still_active 3.1.0 → 3.2.0

data/lib/still_active/deps_dev_client.rb

@@ -2,6 +2,7 @@
 
 require_relative "helpers/http_helper"
 require_relative "helpers/version_helper"
+require_relative "helpers/http_cache"
 
 module StillActive
   module DepsDevClient
@@ -21,19 +22,29 @@ module StillActive
     # canary comes back empty (schema drift) or unreachable (can't confirm). The
     # caller warns loudly rather than presenting a possibly-understated "all clear".
     def advisory_schema_ok?
-      info = version_info(gem_name: ADVISORY_CANARY[:name], version: ADVISORY_CANARY[:version], system: ADVISORY_CANARY[:system])
+      info = version_info(gem_name: ADVISORY_CANARY[:name], version: ADVISORY_CANARY[:version], system: ADVISORY_CANARY[:system], cache: false)
       !(info.nil? || info[:advisory_keys].empty?)
+    rescue HttpHelper::Unavailable
+      false
     end
 
     # `system` is the deps.dev package system, lowercased: rubygems, npm, pypi,
     # cargo, go, maven, nuget. It matches the ecosystem symbol SbomReader emits,
-    # so a cross-ecosystem caller threads it straight through. An unknown system
-    # 404s and degrades to nil (HttpHelper swallows 404), never raising.
-    def version_info(gem_name:, version:, system: :rubygems)
+    # so a cross-ecosystem caller threads it straight through. nil when deps.dev
+    # has no record (a 404: an unknown system, a private package, a yanked
+    # version). This response carries the advisories, so a failure to answer is
+    # NOT nil: it is retried once, then raises HttpHelper::Unavailable, and the
+    # caller reports the advisories unchecked rather than clean.
+    def version_info(gem_name:, version:, system: :rubygems, cache: true)
       return if gem_name.nil? || version.nil?
 
-      path = "/v3alpha/systems/#{encode(system)}/packages/#{encode(gem_name)}/versions/#{encode(version)}"
-      body = HttpHelper.get_json(BASE_URI, path)
+      path = version_path(system, gem_name, version)
+      # A caller that skips the cache (a canary) skips the prefetched table too.
+      body = (cache && @prefetched&.[](path)) || begin
+        version_record(path, cache: cache)
+      rescue HttpHelper::Unavailable
+        version_record(path, cache: cache)
+      end
       return if body.nil?
 
       {
@@ -61,6 +72,33 @@ module StillActive
       }
     end
 
+    # The most versions one versionbatch request takes (deps.dev rejects more).
+    BATCH_LIMIT = 5000
+    # deps.dev pages a batch 100 records at a time, so 5000 keys take 50 pages;
+    # past this, the pagination is broken and the batch is abandoned, not trusted.
+    MAX_BATCH_PAGES = 60
+
+    # Fetches the version records for [system, name, version] keys in batches of
+    # BATCH_LIMIT, before a fan-out, so version_info answers from memory instead of
+    # a GET per version. Only a well-formed record is kept. A key the batch left
+    # out, a malformed record, or a failed batch is simply not prefetched, and
+    # version_info fetches it itself as before: the batch saves requests but never
+    # decides an answer, so a partial failure can't pass for "no record". Each
+    # record also goes into the disk cache under its GET's key. Run-scoped: pair
+    # with clear_prefetch.
+    def prefetch_versions(keys)
+      @prefetched = {}
+      keys.uniq.each_slice(BATCH_LIMIT) { prefetch_batch(_1) }
+    rescue => e
+      # An optimisation must never abort the audit: whatever didn't prefetch is
+      # fetched per version as before.
+      warn("warning: deps.dev batch prefetch failed: #{e.class} (#{e.message}); looking versions up one at a time")
+    end
+
+    def clear_prefetch
+      @prefetched = nil
+    end
+
     # The package's default version and its release date: { version:,
     # published_at: }, or nil. deps.dev's default version is the latest stable;
     # when none is flagged (all pre-release), the newest publishedAt stands in so
@@ -84,21 +122,50 @@ module StillActive
       # upgrade. So rank by version and take the newest STABLE release; fall back to
       # isDefault, then newest-by-date, only when no stable version parses (a
       # genuinely prerelease-only package still reads active, not dormant).
-      entry = latest_stable_version(versions) ||
+      entry = latest_stable_version(versions, system: system) ||
         versions.find { |v| v.is_a?(Hash) && v["isDefault"] } ||
-        newest_version(versions)
+        newest_version(versions, system: system)
       return if entry.nil?
 
