From e4fd821be989da0bf7420c67455d905e233c9069 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Juan=20V=C3=A1squez?= Date: Mon, 6 Jul 2026 12:43:04 -0600 Subject: [PATCH 01/28] Add Docker and docker-compose setup for local development Ruby 2.7.2/Rails 6.1 on Debian buster needs its apt sources pointed at archive.debian.org (buster is EOL) and Node 12 installed from the official tarball since NodeSource dropped its setup script. Debian buster's glibc is also too old for nokogiri's precompiled native gem, so bundler is configured to build it from source instead. database.yml now reads host/username/password from env vars (defaulting to the existing local behavior) so the same file works inside and outside Docker. Mounting a volume over /usr/local/bundle would shadow the gems baked into the image at build time, so docker-compose relies on the image's built-in gem set instead. --- .dockerignore | 12 ++++++++ .gitignore | 1 + Dockerfile | 56 ++++++++++++++++++++++++++++++++++++++ config/database.yml.sample | 5 ++-- docker-compose.yml | 34 +++++++++++++++++++++++ docker/entrypoint.sh | 16 +++++++++++ 6 files changed, 122 insertions(+), 2 deletions(-) create mode 100644 .dockerignore create mode 100644 Dockerfile create mode 100644 docker-compose.yml create mode 100644 docker/entrypoint.sh diff --git a/.dockerignore b/.dockerignore new file mode 100644 index 0000000..b7edad4 --- /dev/null +++ b/.dockerignore @@ -0,0 +1,12 @@ +.git +.circleci +log/* +tmp/* +!log/.keep +!tmp/.keep +vendor/bundle +node_modules +.env +config/database.yml +.bundle +*.sqlite3 diff --git a/.gitignore b/.gitignore index cf829a3..b4123c0 100644 --- a/.gitignore +++ b/.gitignore @@ -6,6 +6,7 @@ # Ignore bundler config. /.bundle +/vendor/bundle # Ignore app config .env diff --git a/Dockerfile b/Dockerfile new file mode 100644 index 0000000..5fe33db --- /dev/null +++ b/Dockerfile @@ -0,0 +1,56 @@ +FROM ruby:2.7.2 + +# Debian buster is EOL; its repos moved to archive.debian.org. +RUN sed -i 's|deb.debian.org|archive.debian.org|g; s|security.debian.org|archive.debian.org|g' /etc/apt/sources.list \ + && echo 'Acquire::Check-Valid-Until "false";' > /etc/apt/apt.conf.d/99no-check-valid-until + +RUN apt-get update -qq \ + && apt-get install -y --no-install-recommends \ + build-essential \ + patch \ + autoconf \ + pkg-config \ + libpq-dev \ + postgresql-client \ + imagemagick \ + fontconfig \ + libxrender1 \ + libxext6 \ + libjpeg62-turbo \ + xfonts-75dpi \ + xfonts-base \ + && rm -rf /var/lib/apt/lists/* + +# Node 12 matches .nvmrc; used by the asset pipeline (sprockets/coffee/sass). +# Installed from the official tarball since NodeSource dropped its Node 12 setup script. +ENV NODE_VERSION=12.13.0 +RUN ARCH="$(dpkg --print-architecture)" \ + && case "$ARCH" in \ + amd64) NODE_ARCH=x64 ;; \ + arm64) NODE_ARCH=arm64 ;; \ + *) echo "Unsupported architecture: $ARCH" && exit 1 ;; \ + esac \ + && curl -fsSLO "https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-${NODE_ARCH}.tar.xz" \ + && tar -xJf "node-v${NODE_VERSION}-linux-${NODE_ARCH}.tar.xz" -C /usr/local --strip-components=1 \ + && rm "node-v${NODE_VERSION}-linux-${NODE_ARCH}.tar.xz" + +RUN gem install bundler -v 2.2.21 + +# Debian buster's glibc (2.28) is too old for nokogiri's precompiled native gem; +# build it from source instead. +RUN bundle config set --global force_ruby_platform true + +WORKDIR /app + +COPY Gemfile Gemfile.lock ./ +RUN bundle _2.2.21_ install --jobs=4 --retry=3 + +COPY . . + +COPY docker/entrypoint.sh /usr/local/bin/entrypoint.sh +RUN chmod +x /usr/local/bin/entrypoint.sh + +EXPOSE 3000 + +ENTRYPOINT ["/usr/local/bin/entrypoint.sh"] +CMD ["bundle", "exec", "rails", "server", "-b", "0.0.0.0"] diff --git a/config/database.yml.sample b/config/database.yml.sample index 1546db9..265a9e3 100644 --- a/config/database.yml.sample +++ b/config/database.yml.sample @@ -9,8 +9,9 @@ default: &default encoding: unicode pool: <%= ENV.fetch("RAILS_MAX_THREADS") { 5 } %> timeout: 5000 - host: localhost - username: + host: <%= ENV.fetch("DATABASE_HOST", "localhost") %> + username: <%= ENV.fetch("DATABASE_USERNAME", "") %> + password: <%= ENV.fetch("DATABASE_PASSWORD", "") %> development: <<: *default diff --git a/docker-compose.yml b/docker-compose.yml new file mode 100644 index 0000000..882da12 --- /dev/null +++ b/docker-compose.yml @@ -0,0 +1,34 @@ +services: + db: + image: postgres:13 + environment: + POSTGRES_USER: postgres + POSTGRES_PASSWORD: postgres + volumes: + - db_data:/var/lib/postgresql/data + healthcheck: + test: ["CMD-SHELL", "pg_isready -U postgres"] + interval: 5s + timeout: 5s + retries: 5 + + web: + build: . + command: bundle exec rails server -b 0.0.0.0 + volumes: + - .:/app + ports: + - "3000:3000" + environment: + RAILS_ENV: development + DATABASE_HOST: db + DATABASE_USERNAME: postgres + DATABASE_PASSWORD: postgres + depends_on: + db: + condition: service_healthy + stdin_open: true + tty: true + +volumes: + db_data: diff --git a/docker/entrypoint.sh b/docker/entrypoint.sh new file mode 100644 index 0000000..f0df4ae --- /dev/null +++ b/docker/entrypoint.sh @@ -0,0 +1,16 @@ +#!/usr/bin/env bash +set -e + +if [ ! -f config/database.yml ]; then + cp config/database.yml.sample config/database.yml +fi + +if [ ! -f .env ]; then + cp .env.sample .env +fi + +rm -f tmp/pids/server.pid + +bundle exec rails db:prepare + +exec "$@" From 76656e28662c43450434f2e568fc89d43dba243c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Juan=20V=C3=A1squez?= Date: Mon, 6 Jul 2026 12:43:17 -0600 Subject: [PATCH 02/28] Upgrade to latest Rails 6.1 patch (6.1.7.10) before hopping to 7.0 Bumping the patch surfaced two transitive incompatibilities to fix first: concurrent-ruby >= 1.3.5 breaks Rails' logger require order on Ruby 2.7, and the nokogiri ~> 1.8.2 pin is too old for the loofah/ rails-html-sanitizer versions that ship with the newer Rails patch. Test suite, rubocop, and reek all pass against 6.1.7.10. --- Gemfile | 4 +- Gemfile.lock | 201 ++++++++++++++++++++++++++++----------------------- db/schema.rb | 12 +-- 3 files changed, 121 insertions(+), 96 deletions(-) diff --git a/Gemfile b/Gemfile index d46e0c2..3ab942a 100644 --- a/Gemfile +++ b/Gemfile @@ -17,11 +17,13 @@ else end gem "bundler-audit" +# concurrent-ruby >= 1.3.5 breaks Rails' logger require order on Ruby 2.7 +gem "concurrent-ruby", "< 1.3.5" # Use sqlite3 as the database for Active Record # gem 'sqlite3' # Use Puma as the app server gem "puma", "~> 3.7" -gem "nokogiri", "~> 1.8.2" +gem "nokogiri", ">= 1.13.0" # Use SCSS for stylesheets gem "sass-rails", "~> 5.0" # Font awesome diff --git a/Gemfile.lock b/Gemfile.lock index 4476373..8288f0d 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -14,60 +14,60 @@ GIT GEM remote: https://rubygems.org/ specs: - actioncable (6.1.4) - actionpack (= 6.1.4) - activesupport (= 6.1.4) + actioncable (6.1.7.10) + actionpack (= 6.1.7.10) + activesupport (= 6.1.7.10) nio4r (~> 2.0) websocket-driver (>= 0.6.1) - actionmailbox (6.1.4) - actionpack (= 6.1.4) - activejob (= 6.1.4) - activerecord (= 6.1.4) - activestorage (= 6.1.4) - activesupport (= 6.1.4) + actionmailbox (6.1.7.10) + actionpack (= 6.1.7.10) + activejob (= 6.1.7.10) + activerecord (= 6.1.7.10) + activestorage (= 6.1.7.10) + activesupport (= 6.1.7.10) mail (>= 2.7.1) - actionmailer (6.1.4) - actionpack (= 6.1.4) - actionview (= 6.1.4) - activejob (= 6.1.4) - activesupport (= 6.1.4) + actionmailer (6.1.7.10) + actionpack (= 6.1.7.10) + actionview (= 6.1.7.10) + activejob (= 6.1.7.10) + activesupport (= 6.1.7.10) mail (~> 2.5, >= 2.5.4) rails-dom-testing (~> 2.0) - actionpack (6.1.4) - actionview (= 6.1.4) - activesupport (= 6.1.4) + actionpack (6.1.7.10) + actionview (= 6.1.7.10) + activesupport (= 6.1.7.10) rack (~> 2.0, >= 2.0.9) rack-test (>= 0.6.3) rails-dom-testing (~> 2.0) rails-html-sanitizer (~> 1.0, >= 1.2.0) - actiontext (6.1.4) - actionpack (= 6.1.4) - activerecord (= 6.1.4) - activestorage (= 6.1.4) - activesupport (= 6.1.4) + actiontext (6.1.7.10) + actionpack (= 6.1.7.10) + activerecord (= 6.1.7.10) + activestorage (= 6.1.7.10) + activesupport (= 6.1.7.10) nokogiri (>= 1.8.5) - actionview (6.1.4) - activesupport (= 6.1.4) + actionview (6.1.7.10) + activesupport (= 6.1.7.10) builder (~> 3.1) erubi (~> 1.4) rails-dom-testing (~> 2.0) rails-html-sanitizer (~> 1.1, >= 1.2.0) - activejob (6.1.4) - activesupport (= 6.1.4) + activejob (6.1.7.10) + activesupport (= 6.1.7.10) globalid (>= 0.3.6) - activemodel (6.1.4) - activesupport (= 6.1.4) - activerecord (6.1.4) - activemodel (= 6.1.4) - activesupport (= 6.1.4) - activestorage (6.1.4) - actionpack (= 6.1.4) - activejob (= 6.1.4) - activerecord (= 6.1.4) - activesupport (= 6.1.4) - marcel (~> 1.0.0) + activemodel (6.1.7.10) + activesupport (= 6.1.7.10) + activerecord (6.1.7.10) + activemodel (= 6.1.7.10) + activesupport (= 6.1.7.10) + activestorage (6.1.7.10) + actionpack (= 6.1.7.10) + activejob (= 6.1.7.10) + activerecord (= 6.1.7.10) + activesupport (= 6.1.7.10) + marcel (~> 1.0) mini_mime (>= 1.1.0) - activesupport (6.1.4) + activesupport (6.1.7.10) concurrent-ruby (~> 1.0, >= 1.0.2) i18n (>= 1.6, < 2) minitest (>= 5.1) @@ -84,11 +84,12 @@ GEM jmespath (~> 1.0) aws-sdk-resources (2.3.23) aws-sdk-core (= 2.3.23) + base64 (0.3.0) bindex (0.8.1) bootstrap-sass (3.4.1) autoprefixer-rails (>= 5.2.1) sassc (>= 2.0.0) - builder (3.2.4) + builder (3.3.0) bundler-audit (0.8.0) bundler (>= 1.2.0, < 3) thor (~> 1.0) @@ -112,21 +113,22 @@ GEM coffee-script-source execjs coffee-script-source (1.12.2) - concurrent-ruby (1.1.9) - crass (1.0.6) + concurrent-ruby (1.3.4) + crass (1.0.7) + date (3.5.1) diff-lcs (1.4.4) dotenv (2.7.6) dotenv-rails (2.7.6) dotenv (= 2.7.6) railties (>= 3.2) - erubi (1.10.0) + erubi (1.13.1) execjs (2.8.1) ffi (1.15.3) font-awesome-rails (4.7.0.7) railties (>= 3.2, < 7) - globalid (0.4.2) - activesupport (>= 4.2.0) - i18n (1.8.10) + globalid (1.4.0) + activesupport (>= 6.1) + i18n (1.14.8) concurrent-ruby (~> 1.0) jbuilder (2.11.2) activesupport (>= 5.0.0) @@ -140,28 +142,43 @@ GEM rb-fsevent (~> 0.9, >= 0.9.4) rb-inotify (~> 0.9, >= 0.9.7) ruby_dep (~> 1.2) - loofah (2.10.0) + logger (1.7.0) + loofah (2.21.1) crass (~> 1.0.2) nokogiri (>= 1.5.9) - mail (2.7.1) + mail (2.9.1) + logger mini_mime (>= 0.1.1) - marcel (1.0.1) + net-imap + net-pop + net-smtp + marcel (1.2.1) material_design_lite-sass (1.3.0.1) autoprefixer-rails (>= 6.5) sass (>= 3.3) - method_source (1.0.0) + method_source (1.1.0) mime-types (3.3.1) mime-types-data (~> 3.2015) mime-types-data (3.2021.0225) mimemagic (0.3.10) nokogiri (~> 1) rake - mini_mime (1.1.0) - mini_portile2 (2.3.0) - minitest (5.14.4) - nio4r (2.5.7) - nokogiri (1.8.5) - mini_portile2 (~> 2.3.0) + mini_mime (1.1.5) + mini_portile2 (2.8.9) + minitest (5.26.1) + net-imap (0.3.10) + date + net-protocol + net-pop (0.1.2) + net-protocol + net-protocol (0.2.2) + timeout + net-smtp (0.5.1) + net-protocol + nio4r (2.7.5) + nokogiri (1.15.7) + mini_portile2 (~> 2.8.2) + racc (~> 1.4) paperclip (5.2.1) activemodel (>= 4.2.0) activesupport (>= 4.2.0) @@ -176,37 +193,39 @@ GEM psych (3.3.2) public_suffix (4.0.6) puma (3.12.6) - rack (2.2.3) - rack-test (1.1.0) - rack (>= 1.0, < 3) - rails (6.1.4) - actioncable (= 6.1.4) - actionmailbox (= 6.1.4) - actionmailer (= 6.1.4) - actionpack (= 6.1.4) - actiontext (= 6.1.4) - actionview (= 6.1.4) - activejob (= 6.1.4) - activemodel (= 6.1.4) - activerecord (= 6.1.4) - activestorage (= 6.1.4) - activesupport (= 6.1.4) + racc (1.8.1) + rack (2.2.23) + rack-test (2.2.0) + rack (>= 1.3) + rails (6.1.7.10) + actioncable (= 6.1.7.10) + actionmailbox (= 6.1.7.10) + actionmailer (= 6.1.7.10) + actionpack (= 6.1.7.10) + actiontext (= 6.1.7.10) + actionview (= 6.1.7.10) + activejob (= 6.1.7.10) + activemodel (= 6.1.7.10) + activerecord (= 6.1.7.10) + activestorage (= 6.1.7.10) + activesupport (= 6.1.7.10) bundler (>= 1.15.0) - railties (= 6.1.4) + railties (= 6.1.7.10) sprockets-rails (>= 2.0.0) - rails-dom-testing (2.0.3) - activesupport (>= 4.2.0) + rails-dom-testing (2.3.0) + activesupport (>= 5.0.0) + minitest nokogiri (>= 1.6) - rails-html-sanitizer (1.3.0) - loofah (~> 2.3) - railties (6.1.4) - actionpack (= 6.1.4) - activesupport (= 6.1.4) + rails-html-sanitizer (1.5.0) + loofah (~> 2.19, >= 2.19.1) + railties (6.1.7.10) + actionpack (= 6.1.7.10) + activesupport (= 6.1.7.10) method_source - rake (>= 0.13) + rake (>= 12.2) thor (~> 1.0) rainbow (3.0.0) - rake (13.0.3) + rake (13.4.2) rb-fsevent (0.11.0) rb-inotify (0.10.1) ffi (~> 1.0) @@ -279,22 +298,24 @@ GEM spring-watcher-listen (2.0.1) listen (>= 2.7, < 4.0) spring (>= 1.2, < 3.0) - sprockets (3.7.2) + sprockets (3.7.5) + base64 concurrent-ruby (~> 1.0) rack (> 1, < 3) - sprockets-rails (3.2.2) - actionpack (>= 4.0) - activesupport (>= 4.0) + sprockets-rails (3.5.2) + actionpack (>= 6.1) + activesupport (>= 6.1) sprockets (>= 3.0.0) standard (1.1.5) rubocop (= 1.18.3) rubocop-performance (= 1.11.4) - thor (1.1.0) + thor (1.5.0) tilt (2.0.10) + timeout (0.6.1) turbolinks (5.2.1) turbolinks-source (~> 5.2) turbolinks-source (5.2.0) - tzinfo (2.0.4) + tzinfo (2.0.6) concurrent-ruby (~> 1.0) uglifier (4.2.0) execjs (>= 0.3.0, < 3) @@ -304,7 +325,8 @@ GEM activemodel (>= 6.0.0) bindex (>= 0.4.0) railties (>= 6.0.0) - websocket-driver (0.7.5) + websocket-driver (0.8.2) + base64 websocket-extensions (>= 0.1.0) websocket-extensions (0.1.5) wicked_pdf (1.4.0) @@ -312,7 +334,7 @@ GEM wkhtmltopdf-binary (0.12.3.1) xpath (3.2.0) nokogiri (~> 1.8) - zeitwerk (2.4.2) + zeitwerk (2.6.18) PLATFORMS ruby @@ -324,12 +346,13 @@ DEPENDENCIES capybara (~> 2.13) clipboard-rails coffee-rails (~> 5.0) + concurrent-ruby (< 1.3.5) dotenv-rails fastruby-styleguide! font-awesome-rails jbuilder (~> 2.5) listen (>= 3.0.5, < 3.2) - nokogiri (~> 1.8.2) + nokogiri (>= 1.13.0) paperclip (~> 5.2.1) pg (~> 1.1) puma (~> 3.7) diff --git a/db/schema.rb b/db/schema.rb index c11571d..ec8d49c 100644 --- a/db/schema.rb +++ b/db/schema.rb @@ -2,15 +2,15 @@ # of editing this file, please use the migrations feature of Active Record to # incrementally modify your database, and then regenerate this schema definition. # -# Note that this schema.rb definition is the authoritative source for your -# database schema. If you need to create the application database on another -# system, you should be using db:schema:load, not running all the migrations -# from scratch. The latter is a flawed and unsustainable approach (the more migrations -# you'll amass, the slower it'll run and the greater likelihood for issues). +# This file is the source Rails uses to define your schema when running `bin/rails +# db:schema:load`. When creating a new database, `bin/rails db:schema:load` tends to +# be faster and is potentially less error prone than running all of your +# migrations from scratch. Old migrations may fail to apply correctly if those +# migrations use external dependencies or application code. # # It's strongly recommended that you check this file into your version control system. -ActiveRecord::Schema.define(version: 20180325143727) do +ActiveRecord::Schema.define(version: 2018_03_25_143727) do # These are extensions that must be enabled in order to support this database enable_extension "plpgsql" From a1e704e31652adf656e247cc4497c1da3e40a1de Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Juan=20V=C3=A1squez?= Date: Mon, 6 Jul 2026 12:58:00 -0600 Subject: [PATCH 03/28] Set up dual-boot for the Rails 6.1 -> 7.0 hop Gemfile.next existed as an ad-hoc symlink pointing at rails/rails main (unstable). Points it at the 7.0.0 release series instead, adds the next_rails gem for NextRails.next? in application code and deprecation tracking, and bakes both dependency sets into the Docker image so `BUNDLE_GEMFILE=Gemfile.next` works without a separate install step. Getting both sides to boot and pass required unpinning a few long-stale dev/asset gems that only worked by accident on old Rails: - font-awesome-rails: >= 4.7.0.9 (old version capped railties < 7) - listen: >= 3.5 (Rails 7's evented file watcher needs ~> 3.5) - spring / spring-watcher-listen: dropped from the `next?