still_active 3.1.0 → 3.2.0

data/lib/still_active/workflow.rb

@@ -4,6 +4,9 @@ require_relative "artifactory_client"
 require_relative "compact_index_client"
 require_relative "source_credentials"
 require_relative "ceiling_reconciler"
+require_relative "errors"
+require_relative "assessment"
+require_relative "repository_signals"
 require_relative "deps_dev_client"
 require_relative "osv_client"
 require_relative "poison_security_correlator"
@@ -19,6 +22,7 @@ require_relative "helpers/constraint_helper"
 require_relative "helpers/http_helper"
 require_relative "helpers/libyear_helper"
 require_relative "helpers/ruby_advisory_db"
+require_relative "source_health"
 require_relative "helpers/ruby_helper"
 require_relative "helpers/runtime_ceiling_helper"
 require_relative "helpers/version_helper"
@@ -27,13 +31,16 @@ require "async"
 require "async/barrier"
 require "async/semaphore"
 require "cgi"
-require "gems"
+require_relative "rubygems_client"
 
 module StillActive
   module Workflow
     extend self
 
-    def call(&on_progress)
+    # `health` is the run's SourceHealth report: when it distrusts deps.dev for
+    # rubygems, deps.dev's advisories count as unchecked unless ruby-advisory-db
+    # answered for them.
+    def call(health: SourceHealth::Report.healthy, &on_progress)
       task = Async do
         # Load the optional ruby-advisory-db once, before the fan-out, so the
         # read-only Database is shared across fibers rather than reloaded per gem.
@@ -53,11 +60,14 @@ module StillActive
             nil
           end
         # Resolve the GitHub token once here, single-fibered, before the fan-out:
-        # provider_for reads it per gem across fibers and gh_cli_token shells out,
+        # RepositorySignals reads it per gem across fibers and gh_cli_token shells out,
         # so resolving eagerly keeps that off the concurrent path and guarantees
         # every fiber sees one consistent value (token -> live GitHub, incl. private
         # repos; only a genuinely absent token falls back to ecosyste.ms).
         StillActive.config.github_oauth_token
+        # Every pinned gem's deps.dev version record in one batch request, rather
+        # than one GET each. The same names the per-gem lookups already send.
+        DepsDevClient.prefetch_versions(StillActive.config.gems.filter_map { [:rubygems, _1[:name], _1[:version]] if _1[:version] })
         barrier = Async::Barrier.new
         semaphore = Async::Semaphore.new(StillActive.config.parallelism, parent: barrier)
         result_object = {}
@@ -83,18 +93,20 @@ module StillActive
               constraint_cache: constraint_cache,
               ruby_range: ruby_range
             )
-          rescue Octokit::TooManyRequests
-            $stderr.print("\r\e[K") if on_progress
-            warn("rate limited checking #{gem[:name]}: set GITHUB_TOKEN to increase your limit")
           rescue => e
             $stderr.print("\r\e[K") if on_progress
             warn("error occurred for #{gem[:name]}: #{e.class}\n\t#{e.message}")
           ensure
+            # An assessment that raised part-way is left without its answers;
+            # Assessment.from reads those as unchecked and failed.
             completed += 1
             on_progress&.call(completed, total)
           end
         end
         barrier.wait
+        unless health.deps_dev_trusted?(:rubygems) || advisory_db
+          result_object.each_value { |data| data[:vulnerabilities_checked] = false }
+        end
         # Whole-tree correlation, once every gem's signals are in: a ceiling's
         # "upgrade to lift it" must not contradict a poison finding that caps the
         # same gem below that upgrade.
@@ -105,9 +117,13 @@ module StillActive
         # Gems are inserted as their async tasks finish, so the natural order is
         # nondeterministic completion order. Sort by name once here so every
         # consumer (JSON, SARIF, the baseline diff) gets a stable, diffable order.
-        result_object.sort_by { |name, _| name }.to_h
+        # Every pass over the hashes is done; from here on consumers read the
+        # finished Assessment.
+        result_object.sort_by { |name, _| name }.to_h.transform_values { Assessment.from(_1) }
       end
       task.wait
+    ensure
+      DepsDevClient.clear_prefetch
     end
 
     def ruby_freshness
@@ -150,7 +166,8 @@ module StillActive
       signals = repo_signals(
         source: repo_info[:source],
         repository_owner: repo_info[:owner],
-        repository_name: repo_info[:name]
+        repository_name: repo_info[:name],
+        public: public_source?(source_uri)
       )
       commit_date = signals[:last_commit_date]
       archived = signals[:archived]
@@ -174,6 +191,7 @@ module StillActive
         repository_url: repo_info[:url],
         last_commit_date: commit_date,
         archived: archived,
+        **repository_availability(signals),
         **deps_dev
       })
 