-      {version: entry.dig("versionKey", "version"), published_at: entry["publishedAt"]}
+      {
+        version: entry.dig("versionKey", "version"),
+        published_at: entry["publishedAt"],
+        # The latest version's own deprecation, from the listing already fetched.
+        deprecated: entry["isDeprecated"] == true,
+        deprecation_reason: presence(entry["deprecatedReason"])
+      }
+    end
+
+    # A Go module's deprecation, as deps.dev words it: `// Deprecated:` in the
+    # latest go.mod, which covers every version. deps.dev uses the same flag for
+    # a retracted version ("Version retracted: ..."), which covers only that one.
+    MODULE_DEPRECATED = "Module deprecated:"
+
+    def module_deprecation?(reason) = reason.to_s.start_with?(MODULE_DEPRECATED)
+
+    # The newest publishedAt across every version, prereleases and pseudo-versions
+    # included: when deps.dev last ingested anything for this package, which is the
+    # index-freshness question, not "what is the latest release". nil when no
+    # version carries a date or the package isn't indexed; raises
+    # HttpHelper::Unavailable when deps.dev can't answer, after one retry.
+    def newest_publish_date(name:, system:)
+      path = "/v3alpha/systems/#{encode(system)}/packages/#{encode(name)}"
+      # A canary: it has to see deps.dev as it is now, so never from the cache.
+      body = begin
+        HttpHelper.get_json(BASE_URI, path, strict: true, cache: false)
+      rescue HttpHelper::Unavailable
+        HttpHelper.get_json(BASE_URI, path, strict: true, cache: false)
+      end
+      Array(body.is_a?(Hash) ? body["versions"] : nil).filter_map { _1["publishedAt"] if _1.is_a?(Hash) && _1["publishedAt"].is_a?(String) }.max
     end
 
     # The newest non-prerelease version by version number (not publishedAt: a
     # backported patch on an old line can post-date the latest major). nil when no
     # version parses as a stable release.
-    def latest_stable_version(versions)
+    def latest_stable_version(versions, system: :rubygems)
       versions
         .filter_map do |v|
-          next unless v.is_a?(Hash) && !v["isDeprecated"]
+          next unless v.is_a?(Hash) && !superseded?(v, system)
 
           gem_version = VersionHelper.comparable(v.dig("versionKey", "version"))
           [gem_version, v] if gem_version && !gem_version.prerelease?
@@ -115,8 +182,13 @@ module StillActive
       default_version_info(name: name, system: system)&.dig(:published_at)
     end
 
+    # The only hosts deps.dev keys projects under; any other answers 400 "invalid
+    # project key" (go.googlesource.com, self-hosted GitLab, Codeberg), so asking is
+    # a guaranteed warning with nothing to gain.
+    PROJECT_HOSTS = ["github.com", "gitlab.com", "bitbucket.org"].freeze
+
     def project_scorecard(project_id:)
-      return if project_id.nil?
+      return unless PROJECT_HOSTS.include?(project_id.to_s.split("/").first)
 
       path = "/v3alpha/projects/#{encode(project_id)}"
       body = HttpHelper.get_json(BASE_URI, path)
@@ -174,6 +246,77 @@ module StillActive
 