` side -- the Rails-7-compatible spring 4.x requires Ruby >= 3.1, which is a separate hop; dev-only, not needed for CI or tests. Both dependency sets boot, migrate, serve requests, and pass the full test suite plus rubocop. --- Dockerfile | 5 + Gemfile | 15 ++- Gemfile.lock | 27 ++--- Gemfile.next.lock | 279 +++++++++++++++++++++++++--------------------- 4 files changed, 184 insertions(+), 142 deletions(-) diff --git a/Dockerfile b/Dockerfile index 5fe33db..8fdd3aa 100644 --- a/Dockerfile +++ b/Dockerfile @@ -45,6 +45,11 @@ WORKDIR /app COPY Gemfile Gemfile.lock ./ RUN bundle _2.2.21_ install --jobs=4 --retry=3 +# Dual-boot: Gemfile.next targets the Rails version we're upgrading to. +# Remove this block (and Gemfile.next / Gemfile.next.lock) once the upgrade lands. +COPY Gemfile.next Gemfile.next.lock ./ +RUN BUNDLE_GEMFILE=Gemfile.next bundle _2.2.21_ install --jobs=4 --retry=3 + COPY . . COPY docker/entrypoint.sh /usr/local/bin/entrypoint.sh diff --git a/Gemfile b/Gemfile index 3ab942a..160375b 100644 --- a/Gemfile +++ b/Gemfile @@ -11,12 +11,13 @@ end ruby "2.7.2" if next? - gem "rails", github: "rails/rails", branch: "main" + gem "rails", "~> 7.0.0" else gem "rails", "~> 6.1.0" end gem "bundler-audit" +gem "next_rails" # concurrent-ruby >= 1.3.5 breaks Rails' logger require order on Ruby 2.7 gem "concurrent-ruby", "< 1.3.5" # Use sqlite3 as the database for Active Record @@ -27,7 +28,7 @@ gem "nokogiri", ">= 1.13.0" # Use SCSS for stylesheets gem "sass-rails", "~> 5.0" # Font awesome -gem "font-awesome-rails" +gem "font-awesome-rails", ">= 4.7.0.9" # Use Uglifier as compressor for JavaScript assets gem "uglifier", ">= 1.3.0" # See https://github.com/rails/execjs#readme for more supported runtimes @@ -76,11 +77,15 @@ end group :development do # Access an IRB console on exception pages or by using <%= console %> anywhere in the code. gem "web-console", ">= 3.3.0" - gem "listen", ">= 3.0.5", "< 3.2" + gem "listen", ">= 3.5" gem "reek" # code smells linter # Spring speeds up development by keeping your application running in the background. Read more: https://github.com/rails/spring - gem "spring" - gem "spring-watcher-listen", "~> 2.0.0" + # spring >= 4 (needed for Rails 7 support) requires Ruby >= 3.1; re-add on the + # `next?` side once Ruby is upgraded past this hop. + unless next? + gem "spring", "~> 2.1" + gem "spring-watcher-listen", "~> 2.0.0" + end end # Windows does not include zoneinfo files, so bundle the tzinfo-data gem diff --git a/Gemfile.lock b/Gemfile.lock index 8288f0d..2017b5f 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -123,9 +123,9 @@ GEM railties (>= 3.2) erubi (1.13.1) execjs (2.8.1) - ffi (1.15.3) - font-awesome-rails (4.7.0.7) - railties (>= 3.2, < 7) + ffi (1.17.4) + font-awesome-rails (4.7.0.9) + railties (>= 3.2, < 9.0) globalid (1.4.0) activesupport (>= 6.1) i18n (1.14.8) @@ -138,10 +138,10 @@ GEM railties (>= 4.2.0) thor (>= 0.14, < 2.0) kwalify (0.7.2) - listen (3.1.5) - rb-fsevent (~> 0.9, >= 0.9.4) - rb-inotify (~> 0.9, >= 0.9.7) - ruby_dep (~> 1.2) + listen (3.10.0) + logger + rb-fsevent (~> 0.10, >= 0.10.3) + rb-inotify (~> 0.9, >= 0.9.10) logger (1.7.0) loofah (2.21.1) crass (~> 1.0.2) @@ -175,6 +175,7 @@ GEM timeout net-smtp (0.5.1) net-protocol + next_rails (1.6.0) nio4r (2.7.5) nokogiri (1.15.7) mini_portile2 (~> 2.8.2) @@ -226,8 +227,8 @@ GEM thor (~> 1.0) rainbow (3.0.0) rake (13.4.2) - rb-fsevent (0.11.0) - rb-inotify (0.10.1) + rb-fsevent (0.11.2) + rb-inotify (0.11.1) ffi (~> 1.0) redcarpet (3.5.1) reek (6.0.4) @@ -276,7 +277,6 @@ GEM rubocop (~> 1.0) rubocop-ast (>= 1.1.0) ruby-progressbar (1.11.0) - ruby_dep (1.5.0) rubyzip (2.3.1) sass (3.7.4) sass-listen (~> 4.0.0) @@ -349,9 +349,10 @@ DEPENDENCIES concurrent-ruby (< 1.3.5) dotenv-rails fastruby-styleguide! - font-awesome-rails + font-awesome-rails (>= 4.7.0.9) jbuilder (~> 2.5) - listen (>= 3.0.5, < 3.2) + listen (>= 3.5) + next_rails nokogiri (>= 1.13.0) paperclip (~> 5.2.1) pg (~> 1.1) @@ -364,7 +365,7 @@ DEPENDENCIES rubocop-rspec sass-rails (~> 5.0) selenium-webdriver - spring + spring (~> 2.1) spring-watcher-listen (~> 2.0.0) standard turbolinks (~> 5) diff --git a/Gemfile.next.lock b/Gemfile.next.lock index af9f9d2..3a27a62 100644 --- a/Gemfile.next.lock +++ b/Gemfile.next.lock @@ -11,95 +11,82 @@ GIT rails (>= 5.2.1) sass-rails (>= 5.0) -GIT - remote: https://github.com/rails/rails.git - revision: 7179dcb269b6cd9fa7504c9bfbe9585021ba8784 - branch: main +GEM + remote: https://rubygems.org/ specs: - actioncable (7.0.0.alpha) - actionpack (= 7.0.0.alpha) - activesupport (= 7.0.0.alpha) + actioncable (7.0.10) + actionpack (= 7.0.10) + activesupport (= 7.0.10) nio4r (~> 2.0) websocket-driver (>= 0.6.1) - actionmailbox (7.0.0.alpha) - actionpack (= 7.0.0.alpha) - activejob (= 7.0.0.alpha) - activerecord (= 7.0.0.alpha) - activestorage (= 7.0.0.alpha) - activesupport (= 7.0.0.alpha) + actionmailbox (7.0.10) + actionpack (= 7.0.10) + activejob (= 7.0.10) + activerecord (= 7.0.10) + activestorage (= 7.0.10) + activesupport (= 7.0.10) mail (>= 2.7.1) - actionmailer (7.0.0.alpha) - actionpack (= 7.0.0.alpha) - actionview (= 7.0.0.alpha) - activejob (= 7.0.0.alpha) - activesupport (= 7.0.0.alpha) + net-imap + net-pop + net-smtp + actionmailer (7.0.10) + actionpack (= 7.0.10) + actionview (= 7.0.10) + activejob (= 7.0.10) + activesupport (= 7.0.10) mail (~> 2.5, >= 2.5.4) + net-imap + net-pop + net-smtp rails-dom-testing (~> 2.0) - actionpack (7.0.0.alpha) - actionview (= 7.0.0.alpha) - activesupport (= 7.0.0.alpha) - rack (~> 2.0, >= 2.2.0) + actionpack (7.0.10) + actionview (= 7.0.10) + activesupport (= 7.0.10) + racc + rack (~> 2.0, >= 2.2.4) rack-test (>= 0.6.3) rails-dom-testing (~> 2.0) rails-html-sanitizer (~> 1.0, >= 1.2.0) - actiontext (7.0.0.alpha) - actionpack (= 7.0.0.alpha) - activerecord (= 7.0.0.alpha) - activestorage (= 7.0.0.alpha) - activesupport (= 7.0.0.alpha) + actiontext (7.0.10) + actionpack (= 7.0.10) + activerecord (= 7.0.10) + activestorage (= 7.0.10) + activesupport (= 7.0.10) + globalid (>= 0.6.0) nokogiri (>= 1.8.5) - actionview (7.0.0.alpha) - activesupport (= 7.0.0.alpha) + actionview (7.0.10) + activesupport (= 7.0.10) builder (~> 3.1) erubi (~> 1.4) rails-dom-testing (~> 2.0) rails-html-sanitizer (~> 1.1, >= 1.2.0) - activejob (7.0.0.alpha) - activesupport (= 7.0.0.alpha) + activejob (7.0.10) + activesupport (= 7.0.10) globalid (>= 0.3.6) - activemodel (7.0.0.alpha) - activesupport (= 7.0.0.alpha) - activerecord (7.0.0.alpha) - activemodel (= 7.0.0.alpha) - activesupport (= 7.0.0.alpha) - activestorage (7.0.0.alpha) - actionpack (= 7.0.0.alpha) - activejob (= 7.0.0.alpha) - activerecord (= 7.0.0.alpha) - activesupport (= 7.0.0.alpha) - marcel (~> 1.0.0) + activemodel (7.0.10) + activesupport (= 7.0.10) + activerecord (7.0.10) + activemodel (= 7.0.10) + activesupport (= 7.0.10) + activestorage (7.0.10) + actionpack (= 7.0.10) + activejob (= 7.0.10) + activerecord (= 7.0.10) + activesupport (= 7.0.10) + marcel (~> 1.0) mini_mime (>= 1.1.0) - activesupport (7.0.0.alpha) + activesupport (7.0.10) + base64 + benchmark (>= 0.3) + bigdecimal concurrent-ruby (~> 1.0, >= 1.0.2) + drb i18n (>= 1.6, < 2) + logger (>= 1.4.2) minitest (>= 5.1) + mutex_m + securerandom (>= 0.3) tzinfo (~> 2.0) - zeitwerk (~> 2.3) - rails (7.0.0.alpha) - actioncable (= 7.0.0.alpha) - actionmailbox (= 7.0.0.alpha) - actionmailer (= 7.0.0.alpha) - actionpack (= 7.0.0.alpha) - actiontext (= 7.0.0.alpha) - actionview (= 7.0.0.alpha) - activejob (= 7.0.0.alpha) - activemodel (= 7.0.0.alpha) - activerecord (= 7.0.0.alpha) - activestorage (= 7.0.0.alpha) - activesupport (= 7.0.0.alpha) - bundler (>= 1.15.0) - railties (= 7.0.0.alpha) - sprockets-rails (>= 2.0.0) - railties (7.0.0.alpha) - actionpack (= 7.0.0.alpha) - activesupport (= 7.0.0.alpha) - method_source - rake (>= 0.13) - thor (~> 1.0) - -GEM - remote: https://rubygems.org/ - specs: addressable (2.8.0) public_suffix (>= 2.0.2, < 5.0) ast (2.4.2) @@ -111,11 +98,14 @@ GEM jmespath (~> 1.0) aws-sdk-resources (2.3.23) aws-sdk-core (= 2.3.23) + base64 (0.3.0) + benchmark (0.5.0) + bigdecimal (4.1.2) bindex (0.8.1) bootstrap-sass (3.4.1) autoprefixer-rails (>= 5.2.1) sassc (>= 2.0.0) - builder (3.2.4) + builder (3.3.0) bundler-audit (0.8.0) bundler (>= 1.2.0, < 3) thor (~> 1.0) @@ -139,21 +129,23 @@ GEM coffee-script-source execjs coffee-script-source (1.12.2) - concurrent-ruby (1.1.9) - crass (1.0.6) + concurrent-ruby (1.3.4) + crass (1.0.7) + date (3.5.1) diff-lcs (1.4.4) dotenv (2.7.6) dotenv-rails (2.7.6) dotenv (= 2.7.6) railties (>= 3.2) - erubi (1.10.0) + drb (2.2.3) + erubi (1.13.1) execjs (2.8.1) - ffi (1.15.3) - font-awesome-rails (4.7.0.7) - railties (>= 3.2, < 7) - globalid (0.4.2) - activesupport (>= 4.2.0) - i18n (1.8.10) + ffi (1.17.4) + font-awesome-rails (4.7.0.9) + railties (>= 3.2, < 9.0) + globalid (1.4.0) + activesupport (>= 6.1) + i18n (1.14.8) concurrent-ruby (~> 1.0) jbuilder (2.11.2) activesupport (>= 5.0.0) @@ -163,32 +155,49 @@ GEM railties (>= 4.2.0) thor (>= 0.14, < 2.0) kwalify (0.7.2) - listen (3.1.5) - rb-fsevent (~> 0.9, >= 0.9.4) - rb-inotify (~> 0.9, >= 0.9.7) - ruby_dep (~> 1.2) - loofah (2.10.0) + listen (3.10.0) + logger + rb-fsevent (~> 0.10, >= 0.10.3) + rb-inotify (~> 0.9, >= 0.9.10) + logger (1.7.0) + loofah (2.25.1) crass (~> 1.0.2) - nokogiri (>= 1.5.9) - mail (2.7.1) + nokogiri (>= 1.12.0) + mail (2.9.1) + logger mini_mime (>= 0.1.1) - marcel (1.0.1) + net-imap + net-pop + net-smtp + marcel (1.2.1) material_design_lite-sass (1.3.0.1) autoprefixer-rails (>= 6.5) sass (>= 3.3) - method_source (1.0.0) + method_source (1.1.0) mime-types (3.3.1) mime-types-data (~> 3.2015) mime-types-data (3.2021.0225) mimemagic (0.3.10) nokogiri (~> 1) rake - mini_mime (1.1.0) - mini_portile2 (2.3.0) - minitest (5.14.4) - nio4r (2.5.7) - nokogiri (1.8.5) - mini_portile2 (~> 2.3.0) + mini_mime (1.1.5) + mini_portile2 (2.8.9) + minitest (5.26.1) + mutex_m (0.3.0) + net-imap (0.3.10) + date + net-protocol + net-pop (0.1.2) + net-protocol + net-protocol (0.2.2) + timeout + net-smtp (0.5.1) + net-protocol + next_rails (1.6.0) + nio4r (2.7.5) + nokogiri (1.15.7) + mini_portile2 (~> 2.8.2) + racc (~> 1.4) paperclip (5.2.1) activemodel (>= 4.2.0) activesupport (>= 4.2.0) @@ -203,18 +212,42 @@ GEM psych (3.3.2) public_suffix (4.0.6) puma (3.12.6) - rack (2.2.3) - rack-test (1.1.0) - rack (>= 1.0, < 3) - rails-dom-testing (2.0.3) - activesupport (>= 4.2.0) + racc (1.8.1) + rack (2.2.23) + rack-test (2.2.0) + rack (>= 1.3) + rails (7.0.10) + actioncable (= 7.0.10) + actionmailbox (= 7.0.10) + actionmailer (= 7.0.10) + actionpack (= 7.0.10) + actiontext (= 7.0.10) + actionview (= 7.0.10) + activejob (= 7.0.10) + activemodel (= 7.0.10) + activerecord (= 7.0.10) + activestorage (= 7.0.10) + activesupport (= 7.0.10) + bundler (>= 1.15.0) + railties (= 7.0.10) + rails-dom-testing (2.3.0) + activesupport (>= 5.0.0) + minitest nokogiri (>= 1.6) - rails-html-sanitizer (1.3.0) - loofah (~> 2.3) + rails-html-sanitizer (1.7.0) + loofah (~> 2.25) + nokogiri (>= 1.15.7, != 1.16.7, != 1.16.6, != 1.16.5, != 1.16.4, != 1.16.3, != 1.16.2, != 1.16.1, != 1.16.0.rc1, != 1.16.0) + railties (7.0.10) + actionpack (= 7.0.10) + activesupport (= 7.0.10) + method_source + rake (>= 12.2) + thor (~> 1.0) + zeitwerk (~> 2.5) rainbow (3.0.0) - rake (13.0.3) - rb-fsevent (0.11.0) - rb-inotify (0.10.1) + rake (13.4.2) + rb-fsevent (0.11.2) + rb-inotify (0.11.1) ffi (~> 1.0) redcarpet (3.5.1) reek (6.0.4) @@ -263,7 +296,6 @@ GEM rubocop (~> 1.0) rubocop-ast (>= 1.1.0) ruby-progressbar (1.11.0) - ruby_dep (1.5.0) rubyzip (2.3.1) sass (3.7.4) sass-listen (~> 4.0.0) @@ -278,29 +310,28 @@ GEM tilt (>= 1.1, < 3) sassc (2.4.0) ffi (~> 1.9) + securerandom (0.3.2) selenium-webdriver (3.142.7) childprocess (>= 0.5, < 4.0) rubyzip (>= 1.2.2) - spring (2.1.1) - spring-watcher-listen (2.0.1) - listen (>= 2.7, < 4.0) - spring (>= 1.2, < 3.0) - sprockets (3.7.2) + sprockets (3.7.5) + base64 concurrent-ruby (~> 1.0) rack (> 1, < 3) - sprockets-rails (3.2.2) - actionpack (>= 4.0) - activesupport (>= 4.0) + sprockets-rails (3.5.2) + actionpack (>= 6.1) + activesupport (>= 6.1) sprockets (>= 3.0.0) standard (1.1.5) rubocop (= 1.18.3) rubocop-performance (= 1.11.4) - thor (1.1.0) + thor (1.5.0) tilt (2.0.10) + timeout (0.6.1) turbolinks (5.2.1) turbolinks-source (~> 5.2) turbolinks-source (5.2.0) - tzinfo (2.0.4) + tzinfo (2.0.6) concurrent-ruby (~> 1.0) uglifier (4.2.0) execjs (>= 0.3.0, < 3) @@ -310,7 +341,8 @@ GEM activemodel (>= 6.0.0) bindex (>= 0.4.0) railties (>= 6.0.0) - websocket-driver (0.7.5) + websocket-driver (0.8.2) + base64 websocket-extensions (>= 0.1.0) websocket-extensions (0.1.5) wicked_pdf (1.4.0) @@ -318,11 +350,10 @@ GEM wkhtmltopdf-binary (0.12.3.1) xpath (3.2.0) nokogiri (~> 1.8) - zeitwerk (2.4.2) + zeitwerk (2.6.18) PLATFORMS ruby - x86_64-darwin-20 DEPENDENCIES aws-sdk (~> 2.3.0) @@ -331,16 +362,18 @@ DEPENDENCIES capybara (~> 2.13) clipboard-rails coffee-rails (~> 5.0) + concurrent-ruby (< 1.3.5) dotenv-rails fastruby-styleguide! - font-awesome-rails + font-awesome-rails (>= 4.7.0.9) jbuilder (~> 2.5) - listen (>= 3.0.5, < 3.2) - nokogiri (~> 1.8.2) + listen (>= 3.5) + next_rails + nokogiri (>= 1.13.0) paperclip (~> 5.2.1) pg (~> 1.1) puma (~> 3.7) - rails! + rails (~> 7.0.0) redcarpet reek rspec-rails @@ -348,8 +381,6 @@ DEPENDENCIES rubocop-rspec sass-rails (~> 5.0) selenium-webdriver - spring - spring-watcher-listen (~> 2.0.0) standard turbolinks (~> 5) tzinfo-data From 0e6b3bfd779950445712eea25bcc2d9c6addeb6b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Juan=20V=C3=A1squez?= Date: Mon, 6 Jul 2026 13:50:00 -0600 Subject: [PATCH 04/28] Make Rails 7.0 the default; keep dual-boot scaffolding for the 7.1 hop Gemfile/Gemfile.lock now target 7.0.10 (was 6.1.7.10), matching Gemfile.next/Gemfile.next.lock. The if next?/else conditional, the next_rails gem, and the CircleCI build-current/build-next jobs stay in place since the next planned hop is 7.0 -> 7.1 and this scaffolding gets reused rather than torn down and rebuilt. Both branches temporarily resolve to the same "~> 7.0.0" constraint; bump the `if next?` branch to 7.1.0 to start that hop (rubocop's Style/IdenticalConditionalBranches is disabled inline for that block since the duplication is intentional here). db/schema.rb picks up Rails 7's schema format (versioned ActiveRecord::Schema[7.0], explicit precision: nil on datetime columns) now that 7.0 is genuinely the default and not just the dual-boot side. Full test suite, rubocop, and reek pass clean. --- Gemfile | 13 +++-- Gemfile.lock | 148 ++++++++++++++++++++++++++++----------------------- db/schema.rb | 9 ++-- 3 files changed, 91 insertions(+), 79 deletions(-) diff --git a/Gemfile b/Gemfile index 160375b..8db0f3d 100644 --- a/Gemfile +++ b/Gemfile @@ -10,11 +10,15 @@ end ruby "2.7.2" +# Both branches target 7.0.0 for now; bump the `if next?` branch to 7.1.0 +# to start the next dual-boot hop. +# rubocop:disable Style/IdenticalConditionalBranches if next? gem "rails", "~> 7.0.0" else - gem "rails", "~> 6.1.0" + gem "rails", "~> 7.0.0" end +# rubocop:enable Style/IdenticalConditionalBranches gem "bundler-audit" gem "next_rails" @@ -80,12 +84,7 @@ group :development do gem "listen", ">= 3.5" gem "reek" # code smells linter # Spring speeds up development by keeping your application running in the background. Read more: https://github.com/rails/spring - # spring >= 4 (needed for Rails 7 support) requires Ruby >= 3.1; re-add on the - # `next?