@@ -286,7 +304,8 @@ module StillActive
     def gem_info_non_rubygems(gem_name:, gem_version:, result_object:, source_uri: nil, advisory_db: nil)
       repo_info = repository_info_for_non_rubygems(gem_name: gem_name, source_uri: source_uri)
       source, owner, name = repo_info.values_at(:source, :owner, :name)
-      deps_dev = gem_version ? fetch_deps_dev_info(gem_name: gem_name, version: gem_version, advisory_db: advisory_db) : {}
+      # With no version there is nothing to look advisories up by.
+      deps_dev = gem_version ? fetch_deps_dev_info(gem_name: gem_name, version: gem_version, advisory_db: advisory_db) : {vulnerabilities_checked: false}
 
       # Fall back to repo-derived project_id for scorecard when deps.dev doesn't
       # have the version. Use ||= so a maintained score already found via the
@@ -303,6 +322,7 @@ module StillActive
         repository_url: repo_info[:url],
         last_commit_date: signals[:last_commit_date],
         archived: signals[:archived],
+        **repository_availability(signals),
         **deps_dev
       })
     end
@@ -371,7 +391,16 @@ module StillActive
     end
 
     def fetch_deps_dev_info(gem_name:, version:, advisory_db: nil)
-      info = DepsDevClient.version_info(gem_name: gem_name, version: version)
+      # deps.dev failing to answer leaves the advisories unchecked, unless
+      # ruby-advisory-db, the Ruby authority, is loaded and answers for them.
+      # No version (the latest-version lookup failed too) means nothing was asked.
+      checked = !version.nil?
+      info = begin
+        DepsDevClient.version_info(gem_name: gem_name, version: version)
+      rescue HttpHelper::Unavailable
+        checked = !advisory_db.nil?
+        nil
+      end
       scorecard = DepsDevClient.project_scorecard(project_id: info&.dig(:project_id))
       advisory_keys = info&.dig(:advisory_keys) || []
       # The keys ARE the evidence the version is vulnerable; the detail fetch only
@@ -397,6 +426,7 @@ module StillActive
         deprecated: info&.dig(:deprecated) == true,
         deprecation_reason: info&.dig(:deprecation_reason),
         vulnerability_count: vulnerabilities.length,
+        vulnerabilities_checked: checked,
         vulnerabilities: vulnerabilities
       }
     end
@@ -409,20 +439,8 @@ module StillActive
       elsif unqueryable_private_source?(source_uri)
         private_source_versions(gem_name: gem_name, source_uri: source_uri)
       else
-        Gems.versions(gem_name)
+        RubygemsClient.versions(gem_name)
       end
-    rescue Gems::NotFound
-      []
-    # Gems::GemError is the `gems` library's catch-all for any non-success,
-    # non-404 response -- crucially a 429 rate-limit or a 5xx. Left unrescued it
-    # escapes to the per-gem rescue in #call and strips the gem of ALL its signals
-    # (not just versions), blaming a generic "error occurred". The poison-pill
-    # enrichment adds extra version lookups that make a 429 likelier, so a
-    # best-effort feature must not be able to degrade an unrelated gem's core data:
-    # degrade to "no versions known" here, exactly like Gems::NotFound.
-    rescue Gems::GemError, *HttpHelper::TRANSPORT_ERRORS => e
-      warn("warning: rubygems.org versions lookup failed for #{gem_name}: #{e.class} (#{e.message})")
-      []
     end
 
     def github_packages_uri?(uri)
@@ -433,7 +451,7 @@ module StillActive
 
     # A rubygems-type source that isn't public rubygems.org and that we have no
     # client for (Gemfury, Gemstash, geminabox, a private mirror). We must NOT
-    # fall through to Gems.versions, which always hits public rubygems.org: that
+    # fall through to RubygemsClient.versions, which always hits public rubygems.org: that
     # would silently report a public name-collision's data, or blanks, as if it
     # were the private gem's. github_packages/artifactory are handled above, so
     # anything left with a non-rubygems.org host is unqueryable. Refs #43.
@@ -501,7 +519,8 @@ module StillActive
       repo.merge(project_id: deps_dev_project_id(repo))
     end
 
