whoosh 1.2.1 → 1.2.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f647a91b22fcee8322c6af7bf0ab0ac0108aa3113e2d4db89a3f187bb6a1caa3
-  data.tar.gz: e46c07b2f4fbaf1233bb52a321ff161952989313adbbfebdb5b7bf1c08675f08
+  metadata.gz: 336c26ea284a871dafa4b1d26f173293947e30470000539dbf3e0da799063bea
+  data.tar.gz: 6acf7d5007d008070aaddb543a42de5bddf3b3aa2de838e1be5ccba5d18b9442
 SHA512:
-  metadata.gz: 1ca2dbc63ab481d5d61260cfbfca37768a9498fa74fe90d68f039884f05ca2a79f0fa08da07fdca04ba175e95ab0997d5cc00acf0e8b2bbceef5ca576f8fef91
-  data.tar.gz: b0361d6a812b80e093125f7be7d5681977ab615b6ebccacbe87753352223e6058e0076dd2eace8e3092a60a57e3387b9ebe0baed4b2f623befeb8f1c38d9435e
+  metadata.gz: 86aebc850e904960fe87d08aa7c6e8d6aba82c5e411e66e0e9ae65fb64d5510b8ddae4125099554fecac71907c163ce854d1adc416bd8e84ee5f6f3376556809
+  data.tar.gz: 99c067d27463fff53a3cb5818836a11e90e0e86d1f886d211770a6407725b6ca0ba72cd3e52c94bd4b204d57e5d282ff89d102863c9410c545c63e3d60bcf332

data/lib/whoosh/cli/main.rb

@@ -224,45 +224,67 @@ module Whoosh
         end
       }
 
-      desc "ci", "Run full CI pipeline (lint + security + tests)"
+      desc "ci", "Run full CI pipeline (lint + security + audit + tests + coverage)"
       def ci
         puts "=> Whoosh CI Pipeline"
         puts "=" * 50
         puts ""
 
         steps = []
+        skipped = []
 
         # Step 1: Rubocop (lint)
         if system("bundle exec rubocop --version > /dev/null 2>&1")
           steps << { name: "Rubocop (lint)", cmd: "bundle exec rubocop --format simple" }
         else
-          puts "  [skip] Rubocop not installed (add rubocop to Gemfile)"
+          skipped << "Rubocop (add rubocop to Gemfile)"
         end
 
-        # Step 2: Brakeman (security)
+        # Step 2: Brakeman (security scan)
         if system("bundle exec brakeman --version > /dev/null 2>&1")
           steps << { name: "Brakeman (security)", cmd: "bundle exec brakeman -q --no-pager" }
         else
-          puts "  [skip] Brakeman not installed (add brakeman to Gemfile)"
+          skipped << "Brakeman (add brakeman to Gemfile)"
         end
 
-        # Step 3: RSpec (tests)
+        # Step 3: Bundle audit (CVE check)
+        if system("bundle exec bundle-audit version > /dev/null 2>&1")
+          steps << { name: "Bundle Audit (CVE)", cmd: "bundle exec bundle-audit check --update" }
+        elsif system("bundle audit --help > /dev/null 2>&1")
+          steps << { name: "Bundle Audit (CVE)", cmd: "bundle audit" }
+        else
+          skipped << "Bundle Audit (add bundler-audit to Gemfile)"
+        end
+
+        # Step 4: Secret leak scan (built-in, no gem needed)
+        steps << { name: "Secret Scan", type: :secret_scan }
+
+        # Step 5: RSpec (tests)
         if system("bundle exec rspec --version > /dev/null 2>&1")
           steps << { name: "RSpec (tests)", cmd: "bundle exec rspec --format progress" }
         else
-          puts "  [skip] RSpec not installed"
+          skipped << "RSpec (add rspec to Gemfile)"
         end
 
-        # Step 4: Gem build check
-        gemspec = Dir.glob("*.gemspec").first
-        if gemspec
-          steps << { name: "Gem build", cmd: "gem build #{gemspec} --quiet" }
-        end
+        # Step 6: Coverage check (built-in)
+        steps << { name: "Coverage Check", type: :coverage_check }
+
+        skipped.each { |s| puts "  [skip] #{s}" }
+        puts "" unless skipped.empty?
 