` side once Ruby is upgraded past this hop. - unless next? - gem "spring", "~> 2.1" - gem "spring-watcher-listen", "~> 2.0.0" - end + # spring >= 4 (needed for Rails 7 support) requires Ruby >= 3.1; re-add once Ruby is upgraded. end # Windows does not include zoneinfo files, so bundle the tzinfo-data gem diff --git a/Gemfile.lock b/Gemfile.lock index 2017b5f..3a27a62 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -14,65 +14,79 @@ GIT GEM remote: https://rubygems.org/ specs: - actioncable (6.1.7.10) - actionpack (= 6.1.7.10) - activesupport (= 6.1.7.10) + actioncable (7.0.10) + actionpack (= 7.0.10) + activesupport (= 7.0.10) nio4r (~> 2.0) websocket-driver (>= 0.6.1) - actionmailbox (6.1.7.10) - actionpack (= 6.1.7.10) - activejob (= 6.1.7.10) - activerecord (= 6.1.7.10) - activestorage (= 6.1.7.10) - activesupport (= 6.1.7.10) + actionmailbox (7.0.10) + actionpack (= 7.0.10) + activejob (= 7.0.10) + activerecord (= 7.0.10) + activestorage (= 7.0.10) + activesupport (= 7.0.10) mail (>= 2.7.1) - actionmailer (6.1.7.10) - actionpack (= 6.1.7.10) - actionview (= 6.1.7.10) - activejob (= 6.1.7.10) - activesupport (= 6.1.7.10) + net-imap + net-pop + net-smtp + actionmailer (7.0.10) + actionpack (= 7.0.10) + actionview (= 7.0.10) + activejob (= 7.0.10) + activesupport (= 7.0.10) mail (~> 2.5, >= 2.5.4) + net-imap + net-pop + net-smtp rails-dom-testing (~> 2.0) - actionpack (6.1.7.10) - actionview (= 6.1.7.10) - activesupport (= 6.1.7.10) - rack (~> 2.0, >= 2.0.9) + actionpack (7.0.10) + actionview (= 7.0.10) + activesupport (= 7.0.10) + racc + rack (~> 2.0, >= 2.2.4) rack-test (>= 0.6.3) rails-dom-testing (~> 2.0) rails-html-sanitizer (~> 1.0, >= 1.2.0) - actiontext (6.1.7.10) - actionpack (= 6.1.7.10) - activerecord (= 6.1.7.10) - activestorage (= 6.1.7.10) - activesupport (= 6.1.7.10) + actiontext (7.0.10) + actionpack (= 7.0.10) + activerecord (= 7.0.10) + activestorage (= 7.0.10) + activesupport (= 7.0.10) + globalid (>= 0.6.0) nokogiri (>= 1.8.5) - actionview (6.1.7.10) - activesupport (= 6.1.7.10) + actionview (7.0.10) + activesupport (= 7.0.10) builder (~> 3.1) erubi (~> 1.4) rails-dom-testing (~> 2.0) rails-html-sanitizer (~> 1.1, >= 1.2.0) - activejob (6.1.7.10) - activesupport (= 6.1.7.10) + activejob (7.0.10) + activesupport (= 7.0.10) globalid (>= 0.3.6) - activemodel (6.1.7.10) - activesupport (= 6.1.7.10) - activerecord (6.1.7.10) - activemodel (= 6.1.7.10) - activesupport (= 6.1.7.10) - activestorage (6.1.7.10) - actionpack (= 6.1.7.10) - activejob (= 6.1.7.10) - activerecord (= 6.1.7.10) - activesupport (= 6.1.7.10) + activemodel (7.0.10) + activesupport (= 7.0.10) + activerecord (7.0.10) + activemodel (= 7.0.10) + activesupport (= 7.0.10) + activestorage (7.0.10) + actionpack (= 7.0.10) + activejob (= 7.0.10) + activerecord (= 7.0.10) + activesupport (= 7.0.10) marcel (~> 1.0) mini_mime (>= 1.1.0) - activesupport (6.1.7.10) + activesupport (7.0.10) + base64 + benchmark (>= 0.3) + bigdecimal concurrent-ruby (~> 1.0, >= 1.0.2) + drb i18n (>= 1.6, < 2) + logger (>= 1.4.2) minitest (>= 5.1) + mutex_m + securerandom (>= 0.3) tzinfo (~> 2.0) - zeitwerk (~> 2.3) addressable (2.8.0) public_suffix (>= 2.0.2, < 5.0) ast (2.4.2) @@ -85,6 +99,8 @@ GEM aws-sdk-resources (2.3.23) aws-sdk-core (= 2.3.23) base64 (0.3.0) + benchmark (0.5.0) + bigdecimal (4.1.2) bindex (0.8.1) bootstrap-sass (3.4.1) autoprefixer-rails (>= 5.2.1) @@ -121,6 +137,7 @@ GEM dotenv-rails (2.7.6) dotenv (= 2.7.6) railties (>= 3.2) + drb (2.2.3) erubi (1.13.1) execjs (2.8.1) ffi (1.17.4) @@ -143,9 +160,9 @@ GEM rb-fsevent (~> 0.10, >= 0.10.3) rb-inotify (~> 0.9, >= 0.9.10) logger (1.7.0) - loofah (2.21.1) + loofah (2.25.1) crass (~> 1.0.2) - nokogiri (>= 1.5.9) + nokogiri (>= 1.12.0) mail (2.9.1) logger mini_mime (>= 0.1.1) @@ -166,6 +183,7 @@ GEM mini_mime (1.1.5) mini_portile2 (2.8.9) minitest (5.26.1) + mutex_m (0.3.0) net-imap (0.3.10) date net-protocol @@ -198,33 +216,34 @@ GEM rack (2.2.23) rack-test (2.2.0) rack (>= 1.3) - rails (6.1.7.10) - actioncable (= 6.1.7.10) - actionmailbox (= 6.1.7.10) - actionmailer (= 6.1.7.10) - actionpack (= 6.1.7.10) - actiontext (= 6.1.7.10) - actionview (= 6.1.7.10) - activejob (= 6.1.7.10) - activemodel (= 6.1.7.10) - activerecord (= 6.1.7.10) - activestorage (= 6.1.7.10) - activesupport (= 6.1.7.10) + rails (7.0.10) + actioncable (= 7.0.10) + actionmailbox (= 7.0.10) + actionmailer (= 7.0.10) + actionpack (= 7.0.10) + actiontext (= 7.0.10) + actionview (= 7.0.10) + activejob (= 7.0.10) + activemodel (= 7.0.10) + activerecord (= 7.0.10) + activestorage (= 7.0.10) + activesupport (= 7.0.10) bundler (>= 1.15.0) - railties (= 6.1.7.10) - sprockets-rails (>= 2.0.0) + railties (= 7.0.10) rails-dom-testing (2.3.0) activesupport (>= 5.0.0) minitest nokogiri (>= 1.6) - rails-html-sanitizer (1.5.0) - loofah (~> 2.19, >= 2.19.1) - railties (6.1.7.10) - actionpack (= 6.1.7.10) - activesupport (= 6.1.7.10) + rails-html-sanitizer (1.7.0) + loofah (~> 2.25) + nokogiri (>= 1.15.7, != 1.16.7, != 1.16.6, != 1.16.5, != 1.16.4, != 1.16.3, != 1.16.2, != 1.16.1, != 1.16.0.rc1, != 1.16.0) + railties (7.0.10) + actionpack (= 7.0.10) + activesupport (= 7.0.10) method_source rake (>= 12.2) thor (~> 1.0) + zeitwerk (~> 2.5) rainbow (3.0.0) rake (13.4.2) rb-fsevent (0.11.2) @@ -291,13 +310,10 @@ GEM tilt (>= 1.1, < 3) sassc (2.4.0) ffi (~> 1.9) + securerandom (0.3.2) selenium-webdriver (3.142.7) childprocess (>= 0.5, < 4.0) rubyzip (>= 1.2.2) - spring (2.1.1) - spring-watcher-listen (2.0.1) - listen (>= 2.7, < 4.0) - spring (>= 1.2, < 3.0) sprockets (3.7.5) base64 concurrent-ruby (~> 1.0) @@ -357,7 +373,7 @@ DEPENDENCIES paperclip (~> 5.2.1) pg (~> 1.1) puma (~> 3.7) - rails (~> 6.1.0) + rails (~> 7.0.0) redcarpet reek rspec-rails @@ -365,8 +381,6 @@ DEPENDENCIES rubocop-rspec sass-rails (~> 5.0) selenium-webdriver - spring (~> 2.1) - spring-watcher-listen (~> 2.0.0) standard turbolinks (~> 5) tzinfo-data diff --git a/db/schema.rb b/db/schema.rb index ec8d49c..474843c 100644 --- a/db/schema.rb +++ b/db/schema.rb @@ -10,8 +10,7 @@ # # It's strongly recommended that you check this file into your version control system. -ActiveRecord::Schema.define(version: 2018_03_25_143727) do - +ActiveRecord::Schema[7.0].define(version: 2018_03_25_143727) do # These are extensions that must be enabled in order to support this database enable_extension "plpgsql" @@ -19,9 +18,9 @@ t.string "file_file_name" t.string "file_content_type" t.integer "file_file_size" - t.datetime "file_updated_at" - t.datetime "created_at", null: false - t.datetime "updated_at", null: false + t.datetime "file_updated_at", precision: nil + t.datetime "created_at", precision: nil, null: false + t.datetime "updated_at", precision: nil, null: false t.string "alpha_id" end From c60c01efe6c9bb5a1a90e3e893b289fcacbad2b0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Juan=20V=C3=A1squez?= Date: Mon, 6 Jul 2026 14:04:28 -0600 Subject: [PATCH 05/28] Fix PDF export broken by Rails 7's stricter template resolution GemfilesController#show passed template: "gemfiles/show.html.erb" (literal extension included) and layout: "pdf.html" to wicked_pdf's render call. Rails 6.1's template resolver tolerated the redundant format/handler suffix; Rails 7.0's stricter resolver does not, so both raised ActionView::MissingTemplate once 7.0 became the default. Also, wicked_pdf forwards render's :formats straight through to render_to_string. Without an explicit :formats, Rails used the current request format (:pdf, since this runs inside format.pdf do...end) to resolve the template, but the view is only authored as .html.erb. 6.1's format negotiation fell back to :html; 7.0's does not. Passing formats: [:html] explicitly restores the original behavior. --- app/controllers/gemfiles_controller.rb | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/app/controllers/gemfiles_controller.rb b/app/controllers/gemfiles_controller.rb index b91dee2..c145222 100644 --- a/app/controllers/gemfiles_controller.rb +++ b/app/controllers/gemfiles_controller.rb @@ -25,8 +25,9 @@ def show format.html format.pdf do render pdf: "vulnerabilities_list", - template: "gemfiles/show.html.erb", - layout: 'pdf.html' + template: "gemfiles/show", + formats: [:html], + layout: 'pdf' end end end From c9f658e8ab10b28e73da48fe58ad288aefe4afa3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Juan=20V=C3=A1squez?= Date: Mon, 6 Jul 2026 14:04:40 -0600 Subject: [PATCH 06/28] Add PDF export coverage to GemfilesController#show spec Nothing exercised the format.pdf branch before, which is exactly the code path the Rails 6.1 -> 7.0 upgrade silently broke. This would have caught the regression fixed in the previous commit. --- spec/controllers/gemfiles_controller_spec.rb | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/spec/controllers/gemfiles_controller_spec.rb b/spec/controllers/gemfiles_controller_spec.rb index 81a8b99..eddc3d7 100644 --- a/spec/controllers/gemfiles_controller_spec.rb +++ b/spec/controllers/gemfiles_controller_spec.rb @@ -72,5 +72,15 @@ expect(response).to be_ok end end + + context "when requesting the PDF format" do + it "renders a PDF successfully" do + get :show, params: { id: subject.alpha_id, format: :pdf } + + expect(response).to be_ok + expect(response.content_type).to eq("application/pdf") + expect(response.body).to start_with("%PDF") + end + end end end From b76fb87b74605e5f792897fc9830854d3b8f7753 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Juan=20V=C3=A1squez?= Date: Mon, 6 Jul 2026 14:16:33 -0600 Subject: [PATCH 07/28] Make wkhtmltopdf's 32-bit binary actually runnable in Docker on arm64 wkhtmltopdf-binary (0.12.3.1) ships a 32-bit x86 binary. On Apple Silicon, running it under full arm64 emulation failed with "qemu-i386: Could not open '/lib/ld-linux.so.2': No such file or directory" -- i386 is only a valid multiarch pairing alongside an amd64 base, not arm64. Forcing the web service to build/run as linux/amd64 (Rosetta on Apple Silicon) and installing libc6:i386/libstdc++6:i386 lets the kernel run the 32-bit binary directly, no further emulation needed. Verified: the PDF export request spec, which was silently failing before with no signal locally, now runs the real wkhtmltopdf binary end-to-end and passes. --- Dockerfile | 7 +++++++ docker-compose.yml | 3 +++ 2 files changed, 10 insertions(+) diff --git a/Dockerfile b/Dockerfile index 8fdd3aa..3d7ce63 100644 --- a/Dockerfile +++ b/Dockerfile @@ -21,6 +21,13 @@ RUN apt-get update -qq \ xfonts-base \ && rm -rf /var/lib/apt/lists/* +# wkhtmltopdf-binary ships a 32-bit x86 binary; add i386 multiarch support +# (only valid alongside an amd64 base, see docker-compose.yml). +RUN dpkg --add-architecture i386 \ + && apt-get update -qq \ + && apt-get install -y --no-install-recommends libc6:i386 libstdc++6:i386 \ + && rm -rf /var/lib/apt/lists/* + # Node 12 matches .nvmrc; used by the asset pipeline (sprockets/coffee/sass). # Installed from the official tarball since NodeSource dropped its Node 12 setup script. ENV NODE_VERSION=12.13.0 diff --git a/docker-compose.yml b/docker-compose.yml index 882da12..9077d25 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -14,6 +14,9 @@ services: web: build: . + # wkhtmltopdf-binary ships a 32-bit x86 binary; arm64 hosts can't run i386 + # via multiarch (only amd64+i386 is a valid pairing), so force amd64 here. + platform: linux/amd64 command: bundle exec rails server -b 0.0.0.0 volumes: - .:/app From 6d2212f1070659c99e45a3d81657318668f9e4ec Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Juan=20V=C3=A1squez?= Date: Mon, 6 Jul 2026 14:17:02 -0600 Subject: [PATCH 08/28] Add web_next service for running Gemfile.next locally Runs the Rails 7.1 dual-boot side (currently 7.0.10, same as the default Gemfile) on port 3001, reusing the image already built for `web` instead of a second build -- only BUNDLE_GEMFILE differs. Not using `extends`: it merges array fields like `ports` instead of overriding them, which leaked web's 3000:3000 mapping into web_next too when tried. A plain service definition avoids that. web and web_next share the same bind-mounted /app, so they'd otherwise race on tmp/pids/server.pid and refuse to boot at the same time; gives web_next its own --pid path and has the entrypoint clean up both. --- docker-compose.yml | 29 +++++++++++++++++++++++++++++ docker/entrypoint.sh | 2 +- 2 files changed, 30 insertions(+), 1 deletion(-) diff --git a/docker-compose.yml b/docker-compose.yml index 9077d25..4fa8523 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -33,5 +33,34 @@ services: stdin_open: true tty: true + web_next: + # Reuse the image built for `web` (compose tags it -web, i.e. + # audit-web) instead of building a second image. Only BUNDLE_GEMFILE + # differs, so a separate build is unnecessary. (Not using `extends` here: + # it merges array fields like `ports` instead of overriding them, which + # would leak web's 3000:3000 mapping into this service too.) + image: audit-web + platform: linux/amd64 + # Distinct pidfile: web and web_next share the same bind-mounted /app, so + # they'd otherwise race on tmp/pids/server.pid and refuse to boot together. + command: bundle exec rails server -b 0.0.0.0 --pid tmp/pids/server_next.pid + volumes: + - .:/app + ports: + - "3001:3000" + environment: + RAILS_ENV: development + DATABASE_HOST: db + DATABASE_USERNAME: postgres + DATABASE_PASSWORD: postgres + BUNDLE_GEMFILE: Gemfile.next + depends_on: + db: + condition: service_healthy + web: + condition: service_started + stdin_open: true + tty: true + volumes: db_data: diff --git a/docker/entrypoint.sh b/docker/entrypoint.sh index f0df4ae..87c9602 100644 --- a/docker/entrypoint.sh +++ b/docker/entrypoint.sh @@ -9,7 +9,7 @@ if [ ! -f .env ]; then cp .env.sample .env fi -rm -f tmp/pids/server.pid +rm -f tmp/pids/server.pid tmp/pids/server_next.pid bundle exec rails db:prepare From 6e245357436e2eb9eec135be06fbefa5dd0c4c7e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Juan=20V=C3=A1squez?= Date: Mon, 6 Jul 2026 14:30:09 -0600 Subject: [PATCH 09/28] Retry db:prepare on concurrent migration lock in the entrypoint web and web_next intentionally share one database (matches how dual-boot is run in other upgrades here). Both containers run db:prepare on boot, so starting or restarting them around the same time hits Rails' migration advisory lock: the second one raised ActiveRecord::ConcurrentMigrationError and the container exited. The migration itself is a no-op once the first process finishes (both sides are on the same schema during this hop), so retrying a few times resolves it instead of failing the boot. Reproduced the race with a simultaneous `docker restart` of both containers and confirmed the retry fires and both come up healthy. --- docker/entrypoint.sh | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/docker/entrypoint.sh b/docker/entrypoint.sh index 87c9602..3159ea6 100644 --- a/docker/entrypoint.sh +++ b/docker/entrypoint.sh @@ -11,6 +11,20 @@ fi rm -f tmp/pids/server.pid tmp/pids/server_next.pid -bundle exec rails db:prepare +# web and web_next share the same database and both run db:prepare on boot. +# If they start around the same time, ActiveRecord's migration lock makes the +# second one fail with ConcurrentMigrationError; retry instead of giving up, +# since the migration itself is a no-op once the first process finishes. +for attempt in 1 2 3 4 5; do + if bundle exec rails db:prepare; then + break + elif [ "$attempt" -eq 5 ]; then + echo "db:prepare failed after $attempt attempts" >&2 + exit 1 + else + echo "db:prepare failed (attempt $attempt/5), retrying in 3s..." >&2 + sleep 3 + fi +done exec "$@" From 613b896672bcfeb3596d4cfd04b135c30141a6ec Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Juan=20V=C3=A1squez?= Date: Mon, 6 Jul 2026 15:20:49 -0600 Subject: [PATCH 10/28] Point Gemfile.next at Rails 7.1 (capped at 7.1.3.4) Resolves to 7.1.3.4, not the latest 7.1.6: activerecord 7.1.4+ uses def method_missing(name, ...) (leading arg + ... forwarding), which is Ruby 3.0+ only syntax and fails to even parse on our Ruby 2.7.2, despite the rails gemspec still advertising ruby_version >= 2.7.0. Confirmed by diffing activerecord/lib/active_record/attribute_methods.rb across tags: absent through v7.1.3, present from v7.1.4 on. Cap stays until Ruby is separately upgraded past 3.0. bundle_report compatibility --rails-version=7.1.6 (and re-checked against 7.1.3.4): 0 incompatible gems. Boot smoke test, full suite (11 examples), rubocop, and reek all pass clean on Gemfile.next. Detection scan found one deprecation (config.cache_classes -> config.enable_reloading) -- deferred to the commit that makes 7.1 the default, since config/environments/*.rb are shared unconditionally with the still-current Rails 7.0 side, which doesn't have enable_reloading at all. --- Gemfile | 10 +-- Gemfile.next.lock | 161 ++++++++++++++++++++++++++-------------------- 2 files changed, 95 insertions(+), 76 deletions(-) diff --git a/Gemfile b/Gemfile index 8db0f3d..14d6150 100644 --- a/Gemfile +++ b/Gemfile @@ -10,15 +10,15 @@ end ruby "2.7.2" -# Both branches target 7.0.0 for now; bump the `if next?` branch to 7.1.0 -# to start the next dual-boot hop. -# rubocop:disable Style/IdenticalConditionalBranches if next? - gem "rails", "~> 7.0.0" + # activerecord 7.1.4+ uses `def method_missing(name, ...)` (leading arg + + # `...