trek 0.1.26 → 0.1.27

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: 5a1b779a620ab9d8286b2f42d3164cef475a04d2696e765951e33ef4ac351036
4
- data.tar.gz: 1485275e1fe7f5bdc5f1d8785de59d8c8e39410bcafe05732e148abf17c4634a
3
+ metadata.gz: 53eb1b618fd47d1aaba94f028d33ff91a4ae1361184149f0ac51a3530392d5db
4
+ data.tar.gz: 772ce6d84a6f4e05eec679089a7428049119b2c178f930a5e9934424d2465717
5
5
  SHA512:
6
- metadata.gz: 6e9492dd289b327e48cd06f9f8d3abd5962c1cf19319bb2fb0bc94bbafc35a1438fef67b80134a56e13400410ffa0504b41518ebe9ad7ca450de4ce2ef35826b
7
- data.tar.gz: c2b8ecb84e9944bd1477b90b1d98731a8b7403459071de88911b8676eff237c987a04873fb978b486a56e73a676ad35358a4b0dbfa16a8e6ff16d30f6af0d278
6
+ metadata.gz: 4f866c4a665ed0cdd1101385a86edf1264b07b5810e41c5e48399ede3bb25e95912f5b8a0c1153089361b61f4aa535bbced16f2f30d4724a53f78c75bf747faf
7
+ data.tar.gz: 6f9ad9c66a64db021d848dadaf8d6c485497d1e6b49683c01d09623a4c0640a46ce9b2493c5bf2864fd43ebea13f1cef12ce617b10268be516d63e670cd8716e
data/.yarnrc.yml CHANGED
@@ -4,7 +4,7 @@ npmScopes:
4
4
  etaminstudio:
5
5
  npmAlwaysAuth: true
6
6
  npmAuthToken: "${NPM_AUTH_TOKEN-fallback}"
7
- npmPublishRegistry: "https://git.etaminstud.io/api/v4/projects/229/packages/npm/"
7
+ npmPublishRegistry: "https://git.etamin.studio/api/v4/projects/229/packages/npm/"
8
8
 
9
9
  plugins:
10
10
  - path: .yarn/plugins/@yarnpkg/plugin-interactive-tools.cjs
data/AGENTS.md CHANGED
@@ -4,7 +4,7 @@ Guidance for AI coding agents working in this repository. Keep it accurate — u
4
4
 
5
5
  ## What is Trek
6
6
 
7
- Trek is a customizable CMS for Ruby on Rails, shipped as a **Ruby gem** (`trek`) plus a companion **NPM package** (`@etaminstudio/trek`). It's a Rails **engine** (`lib/trek/engine.rb`) that installs a back-office/admin into a host app. Installation and features are driven by Rails generators (`rails g trek:install`, `trek:scaffold`, `trek:admin:user`, …). Authored by Etamin Studio. Private gem hosted on self-hosted GitLab (`git.etaminstud.io`), not public RubyGems.
7
+ Trek is a customizable CMS for Ruby on Rails, shipped as a **Ruby gem** (`trek`) plus a companion **NPM package** (`@etaminstudio/trek`). It's a Rails **engine** (`lib/trek/engine.rb`) that installs a back-office/admin into a host app. Installation and features are driven by Rails generators (`rails g trek:install`, `trek:scaffold`, `trek:admin:user`, …). Authored by Etamin Studio. Private gem hosted on self-hosted GitLab (`git.etamin.studio`), not public RubyGems.
8
8
 
9
9
  ## Tech stack
10
10
 
data/CHANGELOG.md CHANGED
@@ -1,5 +1,15 @@
1
1
  ## [Unreleased]
2
2
 
3
+ ## [0.1.27] - 2026-08-18
4
+
5
+ ### Added
6
+
7
+ - `trek:upgrade:v2` generator: upgrades a host app to Trek 2.0 by switching it from the private GitLab packages to the public ones — the [`trek` gem on RubyGems](https://rubygems.org/gems/trek) and the unscoped [`trek` npm package](https://www.npmjs.com/package/trek). It rewrites the Gemfile (`git:` source → `gem "trek", "~> 2.0"`), drops the `git.etamin.studio` Bundler credentials, swaps the `@etaminstudio/trek` npm dependency and imports for `trek`, cleans the GitLab registry/scope out of `.yarnrc.yml`, and lists the CI credentials to remove manually. (#198) **Upgrade note:** this ships in 0.1.27 — the last version published to the private GitLab sources — so upgrade to it, then run `rails g trek:upgrade:v2` to move to Trek 2.0 and stop depending on the private GitLab sources and their deploy token.
8
+
9
+ ### Changed
10
+
11
+ - `trek:install:ruby` now pins **Ruby 4.0.6** (was 4.0.5), and the CI images (repo + generated `.gitlab-ci.yml` template) use the matching `4.0.6` tag. **Upgrade note:** existing apps can set `4.0.6` in `.ruby-version` and bump the `ci-ruby` image tag in `.gitlab-ci.yml`.
12
+
3
13
  ## [0.1.26] - 2026-07-02
4
14
 