     private
 
+    # A version not to count as the latest: deprecated on its own (npm's one bad
+    # release, a retracted Go version). A Go module's deprecation covers every
+    # version since, so skipping those would make a years-old one the latest.
+    def superseded?(version, system)
+      version["isDeprecated"] == true && !(system.to_sym == :go && module_deprecation?(version["deprecatedReason"]))
+    end
+
+    def version_path(system, name, version)
+      "/v3alpha/systems/#{encode(system)}/packages/#{encode(name)}/versions/#{encode(version)}"
+    end
+
+    # Each batch carries the advisory canary, and its records are used (and
+    # cached) only if the canary comes back with its advisories: the GET canary
+    # in SourceHealth can't vouch for this endpoint, and a batch that silently
+    # zeroed advisoryKeys would otherwise read every dependency clean. Every page
+    # is collected before that check, since the canary can land on any of them.
+    def prefetch_batch(keys)
+      canary = [ADVISORY_CANARY[:system], ADVISORY_CANARY[:name], ADVISORY_CANARY[:version]]
+      requests = (keys + [canary]).uniq.map { |system, name, version| {versionKey: {system: system.to_s.upcase, name: name, version: version}} }
+      records = {}
+      page_token = nil
+      MAX_BATCH_PAGES.times do
+        body = HttpHelper.post_json(BASE_URI, "/v3alpha/versionbatch", body: JSON.generate({requests: requests, pageToken: page_token}.compact))
+        return unless body.is_a?(Hash)
+
+        Array(body["responses"]).each { |response| batch_record(response)&.then { |path, record| records[path] = record } }
+        page_token = body["nextPageToken"]
+        return accept_batch(records) if page_token.nil? || page_token.to_s.empty?
+      end
+      warn("warning: deps.dev's version batch ran past #{MAX_BATCH_PAGES} pages; looking those versions up one at a time")
+    end
+
+    # [path, record] for a well-formed record in a batch response, or nil.
+    def batch_record(response)
+      key = response.is_a?(Hash) && response.dig("request", "versionKey")
+      record = response.is_a?(Hash) && response["version"]
+      return unless key.is_a?(Hash) && record.is_a?(Hash) && version_record?(record)
+
+      [version_path(key["system"].to_s.downcase, key["name"], key["version"]), record]
+    end
+
+    def accept_batch(records)
+      canary = records[version_path(ADVISORY_CANARY[:system], ADVISORY_CANARY[:name], ADVISORY_CANARY[:version])]
+      unless canary && !canary["advisoryKeys"].empty?
+        warn("warning: deps.dev's version batch returned its advisory canary without advisories; looking those versions up one at a time")
+        return
+      end
+
+      records.each do |path, record|
+        @prefetched[path] = record
+        uri = BASE_URI.dup.tap { _1.path = path }
+        HttpCache.write(HttpCache.key("GET", uri), record) if HttpCache.ttl(uri, {})
+      end
+    end
+
+    # deps.dev sends `advisoryKeys` on every version record, as [] when there are
+    # none (verified 2026-09-24). A record without it is schema drift or a garbled
+    # answer, and reading it as "no advisories" is the silent zero the canary
+    # guards against, so it counts as no answer, per dependency.
+    def version_record(path, cache: true)
+      body = HttpHelper.get_json(BASE_URI, path, strict: true, cache: cache, cache_if: method(:version_record?))
+      return body if body.nil? || version_record?(body)
+
+      warn("warning: api.deps.dev#{path} returned a version record with no advisoryKeys list; the API may have changed")
+      raise HttpHelper::Unavailable, path
+    end
+
+    def version_record?(body)
+      body.is_a?(Hash) && body["advisoryKeys"].is_a?(Array)
+    end
+
     # "" is how deps.dev renders "no deprecation message"; nil keeps an absent
     # reason from rendering as a present blank.
     def presence(value)
@@ -222,12 +365,15 @@ module StillActive
       # any `scheme://`, and ssh userinfo (`git@`) so what remains is host/owner/repo.
       # Left unnormalized, a git-scheme URL mis-parses (host becomes `git:`), which
       # 400s the projects lookup and drops the repo signals.
-      cleaned = url.strip.delete_prefix("git+").sub(%r{\A[a-z][a-z0-9+.-]*://}i, "").sub(%r{\A[^/@]+@}, "")
+      # A fragment or query (`...bar.git#main`, `...?tab=readme`) isn't part of
+      # the repository's path.
+      cleaned = url.strip.sub(/[#?].*\z/m, "").delete_prefix("git+").sub(%r{\A[a-z][a-z0-9+.-]*://}i, "").sub(%r{\A[^/@]+@}, "")
       # scp-style git remotes separate host from path with a colon (`host:owner/repo`)
       # rather than a slash. Convert it so the split yields host/owner/repo, but leave
       # a real port (`host:443/...`) alone -- a colon before a digit isn't a path.
       cleaned = cleaned.sub(%r{\A([^/:]+):(?=\D)}, '\1/')
       host, *segments = cleaned.split("/")
+      host = host&.downcase&.delete_prefix("www.")
       segments = repo_path_segments(host, segments)
       return if host.nil? || segments.empty?
 