` forwarding), which is Ruby 3.0+ only syntax and fails to parse on + # our Ruby 2.7.2, despite the rails gemspec still advertising `>= 2.7.0`. + # Cap below that until Ruby is separately upgraded past 3.0. + gem "rails", ">= 7.1.0", "< 7.1.4" else gem "rails", "~> 7.0.0" end -# rubocop:enable Style/IdenticalConditionalBranches gem "bundler-audit" gem "next_rails" diff --git a/Gemfile.next.lock b/Gemfile.next.lock index 3a27a62..963f161 100644 --- a/Gemfile.next.lock +++ b/Gemfile.next.lock @@ -14,78 +14,79 @@ GIT GEM remote: https://rubygems.org/ specs: - actioncable (7.0.10) - actionpack (= 7.0.10) - activesupport (= 7.0.10) + actioncable (7.1.3.4) + actionpack (= 7.1.3.4) + activesupport (= 7.1.3.4) nio4r (~> 2.0) websocket-driver (>= 0.6.1) - actionmailbox (7.0.10) - actionpack (= 7.0.10) - activejob (= 7.0.10) - activerecord (= 7.0.10) - activestorage (= 7.0.10) - activesupport (= 7.0.10) + zeitwerk (~> 2.6) + actionmailbox (7.1.3.4) + actionpack (= 7.1.3.4) + activejob (= 7.1.3.4) + activerecord (= 7.1.3.4) + activestorage (= 7.1.3.4) + activesupport (= 7.1.3.4) mail (>= 2.7.1) net-imap net-pop net-smtp - actionmailer (7.0.10) - actionpack (= 7.0.10) - actionview (= 7.0.10) - activejob (= 7.0.10) - activesupport (= 7.0.10) + actionmailer (7.1.3.4) + actionpack (= 7.1.3.4) + actionview (= 7.1.3.4) + activejob (= 7.1.3.4) + activesupport (= 7.1.3.4) mail (~> 2.5, >= 2.5.4) net-imap net-pop net-smtp - rails-dom-testing (~> 2.0) - actionpack (7.0.10) - actionview (= 7.0.10) - activesupport (= 7.0.10) + rails-dom-testing (~> 2.2) + actionpack (7.1.3.4) + actionview (= 7.1.3.4) + activesupport (= 7.1.3.4) + nokogiri (>= 1.8.5) racc - rack (~> 2.0, >= 2.2.4) + rack (>= 2.2.4) + rack-session (>= 1.0.1) rack-test (>= 0.6.3) - rails-dom-testing (~> 2.0) - rails-html-sanitizer (~> 1.0, >= 1.2.0) - actiontext (7.0.10) - actionpack (= 7.0.10) - activerecord (= 7.0.10) - activestorage (= 7.0.10) - activesupport (= 7.0.10) + rails-dom-testing (~> 2.2) + rails-html-sanitizer (~> 1.6) + actiontext (7.1.3.4) + actionpack (= 7.1.3.4) + activerecord (= 7.1.3.4) + activestorage (= 7.1.3.4) + activesupport (= 7.1.3.4) globalid (>= 0.6.0) nokogiri (>= 1.8.5) - actionview (7.0.10) - activesupport (= 7.0.10) + actionview (7.1.3.4) + activesupport (= 7.1.3.4) builder (~> 3.1) - erubi (~> 1.4) - rails-dom-testing (~> 2.0) - rails-html-sanitizer (~> 1.1, >= 1.2.0) - activejob (7.0.10) - activesupport (= 7.0.10) + erubi (~> 1.11) + rails-dom-testing (~> 2.2) + rails-html-sanitizer (~> 1.6) + activejob (7.1.3.4) + activesupport (= 7.1.3.4) globalid (>= 0.3.6) - activemodel (7.0.10) - activesupport (= 7.0.10) - activerecord (7.0.10) - activemodel (= 7.0.10) - activesupport (= 7.0.10) - activestorage (7.0.10) - actionpack (= 7.0.10) - activejob (= 7.0.10) - activerecord (= 7.0.10) - activesupport (= 7.0.10) + activemodel (7.1.3.4) + activesupport (= 7.1.3.4) + activerecord (7.1.3.4) + activemodel (= 7.1.3.4) + activesupport (= 7.1.3.4) + timeout (>= 0.4.0) + activestorage (7.1.3.4) + actionpack (= 7.1.3.4) + activejob (= 7.1.3.4) + activerecord (= 7.1.3.4) + activesupport (= 7.1.3.4) marcel (~> 1.0) - mini_mime (>= 1.1.0) - activesupport (7.0.10) + activesupport (7.1.3.4) base64 - benchmark (>= 0.3) bigdecimal concurrent-ruby (~> 1.0, >= 1.0.2) + connection_pool (>= 2.2.5) drb i18n (>= 1.6, < 2) - logger (>= 1.4.2) minitest (>= 5.1) mutex_m - securerandom (>= 0.3) tzinfo (~> 2.0) addressable (2.8.0) public_suffix (>= 2.0.2, < 5.0) @@ -99,7 +100,6 @@ GEM aws-sdk-resources (2.3.23) aws-sdk-core (= 2.3.23) base64 (0.3.0) - benchmark (0.5.0) bigdecimal (4.1.2) bindex (0.8.1) bootstrap-sass (3.4.1) @@ -130,6 +130,7 @@ GEM execjs coffee-script-source (1.12.2) concurrent-ruby (1.3.4) + connection_pool (2.5.5) crass (1.0.7) date (3.5.1) diff-lcs (1.4.4) @@ -147,6 +148,12 @@ GEM activesupport (>= 6.1) i18n (1.14.8) concurrent-ruby (~> 1.0) + io-console (0.8.2) + irb (1.18.0) + pp (>= 0.6.0) + prism (>= 1.3.0) + rdoc (>= 4.0.0) + reline (>= 0.4.2) jbuilder (2.11.2) activesupport (>= 5.0.0) jmespath (1.4.0) @@ -173,7 +180,6 @@ GEM material_design_lite-sass (1.3.0.1) autoprefixer-rails (>= 6.5) sass (>= 3.3) - method_source (1.1.0) mime-types (3.3.1) mime-types-data (~> 3.2015) mime-types-data (3.2021.0225) @@ -209,27 +215,36 @@ GEM ast (~> 2.4.1) pg (1.2.3) popper_js (2.9.2) + pp (0.6.4) + prettyprint + prettyprint (0.2.0) + prism (1.9.0) psych (3.3.2) public_suffix (4.0.6) puma (3.12.6) racc (1.8.1) rack (2.2.23) + rack-session (1.0.2) + rack (< 3) rack-test (2.2.0) rack (>= 1.3) - rails (7.0.10) - actioncable (= 7.0.10) - actionmailbox (= 7.0.10) - actionmailer (= 7.0.10) - actionpack (= 7.0.10) - actiontext (= 7.0.10) - actionview (= 7.0.10) - activejob (= 7.0.10) - activemodel (= 7.0.10) - activerecord (= 7.0.10) - activestorage (= 7.0.10) - activesupport (= 7.0.10) + rackup (1.0.1) + rack (< 3) + webrick + rails (7.1.3.4) + actioncable (= 7.1.3.4) + actionmailbox (= 7.1.3.4) + actionmailer (= 7.1.3.4) + actionpack (= 7.1.3.4) + actiontext (= 7.1.3.4) + actionview (= 7.1.3.4) + activejob (= 7.1.3.4) + activemodel (= 7.1.3.4) + activerecord (= 7.1.3.4) + activestorage (= 7.1.3.4) + activesupport (= 7.1.3.4) bundler (>= 1.15.0) - railties (= 7.0.10) + railties (= 7.1.3.4) rails-dom-testing (2.3.0) activesupport (>= 5.0.0) minitest @@ -237,18 +252,20 @@ GEM rails-html-sanitizer (1.7.0) loofah (~> 2.25) nokogiri (>= 1.15.7, != 1.16.7, != 1.16.6, != 1.16.5, != 1.16.4, != 1.16.3, != 1.16.2, != 1.16.1, != 1.16.0.rc1, != 1.16.0) - railties (7.0.10) - actionpack (= 7.0.10) - activesupport (= 7.0.10) - method_source + railties (7.1.3.4) + actionpack (= 7.1.3.4) + activesupport (= 7.1.3.4) + irb + rackup (>= 1.0.0) rake (>= 12.2) - thor (~> 1.0) - zeitwerk (~> 2.5) + thor (~> 1.0, >= 1.2.2) + zeitwerk (~> 2.6) rainbow (3.0.0) rake (13.4.2) rb-fsevent (0.11.2) rb-inotify (0.11.1) ffi (~> 1.0) + rdoc (6.3.4.1) redcarpet (3.5.1) reek (6.0.4) kwalify (~> 0.7.0) @@ -256,6 +273,8 @@ GEM psych (~> 3.1) rainbow (>= 2.0, < 4.0) regexp_parser (2.1.1) + reline (0.6.3) + io-console (~> 0.5) rexml (3.2.5) rspec-core (3.10.1) rspec-support (~> 3.10.0) @@ -310,7 +329,6 @@ GEM tilt (>= 1.1, < 3) sassc (2.4.0) ffi (~> 1.9) - securerandom (0.3.2) selenium-webdriver (3.142.7) childprocess (>= 0.5, < 4.0) rubyzip (>= 1.2.2) @@ -341,6 +359,7 @@ GEM activemodel (>= 6.0.0) bindex (>= 0.4.0) railties (>= 6.0.0) + webrick (1.9.2) websocket-driver (0.8.2) base64 websocket-extensions (>= 0.1.0) @@ -373,7 +392,7 @@ DEPENDENCIES paperclip (~> 5.2.1) pg (~> 1.1) puma (~> 3.7) - rails (~> 7.0.0) + rails (>= 7.1.0, < 7.1.4) redcarpet reek rspec-rails From 0138804be79f08dae2ac86ac48651ec1946789bd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Juan=20V=C3=A1squez?= Date: Mon, 6 Jul 2026 15:36:05 -0600 Subject: [PATCH 11/28] Make Rails 7.1.3.4 the default; fix cache_classes deprecation Gemfile/Gemfile.lock now target 7.1.3.4 (was 7.0.10), matching Gemfile.next/Gemfile.next.lock. Both branches stay at the same >= 7.1.0, < 7.1.4 range for now (capped below the Ruby-3.0-only method_missing syntax in 7.1.4+); bump the if next? branch to start the 7.1 -> 7.2 hop. config.cache_classes -> config.enable_reloading (inverted boolean) in all three environments, per Rails 7.1's deprecation. Deferred from the dual-boot commit since config/environments/*.rb are shared unconditionally and Rails 7.0 doesn't have enable_reloading at all. db/schema.rb picks up Rails 7.1's schema version tag now that 7.1 is genuinely the default. Full test suite (11 examples), rubocop, and reek all pass clean. --- Gemfile | 14 ++- Gemfile.lock | 161 ++++++++++++++++------------- config/environments/development.rb | 2 +- config/environments/production.rb | 2 +- config/environments/test.rb | 2 +- db/schema.rb | 2 +- 6 files changed, 103 insertions(+), 80 deletions(-) diff --git a/Gemfile b/Gemfile index 14d6150..fa3da79 100644 --- a/Gemfile +++ b/Gemfile @@ -10,15 +10,19 @@ end ruby "2.7.2" +# activerecord 7.1.4+ uses `def method_missing(name, ...)` (leading arg + +# `...` forwarding), which is Ruby 3.0+ only syntax and fails to parse on +# our Ruby 2.7.2, despite the rails gemspec still advertising `>= 2.7.0`. +# Cap below that until Ruby is separately upgraded past 3.0. +# Both branches target the same range for now; bump the `if next?` branch +# to start the next dual-boot hop (7.2). +# rubocop:disable Style/IdenticalConditionalBranches if next? - # activerecord 7.1.4+ uses `def method_missing(name, ...)` (leading arg + - # `...` forwarding), which is Ruby 3.0+ only syntax and fails to parse on - # our Ruby 2.7.2, despite the rails gemspec still advertising `>= 2.7.0`. - # Cap below that until Ruby is separately upgraded past 3.0. gem "rails", ">= 7.1.0", "< 7.1.4" else - gem "rails", "~> 7.0.0" + gem "rails", ">= 7.1.0", "< 7.1.4" end +# rubocop:enable Style/IdenticalConditionalBranches gem "bundler-audit" gem "next_rails" diff --git a/Gemfile.lock b/Gemfile.lock index 3a27a62..963f161 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -14,78 +14,79 @@ GIT GEM remote: https://rubygems.org/ specs: - actioncable (7.0.10) - actionpack (= 7.0.10) - activesupport (= 7.0.10) + actioncable (7.1.3.4) + actionpack (= 7.1.3.4) + activesupport (= 7.1.3.4) nio4r (~> 2.0) websocket-driver (>= 0.6.1) - actionmailbox (7.0.10) - actionpack (= 7.0.10) - activejob (= 7.0.10) - activerecord (= 7.0.10) - activestorage (= 7.0.10) - activesupport (= 7.0.10) + zeitwerk (~> 2.6) + actionmailbox (7.1.3.4) + actionpack (= 7.1.3.4) + activejob (= 7.1.3.4) + activerecord (= 7.1.3.4) + activestorage (= 7.1.3.4) + activesupport (= 7.1.3.4) mail (>= 2.7.1) net-imap net-pop net-smtp - actionmailer (7.0.10) - actionpack (= 7.0.10) - actionview (= 7.0.10) - activejob (= 7.0.10) - activesupport (= 7.0.10) + actionmailer (7.1.3.4) + actionpack (= 7.1.3.4) + actionview (= 7.1.3.4) + activejob (= 7.1.3.4) + activesupport (= 7.1.3.4) mail (~> 2.5, >= 2.5.4) net-imap net-pop net-smtp - rails-dom-testing (~> 2.0) - actionpack (7.0.10) - actionview (= 7.0.10) - activesupport (= 7.0.10) + rails-dom-testing (~> 2.2) + actionpack (7.1.3.4) + actionview (= 7.1.3.4) + activesupport (= 7.1.3.4) + nokogiri (>= 1.8.5) racc - rack (~> 2.0, >= 2.2.4) + rack (>= 2.2.4) + rack-session (>= 1.0.1) rack-test (>= 0.6.3) - rails-dom-testing (~> 2.0) - rails-html-sanitizer (~> 1.0, >= 1.2.0) - actiontext (7.0.10) - actionpack (= 7.0.10) - activerecord (= 7.0.10) - activestorage (= 7.0.10) - activesupport (= 7.0.10) + rails-dom-testing (~> 2.2) + rails-html-sanitizer (~> 1.6) + actiontext (7.1.3.4) + actionpack (= 7.1.3.4) + activerecord (= 7.1.3.4) + activestorage (= 7.1.3.4) + activesupport (= 7.1.3.4) globalid (>= 0.6.0) nokogiri (>= 1.8.5) - actionview (7.0.10) - activesupport (= 7.0.10) + actionview (7.1.3.4) + activesupport (= 7.1.3.4) builder (~> 3.1) - erubi (~> 1.4) - rails-dom-testing (~> 2.0) - rails-html-sanitizer (~> 1.1, >= 1.2.0) - activejob (7.0.10) - activesupport (= 7.0.10) + erubi (~> 1.11) + rails-dom-testing (~> 2.2) + rails-html-sanitizer (~> 1.6) + activejob (7.1.3.4) + activesupport (= 7.1.3.4) globalid (>= 0.3.6) - activemodel (7.0.10) - activesupport (= 7.0.10) - activerecord (7.0.10) - activemodel (= 7.0.10) - activesupport (= 7.0.10) - activestorage (7.0.10) - actionpack (= 7.0.10) - activejob (= 7.0.10) - activerecord (= 7.0.10) - activesupport (= 7.0.10) + activemodel (7.1.3.4) + activesupport (= 7.1.3.4) + activerecord (7.1.3.4) + activemodel (= 7.1.3.4) + activesupport (= 7.1.3.4) + timeout (>= 0.4.0) + activestorage (7.1.3.4) + actionpack (= 7.1.3.4) + activejob (= 7.1.3.4) + activerecord (= 7.1.3.4) + activesupport (= 7.1.3.4) marcel (~> 1.0) - mini_mime (>= 1.1.0) - activesupport (7.0.10) + activesupport (7.1.3.4) base64 - benchmark (>= 0.3) bigdecimal concurrent-ruby (~> 1.0, >= 1.0.2) + connection_pool (>= 2.2.5) drb i18n (>= 1.6, < 2) - logger (>= 1.4.2) minitest (>= 5.1) mutex_m - securerandom (>= 0.3) tzinfo (~> 2.0) addressable (2.8.0) public_suffix (>= 2.0.2, < 5.0) @@ -99,7 +100,6 @@ GEM aws-sdk-resources (2.3.23) aws-sdk-core (= 2.3.23) base64 (0.3.0) - benchmark (0.5.0) bigdecimal (4.1.2) bindex (0.8.1) bootstrap-sass (3.4.1) @@ -130,6 +130,7 @@ GEM execjs coffee-script-source (1.12.2) concurrent-ruby (1.3.4) + connection_pool (2.5.5) crass (1.0.7) date (3.5.1) diff-lcs (1.4.4) @@ -147,6 +148,12 @@ GEM activesupport (>= 6.1) i18n (1.14.8) concurrent-ruby (~> 1.0) + io-console (0.8.2) + irb (1.18.0) + pp (>= 0.6.0) + prism (>= 1.3.0) + rdoc (>= 4.0.0) + reline (>= 0.4.2) jbuilder (2.11.2) activesupport (>= 5.0.0) jmespath (1.4.0) @@ -173,7 +180,6 @@ GEM material_design_lite-sass (1.3.0.1) autoprefixer-rails (>= 6.5) sass (>= 3.3) - method_source (1.1.0) mime-types (3.3.1) mime-types-data (~> 3.2015) mime-types-data (3.2021.0225) @@ -209,27 +215,36 @@ GEM ast (~> 2.4.1) pg (1.2.3) popper_js (2.9.2) + pp (0.6.4) + prettyprint + prettyprint (0.2.0) + prism (1.9.0) psych (3.3.2) public_suffix (4.0.6) puma (3.12.6) racc (1.8.1) rack (2.2.23) + rack-session (1.0.2) + rack (< 3) rack-test (2.2.0) rack (>= 1.3) - rails (7.0.10) - actioncable (= 7.0.10) - actionmailbox (= 7.0.10) - actionmailer (= 7.0.10) - actionpack (= 7.0.10) - actiontext (= 7.0.10) - actionview (= 7.0.10) - activejob (= 7.0.10) - activemodel (= 7.0.10) - activerecord (= 7.0.10) - activestorage (= 7.0.10) - activesupport (= 7.0.10) + rackup (1.0.1) + rack (< 3) + webrick + rails (7.1.3.4) + actioncable (= 7.1.3.4) + actionmailbox (= 7.1.3.4) + actionmailer (= 7.1.3.4) + actionpack (= 7.1.3.4) + actiontext (= 7.1.3.4) + actionview (= 7.1.3.4) + activejob (= 7.1.3.4) + activemodel (= 7.1.3.4) + activerecord (= 7.1.3.4) + activestorage (= 7.1.3.4) + activesupport (= 7.1.3.4) bundler (>= 1.15.0) - railties (= 7.0.10) + railties (= 7.1.3.4) rails-dom-testing (2.3.0) activesupport (>= 5.0.0) minitest @@ -237,18 +252,20 @@ GEM rails-html-sanitizer (1.7.0) loofah (~> 2.25) nokogiri (>= 1.15.7, != 1.16.7, != 1.16.6, != 1.16.5, != 1.16.4, != 1.16.3, != 1.16.2, != 1.16.1, != 1.16.0.rc1, != 1.16.0) - railties (7.0.10) - actionpack (= 7.0.10) - activesupport (= 7.0.10) - method_source + railties (7.1.3.4) + actionpack (= 7.1.3.4) + activesupport (= 7.1.3.4) + irb + rackup (>= 1.0.0) rake (>= 12.2) - thor (~> 1.0) - zeitwerk (~> 2.5) + thor (~> 1.0, >= 1.2.2) + zeitwerk (~> 2.6) rainbow (3.0.0) rake (13.4.2) rb-fsevent (0.11.2) rb-inotify (0.11.1) ffi (~> 1.0) + rdoc (6.3.4.1) redcarpet (3.5.1) reek (6.0.4) kwalify (~> 0.7.0) @@ -256,6 +273,8 @@ GEM psych (~> 3.1) rainbow (>= 2.0, < 4.0) regexp_parser (2.1.1) + reline (0.6.3) + io-console (~> 0.5) rexml (3.2.5) rspec-core (3.10.1) rspec-support (~> 3.10.0) @@ -310,7 +329,6 @@ GEM tilt (>= 1.1, < 3) sassc (2.4.0) ffi (~> 1.9) - securerandom (0.3.2) selenium-webdriver (3.142.7) childprocess (>= 0.5, < 4.0) rubyzip (>= 1.2.2) @@ -341,6 +359,7 @@ GEM activemodel (>= 6.0.0) bindex (>= 0.4.0) railties (>= 6.0.0) + webrick (1.9.2) websocket-driver (0.8.2) base64 websocket-extensions (>= 0.1.0) @@ -373,7 +392,7 @@ DEPENDENCIES paperclip (~> 5.2.1) pg (~> 1.1) puma (~> 3.7) - rails (~> 7.0.0) + rails (>= 7.1.0, < 7.1.4) redcarpet reek rspec-rails diff --git a/config/environments/development.rb b/config/environments/development.rb index 7f777e6..6ec850d 100644 --- a/config/environments/development.rb +++ b/config/environments/development.rb @@ -8,7 +8,7 @@ # In the development environment your application's code is reloaded on # every request. This slows down response time but is perfect for development # since you don't have to restart the web server when you make code changes. - config.cache_classes = false + config.enable_reloading = true # Do not eager load code on boot. config.eager_load = false diff --git a/config/environments/production.rb b/config/environments/production.rb index 3671f4f..9b26a8b 100644 --- a/config/environments/production.rb +++ b/config/environments/production.rb @@ -2,7 +2,7 @@ # Settings specified here will take precedence over those in config/application.rb. # Code is not reloaded between requests. - config.cache_classes = true + config.enable_reloading = false # Eager load code on boot. This eager loads most of Rails and # your application in memory, allowing both threaded web servers diff --git a/config/environments/test.rb b/config/environments/test.rb index 43cd9e4..4841d46 100644 --- a/config/environments/test.rb +++ b/config/environments/test.rb @@ -10,7 +10,7 @@ # test suite. You never need to work with it otherwise. Remember that # your test database is "scratch space" for the test suite and is wiped # and recreated between test runs. Don't rely on the data there! - config.cache_classes = true + config.enable_reloading = false # Do not eager load code on boot. This avoids loading your whole application # just for the purpose of running a single test. If you are using a tool that diff --git a/db/schema.rb b/db/schema.rb index 474843c..24a0cd6 100644 --- a/db/schema.rb +++ b/db/schema.rb @@ -10,7 +10,7 @@ # # It's strongly recommended that you check this file into your version control system. -ActiveRecord::Schema[7.0].define(version: 2018_03_25_143727) do +ActiveRecord::Schema[7.1].define(version: 2018_03_25_143727) do # These are extensions that must be enabled in order to support this database enable_extension "plpgsql" From 3aa7012c996843780f62c52fb03e9afbece34bbe Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Juan=20V=C3=A1squez?