5
15
  ### Changed
@@ -37,6 +47,12 @@
37
47
  - `trek:install` now adds a `!/.env.example` exception to `.gitignore` so the generated `.env.example` template stays tracked (Rails ignores all `/.env*` files by default).
38
48
  - `trek:install:postmark` now matches the production.rb SMTP comment with or without the `bin/` prefix, so the Postmark config is injected on Rails 8.0 as well as 8.1 (previously the injection silently did nothing when the anchor did not match).
39
49
 
50
+ ## [0.1.8] - 2025-09-03
51
+
52
+ ### Fixed
53
+
54
+ - _(documented retroactively, 2026-07-27)_ Removed the dead `option :items` from `Trek::ListComponent`, which collided with its `renders_many :items` slot. This turned out to fix a serious incompatibility: since view_component **3.15.0**, slot readers are defined in an included module, so the dry-initializer option reader (defaulting to `[]`) shadows the slot reader — `items` always returns `[]` and **every `ListComponent` list renders its empty state**, i.e. all admin index pages look empty regardless of data or permissions (tree-based indexes like pages are unaffected). With view_component ≤ 3.14 the slot reader happened to overwrite the option reader, masking the collision. **Upgrade note:** apps pinned to Trek < 0.1.8 that bump view_component to ≥ 3.15 (e.g. for its security fixes) hit this immediately; until they can upgrade Trek, they can restore the slot reader with an initializer: `Rails.application.config.to_prepare { Trek::ListComponent.class_eval { def items = get_slot(:items) } }`.
55
+
40
56
  ## [0.0.1] - 2023-01-24
41
57
 