@@ -265,9 +411,9 @@ module StillActive
     # flagged default. Versions without a publishedAt are dropped; the rest
     # compare lexicographically (deps.dev returns RFC3339 UTC, so string order
     # is chronological), and a dated release always wins over an undated one.
-    def newest_version(versions)
+    def newest_version(versions, system: :rubygems)
       versions
-        .select { |v| v.is_a?(Hash) && v["publishedAt"] && !v["isDeprecated"] }
+        .select { |v| v.is_a?(Hash) && v["publishedAt"] && !superseded?(v, system) }
         .max_by { |v| v["publishedAt"].to_s }
     end
 

data/lib/still_active/diff.rb

@@ -24,6 +24,8 @@ module StillActive
     SUPPRESSIBLE_REGRESSION_SIGNALS = {
       new_gem_archived: :activity,
       archived: :activity,
+      new_gem_repository_check_failed: :activity,
+      repository_unchecked: :activity,
       new_gem_stale: :libyear,
       libyear_worsened: :libyear
     }.freeze
@@ -160,12 +162,16 @@ module StillActive
     end
 
     # Categorises a version bump:
+    # - :advisories_unchecked - no source answered for the new version's advisories
     # - :introduced_vulns  - new advisories appeared on the resolved version
     # - :closed_vulns      - all advisories cleared
     # - :older_relative    - libyear-to-latest grew (rare; usually unchanged)
     # - :fresher           - libyear-to-latest shrank
     # - :neutral           - no obvious signal change
     def classify_bump(before, after)
+      # No source answered for the new version, so its zero is not a fix.
+      return :advisories_unchecked if unchecked?(after)
+
       opened = vuln_count(after) - vuln_count(before)
       return :introduced_vulns if opened.positive?
       return :closed_vulns if opened.negative?
@@ -219,6 +225,16 @@ module StillActive
         changes << {kind: :version_yanked}
       end
 
+      if !unchecked?(before) && unchecked?(after) && before["version_used"] == after["version_used"]
+        changes << {kind: :advisories_unchecked}
+      end
+
+      # An archived repo would be a regression; one no longer checked might be one
+      # (a check that failed, or a repository that has gone private or away).
+      if repository_answered?(before) && !repository_answered?(after)
+        changes << {kind: :repository_unchecked, check: after["repository_check"]}
+      end
+
       changes
     end
 
@@ -229,6 +245,10 @@ module StillActive
         data = a.data
         if vuln_count(data).positive?
           regs << Regression.new(kind: :new_gem_with_vulns, gem: a.name, detail: "#{vuln_count(data)} vulns at introduction")
+        elsif unchecked?(data)
+          regs << Regression.new(kind: :new_gem_unchecked, gem: a.name, detail: "added gem's advisories could not be checked")
+        elsif data["repository_check"] == "failed"
+          regs << Regression.new(kind: :new_gem_repository_check_failed, gem: a.name, detail: "added gem's repository check failed, so it may be archived")
         elsif data["archived"]
           regs << Regression.new(kind: :new_gem_archived, gem: a.name, detail: "added gem points at archived repo")
         elsif data["libyear"] && data["libyear"] > NEW_GEM_LIBYEAR_THRESHOLD
@@ -243,6 +263,8 @@ module StillActive
             gem: b.name,
             detail: "#{b.before_version} -> #{b.after_version}"
           )
+        elsif b.kind == :advisories_unchecked
+          regs << Regression.new(kind: :bump_unchecked, gem: b.name, detail: "#{b.before_version} -> #{b.after_version}; advisories could not be checked")
         end
       end
 