         failed = []
         steps.each_with_index do |step, i|
           puts "--- [#{i + 1}/#{steps.length}] #{step[:name]} ---"
-          success = system(step[:cmd])
+
+          success = case step[:type]
+          when :secret_scan
+            run_secret_scan
+          when :coverage_check
+            run_coverage_check
+          else
+            system(step[:cmd])
+          end
+
           if success
             puts "  ✓ #{step[:name]} passed"
           else
@@ -274,7 +296,7 @@ module Whoosh
 
         puts "=" * 50
         if failed.empty?
-          puts "=> All checks passed! ✓"
+          puts "=> All #{steps.length} checks passed! ✓"
           exit 0
         else
           puts "=> FAILED: #{failed.join(', ')}"
@@ -282,6 +304,61 @@ module Whoosh
         end
       end
 
+      private
+
+      def run_secret_scan
+        patterns = [
+          /(?:api[_-]?key|secret|password|token)\s*[:=]\s*["'][A-Za-z0-9+\/=]{8,}["']/i,
+          /(?:sk-|pk-|rk-)[a-zA-Z0-9]{20,}/,
+          /-----BEGIN (?:RSA |EC )?PRIVATE KEY-----/,
+          /AKIA[0-9A-Z]{16}/,  # AWS access key
+        ]
+
+        leaked = []
+        Dir.glob("{app.rb,lib/**/*.rb,endpoints/**/*.rb,config/**/*.rb}").each do |file|
+          next if file.include?("spec/") || file.include?("test/")
+          content = File.read(file) rescue next
+          patterns.each do |pattern|
+            content.each_line.with_index do |line, i|
+              if line.match?(pattern) && !line.include?("ENV[") && !line.include?("ENV.fetch")
+                leaked << "#{file}:#{i + 1}: #{line.strip[0..80]}"
+              end
+            end
+          end
+        end
+
+        if leaked.empty?
+          true
+        else
+          puts "  Potential secrets found:"
+          leaked.each { |l| puts "    #{l}" }
+          false
+        end
+      end
+
+      def run_coverage_check
+        coverage_file = File.join(Dir.pwd, "coverage", ".last_run.json")
+        unless File.exist?(coverage_file)
+          puts "  [info] No coverage data found (add simplecov to test_helper for tracking)"
+          true  # Don't fail if SimpleCov not set up
+        else
+          require "json"
+          data = JSON.parse(File.read(coverage_file))
+          coverage = data.dig("result", "line") || data.dig("result", "covered_percent") || 0
+          threshold = 80
+
+          if coverage >= threshold
+            puts "  Coverage: #{coverage.round(1)}% (threshold: #{threshold}%)"
+            true
+          else
+            puts "  Coverage: #{coverage.round(1)}% — below #{threshold}% threshold"
+            false
+          end
+        end
+      end
+
+      public
+
       desc "new NAME", "Create a new Whoosh project"
       option :minimal, type: :boolean, default: false
       option :full, type: :boolean, default: false

data/lib/whoosh/cli/project_generator.rb

@@ -150,6 +150,8 @@ module Whoosh
               gem "rack-test"
               gem "rubocop", require: false
               gem "brakeman", require: false
+              gem "bundler-audit", require: false
+              gem "simplecov", require: false
             end
           GEM
 
@@ -256,6 +258,13 @@ module Whoosh
           <<~RUBY
             # frozen_string_literal: true
 
+            require "simplecov"
+            SimpleCov.start do
+              add_filter "/test/"
+              add_filter "/spec/"
+              minimum_coverage 80
+            end
+
             require "whoosh/test"
             require_relative "../app"
 

data/lib/whoosh/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Whoosh
-  VERSION = "1.2.1"
+  VERSION = "1.2.2"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: whoosh
 version: !ruby/object:Gem::Version
-  version: 1.2.1
+  version: 1.2.2
 platform: ruby
 authors:
 - Johannes Dwi Cahyo