42
58
  - Initial release
data/Gemfile.lock CHANGED
@@ -1,7 +1,7 @@
1
1
  PATH
2
2
  remote: .
3
3
  specs:
4
- trek (0.1.26)
4
+ trek (0.1.27)
5
5
  action_policy (~> 0.6)
6
6
  actioncable
7
7
  acts_as_list (~> 1.1)
@@ -39,29 +39,29 @@ GEM
39
39
  ruby-next-core (>= 1.0)
40
40
  action_text-trix (2.1.18)
41
41
  railties
42
- actioncable (8.1.3)
43
- actionpack (= 8.1.3)
44
- activesupport (= 8.1.3)
42
+ actioncable (8.1.3.1)
43
+ actionpack (= 8.1.3.1)
44
+ activesupport (= 8.1.3.1)
45
45
  nio4r (~> 2.0)
46
46
  websocket-driver (>= 0.6.1)
47
47
  zeitwerk (~> 2.6)
48
- actionmailbox (8.1.3)
49
- actionpack (= 8.1.3)
50
- activejob (= 8.1.3)
51
- activerecord (= 8.1.3)
52
- activestorage (= 8.1.3)
53
- activesupport (= 8.1.3)
48
+ actionmailbox (8.1.3.1)
49
+ actionpack (= 8.1.3.1)
50
+ activejob (= 8.1.3.1)
51
+ activerecord (= 8.1.3.1)
52
+ activestorage (= 8.1.3.1)
53
+ activesupport (= 8.1.3.1)
54
54
  mail (>= 2.8.0)
55
- actionmailer (8.1.3)
56
- actionpack (= 8.1.3)
57
- actionview (= 8.1.3)
58
- activejob (= 8.1.3)
59
- activesupport (= 8.1.3)
55
+ actionmailer (8.1.3.1)
56
+ actionpack (= 8.1.3.1)
57
+ actionview (= 8.1.3.1)
58
+ activejob (= 8.1.3.1)
59
+ activesupport (= 8.1.3.1)
60
60
  mail (>= 2.8.0)
61
61
  rails-dom-testing (~> 2.2)
62
- actionpack (8.1.3)
63
- actionview (= 8.1.3)
64
- activesupport (= 8.1.3)
62
+ actionpack (8.1.3.1)
63
+ actionview (= 8.1.3.1)
64
+ activesupport (= 8.1.3.1)
65
65
  nokogiri (>= 1.8.5)
66
66
  rack (>= 2.2.4)
67
67
  rack-session (>= 1.0.1)
@@ -69,36 +69,36 @@ GEM
69
69
  rails-dom-testing (~> 2.2)
70
70
  rails-html-sanitizer (~> 1.6)
71
71
  useragent (~> 0.16)
72
- actiontext (8.1.3)
72
+ actiontext (8.1.3.1)
73
73
  action_text-trix (~> 2.1.15)
74
- actionpack (= 8.1.3)
75
- activerecord (= 8.1.3)
76
- activestorage (= 8.1.3)
77
- activesupport (= 8.1.3)
74
+ actionpack (= 8.1.3.1)
75
+ activerecord (= 8.1.3.1)
76
+ activestorage (= 8.1.3.1)
77
+ activesupport (= 8.1.3.1)
78
78
  globalid (>= 0.6.0)
79
79
  nokogiri (>= 1.8.5)
80
- actionview (8.1.3)
81
- activesupport (= 8.1.3)
80
+ actionview (8.1.3.1)
81
+ activesupport (= 8.1.3.1)
82
82
  builder (~> 3.1)
83
83
  erubi (~> 1.11)
84
84
  rails-dom-testing (~> 2.2)
85
85
  rails-html-sanitizer (~> 1.6)
86
- activejob (8.1.3)
87
- activesupport (= 8.1.3)
86
+ activejob (8.1.3.1)
87
+ activesupport (= 8.1.3.1)
88
88
  globalid (>= 0.3.6)
89
- activemodel (8.1.3)
90
- activesupport (= 8.1.3)
91
- activerecord (8.1.3)
92
- activemodel (= 8.1.3)
93
- activesupport (= 8.1.3)
89
+ activemodel (8.1.3.1)
90
+ activesupport (= 8.1.3.1)
91
+ activerecord (8.1.3.1)
92
+ activemodel (= 8.1.3.1)
93
+ activesupport (= 8.1.3.1)
94
94
  timeout (>= 0.4.0)
95
- activestorage (8.1.3)
96
- actionpack (= 8.1.3)
97
- activejob (= 8.1.3)
98
- activerecord (= 8.1.3)
99
- activesupport (= 8.1.3)
95
+ activestorage (8.1.3.1)
96
+ actionpack (= 8.1.3.1)
97
+ activejob (= 8.1.3.1)
98
+ activerecord (= 8.1.3.1)
99
+ activesupport (= 8.1.3.1)
100
100
  marcel (~> 1.0)
101
- activesupport (8.1.3)
101
+ activesupport (8.1.3.1)
102
102
  base64
103
103
  bigdecimal
104
104
  concurrent-ruby (~> 1.0, >= 1.3.1)
@@ -158,7 +158,7 @@ GEM
158
158
  activerecord (>= 7.2.0)
159
159
  with_advisory_lock (>= 7.0.0)
160
160
  zeitwerk (~> 2.7)
161
- concurrent-ruby (1.3.7)
161
+ concurrent-ruby (1.3.8)
162
162