@@ -259,6 +281,10 @@ module StillActive
             regs << Regression.new(kind: :scorecard_dropped, gem: sc.name, detail: "#{ch[:from]} -> #{ch[:to]}#{note}")
           when :version_yanked
             regs << Regression.new(kind: :version_yanked, gem: sc.name, detail: "pinned version yanked from rubygems")
+          when :advisories_unchecked
+            regs << Regression.new(kind: :advisories_unchecked, gem: sc.name, detail: "advisories could not be checked")
+          when :repository_unchecked
+            regs << Regression.new(kind: :repository_unchecked, gem: sc.name, detail: "repository no longer checked (#{ch[:check]}), so it may be archived")
           when :libyear_worsened
             regs << Regression.new(
               kind: :libyear_worsened,
@@ -291,6 +317,18 @@ module StillActive
       }
     end
 
+    # A baseline from before repository_check existed (3.1.0) was answered only
+    # where its archived state was known.
+    def repository_answered?(data)
+      return data["repository_check"] == "answered" if data.key?("repository_check")
+
+      [true, false].include?(data["archived"])
+    end
+
+    def unchecked?(data)
+      data["vulnerabilities_checked"] == false
+    end
+
     def vuln_count(data)
       data["vulnerability_count"].to_i
     end

data/lib/still_active/ecosystem_lens.rb

@@ -1,9 +1,12 @@
 # frozen_string_literal: true
 
+require_relative "errors"
+require_relative "repository_signals"
 require_relative "deps_dev_client"
 require_relative "osv_client"
 require_relative "ecosystems_client"
 require_relative "github_client"
+require_relative "go_toolchain"
 require_relative "pypi_client"
 require "time"
 require_relative "helpers/activity_helper"
@@ -55,37 +58,24 @@ module StillActive
     FLAT_RESOLUTION_ECOSYSTEMS = [:rubygems, :pypi].freeze
 
     def assess(ecosystem:, name:, version:, constraint_cache: {}, runtime_ranges: {})
-      info = DepsDevClient.version_info(gem_name: name, version: version, system: ecosystem)
-      default = DepsDevClient.default_version_info(name: name, system: ecosystem)
-      # Retry the version lookup once when it came back empty but the package DID
-      # resolve: HttpHelper collapses a genuine 404 and a transient network blip to
-      # the same nil, and a healthy version must not be mis-flagged as unresolved
-      # (below) on a one-off miss. A real 404 stays nil; a blip recovers the data.
-      info ||= DepsDevClient.version_info(gem_name: name, version: version, system: ecosystem) if default
-      # Recover the repo from the default version when the exact locked version
-      # isn't indexed (yanked/normalization mismatch): otherwise its project link
-      # vanishes and a still-fresh package date would read a false :ok with
-      # archived/scorecard silently dropped. The native Bundler path resolves the
-      # repo independently of deps.dev's per-version record; this gives the lens
-      # the same resilience.
-      # The pinned version isn't indexed by deps.dev (info nil) while the package IS
-      # (default present, so the feed is up): the version is yanked/nonexistent, not a
-      # transient miss. Flag it so status reads :unknown rather than letting the still-
-      # fresh PACKAGE date report a nonexistent version as :ok.
-      version_unresolved = info.nil? && !default.nil?
-      project_id = info&.dig(:project_id) || project_id_from(name, ecosystem, default)
-      vulnerabilities = vulnerabilities_for(info)
-      # Enrich with OSV: a real GHSA severity label (deps.dev can't score a CVSS-4-only
-      # advisory) and the fixed-version ranges the "capped below the fix" signal needs.
-      # Passing the version also lets OSV confirm the advisory actually applies to it,
-      # correcting deps.dev's lag on an advisory amended with backport fixes.
-      vulnerabilities = OsvClient.enrich(vulnerabilities, ecosystem: ecosystem, name: name, version: version)
+      signals =
+        if GoToolchain.toolchain?(ecosystem, name)
+          version = GoToolchain.release(version)
+          GoToolchain.signals(version: version)
+        else
+          registry_signals(ecosystem: ecosystem, name: name, version: version)
+        end
+      info, default, vulnerabilities, vulnerabilities_checked, project_id, version_unresolved =
+        signals.values_at(:info, :default, :vulnerabilities, :vulnerabilities_checked, :project_id, :version_unresolved)
       scorecard = DepsDevClient.project_scorecard(project_id: project_id)
-      repo = repo_signals(project_id)
+      # The Go toolchain is the language: there's no package repository to check,
+      # and its lifecycle comes from endoflife.date instead.
+      repo = GoToolchain.toolchain?(ecosystem, name) ? {check: "not_applicable"} : repo_signals(project_id)
 