= Date: Mon, 6 Jul 2026 16:30:06 -0600 Subject: [PATCH 12/28] Replace unmaintained paperclip with kt-paperclip fork paperclip (last real release 2018) calls URI.escape in lib/paperclip/url_generator.rb on every asset URL it generates -- URI.escape was fully removed in Ruby 3.0. Confirmed even paperclip's latest release (6.1.0, also 2018) never fixed this; the gem has had no maintenance since Active Storage replaced it. This was a hard blocker for any future Ruby 3.x upgrade. kt-paperclip is an actively maintained fork (latest release 8.0.0) that fixes this via URI::RFC2396_Parser instead, and stays drop-in compatible -- same Paperclip:: module and require path, just a different gem name (require: "paperclip" in the Gemfile line). As a side effect, kt-paperclip 8.0.0 drops the mimemagic dependency entirely, which also resolves an unrelated landmine: mimemagic 0.3.10 (our prior locked version) was yanked from RubyGems in 2020 over a license violation, so any clean bundle install without a cache hit would have failed regardless of Ruby version. Verified end-to-end on the current stack (Ruby 2.7.2, Rails 7.1.3.4): full test suite (11 examples), rubocop, and reek all pass. Manually exercised the real upload -> HTML view -> PDF export flow via HTTP (not rails runner) to exercise kt-paperclip's URL generation under real request conditions -- no errors, and the "URI.escape is obsolete" warnings that appeared in every previous test run are now gone. --- Gemfile | 5 ++++- Gemfile.lock | 30 ++++++++++++++---------------- Gemfile.next.lock | 30 ++++++++++++++---------------- 3 files changed, 32 insertions(+), 33 deletions(-) diff --git a/Gemfile b/Gemfile index fa3da79..f347167 100644 --- a/Gemfile +++ b/Gemfile @@ -62,7 +62,10 @@ gem "wkhtmltopdf-binary", "0.12.3.1" # FastRuby Styleguide gem "fastruby-styleguide", git: "https://github.com/fastruby/styleguide.git", branch: "gh-pages" -gem "paperclip", "~> 5.2.1" +# paperclip is unmaintained since 2018 and calls URI.escape (removed in Ruby +# 3.0); kt-paperclip is a maintained, actively-released fork that fixes this +# and stays drop-in compatible (same Paperclip:: module/require path). +gem "kt-paperclip", "~> 8.0.0", require: "paperclip" gem "aws-sdk", "~> 2.3.0" gem "pg", "~> 1.1" diff --git a/Gemfile.lock b/Gemfile.lock index 963f161..0abfb99 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -118,10 +118,8 @@ GEM rack-test (>= 0.5.4) xpath (>= 2.0, < 4.0) childprocess (3.0.0) - climate_control (0.2.0) + climate_control (1.2.0) clipboard-rails (1.7.1) - cocaine (0.5.8) - climate_control (>= 0.0.3, < 1.0) coffee-rails (5.0.0) coffee-script (>= 2.2.0) railties (>= 5.2.0) @@ -161,6 +159,12 @@ GEM rails-dom-testing (>= 1, < 3) railties (>= 4.2.0) thor (>= 0.14, < 2.0) + kt-paperclip (8.0.0) + activemodel (>= 4.2.0) + activesupport (>= 4.2.0) + marcel (>= 1.0.1) + mime-types + terrapin (>= 0.6.0) kwalify (0.7.2) listen (3.10.0) logger @@ -180,12 +184,10 @@ GEM material_design_lite-sass (1.3.0.1) autoprefixer-rails (>= 6.5) sass (>= 3.3) - mime-types (3.3.1) - mime-types-data (~> 3.2015) - mime-types-data (3.2021.0225) - mimemagic (0.3.10) - nokogiri (~> 1) - rake + mime-types (3.7.0) + logger + mime-types-data (~> 3.2025, >= 3.2025.0507) + mime-types-data (3.2026.0701) mini_mime (1.1.5) mini_portile2 (2.8.9) minitest (5.26.1) @@ -204,12 +206,6 @@ GEM nokogiri (1.15.7) mini_portile2 (~> 2.8.2) racc (~> 1.4) - paperclip (5.2.1) - activemodel (>= 4.2.0) - activesupport (>= 4.2.0) - cocaine (~> 0.5.5) - mime-types - mimemagic (~> 0.3.0) parallel (1.20.1) parser (3.0.2.0) ast (~> 2.4.1) @@ -343,6 +339,8 @@ GEM standard (1.1.5) rubocop (= 1.18.3) rubocop-performance (= 1.11.4) + terrapin (1.1.1) + climate_control thor (1.5.0) tilt (2.0.10) timeout (0.6.1) @@ -386,10 +384,10 @@ DEPENDENCIES fastruby-styleguide! font-awesome-rails (>= 4.7.0.9) jbuilder (~> 2.5) + kt-paperclip (~> 8.0.0) listen (>= 3.5) next_rails nokogiri (>= 1.13.0) - paperclip (~> 5.2.1) pg (~> 1.1) puma (~> 3.7) rails (>= 7.1.0, < 7.1.4) diff --git a/Gemfile.next.lock b/Gemfile.next.lock index 963f161..0abfb99 100644 --- a/Gemfile.next.lock +++ b/Gemfile.next.lock @@ -118,10 +118,8 @@ GEM rack-test (>= 0.5.4) xpath (>= 2.0, < 4.0) childprocess (3.0.0) - climate_control (0.2.0) + climate_control (1.2.0) clipboard-rails (1.7.1) - cocaine (0.5.8) - climate_control (>= 0.0.3, < 1.0) coffee-rails (5.0.0) coffee-script (>= 2.2.0) railties (>= 5.2.0) @@ -161,6 +159,12 @@ GEM rails-dom-testing (>= 1, < 3) railties (>= 4.2.0) thor (>= 0.14, < 2.0) + kt-paperclip (8.0.0) + activemodel (>= 4.2.0) + activesupport (>= 4.2.0) + marcel (>= 1.0.1) + mime-types + terrapin (>= 0.6.0) kwalify (0.7.2) listen (3.10.0) logger @@ -180,12 +184,10 @@ GEM material_design_lite-sass (1.3.0.1) autoprefixer-rails (>= 6.5) sass (>= 3.3) - mime-types (3.3.1) - mime-types-data (~> 3.2015) - mime-types-data (3.2021.0225) - mimemagic (0.3.10) - nokogiri (~> 1) - rake + mime-types (3.7.0) + logger + mime-types-data (~> 3.2025, >= 3.2025.0507) + mime-types-data (3.2026.0701) mini_mime (1.1.5) mini_portile2 (2.8.9) minitest (5.26.1) @@ -204,12 +206,6 @@ GEM nokogiri (1.15.7) mini_portile2 (~> 2.8.2) racc (~> 1.4) - paperclip (5.2.1) - activemodel (>= 4.2.0) - activesupport (>= 4.2.0) - cocaine (~> 0.5.5) - mime-types - mimemagic (~> 0.3.0) parallel (1.20.1) parser (3.0.2.0) ast (~> 2.4.1) @@ -343,6 +339,8 @@ GEM standard (1.1.5) rubocop (= 1.18.3) rubocop-performance (= 1.11.4) + terrapin (1.1.1) + climate_control thor (1.5.0) tilt (2.0.10) timeout (0.6.1) @@ -386,10 +384,10 @@ DEPENDENCIES fastruby-styleguide! font-awesome-rails (>= 4.7.0.9) jbuilder (~> 2.5) + kt-paperclip (~> 8.0.0) listen (>= 3.5) next_rails nokogiri (>= 1.13.0) - paperclip (~> 5.2.1) pg (~> 1.1) puma (~> 3.7) rails (>= 7.1.0, < 7.1.4) From 02fba1d66ccf228036531f75093a7cdaf281d5c5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Juan=20V=C3=A1squez?= Date: Mon, 6 Jul 2026 17:01:56 -0600 Subject: [PATCH 13/28] Replace RSpec with Minitest Ports both spec files to Minitest, preserving every case including the PDF-export coverage added earlier: - spec/models/gemfile_spec.rb -> test/models/gemfile_test.rb (uses Bundler::Audit::Scanner.stub via minitest/mock instead of rspec-mocks; needed explicit `require "bundler/audit/scanner"` and `require "minitest/mock"` since nothing else forces those to load before the stub call, unlike RSpec where `RSpec.describe Gemfile` itself triggered the Gemfile model's autoload at file-parse time) - spec/controllers/gemfiles_controller_spec.rb -> test/controllers/gemfiles_controller_test.rb, written as ActionDispatch::IntegrationTest (real routes, real view rendering, matching RSpec's `render_views` + `type: :controller` behavior) Moved fixtures from spec/support/fixtures/ to the Rails-conventional test/fixtures/files/. Deleted test/fixtures/gemfiles.yml -- it was a stale default-scaffold fixture referencing a `file` column that has never existed (Paperclip splits it into file_file_name etc.), dead weight since the project used RSpec until now and never exercised it. Removed rspec-rails and rubocop-rspec from the Gemfile (capybara / selenium-webdriver stay -- Rails' own system tests need them regardless of test framework). Stripped RSpec-only cops and stale spec/ file references from .rubocop.yml / .rubocop_with_todo.yml / .rubocop_todo.yml. Deleted config/spring.rb, dead config left over from when the spring gem was dropped during the Rails 7.0 hop. Updated CircleCI (both build-current and build-next) to run `bin/rails test` instead of `bundle exec rspec`, README's documented test command, and .gitignore's test-fixture storage path (spec/test_files -> test/test_files, also updated in config/environments/test.rb). Also fixes a Rails 7.1 deprecation surfaced while writing the integration test: config.action_dispatch.show_exceptions = false -> :none. Verified: full suite (11 runs, 35 assertions, 0 failures, 0 errors), rubocop (49 files, no offenses), reek clean. Manually exercised the real upload -> HTML view -> PDF export flow via HTTP end to end. --- .circleci/config.yml | 34 +---- .gitignore | 2 +- .rspec | 1 - .rubocop.yml | 9 -- .rubocop_todo.yml | 61 --------- .rubocop_with_todo.yml | 9 -- Gemfile | 2 - Gemfile.lock | 23 ---- Gemfile.next.lock | 23 ---- README.md | 2 +- config/environments/test.rb | 4 +- config/spring.rb | 6 - spec/controllers/gemfiles_controller_spec.rb | 86 ------------ spec/models/gemfile_spec.rb | 126 ------------------ spec/rails_helper.rb | 57 -------- spec/spec_helper.rb | 100 -------------- test/controllers/gemfiles_controller_test.rb | 47 +++++++ .../fixtures/files}/Gemfile.lock | 0 .../fixtures/files}/corrupt.lock | 0 test/fixtures/gemfiles.yml | 7 - test/models/gemfile_test.rb | 116 +++++++++++++++- test/test_helper.rb | 4 +- 22 files changed, 172 insertions(+), 547 deletions(-) delete mode 100644 .rspec delete mode 100644 config/spring.rb delete mode 100644 spec/controllers/gemfiles_controller_spec.rb delete mode 100644 spec/models/gemfile_spec.rb delete mode 100644 spec/rails_helper.rb delete mode 100644 spec/spec_helper.rb create mode 100644 test/controllers/gemfiles_controller_test.rb rename {spec/support/fixtures => test/fixtures/files}/Gemfile.lock (100%) rename {spec/support/fixtures => test/fixtures/files}/corrupt.lock (100%) delete mode 100644 test/fixtures/gemfiles.yml diff --git a/.circleci/config.yml b/.circleci/config.yml index fdd4438..4c5ecab 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -64,20 +64,9 @@ jobs: - run: name: run tests command: | - mkdir /tmp/test-results - TEST_FILES="$(circleci tests glob "spec/**/*_spec.rb" | circleci tests split --split-by=timings)" - - bundle exec rspec --format progress \ - --out /tmp/test-results/rspec.xml \ - --format progress \ - $TEST_FILES - - # collect reports - - store_test_results: - path: /tmp/test-results - - store_artifacts: - path: /tmp/test-results - destination: test-results + TEST_FILES="$(circleci tests glob "test/**/*_test.rb" | circleci tests split --split-by=timings)" + + bin/rails test $TEST_FILES build-next: docker: - image: circleci/ruby:2.7.2-node-browsers @@ -140,20 +129,9 @@ jobs: - run: name: run tests command: | - mkdir /tmp/test-results - TEST_FILES="$(circleci tests glob "spec/**/*_spec.rb" | circleci tests split --split-by=timings)" - - bundle exec rspec --format progress \ - --out /tmp/test-results/rspec.xml \ - --format progress \ - $TEST_FILES - - # collect reports - - store_test_results: - path: /tmp/test-results - - store_artifacts: - path: /tmp/test-results - destination: test-results + TEST_FILES="$(circleci tests glob "test/**/*_test.rb" | circleci tests split --split-by=timings)" + + bin/rails test $TEST_FILES workflows: version: 2 diff --git a/.gitignore b/.gitignore index b4123c0..001c4bb 100644 --- a/.gitignore +++ b/.gitignore @@ -25,7 +25,7 @@ config/database.yml /node_modules /yarn-error.log -spec/test_files +test/test_files .byebug_history .DS_Store diff --git a/.rspec b/.rspec deleted file mode 100644 index c99d2e7..0000000 --- a/.rspec +++ /dev/null @@ -1 +0,0 @@ ---require spec_helper diff --git a/.rubocop.yml b/.rubocop.yml index 9a1e784..68a6fde 100644 --- a/.rubocop.yml +++ b/.rubocop.yml @@ -3,7 +3,6 @@ inherit_from: .rubocop_todo.yml require: - standard - rubocop-rails - - rubocop-rspec inherit_gem: standard: config/base.yml @@ -17,14 +16,6 @@ AllCops: Rails: Enabled: true -RSpec: - Enabled: true -RSpec/DescribeClass: - Enabled: false -RSpec/ExampleLength: - Max: 20 -RSpec/FilePath: - Enabled: false Style/MixinUsage: Exclude: - bin/**/* diff --git a/.rubocop_todo.yml b/.rubocop_todo.yml index 6345468..af54a80 100644 --- a/.rubocop_todo.yml +++ b/.rubocop_todo.yml @@ -53,7 +53,6 @@ Layout/ExtraSpacing: - 'config/environments/production.rb' - 'config/environments/test.rb' - 'config/puma.rb' - - 'spec/models/gemfile_spec.rb' # Offense count: 1 # Cop supports --auto-correct. @@ -89,7 +88,6 @@ Layout/SpaceInsideHashLiteralBraces: Exclude: - 'app/models/gemfile.rb' - 'config/initializers/paperclip.rb' - - 'spec/controllers/gemfiles_controller_spec.rb' # Offense count: 2 # Cop supports --auto-correct. @@ -97,14 +95,6 @@ Layout/SpaceInsideHashLiteralBraces: Layout/TrailingWhitespace: Exclude: - 'app/controllers/gemfiles_controller.rb' - - 'spec/spec_helper.rb' - -# Offense count: 1 -# Configuration parameters: AllowedMethods. -# AllowedMethods: enums -Lint/ConstantDefinitionInBlock: - Exclude: - - 'spec/models/gemfile_spec.rb' # Offense count: 1 # Cop supports --auto-correct. @@ -112,47 +102,6 @@ Lint/RedundantStringCoercion: Exclude: - 'app/models/gemfile.rb' -# Offense count: 1 -# Cop supports --auto-correct. -# Configuration parameters: SkipBlocks, EnforcedStyle. -# SupportedStyles: described_class, explicit -RSpec/DescribedClass: - Exclude: - - 'spec/models/gemfile_spec.rb' - -# Offense count: 1 -# Cop supports --auto-correct. -RSpec/EmptyLineAfterFinalLet: - Exclude: - - 'spec/controllers/gemfiles_controller_spec.rb' - -# Offense count: 2 -# Cop supports --auto-correct. -RSpec/LeadingSubject: - Exclude: - - 'spec/controllers/gemfiles_controller_spec.rb' - - 'spec/models/gemfile_spec.rb' - -# Offense count: 1 -RSpec/LeakyConstantDeclaration: - Exclude: - - 'spec/models/gemfile_spec.rb' - -# Offense count: 6 -RSpec/MultipleExpectations: - Max: 12 - -# Offense count: 12 -# Configuration parameters: IgnoreSharedExamples. -RSpec/NamedSubject: - Exclude: - - 'spec/controllers/gemfiles_controller_spec.rb' - - 'spec/models/gemfile_spec.rb' - -# Offense count: 1 -RSpec/NestedGroups: - Max: 4 - # Offense count: 8 # Configuration parameters: EnforcedStyle. # SupportedStyles: slashes, arguments @@ -161,9 +110,6 @@ Rails/FilePath: - 'app/models/gemfile.rb' - 'config/environments/development.rb' - 'config/environments/test.rb' - - 'spec/controllers/gemfiles_controller_spec.rb' - - 'spec/models/gemfile_spec.rb' - - 'spec/spec_helper.rb' # Offense count: 1 # Configuration parameters: Include. @@ -184,12 +130,6 @@ Security/Open: Exclude: - 'app/models/gemfile.rb' -# Offense count: 1 -# Cop supports --auto-correct. -Style/BlockComments: - Exclude: - - 'spec/spec_helper.rb' - # Offense count: 1 # Cop supports --auto-correct. Style/GlobalStdStream: @@ -211,7 +151,6 @@ Style/HashSyntax: Style/PercentLiteralDelimiters: Exclude: - 'config/initializers/assets.rb' - - 'config/spring.rb' # Offense count: 2 # Cop supports --auto-correct. diff --git a/.rubocop_with_todo.yml b/.rubocop_with_todo.yml index ba0861f..f25b1e2 100644 --- a/.rubocop_with_todo.yml +++ b/.rubocop_with_todo.yml @@ -3,7 +3,6 @@ inherit_from: .rubocop_todo.yml require: - standard - rubocop-rails - - rubocop-rspec inherit_gem: standard: config/base.yml @@ -19,14 +18,6 @@ AllCops: Rails: Enabled: true -RSpec: - Enabled: true -RSpec/DescribeClass: - Enabled: false -RSpec/ExampleLength: - Max: 20 -RSpec/FilePath: - Enabled: false Style/MixinUsage: Exclude: - bin/**/* diff --git a/Gemfile b/Gemfile index f347167..4634981 100644 --- a/Gemfile +++ b/Gemfile @@ -77,9 +77,7 @@ group :development, :test do gem "byebug", platforms: [:mri, :mingw, :x64_mingw] # Adds support for Capybara system testing and selenium driver gem 'capybara', '~> 2.13' - gem 'rspec-rails' gem "rubocop-rails", require: false # rails rules for standard - gem "rubocop-rspec", require: false # rspec rules for standard gem 'selenium-webdriver' gem "standard" gem 'dotenv-rails' diff --git a/Gemfile.lock b/Gemfile.lock index 0abfb99..d88a309 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -131,7 +131,6 @@ GEM connection_pool (2.5.5) crass (1.0.7) date (3.5.1) - diff-lcs (1.4.4) dotenv (2.7.6) dotenv-rails (2.7.6) dotenv (= 2.7.6) @@ -272,23 +271,6 @@ GEM reline (0.6.3) io-console (~> 0.5) rexml (3.2.5) - rspec-core (3.10.1) - rspec-support (~> 3.10.0) - rspec-expectations (3.10.1) - diff-lcs (>= 1.2.0, < 2.0) - rspec-support (~> 3.10.0) - rspec-mocks (3.10.2) - diff-lcs (>= 1.2.0, < 2.0) - rspec-support (~> 3.10.0) - rspec-rails (5.0.1) - actionpack (>= 5.2) - activesupport (>= 5.2) - railties (>= 5.2) - rspec-core (~> 3.10) - rspec-expectations (~> 3.10) - rspec-mocks (~> 3.10) - rspec-support (~> 3.10) - rspec-support (3.10.2) rubocop (1.18.3) parallel (~> 1.10) parser (>= 3.0.0.0) @@ -307,9 +289,6 @@ GEM activesupport (>= 4.2.0) rack (>= 1.1) rubocop (>= 1.7.0, < 2.0) - rubocop-rspec (2.4.0) - rubocop (~> 1.0) - rubocop-ast (>= 1.1.0) ruby-progressbar (1.11.0) rubyzip (2.3.1) sass (3.7.4) @@ -393,9 +372,7 @@ DEPENDENCIES rails (>= 7.1.0, < 7.1.4) redcarpet reek - rspec-rails rubocop-rails - rubocop-rspec sass-rails (~> 5.0) selenium-webdriver standard diff --git a/Gemfile.next.lock b/Gemfile.next.lock index 0abfb99..d88a309 100644 --- a/Gemfile.next.lock +++ b/Gemfile.next.lock @@ -131,7 +131,6 @@ GEM connection_pool (2.5.5) crass (1.0.7) date (3.5.1) - diff-lcs (1.4.4) dotenv (2.7.6) dotenv-rails (2.7.6) dotenv (= 2.7.6) @@ -272,23 +271,6 @@ GEM reline (0.6.3) io-console (~> 0.5) rexml (3.2.5) - rspec-core (3.10.1) - rspec-support (~> 3.10.0) - rspec-expectations (3.10.1) - diff-lcs (>= 1.2.0, < 2.0) - rspec-support (~> 3.10.0) - rspec-mocks (3.10.2) - diff-lcs (>= 1.2.0, < 2.0) - rspec-support (~> 3.10.0) - rspec-rails (5.0.1) - actionpack (>= 5.2) - activesupport (>= 5.2) - railties (>= 5.2) - rspec-core (~> 3.10) - rspec-expectations (~> 3.10) - rspec-mocks (~> 3.10) - rspec-support (~> 3.10) - rspec-support (3.10.2) rubocop (1.18.3) parallel (~> 1.10) parser (>= 3.0.0.0) @@ -307,9 +289,6 @@ GEM activesupport (>= 4.2.0) rack (>= 1.1) rubocop (>= 1.7.0, < 2.0) - rubocop-rspec (2.4.0) - rubocop (~> 1.0) - rubocop-ast (>= 1.1.0) ruby-progressbar (1.11.0) rubyzip (2.3.1) sass (3.7.4) @@ -393,9 +372,7 @@ DEPENDENCIES rails (>= 7.1.0, < 7.1.4) redcarpet reek - rspec-rails rubocop-rails - rubocop-rspec sass-rails (~> 5.0) selenium-webdriver standard diff --git a/README.md b/README.md index 6f576cf..80afa55 100644 --- a/README.md +++ b/README.md @@ -22,7 +22,7 @@ You should be able to go to http://localhost:3000 and see the landing page. ## Running tests - rails spec + rails test ## Contributing diff --git a/config/environments/test.rb b/config/environments/test.rb index 4841d46..2654621 100644 --- a/config/environments/test.rb +++ b/config/environments/test.rb @@ -1,7 +1,7 @@ Rails.application.configure do config.paperclip_defaults = { storage: :filesystem, - path: "#{Rails.root}/spec/test_files/:class/:id_partition/:style.:extension" + path: "#{Rails.root}/test/test_files/:class/:id_partition/:style.:extension" } # Settings specified here will take precedence over those in config/application.rb. @@ -28,7 +28,7 @@ config.action_controller.perform_caching = false # Raise exceptions instead of rendering exception templates. - config.action_dispatch.show_exceptions = false + config.action_dispatch.show_exceptions = :none # Disable request forgery protection in test environment. config.action_controller.allow_forgery_protection = false diff --git a/config/spring.rb b/config/spring.rb deleted file mode 100644 index c9119b4..0000000 --- a/config/spring.rb +++ /dev/null @@ -1,6 +0,0 @@ -%w( - .ruby-version - .rbenv-vars - tmp/restart.txt - tmp/caching-dev.txt -).each { |path| Spring.watch(path) } diff --git a/spec/controllers/gemfiles_controller_spec.rb b/spec/controllers/gemfiles_controller_spec.rb deleted file mode 100644 index eddc3d7..0000000 --- a/spec/controllers/gemfiles_controller_spec.rb +++ /dev/null @@ -1,86 +0,0 @@ -require "rails_helper" - -RSpec.describe GemfilesController, type: :controller do - render_views - - describe "#create" do - context "when file is empty" do - let(:msg) do - "File can't be blank" - end - - it "returns an error message" do - post :create - - expect(flash[:error]).to eq(msg) - end - end - - context "when Gemfile.lock is invalid" do - let(:file) do - File.new("#{Rails.root}/spec/support/fixtures/corrupt.lock") - end - let(:file_upload) do - fixture_file_upload(file) - end - let(:msg_1) do - "File has contents that are not what they are reported to be" - end - let(:msg_2) do - "File is invalid" - end - let(:msg_3) do - "File content type is invalid" - end - - before do - post :create, params: { gemfile: { file: file_upload } } - end - - it "redirects to the homepage" do - expect(response).to redirect_to(root_path) - end - - it "loads an error message in flash[:error]" do - expect(flash[:error]).to include(msg_1) - expect(flash[:error]).to include(msg_2) - expect(flash[:error]).to include(msg_3) - end - end - end - - describe "#show" do - let(:file) do - File.new("#{Rails.root}/spec/support/fixtures/Gemfile.lock") - end - subject { Gemfile.create(file: file) } - - context "when trying to find gemfile by id" do - it "won't find any" do - expect do - get :show, params: { id: subject.id } - end.to raise_error(ActiveRecord::RecordNotFound) - end - end - - context "when trying to find gemfile by alpha id" do - let(:message) { "No vulnerabilities found!" } - - it "will find it" do - get :show, params: { id: subject.alpha_id } - - expect(response).to be_ok - end - end - - context "when requesting the PDF format" do - it "renders a PDF successfully" do - get :show, params: { id: subject.alpha_id, format: :pdf } - - expect(response).to be_ok - expect(response.content_type).to eq("application/pdf") - expect(response.body).to start_with("%PDF") - end - end - end -end diff --git a/spec/models/gemfile_spec.rb b/spec/models/gemfile_spec.rb deleted file mode 100644 index 7a1d9a4..0000000 --- a/spec/models/gemfile_spec.rb +++ /dev/null @@ -1,126 +0,0 @@ -require "rails_helper" - -RSpec.describe Gemfile do - class BundlerAuditScannerStub - attr_reader :vulnerabilities - - def initialize(vulnerabilities) - @vulnerabilities = vulnerabilities - end - - def scan(&block) - vulnerabilities.each { |v| block.call(v) } - end - end - - let(:file) do - File.new("#{Rails.root}/spec/support/fixtures/Gemfile.lock") - end - let(:vulnerabilities) { [] } - let(:bundler_audit_scanner) { BundlerAuditScannerStub.new(vulnerabilities) } - - before do - allow(Bundler::Audit::Scanner).to receive(:new).and_return(bundler_audit_scanner) - end - - subject { Gemfile.new(file: file) } - - describe "#valid?" do - let(:alpha_id_size) { 8 } - - context "when subject is valid" do - it "returns true and generates alpha_id" do - expect(subject).to be_valid - expect(subject.alpha_id.size).to eq(alpha_id_size) - end - end - - context "when subject is invalid" do - let(:file) do - File.new("#{Rails.root}/Gemfile") - end - let(:messages) do - ["File file name is invalid", "File is invalid"] - end - - it "returns false" do - expect(subject).not_to be_valid - expect(subject.errors.full_messages).to eq messages - end - - context "when file is nil" do - let(:file) { nil } - - it "returns false" do - expect(subject).not_to be_valid - expect(subject.errors.full_messages).to eq ["File can't be blank"] - end - end - end - end - - describe "#check_with_bundler_audit" do - context "when Gemfile.lock is not vulnerable" do - it "returns empty default hash" do - expect(subject.save).to be_truthy - expect(subject.check_with_bundler_audit).to eq({warnings: [], advisories: []}) - end - end - - context "when Gemfile.lock is vulnerable" do - let(:vulnerabilities) do - [ - Bundler::Audit::Results::InsecureSource.new("http://rubygems.org/"), - Bundler::Audit::Results::UnpatchedGem.new( - OpenStruct.new(name: 'actionmailer', version: '3.0.1'), - OpenStruct.new({ - id: 'OSVDB-98629', - url: 'http://www.osvdb.org/show/osvdb/98629', - title: 'Action Mailer Gem for Ruby contains a possible DoS Vulnerability', - description: 'Action Mailer Gem for Ruby contains a format string flaw in the Log Subscriber component. The issue is triggered as format string specifiers (e.g. %s and %x) are not properly sanitized in user-supplied input when handling email addresses. This may allow a remote attacker to cause a denial of service' - }) - ), - Bundler::Audit::Results::UnpatchedGem.new( - OpenStruct.new(name: 'actionpack', version: '3.0.1'), - OpenStruct.new({ - id: 'CVE-2014-7829', - url: 'https://groups.google.com/forum/#!topic/rubyonrails-security/rMTQy4oRCGk', - title: 'Arbitrary file existence disclosure in Action Pack', - description: "Specially crafted requests can be used to determine whether a file exists on\nthe filesystem that is outside the Rails application's root directory. The\nfiles will not be served, but attackers can determine whether or not the file\nexists. This vulnerability is very similar to CVE-2014-7818, but the\nspecially crafted string is slightly different.\n" - }) - ), - Bundler::Audit::Results::UnpatchedGem.new( - OpenStruct.new(name: 'actionpack', version: '3.0.1'), - OpenStruct.new({ - id: 'CVE-2014-7830', - url: 'https://groups.google.com/forum/#!topic/rubyonrails-security/rMTQy4oRC321', - title: 'Arbitrary file existence disclosure in Action Pack part 2', - description: "Custom Description" - }) - ) - ] - end - - it "returns a hash with the vulnerabilities" do - expect(subject.save).to be_truthy - - result = subject.check_with_bundler_audit - - expect(result).to include(:warnings) - expect(result).to include(:advisories) - expect(result[:advisories].size).to eq(3) - expect(result[:warnings]).to eq(["Insecure Source URI found: http://rubygems.org/"]) - - last_advisory = result[:advisories].last - - expect(last_advisory[:label]).to eq("actionpack@3.0.1") - expect(last_advisory[:name]).to eq("actionpack") - expect(last_advisory[:version]).to eq("3.0.1") - expect(last_advisory[:id]).to eq("CVE-2014-7830") - expect(last_advisory[:url]).to eq("https://groups.google.com/forum/#!topic/rubyonrails-security/rMTQy4oRC321") - expect(last_advisory[:title]).to eq("Arbitrary file existence disclosure in Action Pack part 2") - expect(last_advisory[:description]).to eq("Custom Description") - end - end - end -end diff --git a/spec/rails_helper.rb b/spec/rails_helper.rb deleted file mode 100644 index bbe1ba5..0000000 --- a/spec/rails_helper.rb +++ /dev/null @@ -1,57 +0,0 @@ -# This file is copied to spec/ when you run 'rails generate rspec:install' -require 'spec_helper' -ENV['RAILS_ENV'] ||= 'test' -require File.expand_path('../../config/environment', __FILE__) -# Prevent database truncation if the environment is production -abort("The Rails environment is running in production mode!") if Rails.env.production? -require 'rspec/rails' -# Add additional requires below this line. Rails is not loaded until this point! - -# Requires supporting ruby files with custom matchers and macros, etc, in -# spec/support/ and its subdirectories. Files matching `spec/**/*_spec.rb` are -# run as spec files by default. This means that files in spec/support that end -# in _spec.rb will both be required and run as specs, causing the specs to be -# run twice. It is recommended that you do not name files matching this glob to -# end with _spec.rb. You can configure this pattern with the --pattern -# option on the command line or in ~/.rspec, .rspec or `.rspec-local`. -# -# The following line is provided for convenience purposes. It has the downside -# of increasing the boot-up time by auto-requiring all files in the support -# directory. Alternatively, in the individual `*_spec.rb` files, manually -# require only the support files necessary. -# -# Dir[Rails.root.join('spec/support/**/*.rb')].each { |f| require f } - -# Checks for pending migrations and applies them before tests are run. -# If you are not using ActiveRecord, you can remove this line. -ActiveRecord::Migration.maintain_test_schema! - -RSpec.configure do |config| - # Remove this line if you're not using ActiveRecord or ActiveRecord fixtures - config.fixture_path = "#{::Rails.root}/spec/fixtures" - - # If you're not using ActiveRecord, or you'd prefer not to run each of your - # examples within a transaction, remove the following line or assign false - # instead of true. - config.use_transactional_fixtures = true - - # RSpec Rails can automatically mix in different behaviours to your tests - # based on their file location, for example enabling you to call `get` and - # `post` in specs under `spec/controllers`. - # - # You can disable this behaviour by removing the line below, and instead - # explicitly tag your specs with their type, e.g.: - # - # RSpec.describe UsersController, :type => :controller do - # # ... - # end - # - # The different available types are documented in the features, such as in - # https://relishapp.com/rspec/rspec-rails/docs - config.infer_spec_type_from_file_location! - - # Filter lines from Rails gems in backtraces. - config.filter_rails_from_backtrace! - # arbitrary gems may also be filtered via: - # config.filter_gems_from_backtrace("gem name") -end diff --git a/spec/spec_helper.rb b/spec/spec_helper.rb deleted file mode 100644 index 6acad1c..0000000 --- a/spec/spec_helper.rb +++ /dev/null @@ -1,100 +0,0 @@ -# This file was generated by the `rails generate rspec:install` command. Conventionally, all -# specs live under a `spec` directory, which RSpec adds to the `$LOAD_PATH`. -# The generated `.rspec` file contains `--require spec_helper` which will cause -# this file to always be loaded, without a need to explicitly require it in any -# files. -# -# Given that it is always loaded, you are encouraged to keep this file as -# light-weight as possible. Requiring heavyweight dependencies from this file -# will add to the boot time of your test suite on EVERY test run, even for an -# individual file that may not need all of that loaded. Instead, consider making -# a separate helper file that requires the additional dependencies and performs -# the additional setup, and require it from the spec files that actually need -# it. -# -# See http://rubydoc.info/gems/rspec-core/RSpec/Core/Configuration -RSpec.configure do |config| - config.after(:suite) do - FileUtils.rm_rf(Dir["#{Rails.root}/spec/test_files/"]) - end - - # rspec-expectations config goes here. You can use an alternate - # assertion/expectation library such as wrong or the stdlib/minitest - # assertions if you prefer. - config.expect_with :rspec do |expectations| - # This option will default to `true` in RSpec 4. It makes the `description` - # and `failure_message` of custom matchers include text for helper methods - # defined using `chain`, e.g.: - # be_bigger_than(2).and_smaller_than(4).description - # # => "be bigger than 2 and smaller than 4" - # ...rather than: - # # => "be bigger than 2" - expectations.include_chain_clauses_in_custom_matcher_descriptions = true - end - - # rspec-mocks config goes here. You can use an alternate test double - # library (such as bogus or mocha) by changing the `mock_with` option here. - config.mock_with :rspec do |mocks| - # Prevents you from mocking or stubbing a method that does not exist on - # a real object. This is generally recommended, and will default to - # `true` in RSpec 4. - mocks.verify_partial_doubles = true - end - - # This option will default to `:apply_to_host_groups` in RSpec 4 (and will - # have no way to turn it off -- the option exists only for backwards - # compatibility in RSpec 3). It causes shared context metadata to be - # inherited by the metadata hash of host groups and examples, rather than - # triggering implicit auto-inclusion in groups with matching metadata. - config.shared_context_metadata_behavior = :apply_to_host_groups - -# The settings below are suggested to provide a good initial experience -# with RSpec, but feel free to customize to your heart's content. -=begin - # This allows you to limit a spec run to individual examples or groups - # you care about by tagging them with `:focus` metadata. When nothing - # is tagged with `:focus`, all examples get run. RSpec also provides - # aliases for `it`, `describe`, and `context` that include `:focus` - # metadata: `fit`, `fdescribe` and `fcontext`, respectively. - config.filter_run_when_matching :focus - - # Allows RSpec to persist some state between runs in order to support - # the `--only-failures` and `--next-failure` CLI options. We recommend - # you configure your source control system to ignore this file. - config.example_status_persistence_file_path = "spec/examples.txt" - - # Limits the available syntax to the non-monkey patched syntax that is - # recommended. For more details, see: - # - http://rspec.info/blog/2012/06/rspecs-new-expectation-syntax/ - # - http://www.teaisaweso.me/blog/2013/05/27/rspecs-new-message-expectation-syntax/ - # - http://rspec.info/blog/2014/05/notable-changes-in-rspec-3/#zero-monkey-patching-mode - config.disable_monkey_patching! - - # Many RSpec users commonly either run the entire suite or an individual - # file, and it's useful to allow more verbose output when running an - # individual spec file. - if config.files_to_run.one? - # Use the documentation formatter for detailed output, - # unless a formatter has already been configured - # (e.g. via a command-line flag). - config.default_formatter = "doc" - end - - # Print the 10 slowest examples and example groups at the - # end of the spec run, to help surface which specs are running - # particularly slow. - config.profile_examples = 10 - - # Run specs in random order to surface order dependencies. If you find an - # order dependency and want to debug it, you can fix the order by providing - # the seed, which is printed after each run. - # --seed 1234 - config.order = :random - - # Seed global randomization in this process using the `--seed` CLI option. - # Setting this allows you to use `--seed` to deterministically reproduce - # test failures related to randomization by passing the same `--seed` value - # as the one that triggered the failure. - Kernel.srand config.seed -=end -end diff --git a/test/controllers/gemfiles_controller_test.rb b/test/controllers/gemfiles_controller_test.rb new file mode 100644 index 0000000..ec2fc73 --- /dev/null +++ b/test/controllers/gemfiles_controller_test.rb @@ -0,0 +1,47 @@ +require "test_helper" + +class GemfilesControllerTest < ActionDispatch::IntegrationTest + test "create with an empty file sets an error message in flash" do + post gemfiles_path + + assert_equal "File can't be blank", flash[:error] + end + + test "create with an invalid Gemfile.lock redirects to the homepage with an error message" do + file = File.new(Rails.root.join("test/fixtures/files/corrupt.lock")) + file_upload = fixture_file_upload(file) + + post gemfiles_path, params: {gemfile: {file: file_upload}} + + assert_redirected_to root_path + assert_includes flash[:error], "File has contents that are not what they are reported to be" + assert_includes flash[:error], "File is invalid" + assert_includes flash[:error], "File content type is invalid" + end + + test "show with a numeric id raises RecordNotFound since lookup is by alpha_id" do + gemfile = Gemfile.create(file: File.new(Rails.root.join("test/fixtures/files/Gemfile.lock"))) + + assert_raises(ActiveRecord::RecordNotFound) do + get gemfile_path(id: gemfile.id) + end + end + + test "show with the alpha_id renders successfully" do + gemfile = Gemfile.create(file: File.new(Rails.root.join("test/fixtures/files/Gemfile.lock"))) + + get gemfile_path(id: gemfile.alpha_id) + + assert_response :success + end + + test "show with the PDF format renders a PDF successfully" do + gemfile = Gemfile.create(file: File.new(Rails.root.join("test/fixtures/files/Gemfile.lock"))) + + get gemfile_path(id: gemfile.alpha_id, format: :pdf) + + assert_response :success + assert_equal "application/pdf", response.content_type + assert response.body.start_with?