  connection_pool (3.0.2)
163
163
  content_disposition (1.0.0)
164
164
  crass (1.0.7)
@@ -213,7 +213,7 @@ GEM
213
213
  htmlbeautifier (1.4.3)
214
214
  htmlentities (4.3.4)
215
215
  http_accept_language (2.1.1)
216
- i18n (1.14.8)
216
+ i18n (1.15.2)
217
217
  concurrent-ruby (~> 1.0)
218
218
  i18n-tasks (1.1.2)
219
219
  activesupport (>= 4.0.2)
@@ -237,7 +237,7 @@ GEM
237
237
  rdoc (>= 4.0.0)
238
238
  reline (>= 0.4.2)
239
239
  jmespath (1.6.2)
240
- json (2.19.5)
240
+ json (2.21.2)
241
241
  kaminari (1.2.2)
242
242
  activesupport (>= 4.1.0)
243
243
  kaminari-actionview (= 1.2.2)
@@ -256,7 +256,7 @@ GEM
256
256
  rb-fsevent (~> 0.10, >= 0.10.3)
257
257
  rb-inotify (~> 0.9, >= 0.9.10)
258
258
  logger (1.7.0)
259
- loofah (2.25.1)
259
+ loofah (2.25.2)
260
260
  crass (~> 1.0.2)
261
261
  nokogiri (>= 1.12.0)
262
262
  lookbook (2.3.14)
@@ -271,7 +271,7 @@ GEM
271
271
  view_component (>= 2.0)
272
272
  yard (~> 0.9)
273
273
  zeitwerk (~> 2.5)
274
- mail (2.9.0)
274
+ mail (2.9.1)
275
275
  logger
276
276
  mini_mime (>= 0.1.1)
277
277
  net-imap
@@ -331,20 +331,20 @@ GEM
331
331
  rack (>= 1.3)
332
332
  rackup (2.3.1)
333
333
  rack (>= 3)
334
- rails (8.1.3)
335
- actioncable (= 8.1.3)
336
- actionmailbox (= 8.1.3)
337
- actionmailer (= 8.1.3)
338
- actionpack (= 8.1.3)
339
- actiontext (= 8.1.3)
340
- actionview (= 8.1.3)
341
- activejob (= 8.1.3)
342
- activemodel (= 8.1.3)
343
- activerecord (= 8.1.3)
344
- activestorage (= 8.1.3)
345
- activesupport (= 8.1.3)
334
+ rails (8.1.3.1)
335
+ actioncable (= 8.1.3.1)
336
+ actionmailbox (= 8.1.3.1)
337
+ actionmailer (= 8.1.3.1)
338
+ actionpack (= 8.1.3.1)
339
+ actiontext (= 8.1.3.1)
340
+ actionview (= 8.1.3.1)
341
+ activejob (= 8.1.3.1)
342
+ activemodel (= 8.1.3.1)
343
+ activerecord (= 8.1.3.1)
344
+ activestorage (= 8.1.3.1)
345
+ activesupport (= 8.1.3.1)
346
346
  bundler (>= 1.15.0)
347
- railties (= 8.1.3)
347
+ railties (= 8.1.3.1)
348
348
  rails-dom-testing (2.3.0)
349
349
  activesupport (>= 5.0.0)
350
350
  minitest
@@ -352,15 +352,15 @@ GEM
352
352
  rails-healthcheck (1.4.0)
353
353
  actionpack
354
354
  railties
355
- rails-html-sanitizer (1.7.0)
356
- loofah (~> 2.25)
355
+ rails-html-sanitizer (1.7.1)
356
+ loofah (~> 2.25, >= 2.25.2)
357
357
  nokogiri (>= 1.15.7, != 1.16.7, != 1.16.6, != 1.16.5, != 1.16.4, != 1.16.3, != 1.16.2, != 1.16.1, != 1.16.0.rc1, != 1.16.0)
358
358
  rails-i18n (8.1.0)
359
359
  i18n (>= 0.7, < 2)
360
360
  railties (>= 8.0.0, < 9)
361
- railties (8.1.3)
362
- actionpack (= 8.1.3)
363
- activesupport (= 8.1.3)
361
+ railties (8.1.3.1)
362
+ actionpack (= 8.1.3.1)
363
+ activesupport (= 8.1.3.1)
364
364
  irb (~> 1.13)
365
365
  rackup (>= 1.0.0)
366
366
  rake (>= 12.2)
@@ -498,7 +498,7 @@ GEM
498
498
  unicode-emoji (4.2.0)
499
499
  uri (1.1.1)
500
500
  useragent (0.16.11)
501
- view_component (4.10.0)
501
+ view_component (4.12.0)
502
502
  actionview (>= 7.1.0)
503
503
  activesupport (>= 7.1.0)
504
504
  concurrent-ruby (~> 1)
@@ -507,7 +507,7 @@ GEM
507
507
  activesupport (>= 7.2.0, < 8.2)
508
508
  view_component (>= 2.34.0, < 5.0)
509
509
  zeitwerk (~> 2.5)
510
- websocket-driver (0.8.0)
510
+ websocket-driver (0.8.2)
511
511
  base64
512
512
  websocket-extensions (>= 0.1.0)
513
513
  websocket-extensions (0.1.5)
@@ -520,6 +520,7 @@ GEM
520
520
  zeitwerk (2.7.5)
521
521
 