       used_release_date = info&.dig(:published_at)
       latest_release_date = default&.dig(:published_at)
       latest_version = default&.dig(:version)
+      deprecation = deprecation(ecosystem, name, version, info, default)
       gem_data = {
         ecosystem: ecosystem,
         name: name,
@@ -116,17 +106,24 @@ module StillActive
         # it. A declared fact rather than a date heuristic, and the one signal a
         # release-recency check can never produce: a package deprecated last month
         # with a release last week looks perfectly healthy by dates alone.
-        deprecated: info&.dig(:deprecated) == true,
-        deprecation_reason: info&.dig(:deprecation_reason),
+        deprecated: deprecation[:deprecated],
+        deprecation_reason: deprecation[:deprecation_reason],
         repository_url: project_id && "https://#{project_id}",
         last_commit_date: repo[:last_commit_date],
         archived: repo[:archived],
         scorecard_score: scorecard&.dig(:score),
         scorecard_maintained: scorecard&.dig(:maintained),
         vulnerability_count: vulnerabilities.length,
+        # false when a source couldn't answer, so the zero above is "not looked
+        # at", never "clean". The status and --fail-if-vulnerable both read it.
+        vulnerabilities_checked: vulnerabilities_checked,
         vulnerabilities: vulnerabilities
       }
       gem_data[:version_unresolved] = true if version_unresolved
+      # Whether a service said if the repository is archived; a blank archived
+      # flag isn't "not archived" unless this is "answered".
+      gem_data[:repository_check] = repo[:check]
+      gem_data[:repository_source] = repo[:source] if repo[:source]
       attach_constraints(gem_data, ecosystem: ecosystem, name: name, version: version, cache: constraint_cache)
       attach_language_ceiling(gem_data, ecosystem: ecosystem, name: name, version: version, latest_version: default&.dig(:version), runtime_ranges: runtime_ranges)
       gem_data
@@ -134,6 +131,55 @@ module StillActive
 