-    # deps.dev scorecards index github.com and gitlab.com only. A Forgejo/Codeberg
+    # Of the forges Repository recognizes, deps.dev indexes github.com and
+    # gitlab.com (DepsDevClient::PROJECT_HOSTS). A Forgejo/Codeberg
     # repo has no deps.dev project, so leave its project_id nil rather than minting
     # a bogus github.com/owner/name that would fetch the wrong (or no) scorecard.
     DEPS_DEV_HOST_BY_SOURCE = {github: "github.com", gitlab: "gitlab.com"}.freeze
@@ -522,7 +541,7 @@ module StillActive
     end
 
     # Locally-installed gem metadata and the gem's own version payload are
-    # source-accurate. This public rubygems.org Gems.info lookup is the last
+    # source-accurate. This public rubygems.org info lookup is the last
     # resort, and is skipped for an unqueryable private source: otherwise a
     # public name-collision's repo/archived/last-commit data would stand in for
     # the private gem, the same substitution #43 prevents for versions.
@@ -549,46 +568,38 @@ module StillActive
     end
 
     def rubygems_gem_repository_url(gem_name:)
-      info = Gems.info(gem_name)
+      info = RubygemsClient.info(gem_name)
       return [] if info.nil?
 
       [
         info["homepage_uri"],
         info["source_code_uri"]
       ].compact.uniq
-    rescue Gems::NotFound
-      []
     end
 
-    # The repo-signal provider for a source, or nil for an unhandled host. Every
-    # provider answers archived/last_commit_date; richer signals (e.g.
-    # commits_since_release) are duck-typed and dispatched by respond_to?, so a
-    # provider opts into them by defining the method, with no base class and no
-    # assumption that every source supports every signal.
-    def provider_for(source)
-      case source
-      # Without a GitHub token, the live API caps at 60 req/hr -- unusable past a
-      # handful of gems. Fall back to ecosyste.ms (5000 anonymous) so a large
-      # Gemfile still resolves. With a token, the live API stays primary (freshest,
-      # and it carries commits_since_release, which ecosyste.ms doesn't).
-      when :github then StillActive.config.github_oauth_token ? GithubClient : EcosystemsClient
-      when :gitlab then GitlabClient
-      when :forgejo then ForgejoClient
-      end
+    # archived + last-activity date, and which service answered, from
+    # RepositorySignals. `public:` says the gem came from a public registry, so
+    # its repository's name may go to ecosyste.ms.
+    def repo_signals(source:, repository_owner:, repository_name:, public: false)
+      host = Repository::SOURCE_BY_HOST.key(source)
+      RepositorySignals.for(host: host, owner: repository_owner, name: repository_name, public: public)
+    end
+
+    # rubygems.org, as opposed to a private registry the lockfile names.
+    def public_source?(source_uri)
+      !(github_packages_uri?(source_uri) || ArtifactoryClient.artifactory_uri?(source_uri) || unqueryable_private_source?(source_uri))
     end
 
-    # One provider call yields both archived and the last-activity date (the
-    # repo object carries both), so a gem's repo signals cost a single request
-    # instead of two. Returns {} for an unhandled host.
-    def repo_signals(source:, repository_owner:, repository_name:)
-      provider_for(source)&.repo_signals(owner: repository_owner, name: repository_name) || {}
+    def repository_availability(signals)
+      {repository_check: signals[:check], **(signals[:source] ? {repository_source: signals[:source]} : {})}
     end
 
+    # GitHub's compare endpoint, and only with a token: it's a per-gem call, and
+    # 60 anonymous requests an hour would starve the repository lookups.
     def unreleased_commits(source:, repository_owner:, repository_name:, version:)
-      provider = provider_for(source)
-      return unless provider.respond_to?(:commits_since_release)
+      return unless source == :github && StillActive.config.github_oauth_token
 