522
522
  PLATFORMS
523
+ arm64-darwin-23
523
524
  arm64-darwin-24
524
525
  x86_64-darwin-21
525
526
  x86_64-darwin-22
data/Makefile CHANGED
@@ -1,4 +1,4 @@
1
- .PHONY: all
1
+ .PHONY: *
2
2
 
3
3
  release:
4
4
  @read -p "New version (current: $$(sed -n 's/.*VERSION = "\(.*\)"/\1/p' lib/trek/version.rb)): " version; \
@@ -11,3 +11,25 @@ release:
11
11
  git commit -m "Version $$version"; \
12
12
  bundle exec rake release; \
13
13
  yarn npm publish
14
+
15
+ audit-fix:
16
+ @out=$$(bundle exec bundle-audit check --update 2>&1); \
17
+ echo "$$out"; echo; \
18
+ gems=$$(echo "$$out" | awk '/^Name: /{print $$2}' | sort -u); \
19
+ if [ -z "$$gems" ]; then \
20
+ echo "No vulnerable gems 🎉"; \
21
+ else \
22
+ echo "Vulnerable gems: $$gems"; \
23
+ bundle update --conservative $$gems; \
24
+ if ! bundle exec bundle-audit check; then \
25
+ echo "Still vulnerable after update — the resolver may have picked an old version; add a version floor in the Gemfile (e.g. gem \"foo\", \">= x.y\") and retry"; \
26
+ git checkout Gemfile.lock; \
27
+ exit 1; \
28
+ elif git diff --quiet Gemfile.lock; then \
29
+ echo "Gemfile.lock unchanged — a version cap may be blocking the fix; try adding the capping gem to 'bundle update'"; \
30
+ else \
31
+ git add Gemfile.lock && \
32
+ git commit -m "Upgrade $$(echo $$gems | sed 's/ /, /g') (CVE)" && \
33
+ git push; \
34
+ fi; \
35
+ fi
data/README.md CHANGED
@@ -52,7 +52,7 @@ Create your Rails project (replace `helloworld` with your own project name):
52
52
  rails new $TREK_PROJECT_NAME -j esbuild -d postgresql --skip-action-mailbox --skip-action-text --skip-action-cable --skip-active-storage --skip-jbuilder --skip-test --skip-system-test
53
53
  cd $TREK_PROJECT_NAME
54
54
 
55
- [Create a deploy token](https://git.etaminstud.io/etaminstudio/trek/-/settings/repository#js-deploy-tokens) associated to Trek project:
55
+ [Create a deploy token](https://git.etamin.studio/etaminstudio/trek/-/settings/repository#js-deploy-tokens) associated to Trek project:
56
56
 
57
57
  - Name: `helloworld` (replace with your project name)
58
58
  - Username: `helloworld` (replace with your project name)
@@ -66,11 +66,11 @@ Copy the generated token to an ENV variable (replace `XXXXXXXXXXX` with the toke
66
66
 
67
67
  Add this deploy token to your project local config:
68
68
 
69
- bundle config git.etaminstud.io $TREK_PROJECT_NAME:$TREK_DEPLOY_TOKEN
69
+ bundle config git.etamin.studio $TREK_PROJECT_NAME:$TREK_DEPLOY_TOKEN
70
70
 
71
71
  Install the gem and add it to the application's Gemfile by running:
72
72
 
73
- bundle add trek --git https://git.etaminstud.io/etaminstudio/trek.git --branch main
73
+ bundle add trek --git https://git.etamin.studio/etaminstudio/trek.git --branch main
74
74
 
75
75
  ### Install the NPM package
76
76
 
@@ -176,7 +176,7 @@ Let's use [Bundler `local` feature](https://bundler.io/v2.7/man/bundle-config.1.
176
176
 
177
177
  First, make sure you're pointing to Trek's git repo main branch in your `Gemfile`:
178
178
 
179
- gem "trek", git: "git@git.etaminstud.io:etaminstudio/trek.git", branch: :main
179
+ gem "trek", git: "git@git.etamin.studio:etaminstudio/trek.git", branch: :main
180
180
 
181
181
  Navigate to your project, then configure the local version of Trek:
182
182
 
@@ -229,4 +229,4 @@ This will:
229
229
  3. Run `bundle` to update the lockfile
230
230
  4. Commit all changes with message "Version X.Y.Z"
231
231
  5. Run `bundle exec rake release` (creates git tag, pushes commits/tag, pushes gem to [rubygems.org](https://rubygems.org))
232
- 6. Run `yarn npm publish` (publishes the npm package). This requires a [personal token](https://git.etaminstud.io/-/user_settings/personal_access_tokens) with the `api` scope to be present in `NPM_AUTH_TOKEN`,
232
+ 6. Run `yarn npm publish` (publishes the npm package). This requires a [personal token](https://git.etamin.studio/-/user_settings/personal_access_tokens) with the `api` scope to be present in `NPM_AUTH_TOKEN`,
@@ -48,7 +48,7 @@ cd $TREK_PROJECT_NAME
48
48
 