     private
 
+    # A package's signals from deps.dev, with OSV enrichment: { info:, default:,
+    # vulnerabilities:, vulnerabilities_checked:, project_id:, version_unresolved: }.
+    def registry_signals(ecosystem:, name:, version:)
+      # The version record carries the advisories, so deps.dev failing to answer it
+      # (after version_info's own retry) leaves them unchecked, not clean. A 404 is
+      # an answer: nothing public lists this version.
+      checked = true
+      info = begin
+        DepsDevClient.version_info(gem_name: name, version: version, system: ecosystem)
+      rescue HttpHelper::Unavailable
+        checked = false
+        nil
+      end
+      default = DepsDevClient.default_version_info(name: name, system: ecosystem)
+      # Recover the repo from the default version when the exact locked version
+      # isn't indexed (yanked/normalization mismatch): otherwise its project link
+      # vanishes and a still-fresh package date would read a false :ok with
+      # archived/scorecard silently dropped. The native Bundler path resolves the
+      # repo independently of deps.dev's per-version record; this gives the lens
+      # the same resilience.
+      # The pinned version isn't indexed by deps.dev (info nil) while the package IS
+      # (default present, so the feed is up): the version is yanked/nonexistent, not a
+      # transient miss. Flag it so status reads :unknown rather than letting the still-
+      # fresh PACKAGE date report a nonexistent version as :ok.
+      version_unresolved = checked && info.nil? && !default.nil?
+      project_id = info&.dig(:project_id) || project_id_from(name, ecosystem, default)
+      vulnerabilities = vulnerabilities_for(info)
+      # Enrich with OSV: a real GHSA severity label (deps.dev can't score a CVSS-4-only
+      # advisory) and the fixed-version ranges the "capped below the fix" signal needs.
+      # Passing the version also lets OSV confirm the advisory actually applies to it,
+      # correcting deps.dev's lag on an advisory amended with backport fixes.
+      vulnerabilities = OsvClient.enrich(vulnerabilities, ecosystem: ecosystem, name: name, version: version)
+      {info: info, default: default, vulnerabilities: vulnerabilities, vulnerabilities_checked: checked, project_id: project_id, version_unresolved: version_unresolved}
+    end
+
+    # The maintainer's deprecation, from the pinned version's record. Go deprecates
+    # a module: `// Deprecated:` in the latest go.mod covers every version (it's
+    # what `go list -m -u` reports), but deps.dev flags only the versions whose
+    # go.mod carries it, so a module deprecated at its latest is deprecated
+    # whichever version is pinned. A retracted latest isn't: that's one release.
+    # npm deprecates versions, so it stays per version.
+    def deprecation(ecosystem, name, version, info, default)
+      if info&.dig(:deprecated) != true && ecosystem == :go && DepsDevClient.module_deprecation?(default&.dig(:deprecation_reason))
+        return {deprecated: true, deprecation_reason: default[:deprecation_reason]}
+      end
+
+      {deprecated: info&.dig(:deprecated) == true, deprecation_reason: info&.dig(:deprecation_reason)}
+    end
+
     # Language-runtime ceiling for the cross-ecosystem path, the sibling of the
     # native Ruby ceiling in Workflow. Python declares its runtime constraint as a
     # PEP 440 `requires_python`, an enforced pip install wall; translate it and run
@@ -290,25 +336,15 @@ module StillActive
       return if version.nil?
 
       DepsDevClient.version_info(gem_name: name, version: version, system: ecosystem)&.dig(:project_id)
+    rescue HttpHelper::Unavailable
+      nil
     end
 
-    # archived + last-commit for a flat github.com/owner/repo project, or {} for
-    # anything else. deps.dev indexes github.com and gitlab.com only, but gitlab
-    # subgroups nest arbitrarily and ecosyste.ms's repo crawler is GitHub-centric,
-    # so a gitlab (or nested, or unresolved) project keeps archived unknown rather
-    # than risk a bogus owner/name lookup.
+    # archived + last-activity date, which service answered, and what came of the
+    # check, for the project deps.dev linked. Every dependency here came through
+    # deps.dev, so from a public registry.
     def repo_signals(project_id)
-      host, owner, name, *rest = project_id.to_s.split("/")
-      return {} unless host == "github.com" && owner && name && rest.empty?
-
-      repo_provider.repo_signals(owner: owner, name: name) || {}
-    end
-
-    # Mirrors Workflow#provider_for(:github): the live GitHub API when a token is
-    # configured (freshest), else ecosyste.ms (5000 anonymous req/hr vs GitHub's
-    # 60), so an untokened cross-ecosystem run still resolves a large SBOM.
-    def repo_provider
-      StillActive.config.github_oauth_token ? GithubClient : EcosystemsClient
+      RepositorySignals.for_project(project_id, public: true)
     end
 