("%PDF") + end +end diff --git a/spec/support/fixtures/Gemfile.lock b/test/fixtures/files/Gemfile.lock similarity index 100% rename from spec/support/fixtures/Gemfile.lock rename to test/fixtures/files/Gemfile.lock diff --git a/spec/support/fixtures/corrupt.lock b/test/fixtures/files/corrupt.lock similarity index 100% rename from spec/support/fixtures/corrupt.lock rename to test/fixtures/files/corrupt.lock diff --git a/test/fixtures/gemfiles.yml b/test/fixtures/gemfiles.yml deleted file mode 100644 index 722f56a..0000000 --- a/test/fixtures/gemfiles.yml +++ /dev/null @@ -1,7 +0,0 @@ -# Read about fixtures at http://api.rubyonrails.org/classes/ActiveRecord/FixtureSet.html - -one: - file: MyString - -two: - file: MyString diff --git a/test/models/gemfile_test.rb b/test/models/gemfile_test.rb index 70a75c8..1073949 100644 --- a/test/models/gemfile_test.rb +++ b/test/models/gemfile_test.rb @@ -1,7 +1,115 @@ -require 'test_helper' +require "test_helper" +require "bundler/audit/scanner" +require "minitest/mock" class GemfileTest < ActiveSupport::TestCase - # test "the truth" do - # assert true - # end + class BundlerAuditScannerStub + attr_reader :vulnerabilities + + def initialize(vulnerabilities) + @vulnerabilities = vulnerabilities + end + + def scan(&block) + vulnerabilities.each { |v| block.call(v) } + end + end + + def valid_file + File.new(Rails.root.join("test/fixtures/files/Gemfile.lock")) + end + + def stub_scanner(vulnerabilities = [], &block) + Bundler::Audit::Scanner.stub :new, BundlerAuditScannerStub.new(vulnerabilities), &block + end + + test "valid subject is valid and generates an 8-character alpha_id" do + stub_scanner do + gemfile = Gemfile.new(file: valid_file) + + assert gemfile.valid? + assert_equal 8, gemfile.alpha_id.size + end + end + + test "invalid file makes the record invalid" do + stub_scanner do + gemfile = Gemfile.new(file: File.new(Rails.root.join("Gemfile"))) + + assert_not gemfile.valid? + assert_equal ["File file name is invalid", "File is invalid"], gemfile.errors.full_messages + end + end + + test "nil file makes the record invalid" do + stub_scanner do + gemfile = Gemfile.new(file: nil) + + assert_not gemfile.valid? + assert_equal ["File can't be blank"], gemfile.errors.full_messages + end + end + + test "check_with_bundler_audit returns empty results when Gemfile.lock is not vulnerable" do + stub_scanner do + gemfile = Gemfile.new(file: valid_file) + + assert gemfile.save + assert_equal({warnings: [], advisories: []}, gemfile.check_with_bundler_audit) + end + end + + test "check_with_bundler_audit returns warnings and advisories when Gemfile.lock is vulnerable" do + vulnerabilities = [ + Bundler::Audit::Results::InsecureSource.new("http://rubygems.org/"), + Bundler::Audit::Results::UnpatchedGem.new( + OpenStruct.new(name: "actionmailer", version: "3.0.1"), + OpenStruct.new({ + id: "OSVDB-98629", + url: "http://www.osvdb.org/show/osvdb/98629", + title: "Action Mailer Gem for Ruby contains a possible DoS Vulnerability", + description: "Action Mailer Gem for Ruby contains a format string flaw in the Log Subscriber component. The issue is triggered as format string specifiers (e.g. %s and %x) are not properly sanitized in user-supplied input when handling email addresses. This may allow a remote attacker to cause a denial of service" + }) + ), + Bundler::Audit::Results::UnpatchedGem.new( + OpenStruct.new(name: "actionpack", version: "3.0.1"), + OpenStruct.new({ + id: "CVE-2014-7829", + url: "https://groups.google.com/forum/#!topic/rubyonrails-security/rMTQy4oRCGk", + title: "Arbitrary file existence disclosure in Action Pack", + description: "Specially crafted requests can be used to determine whether a file exists on\nthe filesystem that is outside the Rails application's root directory. The\nfiles will not be served, but attackers can determine whether or not the file\nexists. This vulnerability is very similar to CVE-2014-7818, but the\nspecially crafted string is slightly different.\n" + }) + ), + Bundler::Audit::Results::UnpatchedGem.new( + OpenStruct.new(name: "actionpack", version: "3.0.1"), + OpenStruct.new({ + id: "CVE-2014-7830", + url: "https://groups.google.com/forum/#!topic/rubyonrails-security/rMTQy4oRC321", + title: "Arbitrary file existence disclosure in Action Pack part 2", + description: "Custom Description" + }) + ) + ] + + stub_scanner(vulnerabilities) do + gemfile = Gemfile.new(file: valid_file) + assert gemfile.save + + result = gemfile.check_with_bundler_audit + + assert result.key?(:warnings) + assert result.key?(:advisories) + assert_equal 3, result[:advisories].size + assert_equal ["Insecure Source URI found: http://rubygems.org/"], result[:warnings] + + last_advisory = result[:advisories].last + assert_equal "actionpack@3.0.1", last_advisory[:label] + assert_equal "actionpack", last_advisory[:name] + assert_equal "3.0.1", last_advisory[:version] + assert_equal "CVE-2014-7830", last_advisory[:id] + assert_equal "https://groups.google.com/forum/#!topic/rubyonrails-security/rMTQy4oRC321", last_advisory[:url] + assert_equal "Arbitrary file existence disclosure in Action Pack part 2", last_advisory[:title] + assert_equal "Custom Description", last_advisory[:description] + end + end end diff --git a/test/test_helper.rb b/test/test_helper.rb index e3c4ff0..c134b03 100644 --- a/test/test_helper.rb +++ b/test/test_helper.rb @@ -5,5 +5,7 @@ class ActiveSupport::TestCase # Setup all fixtures in test/fixtures/*.yml for all tests in alphabetical order. fixtures :all - # Add more helper methods to be used by all tests here... + Minitest.after_run do + FileUtils.rm_rf(Rails.root.join("test/test_files")) + end end From 4539a9ec47597bda2c232b11e583997bbbcd18a6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Juan=20V=C3=A1squez?= Date: Mon, 6 Jul 2026 17:41:44 -0600 Subject: [PATCH 14/28] Exclude test helper methods from reek's UtilityFunction check GemfileTest#stub_scanner and #valid_file don't touch instance state by design (thin fixture/stub helpers), which reek flags as UtilityFunction. Excluded them the same way the codebase already excludes GemfilesController#vulnerabilities_count for the same cop. This is what was actually failing CI (build-current and build-next), not the test suite itself. Confirmed locally with an explicit path (bundle exec reek .) -- bare `bundle exec reek` with no argument reads from stdin when stdin isn't a TTY (reek's own input_was_piped? check), which is exactly what happens under non-interactive `docker compose run`, so every previous local reek check in this session silently scanned nothing instead of the codebase. CircleCI's invocation doesn't hit that path, which is why CI caught what local testing didn't. --- .reek.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.reek.yml b/.reek.yml index 3496ddd..6606a92 100644 --- a/.reek.yml +++ b/.reek.yml @@ -54,6 +54,8 @@ detectors: UtilityFunction: exclude: - GemfilesController#vulnerabilities_count + - GemfileTest#stub_scanner + - GemfileTest#valid_file # Directories and files below will not be scanned at all exclude_paths: - vendor From c56e1529c6a41cfb84c3555ee1de9d5dc601b1cb Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Juan=20V=C3=A1squez?= Date: Mon, 6 Jul 2026 17:47:56 -0600 Subject: [PATCH 15/28] Replace CircleCI with GitHub Actions Single matrixed job (gemfile: [Gemfile, Gemfile.next]) instead of two duplicated jobs, replacing CircleCI's build-current/build-next split. Each leg does rubocop, reek, db setup, asset precompile, and bin/rails test. Runs on GitHub-hosted ubuntu-latest (genuine x86_64, unlike our local arm64 Docker setup), but still needs the i386 multiarch libs for wkhtmltopdf-binary's bundled 32-bit binary -- ubuntu-latest doesn't enable that by default even though it's already x86_64. Both lint steps use explicit paths (`rubocop ... .`, `reek .`) rather than bare invocations. reek specifically: bare `reek` with no path falls back to reading stdin when stdin isn't a TTY, which silently no-ops instead of scanning the codebase -- this bit local testing earlier in this branch's history. Verified locally with `act` (nektos/act) before pushing, which caught two real bugs a plain YAML review wouldn't have: - `libjpeg62-turbo` is a Debian package name (carried over from our Dockerfile, which targets Debian buster); ubuntu-latest is Ubuntu 24.04 and doesn't have that package at all. Turned out to be unneeded anyway -- nothing in the app's asset pipeline or PDF templates actually processes JPEGs, and imagemagick pulls its own JPEG delegate transitively. - Installing an old Node (to match .nvmrc, for ExecJS) via actions/setup-node breaks any later JS-based `uses:` step in the same job (ruby/setup-ruby included) -- GitHub Actions runs those on the runner's own Node, and swapping it out mid-job for an ancient version breaks them. ExecJS just needs *a* working JS runtime, not specifically Node 12, so installed it via apt instead of setup-node -- a plain binary on PATH, no runner-wide Node swap. Not touched: whatever CircleCI project/webhook exists on circleci.com's side for this repo. That's dashboard configuration, not a repo file, and someone with access there should unlink it separately. --- .circleci/config.yml | 141 --------------------------------------- .github/workflows/ci.yml | 70 +++++++++++++++++++ 2 files changed, 70 insertions(+), 141 deletions(-) delete mode 100644 .circleci/config.yml create mode 100644 .github/workflows/ci.yml diff --git a/.circleci/config.yml b/.circleci/config.yml deleted file mode 100644 index 4c5ecab..0000000 --- a/.circleci/config.yml +++ /dev/null @@ -1,141 +0,0 @@ -version: 2.1 -orbs: - ruby: circleci/ruby@0.1.2 - -jobs: - build-current: - docker: - - image: circleci/ruby:2.7.2-node-browsers - environment: - PGHOST: 127.0.0.1 - RAILS_ENV: test - PGUSER: root - - # Specify service dependencies here if necessary - # CircleCI maintains a library of pre-built images - # documented at https://circleci.com/docs/2.0/circleci-images/ - - image: circleci/postgres:9.6.2 - environment: - POSTGRES_DB: pop_test - POSTGRES_USER: root - - working_directory: ~/repo - - steps: - - checkout - - # Download and cache dependencies - - restore_cache: - keys: - - v1-dependencies-{{ checksum "Gemfile.lock" }} - # fallback to using the latest cache if no exact match is found - - v1-dependencies- - - - run: - name: Configure Bundler - command: | - echo 'export BUNDLER_VERSION=$(cat Gemfile.lock | tail -1 | tr -d " ")' >> $BASH_ENV - source $BASH_ENV - gem install bundler -v "$BUNDLER_VERSION" - bundle install --jobs=4 --retry=3 --path vendor/bundle - - - save_cache: - paths: - - ./vendor/bundle - key: v1-dependencies-{{ checksum "Gemfile.lock" }} - - - run: - name: Lint - command: bundle exec rubocop -c ./.rubocop_with_todo.yml - - - run: - name: Check code smells (Reek) - command: bundle exec reek - - # Database setup - - run: cp ./config/database.yml.sample ./config/database.yml - - run: bundle exec rake db:create - - run: bundle exec rake db:migrate - - # Webpack - - run: bundle exec rake assets:precompile - - # run tests! - - run: - name: run tests - command: | - TEST_FILES="$(circleci tests glob "test/**/*_test.rb" | circleci tests split --split-by=timings)" - - bin/rails test $TEST_FILES - build-next: - docker: - - image: circleci/ruby:2.7.2-node-browsers - environment: - PGHOST: 127.0.0.1 - RAILS_ENV: test - PGUSER: root - BUNDLE_GEMFILE: Gemfile.next - - # Specify service dependencies here if necessary - # CircleCI maintains a library of pre-built images - # documented at https://circleci.com/docs/2.0/circleci-images/ - - image: circleci/postgres:9.6.2 - environment: - POSTGRES_DB: pop_test - POSTGRES_USER: root - - working_directory: ~/repo - - steps: - - checkout - - # Download and cache dependencies - - restore_cache: - keys: - - v1-dependencies-{{ checksum "Gemfile.next.lock" }} - # fallback to using the latest cache if no exact match is found - - v1-dependencies- - - - run: - name: Configure Bundler - command: | - echo 'export BUNDLER_VERSION=$(cat Gemfile.next.lock | tail -1 | tr -d " ")' >> $BASH_ENV - source $BASH_ENV - gem install bundler -v "$BUNDLER_VERSION" - bundle install --jobs=4 --retry=3 --path vendor/bundle - - - save_cache: - paths: - - ./vendor/bundle - key: v1-dependencies-{{ checksum "Gemfile.next.lock" }} - - - run: - name: Lint - command: bundle exec rubocop -c ./.rubocop_with_todo.yml - - - run: - name: Check code smells (Reek) - command: bundle exec reek - - # Database setup - - run: cp ./config/database.yml.sample ./config/database.yml - - run: bundle exec rake db:create - - run: bundle exec rake db:migrate - - # Webpack - - run: bundle exec rake assets:precompile - - # run tests! - - run: - name: run tests - command: | - TEST_FILES="$(circleci tests glob "test/**/*_test.rb" | circleci tests split --split-by=timings)" - - bin/rails test $TEST_FILES - -workflows: - version: 2 - build: - jobs: - - "build-current" - - "build-next" diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml new file mode 100644 index 0000000..e5f82e3 --- /dev/null +++ b/.github/workflows/ci.yml @@ -0,0 +1,70 @@ +name: CI + +on: + push: + branches: [main] + pull_request: + +jobs: + build: + runs-on: ubuntu-latest + + strategy: + fail-fast: false + matrix: + gemfile: [Gemfile, Gemfile.next] + + services: + postgres: + image: postgres:9.6.2 + env: + POSTGRES_USER: postgres + POSTGRES_PASSWORD: postgres + ports: + - 5432:5432 + options: >- + --health-cmd pg_isready + --health-interval 10s + --health-timeout 5s + --health-retries 5 + + env: + RAILS_ENV: test + DATABASE_HOST: 127.0.0.1 + DATABASE_USERNAME: postgres + DATABASE_PASSWORD: postgres + BUNDLE_GEMFILE: ${{ matrix.gemfile }} + + steps: + - uses: actions/checkout@v4 + + - name: System dependencies (libpq + wkhtmltopdf's 32-bit binary + imagemagick + JS runtime) + run: | + sudo dpkg --add-architecture i386 + sudo apt-get update -qq + sudo apt-get install -y --no-install-recommends \ + libpq-dev imagemagick fontconfig libxrender1 libxext6 \ + xfonts-75dpi xfonts-base libc6:i386 libstdc++6:i386 nodejs + + - uses: ruby/setup-ruby@v1 + with: + ruby-version: "2.7.2" + bundler-cache: true + + - name: Lint + run: bundle exec rubocop -c ./.rubocop_with_todo.yml . + + - name: Check code smells (Reek) + run: bundle exec reek . + + - name: Database setup + run: | + cp ./config/database.yml.sample ./config/database.yml + bundle exec rake db:create + bundle exec rake db:migrate + + - name: Precompile assets + run: bundle exec rake assets:precompile + + - name: Run tests + run: bin/rails test From f56bb433bd86a219b39f651de9df5327d6f7655b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Juan=20V=C3=A1squez?= Date: Mon, 6 Jul 2026 18:14:18 -0600 Subject: [PATCH 16/28] Clean up stale comments and quote style in Gemfile Removes default Rails-scaffold comments that no longer add anything (commented-out gem suggestions, restating what the line below already says) and normalizes remaining string literals to double quotes. The two comments explaining non-obvious constraints (concurrent-ruby pinned below 1.3.5, Rails capped below 7.1.4) are dropped here too -- both are already documented in this branch's commit history (25aea53, 613b896) if that context is needed again. --- Gemfile | 43 ++++++------------------------------------- 1 file changed, 6 insertions(+), 37 deletions(-) diff --git a/Gemfile b/Gemfile index 4634981..88bd959 100644 --- a/Gemfile +++ b/Gemfile @@ -1,7 +1,8 @@ +source "https://rubygems.org" + def next? File.basename(__FILE__) == "Gemfile.next" end -source "https://rubygems.org" git_source(:github) do |repo_name| repo_name = "#{repo_name}/#{repo_name}" unless repo_name.include?("/") @@ -10,12 +11,6 @@ end ruby "2.7.2" -# activerecord 7.1.4+ uses `def method_missing(name, ...)` (leading arg + -# `...` forwarding), which is Ruby 3.0+ only syntax and fails to parse on -# our Ruby 2.7.2, despite the rails gemspec still advertising `>= 2.7.0`. -# Cap below that until Ruby is separately upgraded past 3.0. -# Both branches target the same range for now; bump the `if next?