49
49
  ## Get access to Trek
50
50
 
51
- Trek is distributed as a gem and an NPM package from Etamin Studio's GitLab. [Create a deploy token](https://git.etaminstud.io/etaminstudio/trek/-/settings/repository#js-deploy-tokens) associated to the Trek project:
51
+ Trek is distributed as a gem and an NPM package from Etamin Studio's GitLab. [Create a deploy token](https://git.etamin.studio/etaminstudio/trek/-/settings/repository#js-deploy-tokens) associated to the Trek project:
52
52
 
53
53
  - **Name**: your project name (e.g. `helloworld`)
54
54
  - **Username**: your project name (e.g. `helloworld`)
@@ -65,13 +65,13 @@ export TREK_DEPLOY_TOKEN=XXXXXXXXXXX
65
65
  Add the deploy token to your project's local Bundler config:
66
66
 
67
67
  ```sh
68
- bundle config git.etaminstud.io $TREK_PROJECT_NAME:$TREK_DEPLOY_TOKEN
68
+ bundle config git.etamin.studio $TREK_PROJECT_NAME:$TREK_DEPLOY_TOKEN
69
69
  ```
70
70
 
71
71
  Install the gem and add it to your `Gemfile`:
72
72
 
73
73
  ```sh
74
- bundle add trek --git https://git.etaminstud.io/etaminstudio/trek.git --branch main
74
+ bundle add trek --git https://git.etamin.studio/etaminstudio/trek.git --branch main
75
75
  ```
76
76
 
77
77
  Prepare the NPM package installation:
@@ -5,7 +5,7 @@ module Trek
5
5
  module Generators
6
6
  module Install
7
7
  class RubyGenerator < Rails::Generators::Base
8
- RUBY_VERSION = "4.0.5"
8
+ RUBY_VERSION = "4.0.6"
9
9
 
10
10
  include Trek::Generators::Helpers
11
11
 
@@ -56,13 +56,13 @@ module Trek
56
56
  nodeLinker: node-modules
57
57
 
58
58
  npmRegistries:
59
- //git.etaminstud.io/api/v4/packages/npm:
59
+ //git.etamin.studio/api/v4/packages/npm:
60
60
  npmAlwaysAuth: true
61
61
  npmAuthToken: "${NPM_AUTH_TOKEN-fallback}"
62
62
 
63
63
  npmScopes:
64
64
  etaminstudio:
65
- npmRegistryServer: "https://git.etaminstud.io/api/v4/packages/npm"
65
+ npmRegistryServer: "https://git.etamin.studio/api/v4/packages/npm"
66
66
  # Our own registry — skip Yarn's minimal-age gate so a freshly
67
67
  # published Trek release installs without the quarantine delay.
68
68
  npmMinimalAgeGate: 0
@@ -20,7 +20,7 @@ stages:
20
20
 
21
21
  # Defaults
22
22
  default:
23
- image: registry.git.etaminstud.io/devops/ci-ruby/node-24:4.0.5
23
+ image: registry.git.etamin.studio/devops/ci-ruby/node-24:4.0.6
24
24
 
25
25
  services:
26
26
  - postgres:16
@@ -30,6 +30,28 @@ scan:
30
30
  bundle exec brakeman
31
31
  bundle exec bundle-audit check --update
32
32
 