-      provider.commits_since_release(owner: repository_owner, name: repository_name, version: version)
+      GithubClient.commits_since_release(owner: repository_owner, name: repository_name, version: version)
     end
   end
 end

data/lib/still_active.rb

@@ -4,6 +4,7 @@ require_relative "still_active/version"
 require_relative "still_active/errors"
 require_relative "still_active/config"
 require_relative "still_active/sbom_reader"
+require_relative "still_active/source_health"
 require_relative "still_active/ecosystem_lens"
 require_relative "still_active/sbom_workflow"
 require_relative "still_active/cli"

data/still_active.gemspec

@@ -62,7 +62,6 @@ Gem::Specification.new do |spec|
   # CvssHelper reads.
   spec.add_runtime_dependency("cvss-suite", ">= 5.0")
   spec.add_runtime_dependency("faraday-retry")
-  spec.add_runtime_dependency("gems")
   spec.add_runtime_dependency("octokit")
   # Spec-compliant package-URL parsing for SBOM ingestion (decodes npm scopes,
   # maven group:artifact, qualifiers). 0.1 is the verified floor; the official

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: still_active
 version: !ruby/object:Gem::Version
-  version: 3.1.0
+  version: 3.2.0
 platform: ruby
 authors:
 - Sean Floyd
@@ -65,20 +65,6 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-- !ruby/object:Gem::Dependency
-  name: gems
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
 - !ruby/object:Gem::Dependency
   name: octokit
   requirement: !ruby/object:Gem::Requirement
@@ -149,6 +135,7 @@ files:
 - bin/still_active
 - lib/still_active.rb
 - lib/still_active/artifactory_client.rb
+- lib/still_active/assessment.rb
 - lib/still_active/ceiling_reconciler.rb
 - lib/still_active/cli.rb
 - lib/still_active/compact_index_client.rb
@@ -163,6 +150,7 @@ files:
 - lib/still_active/forgejo_client.rb
 - lib/still_active/github_client.rb
 - lib/still_active/gitlab_client.rb
+- lib/still_active/go_toolchain.rb
 - lib/still_active/helpers/activity_helper.rb
 - lib/still_active/helpers/alternatives_helper.rb
 - lib/still_active/helpers/ansi_helper.rb
@@ -177,6 +165,7 @@ files:
 - lib/still_active/helpers/dotnet_helper.rb
 - lib/still_active/helpers/emoji_helper.rb
 - lib/still_active/helpers/endoflife_helper.rb
+- lib/still_active/helpers/http_cache.rb
 - lib/still_active/helpers/http_helper.rb
 - lib/still_active/helpers/libyear_helper.rb
 - lib/still_active/helpers/lockfile_dependency_parser.rb
@@ -185,6 +174,7 @@ files:
 - lib/still_active/helpers/markdown_helper.rb
 - lib/still_active/helpers/pep440_helper.rb
 - lib/still_active/helpers/python_helper.rb
+- lib/still_active/helpers/repository_check.rb
 - lib/still_active/helpers/ruby_advisory_db.rb
 - lib/still_active/helpers/ruby_helper.rb
 - lib/still_active/helpers/runtime_ceiling_helper.rb
@@ -201,10 +191,13 @@ files:
 - lib/still_active/poison_security_correlator.rb
 - lib/still_active/pypi_client.rb
 - lib/still_active/repository.rb
+- lib/still_active/repository_signals.rb
+- lib/still_active/rubygems_client.rb
 - lib/still_active/sarif/rules.rb
 - lib/still_active/sbom_reader.rb
 - lib/still_active/sbom_workflow.rb
 - lib/still_active/source_credentials.rb
+- lib/still_active/source_health.rb
 - lib/still_active/suppressions.rb
 - lib/still_active/version.rb
 - lib/still_active/workflow.rb
@@ -233,7 +226,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: 3.2.3
 requirements: []
-rubygems_version: 4.0.16
+rubygems_version: 4.0.20
 specification_version: 4
 summary: Audit your dependencies for maintenance health, abandonment, and below-the-fix
   vulnerabilities. Ruby gems natively; npm, PyPI, Cargo, Go, Maven, and NuGet via