     # Is the pinned version at or ahead of latest stable? nil when latest is unknown.

data/lib/still_active/ecosystems_client.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "time"
+require_relative "errors"
 require_relative "helpers/http_helper"
 require_relative "version"
 
@@ -30,23 +31,25 @@ module StillActive
 
     # archived + last-commit date from a single repository call. ecosyste.ms's
     # pushed_at mirrors GitHub's, so this returns the same shape as GithubClient.
-    # Returns {} when the repo can't be read, so the caller leaves both blank.
+    # Returns {} when ecosyste.ms has no record of the repo (a 404), and raises
+    # RepoSignalsUnavailable when it couldn't answer, including a 200 whose body
+    # isn't a repository record (an error envelope, schema drift).
     def repo_signals(owner:, name:)
       return {} if owner.nil? || name.nil?
 
       path = "/api/v1/hosts/GitHub/repositories/#{encode_repo(owner, name)}"
-      body = HttpHelper.get_json(BASE_URI, path, headers: {"User-Agent" => USER_AGENT}, params: politeness_params)
-      # A non-Hash 200 body (error envelope rendered as an array, schema drift)
-      # would otherwise raise on indexing and vanish the gem from the audit via
-      # the workflow's rescue; degrade to "no signal" like any other read failure.
-      return {} unless body.is_a?(Hash)
+      body = HttpHelper.get_json(BASE_URI, path, headers: {"User-Agent" => USER_AGENT}, params: politeness_params, strict: true)
+      return {} if body.nil?
+      raise RepoSignalsUnavailable, "ecosyste.ms returned a #{body.class} for #{owner}/#{name}" unless body.is_a?(Hash)
 
       signals = {last_commit_date: parse_time(body["pushed_at"], owner, name)}
       # Only assert archived when the field is actually present. A missing field
       # must read as unknown, not be invented as false -- otherwise a partial
       # crawl could silently mask the most actionable verdict (gem is archived).
-      signals[:archived] = body["archived"] == true if body.key?("archived")
+      signals[:archived] = body["archived"] if [true, false].include?(body["archived"])
       signals
+    rescue HttpHelper::Unavailable => e
+      raise RepoSignalsUnavailable, e.message
     end
 
     # ecosyste.ms dependency-kind labels that ship at RUNTIME (so a cap on one

data/lib/still_active/errors.rb

@@ -3,4 +3,14 @@
 module StillActive
   class Error < StandardError; end
   class MissingLockfileError < Error; end
+
+  # A repository provider couldn't answer (a rate limit, a timeout, an error
+  # status, a garbled body), as opposed to answering that the repo isn't there.
+  # The caller marks the repository unavailable rather than reading its blank
+  # archived flag as "not archived".
+  class RepoSignalsUnavailable < Error; end
+
+  # The forge refused the credentials (401/403): the repository may be private,
+  # so its name must not then go to a third-party mirror.
+  class RepoAccessDenied < RepoSignalsUnavailable; end
 end

data/lib/still_active/forgejo_client.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "time"
+require_relative "errors"
 require_relative "helpers/http_helper"
 
 module StillActive
@@ -21,10 +22,13 @@ module StillActive
     def repo_signals(owner:, name:, host: DEFAULT_HOST)
       return {} if owner.nil? || name.nil?
 
-      body = HttpHelper.get_json(base_uri(host), "/api/v1/repos/#{owner}/#{name}", headers: auth_headers)
+      # {} for a 404 (an answer); RepoSignalsUnavailable when Forgejo couldn't answer.
+      body = HttpHelper.get_json(base_uri(host), "/api/v1/repos/#{owner}/#{name}", headers: auth_headers, strict: true)
       return {} if body.nil?
 
       {archived: body["archived"] == true, last_commit_date: parse_time(body["updated_at"], owner, name)}
+    rescue HttpHelper::Unavailable => e
+      raise RepoSignalsUnavailable, e.message
     end
 
     private