33
+ audit-fix:
34
+ @out=$$(bundle exec bundle-audit check --update 2>&1); \
35
+ echo "$$out"; echo; \
36
+ gems=$$(echo "$$out" | awk '/^Name: /{print $$2}' | sort -u); \
37
+ if [ -z "$$gems" ]; then \
38
+ echo "No vulnerable gems 🎉"; \
39
+ else \
40
+ echo "Vulnerable gems: $$gems"; \
41
+ bundle update --conservative $$gems; \
42
+ if ! bundle exec bundle-audit check; then \
43
+ echo "Still vulnerable after update — the resolver may have picked an old version; add a version floor in the Gemfile (e.g. gem \"foo\", \">= x.y\") and retry"; \
44
+ git checkout Gemfile.lock; \
45
+ exit 1; \
46
+ elif git diff --quiet Gemfile.lock; then \
47
+ echo "Gemfile.lock unchanged — a version cap may be blocking the fix; try adding the capping gem to 'bundle update'"; \
48
+ else \
49
+ git add Gemfile.lock && \
50
+ git commit -m "Upgrade $$(echo $$gems | sed 's/ /, /g') (CVE)" && \
51
+ git push; \
52
+ fi; \
53
+ fi
54
+
33
55
  test:
34
56
  overmind run bundle exec rails spec
35
57
  spec: test
@@ -0,0 +1,87 @@
1
+ require "rails/generators/actions"
2
+ require "generators/trek/helpers"
3
+ require "yaml"
4
+
5
+ module Trek
6
+ module Generators
7
+ module Upgrade
8
+ # The Trek 2.0 upgrade: switches a host app from the private GitLab packages (git-sourced gem +
9
+ # @etaminstudio/trek on the GitLab npm registry) to the public ones: the
10
+ # trek gem on RubyGems and the unscoped trek package on npmjs.com.
11
+ class V2Generator < Rails::Generators::Base
12
+ # 2.0.0 is the first version published to RubyGems + npmjs.com (the
13
+ # public npm "trek" name starts there — see the 2.0.0 changelog entry),
14
+ # hence a hardcoded floor rather than Trek::VERSION.
15
+ GEM_REQUIREMENT = "~> 2.0"
16
+ NPM_REQUIREMENT = "^2.0.0"
17
+
18
+ include Trek::Generators::Helpers
19
+
20
+ desc "Upgrade to Trek 2.0: switch the trek gem and npm package from the private GitLab sources to RubyGems and npmjs.com."
21
+
22
+ def switch_gemfile_to_rubygems
23
+ gsub_file "Gemfile", /^gem ["']trek["'],.*$/, %(gem "trek", "#{GEM_REQUIREMENT}")
24
+ end
25
+
26
+ def remove_bundler_credentials
27
+ run "bundle config unset git.etamin.studio"
28
+ end
29
+
30
+ def install_gems
31
+ bundle_install
32
+ end
33
+
34
+ def rename_npm_dependency
35
+ gsub_file "package.json", %r{"@etaminstudio/trek":}, '"trek":'
36
+ end
37
+
38
+ def rewrite_imports
39
+ Dir.glob("app/javascript/**/*.js").each do |file|
40
+ next unless File.read(file).include?("@etaminstudio/trek")
41
+
42
+ gsub_file file, %r{(["'])@etaminstudio/trek(["'/])}, '\1trek\2'
43
+ end
44
+ end
45
+
46
+ def clean_yarnrc
47
+ return unless File.exist?(".yarnrc.yml")
48
+
49
+ # Drop the etaminstudio scope and the git.etamin.studio registry
50
+ # entries (registry server, auth token, minimal-age-gate exemption).
51
+ # Text-based so the rest of the file keeps its comments and layout,
52
+ # but YAML-checked: parent keys are only removed once a parse proves
53
+ # they are empty, and nothing is written if the result doesn't parse.
54
+ content = File.read(".yarnrc.yml")
55
+ .gsub(%r{ "?//git\.etamin\.studio[^\n]*:\n(?: [^\n]*\n)*}, "")
56
+ .gsub(/ etaminstudio:\n(?: [^\n]*\n)*/, "")
57
+
58
+ %w[npmRegistries npmScopes].each do |key|
59
+ content.sub!(/^#{key}:\n/, "") if YAML.safe_load(content)&.fetch(key, :absent).nil?
60
+ end
61
+ content.gsub!(/\n{3,}/, "\n\n")
62
+
63
+ create_file ".yarnrc.yml", content, force: true
64
+ rescue Psych::Exception
65
+ say "Could not safely edit .yarnrc.yml — remove the git.etamin.studio registry " \
66
+ "and the etaminstudio scope manually.", :yellow
67
+ end
68
+
69
+ def install_npm_package
70
+ install_npm_dependencies({ "trek" => NPM_REQUIREMENT })
71
+ end
72
+
73
+ def summary
74
+ say <<~SUMMARY
75
+
76
+ The trek gem now comes from RubyGems and the trek npm package from npmjs.com.
77
+
78
+ Manual follow-ups:
79
+ * Remove the NPM_AUTH_TOKEN variable and the Bundler credentials for
80
+ git.etamin.studio (BUNDLE_GIT__ETAMIN__STUDIO) from your CI settings.
81
+ * Once every app is migrated, revoke the Trek deploy token on GitLab.
82
+ SUMMARY
83
+ end
84
+ end
85
+ end
86
+ end
87
+ end
data/lib/trek/version.rb CHANGED
@@ -1,5 +1,5 @@
1
1
  # frozen_string_literal: true
2
2
 
