.using_latest_emoji(
           using_last_release: VersionHelper.up_to_date(
@@ -484,6 +505,8 @@ module StillActive
       return unless config.fail_if_critical || config.fail_if_warning || config.fail_if_vulnerable || config.fail_if_outdated || config.fail_if_poison || config.fail_if_language_ceiling || config.fail_if_deprecated
 
       warn_unknown_severity_gate(result, config)
+      warn_unchecked_gate(result, config)
+      warn_unreadable_repository_gate(result, config)
       # Match the gate on the dependency's identity (bare gem name natively,
       # "ecosystem/name" for an SBOM dep), not the composite SBOM hash key, so an
       # --ignore/.still_active.yml entry actually covers a cross-ecosystem finding.
@@ -514,6 +537,38 @@ module StillActive
       end
     end
 
+    # The gate fails closed on a gem whose advisories no source could answer for,
+    # so say which gem and why, as warn_unknown_severity_gate does for an unscored
+    # advisory.
+    def warn_unchecked_gate(result, config)
+      return unless config.fail_if_vulnerable
+
+      result.each do |name, data|
+        next unless data[:vulnerabilities_checked] == false
+
+        gem = DependencyHelper.identity(name, data)
+        next if config.ignored_gems.include?(gem)
+
+        warn("warning: #{gem}: advisories could not be checked (no source answered for this version, or its source failed the health check above); failing --fail-if-vulnerable rather than reading it as clean (rerun, or --ignore it)")
+      end
+    end
+
+    # The activity gates fail closed on a repository no source could read, so say
+    # which, and why, as warn_unchecked_gate does for advisories.
+    def warn_unreadable_repository_gate(result, config)
+      return unless config.fail_if_warning || config.fail_if_critical
+
+      result.each do |name, data|
+        next unless RepositoryCheck.failed?(data)
+
+        gem = DependencyHelper.identity(name, data)
+        next if config.ignored_gems.include?(gem) || config.suppressions.suppressed?(gem: gem, signal: :activity)
+
+        gate = config.fail_if_critical ? "--fail-if-critical" : "--fail-if-warning"
+        warn("warning: #{gem}: no service could check its repository, so whether it's archived is unknown; failing #{gate} rather than reading it as active (rerun, or suppress its activity signal)")
+      end
+    end
+
     # A gem fails the run when it trips an enabled gate that is neither
     # whole-gem --ignore'd nor covered by a granular .still_active.yml
     # suppression. Each signal is checked independently so accepting one finding
@@ -568,6 +623,11 @@ module StillActive
       return false unless config.fail_if_warning || config.fail_if_critical
       return false if suppressions.suppressed?(gem: name, signal: :activity)
 
+      # A repository check that failed may have hidden an archived repository,
+      # which both gates catch, so it fails closed. One no service can make
+      # ("unknowable") reads unknown but passes: a rerun would never change it.
+      return true if RepositoryCheck.failed?(data)
+
       level = ActivityHelper.activity_level(data)
       (config.fail_if_warning && [:stale, :critical, :archived].include?(level)) ||
         (config.fail_if_critical && [:critical, :archived].include?(level))
@@ -576,6 +636,7 @@ module StillActive
     def failed_vulnerability?(name, data, config, suppressions)
       setting = config.fail_if_vulnerable
       return false unless setting
+      return true if data[:vulnerabilities_checked] == false
 
       # Reason over the live advisory array (not vulnerability_count) so the gate
       # and warn_unknown_severity_gate share one source of truth: a warning that

data/lib/still_active/config.rb

@@ -21,6 +21,7 @@ module StillActive
       :fail_if_poison,
       :fail_if_language_ceiling,
       :fail_if_warning,
+      :http_cache,
       :futurist_emoji,
       :gems,
       :fail_if_outdated,
@@ -59,6 +60,7 @@ module StillActive
       @ecosystems_email = nil
 
       @parallelism = 10
+      @http_cache = true
 
       @output_format = :auto
       @sarif_path = nil