3
3
  module Trek
4
- VERSION = "0.1.26"
4
+ VERSION = "0.1.27"
5
5
  end
data/package.json CHANGED
@@ -1,11 +1,11 @@
1
1
  {
2
2
  "name": "@etaminstudio/trek",
3
- "version": "0.1.26",
3
+ "version": "0.1.27",
4
4
  "description": "A modern CMS for Ruby on Rails",
5
5
  "main": "app/javascript/trek.js",
6
6
  "repository": {
7
7
  "type": "git",
8
- "url": "git@git.etaminstud.io:etaminstudio/trek.git"
8
+ "url": "git@git.etamin.studio:etaminstudio/trek.git"
9
9
  },
10
10
  "author": "Etamin Studio",
11
11
  "dependencies": {
data/yarn.lock CHANGED
@@ -4693,12 +4693,12 @@ __metadata:
4693
4693
  languageName: node
4694
4694
  linkType: hard
4695
4695
 
4696
- "nanoid@npm:^3.3.12":
4697
- version: 3.3.12
4698
- resolution: "nanoid@npm:3.3.12"
4696
+ "nanoid@npm:^3.3.16":
4697
+ version: 3.3.16
4698
+ resolution: "nanoid@npm:3.3.16"
4699
4699
  bin:
4700
4700
  nanoid: bin/nanoid.cjs
4701
- checksum: 38699257447dc59e21e73e0510d0dfb16b7a610d9ca80633d5c3a68f9b4298c990513d30404ca8f163c2d03225ee01695ff8898bea6179183f38f0477b7635ac
4701
+ checksum: 2489d8f87f02178a15b901d7d06e490838383a2acdf01ec2b4e4343c02325ab648965a539eba8bdb821560a33e4c34be506b9e1c7c1bb5cb750e894f500fce92
4702
4702
  languageName: node
4703
4703
  linkType: hard
4704
4704
 
@@ -5567,13 +5567,13 @@ __metadata:
5567
5567
  linkType: hard
5568
5568
 
5569
5569
  "postcss@npm:^8.4.28, postcss@npm:^8.4.30, postcss@npm:^8.4.31, postcss@npm:^8.4.32, postcss@npm:^8.4.43, postcss@npm:^8.5.15":
5570
- version: 8.5.15
5571
- resolution: "postcss@npm:8.5.15"
5570
+ version: 8.5.23
5571
+ resolution: "postcss@npm:8.5.23"
5572
5572
  dependencies:
5573
- nanoid: ^3.3.12
5573
+ nanoid: ^3.3.16
5574
5574
  picocolors: ^1.1.1
5575
5575
  source-map-js: ^1.2.1
5576
- checksum: 82e046d5bd0c537e7bcae1b97ec366968cac4ebdbd38773b69a2a4ad437f26641643a48f120317dd167199ac718ff8a0ab7dd102258430e4c919daaef0e57904
5576
+ checksum: 02fe0aac9de34914104566b3fe3a29903dc7bae4a3fffffdca1331dc51e14aa62c48e8373fc4d107ef99f8f5cae98199d9a89fbcbf43371693b22a397ff5cc34
5577
5577
  languageName: node
5578
5578
  linkType: hard
5579
5579
 
metadata CHANGED
@@ -1,7 +1,7 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: trek
3
3
  version: !ruby/object:Gem::Version
4
- version: 0.1.26
4
+ version: 0.1.27
5
5
  platform: ruby
6
6
  authors:
7
7
  - Mohamed Bengrich
@@ -938,6 +938,7 @@ files:
938
938
  - lib/generators/trek/templates/views/admin_mailer/invite.en.text.erb
939
939
  - lib/generators/trek/templates/views/admin_mailer/invite.fr.html.slim
940
940
  - lib/generators/trek/templates/views/admin_mailer/invite.fr.text.erb
941
+ - lib/generators/trek/upgrade/v2_generator.rb
941
942
  - lib/trek.rb
942
943
  - lib/trek/engine.rb
943
944
  - lib/trek/i18n_keys_resolver.rb
@@ -968,7 +969,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
968
969
  - !ruby/object:Gem::Version
969
970
  version: '0'
970
971
  requirements: []
971
- rubygems_version: 4.0.10
972
+ rubygems_version: 4.0.16
972
973
  specification_version: 4
973
974
  summary: A modern CMS for Ruby on Rails
974
975
  test_files: []