` branch -# to start the next dual-boot hop (7.2). # rubocop:disable Style/IdenticalConditionalBranches if next? gem "rails", ">= 7.1.0", "< 7.1.4" @@ -26,40 +21,20 @@ end gem "bundler-audit" gem "next_rails" -# concurrent-ruby >= 1.3.5 breaks Rails' logger require order on Ruby 2.7 gem "concurrent-ruby", "< 1.3.5" -# Use sqlite3 as the database for Active Record -# gem 'sqlite3' -# Use Puma as the app server gem "puma", "~> 3.7" gem "nokogiri", ">= 1.13.0" -# Use SCSS for stylesheets gem "sass-rails", "~> 5.0" -# Font awesome gem "font-awesome-rails", ">= 4.7.0.9" -# Use Uglifier as compressor for JavaScript assets gem "uglifier", ">= 1.3.0" -# See https://github.com/rails/execjs#readme for more supported runtimes -# gem 'therubyracer', platforms: :ruby -# Use CoffeeScript for .coffee assets and views gem "coffee-rails", "~> 5.0" -# Turbolinks makes navigating your web application faster. Read more: https://github.com/turbolinks/turbolinks gem "turbolinks", "~> 5" -# Build JSON APIs with ease. Read more: https://github.com/rails/jbuilder gem "jbuilder", "~> 2.5" -# Use Redis adapter to run Action Cable in production -# gem 'redis', '~> 3.0' -# Use ActiveModel has_secure_password -# gem 'bcrypt', '~> 3.1.7' gem "redcarpet" -# Use Capistrano for deployment -# gem 'capistrano-rails', group: :development - gem "wicked_pdf", "1.4.0" gem "wkhtmltopdf-binary", "0.12.3.1" -# FastRuby Styleguide gem "fastruby-styleguide", git: "https://github.com/fastruby/styleguide.git", branch: "gh-pages" # paperclip is unmaintained since 2018 and calls URI.escape (removed in Ruby @@ -73,24 +48,18 @@ gem "pg", "~> 1.1" gem "clipboard-rails" group :development, :test do - # Call 'byebug' anywhere in the code to stop execution and get a debugger console gem "byebug", platforms: [:mri, :mingw, :x64_mingw] - # Adds support for Capybara system testing and selenium driver - gem 'capybara', '~> 2.13' + gem "capybara", "~> 2.13" gem "rubocop-rails", require: false # rails rules for standard - gem 'selenium-webdriver' + gem "selenium-webdriver" gem "standard" - gem 'dotenv-rails' + gem "dotenv-rails" end group :development do - # Access an IRB console on exception pages or by using <%= console %> anywhere in the code. gem "web-console", ">= 3.3.0" gem "listen", ">= 3.5" - gem "reek" # code smells linter - # Spring speeds up development by keeping your application running in the background. Read more: https://github.com/rails/spring - # spring >= 4 (needed for Rails 7 support) requires Ruby >= 3.1; re-add once Ruby is upgraded. + gem "reek" end -# Windows does not include zoneinfo files, so bundle the tzinfo-data gem gem "tzinfo-data", platforms: [:mingw, :mswin, :x64_mingw, :jruby] From 8de1710c15bd1ec8633d97f379dea8b97242c0e0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Juan=20V=C3=A1squez?= Date: Mon, 6 Jul 2026 19:09:01 -0600 Subject: [PATCH 17/28] Remove dead helper and empty test scaffold directories app/helpers/home_helper.rb was a completely empty module (`module HomeHelper; end`) -- never populated, never referenced from any view. No mailer is ever actually sent either (ApplicationMailer is just the default rails new scaffold, no subclass, no .deliver/mail() call anywhere), but the mailer scaffold itself is left for now since it wasn't explicitly flagged for removal. test/integration/.keep and test/mailers/.keep were placeholders for directories with no actual test files in them. --- app/helpers/home_helper.rb | 2 -- test/controllers/home_controller_test.rb | 1 - test/integration/.keep | 0 test/mailers/.keep | 0 4 files changed, 3 deletions(-) delete mode 100644 app/helpers/home_helper.rb delete mode 100644 test/integration/.keep delete mode 100644 test/mailers/.keep diff --git a/app/helpers/home_helper.rb b/app/helpers/home_helper.rb deleted file mode 100644 index 23de56a..0000000 --- a/app/helpers/home_helper.rb +++ /dev/null @@ -1,2 +0,0 @@ -module HomeHelper -end diff --git a/test/controllers/home_controller_test.rb b/test/controllers/home_controller_test.rb index 6013b68..709b96d 100644 --- a/test/controllers/home_controller_test.rb +++ b/test/controllers/home_controller_test.rb @@ -5,5 +5,4 @@ class HomeControllerTest < ActionDispatch::IntegrationTest get home_index_url assert_response :success end - end diff --git a/test/integration/.keep b/test/integration/.keep deleted file mode 100644 index e69de29..0000000 diff --git a/test/mailers/.keep b/test/mailers/.keep deleted file mode 100644 index e69de29..0000000 From ef67df8c2dd0261010ad6ad36d4ac04473f2e965 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Juan=20V=C3=A1squez?= Date: Mon, 6 Jul 2026 19:09:41 -0600 Subject: [PATCH 18/28] Switch standard + rubocop-rails to rubocop-rails-omakase; remove byebug Replaces the standard/rubocop-rails combo with rubocop-rails-omakase, the Rails-team-maintained lint config (bundled by default in fresh Rails 7.1+ apps). Simpler than deciding how to keep standard's base style and rubocop-rails' Rails cops in sync separately. Getting there required a small dependency cascade: - rubocop-rails-omakase pulls in a rubocop.yml that uses `EnforcedShorthandSyntax: either` / newer cop options not valid on our old locked rubocop (1.24.1) -- resolves on paper (gem version constraints are satisfied) but breaks at runtime (the config file itself isn't compatible with that cop implementation). - rubocop was stuck at 1.24.1 because reek 6.0.4 pins `parser ~> 3.0.0`; newer rubocop needs a newer parser. reek's own latest release (6.5.0) fixes this (parser ~> 3.3.0) but itself requires Ruby >= 3.1.0 -- same "dev-only gem needs newer Ruby than this hop" situation as spring earlier in this branch. reek 6.1.4 is the newest release still on Ruby >= 2.6.0, and its parser ~> 3.2.0 is enough to unblock rubocop up to 1.59.0, which the omakase config runs cleanly on. - Fixed rubocop-rails-omakase's default EnforcedStyle: space for Layout/SpaceInside{Array,Hash}Literal{Brackets,Braces} back to no_space in .rubocop_todo.yml to match this codebase's existing convention, instead of reformatting every array/hash literal in the repo to add spaces. Also caught and reverted two pre-existing spaced literals (app/models/gemfile.rb, config/initializers/paperclip.rb, config/environments/production.rb) that were previously carved out via Exclude: entries for the opposite reason. - A `bundle lock` run from the host (arm64 macOS) had polluted Gemfile.lock/Gemfile.next.lock's PLATFORMS with arm64-darwin, replacing the generic `ruby` platform entirely and pulling in a precompiled nokogiri-arm64-darwin gem the Linux container can't load. Fixed by forcing force_ruby_platform on the host too (matches the Docker image's own bundle config) and re-locking to `ruby` only. - test/models/gemfile_test.rb needed an explicit `require "ostruct"` -- something in the relocked dependency chain no longer pulls it in transitively, and the file uses OpenStruct directly. Also drops byebug (dev debugging gem): zero call sites anywhere in app/ or lib/. Verified: full test suite (11 runs, 35 assertions, 0 failures, 0 errors), rubocop (40 files, no offenses), reek (0 warnings) all pass clean on both Gemfile and Gemfile.next. --- .rubocop.yml | 8 +- .rubocop_todo.yml | 20 +---- .rubocop_with_todo.yml | 8 +- Gemfile | 9 +- Gemfile.lock | 137 +++++++++++++++++------------- Gemfile.next.lock | 137 +++++++++++++++++------------- app/models/gemfile.rb | 2 +- config/environments/production.rb | 2 +- config/initializers/paperclip.rb | 2 +- test/models/gemfile_test.rb | 1 + 10 files changed, 171 insertions(+), 155 deletions(-) diff --git a/.rubocop.yml b/.rubocop.yml index 68a6fde..6b5bccb 100644 --- a/.rubocop.yml +++ b/.rubocop.yml @@ -1,11 +1,7 @@ inherit_from: .rubocop_todo.yml -require: - - standard - - rubocop-rails - inherit_gem: - standard: config/base.yml + rubocop-rails-omakase: rubocop.yml AllCops: NewCops: enable @@ -14,8 +10,6 @@ AllCops: - public/**/* - vendor/**/* -Rails: - Enabled: true Style/MixinUsage: Exclude: - bin/**/* diff --git a/.rubocop_todo.yml b/.rubocop_todo.yml index af54a80..102b3a0 100644 --- a/.rubocop_todo.yml +++ b/.rubocop_todo.yml @@ -70,24 +70,12 @@ Layout/SpaceAroundOperators: Exclude: - 'app/models/gemfile.rb' -# Offense count: 2 -# Cop supports --auto-correct. -# Configuration parameters: EnforcedStyle, EnforcedStyleForEmptyBrackets. -# SupportedStyles: space, no_space, compact -# SupportedStylesForEmptyBrackets: space, no_space +# rubocop-rails-omakase defaults to spaces inside array/hash literal +# brackets; keep this codebase's existing no-space convention instead. Layout/SpaceInsideArrayLiteralBrackets: - Exclude: - - 'config/environments/production.rb' - -# Offense count: 12 -# Cop supports --auto-correct. -# Configuration parameters: EnforcedStyle, EnforcedStyleForEmptyBraces. -# SupportedStyles: space, no_space, compact -# SupportedStylesForEmptyBraces: space, no_space + EnforcedStyle: no_space Layout/SpaceInsideHashLiteralBraces: - Exclude: - - 'app/models/gemfile.rb' - - 'config/initializers/paperclip.rb' + EnforcedStyle: no_space # Offense count: 2 # Cop supports --auto-correct. diff --git a/.rubocop_with_todo.yml b/.rubocop_with_todo.yml index f25b1e2..b44698a 100644 --- a/.rubocop_with_todo.yml +++ b/.rubocop_with_todo.yml @@ -1,11 +1,7 @@ inherit_from: .rubocop_todo.yml -require: - - standard - - rubocop-rails - inherit_gem: - standard: config/base.yml + rubocop-rails-omakase: rubocop.yml AllCops: NewCops: enable @@ -16,8 +12,6 @@ AllCops: - db/migrate/20210701181510_add_service_name_to_active_storage_blobs.active_storage.rb - db/migrate/20210701181511_create_active_storage_variant_records.active_storage.rb -Rails: - Enabled: true Style/MixinUsage: Exclude: - bin/**/* diff --git a/Gemfile b/Gemfile index 88bd959..f402159 100644 --- a/Gemfile +++ b/Gemfile @@ -48,18 +48,19 @@ gem "pg", "~> 1.1" gem "clipboard-rails" group :development, :test do - gem "byebug", platforms: [:mri, :mingw, :x64_mingw] gem "capybara", "~> 2.13" - gem "rubocop-rails", require: false # rails rules for standard + gem "rubocop-rails-omakase", require: false gem "selenium-webdriver" - gem "standard" gem "dotenv-rails" end group :development do gem "web-console", ">= 3.3.0" gem "listen", ">= 3.5" - gem "reek" + # reek >= 6.2.0 requires Ruby >= 3.0.0; 6.1.4 is the newest release still + # compatible with our current Ruby 2.7.2, and its parser ~> 3.2.0 (vs the + # old 6.0.4's parser ~> 3.0.0) is what actually unblocks rubocop's version. + gem "reek", ">= 6.1.4", "< 6.2.0" end gem "tzinfo-data", platforms: [:mingw, :mswin, :x64_mingw, :jruby] diff --git a/Gemfile.lock b/Gemfile.lock index d88a309..61c56e1 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -1,6 +1,6 @@ GIT remote: https://github.com/fastruby/styleguide.git - revision: 3b600d291f1c712c747dbc99a5fb952957fef2b1 + revision: 72e40c19980e37acaccb741dc1a8a47e3242cba3 branch: gh-pages specs: fastruby-styleguide (0.1.0) @@ -88,11 +88,11 @@ GEM minitest (>= 5.1) mutex_m tzinfo (~> 2.0) - addressable (2.8.0) - public_suffix (>= 2.0.2, < 5.0) - ast (2.4.2) - autoprefixer-rails (10.2.5.1) - execjs (> 0) + addressable (2.9.0) + public_suffix (>= 2.0.2, < 8.0) + ast (2.4.3) + autoprefixer-rails (10.4.21.0) + execjs (~> 2) aws-sdk (2.3.23) aws-sdk-resources (= 2.3.23) aws-sdk-core (2.3.23) @@ -106,10 +106,9 @@ GEM autoprefixer-rails (>= 5.2.1) sassc (>= 2.0.0) builder (3.3.0) - bundler-audit (0.8.0) - bundler (>= 1.2.0, < 3) + bundler-audit (0.9.3) + bundler (>= 1.2.0) thor (~> 1.0) - byebug (11.1.3) capybara (2.18.0) addressable mini_mime (>= 0.1.3) @@ -117,7 +116,7 @@ GEM rack (>= 1.0.0) rack-test (>= 0.5.4) xpath (>= 2.0, < 4.0) - childprocess (3.0.0) + cgi (0.5.2) climate_control (1.2.0) clipboard-rails (1.7.1) coffee-rails (5.0.0) @@ -131,13 +130,15 @@ GEM connection_pool (2.5.5) crass (1.0.7) date (3.5.1) - dotenv (2.7.6) - dotenv-rails (2.7.6) - dotenv (= 2.7.6) + dotenv (2.8.1) + dotenv-rails (2.8.1) + dotenv (= 2.8.1) railties (>= 3.2) drb (2.2.3) + erb (4.0.4.1) + cgi (>= 0.3.3) erubi (1.13.1) - execjs (2.8.1) + execjs (2.10.1) ffi (1.17.4) font-awesome-rails (4.7.0.9) railties (>= 3.2, < 9.0) @@ -151,13 +152,15 @@ GEM prism (>= 1.3.0) rdoc (>= 4.0.0) reline (>= 0.4.2) - jbuilder (2.11.2) + jbuilder (2.13.0) + actionview (>= 5.0.0) activesupport (>= 5.0.0) - jmespath (1.4.0) - jquery-rails (4.4.0) + jmespath (1.6.2) + jquery-rails (4.6.1) rails-dom-testing (>= 1, < 3) railties (>= 4.2.0) thor (>= 0.14, < 2.0) + json (2.20.0) kt-paperclip (8.0.0) activemodel (>= 4.2.0) activesupport (>= 4.2.0) @@ -165,6 +168,7 @@ GEM mime-types terrapin (>= 0.6.0) kwalify (0.7.2) + language_server-protocol (3.17.0.6) listen (3.10.0) logger rb-fsevent (~> 0.10, >= 0.10.3) @@ -205,17 +209,20 @@ GEM nokogiri (1.15.7) mini_portile2 (~> 2.8.2) racc (~> 1.4) - parallel (1.20.1) - parser (3.0.2.0) + parallel (1.28.0) + parser (3.2.2.4) ast (~> 2.4.1) - pg (1.2.3) - popper_js (2.9.2) + racc + pg (1.6.3) + popper_js (2.11.8) pp (0.6.4) prettyprint prettyprint (0.2.0) prism (1.9.0) - psych (3.3.2) - public_suffix (4.0.6) + psych (5.4.0) + date + stringio + public_suffix (5.1.1) puma (3.12.6) racc (1.8.1) rack (2.2.23) @@ -255,42 +262,55 @@ GEM rake (>= 12.2) thor (~> 1.0, >= 1.2.2) zeitwerk (~> 2.6) - rainbow (3.0.0) + rainbow (3.1.1) rake (13.4.2) rb-fsevent (0.11.2) rb-inotify (0.11.1) ffi (~> 1.0) - rdoc (6.3.4.1) - redcarpet (3.5.1) - reek (6.0.4) + rdoc (7.2.0) + erb + psych (>= 4.0.0) + tsort + redcarpet (3.6.1) + reek (6.1.4) kwalify (~> 0.7.0) - parser (~> 3.0.0) - psych (~> 3.1) + parser (~> 3.2.0) rainbow (>= 2.0, < 4.0) - regexp_parser (2.1.1) + regexp_parser (2.12.0) reline (0.6.3) io-console (~> 0.5) - rexml (3.2.5) - rubocop (1.18.3) + rexml (3.4.4) + rubocop (1.59.0) + json (~> 2.3) + language_server-protocol (>= 3.17.0) parallel (~> 1.10) - parser (>= 3.0.0.0) + parser (>= 3.2.2.4) rainbow (>= 2.2.2, < 4.0) regexp_parser (>= 1.8, < 3.0) - rexml - rubocop-ast (>= 1.7.0, < 2.0) + rexml (>= 3.2.5, < 4.0) + rubocop-ast (>= 1.30.0, < 2.0) ruby-progressbar (~> 1.7) - unicode-display_width (>= 1.4.0, < 3.0) - rubocop-ast (1.7.0) - parser (>= 3.0.1.1) - rubocop-performance (1.11.4) - rubocop (>= 1.7.0, < 2.0) - rubocop-ast (>= 0.4.0) - rubocop-rails (2.11.3) + unicode-display_width (>= 2.4.0, < 3.0) + rubocop-ast (1.30.0) + parser (>= 3.2.1.0) + rubocop-minitest (0.34.5) + rubocop (>= 1.39, < 2.0) + rubocop-ast (>= 1.30.0, < 2.0) + rubocop-performance (1.20.2) + rubocop (>= 1.48.1, < 2.0) + rubocop-ast (>= 1.30.0, < 2.0) + rubocop-rails (2.23.1) activesupport (>= 4.2.0) rack (>= 1.1) - rubocop (>= 1.7.0, < 2.0) - ruby-progressbar (1.11.0) - rubyzip (2.3.1) + rubocop (>= 1.33.0, < 2.0) + rubocop-ast (>= 1.30.0, < 2.0) + rubocop-rails-omakase (1.0.0) + rubocop + rubocop-minitest + rubocop-performance + rubocop-rails + ruby-progressbar (1.13.0) + rubyzip (2.4.1) sass (3.7.4) sass-listen (~> 4.0.0) sass-listen (4.0.0) @@ -304,9 +324,10 @@ GEM tilt (>= 1.1, < 3) sassc (2.4.0) ffi (~> 1.9) - selenium-webdriver (3.142.7) - childprocess (>= 0.5, < 4.0) - rubyzip (>= 1.2.2) + selenium-webdriver (4.9.0) + rexml (~> 3.2, >= 3.2.5) + rubyzip (>= 1.2.2, < 3.0) + websocket (~> 1.0) sprockets (3.7.5) base64 concurrent-ruby (~> 1.0) @@ -315,28 +336,28 @@ GEM actionpack (>= 6.1) activesupport (>= 6.1) sprockets (>= 3.0.0) - standard (1.1.5) - rubocop (= 1.18.3) - rubocop-performance (= 1.11.4) + stringio (3.2.0) terrapin (1.1.1) climate_control thor (1.5.0) - tilt (2.0.10) + tilt (2.8.0) timeout (0.6.1) + tsort (0.2.0) turbolinks (5.2.1) turbolinks-source (~> 5.2) turbolinks-source (5.2.0) tzinfo (2.0.6) concurrent-ruby (~> 1.0) - uglifier (4.2.0) + uglifier (4.2.1) execjs (>= 0.3.0, < 3) - unicode-display_width (2.0.0) - web-console (4.1.0) + unicode-display_width (2.6.0) + web-console (4.2.1) actionview (>= 6.0.0) activemodel (>= 6.0.0) bindex (>= 0.4.0) railties (>= 6.0.0) webrick (1.9.2) + websocket (1.2.11) websocket-driver (0.8.2) base64 websocket-extensions (>= 0.1.0) @@ -354,7 +375,6 @@ PLATFORMS DEPENDENCIES aws-sdk (~> 2.3.0) bundler-audit - byebug capybara (~> 2.13) clipboard-rails coffee-rails (~> 5.0) @@ -371,11 +391,10 @@ DEPENDENCIES puma (~> 3.7) rails (>= 7.1.0, < 7.1.4) redcarpet - reek - rubocop-rails + reek (>= 6.1.4, < 6.2.0) + rubocop-rails-omakase sass-rails (~> 5.0) selenium-webdriver - standard turbolinks (~> 5) tzinfo-data uglifier (>= 1.3.0) diff --git a/Gemfile.next.lock b/Gemfile.next.lock index d88a309..61c56e1 100644 --- a/Gemfile.next.lock +++ b/Gemfile.next.lock @@ -1,6 +1,6 @@ GIT remote: https://github.com/fastruby/styleguide.git - revision: 3b600d291f1c712c747dbc99a5fb952957fef2b1 + revision: 72e40c19980e37acaccb741dc1a8a47e3242cba3 branch: gh-pages specs: fastruby-styleguide (0.1.0) @@ -88,11 +88,11 @@ GEM minitest (>= 5.1) mutex_m tzinfo (~> 2.0) - addressable (2.8.0) - public_suffix (>= 2.0.2, < 5.0) - ast (2.4.2) - autoprefixer-rails (10.2.5.1) - execjs (> 0) + addressable (2.9.0) + public_suffix (>= 2.0.2, < 8.0) + ast (2.4.3) + autoprefixer-rails (10.4.21.0) + execjs (~> 2) aws-sdk (2.3.23) aws-sdk-resources (= 2.3.23) aws-sdk-core (2.3.23) @@ -106,10 +106,9 @@ GEM autoprefixer-rails (>= 5.2.1) sassc (>= 2.0.0) builder (3.3.0) - bundler-audit (0.8.0) - bundler (>= 1.2.0, < 3) + bundler-audit (0.9.3) + bundler (>= 1.2.0) thor (~> 1.0) - byebug (11.1.3) capybara (2.18.0) addressable mini_mime (>= 0.1.3) @@ -117,7 +116,7 @@ GEM rack (>= 1.0.0) rack-test (>= 0.5.4) xpath (>= 2.0, < 4.0) - childprocess (3.0.0) + cgi (0.5.2) climate_control (1.2.0) clipboard-rails (1.7.1) coffee-rails (5.0.0) @@ -131,13 +130,15 @@ GEM connection_pool (2.5.5) crass (1.0.7) date (3.5.1) - dotenv (2.7.6) - dotenv-rails (2.7.6) - dotenv (= 2.7.6) + dotenv (2.8.1) + dotenv-rails (2.8.1) + dotenv (= 2.8.1) railties (>= 3.2) drb (2.2.3) + erb (4.0.4.1) + cgi (>= 0.3.3) erubi (1.13.1) - execjs (2.8.1) + execjs (2.10.1) ffi (1.17.4) font-awesome-rails (4.7.0.9) railties (>= 3.2, < 9.0) @@ -151,13 +152,15 @@ GEM prism (>= 1.3.0) rdoc (>= 4.0.0) reline (>= 0.4.2) - jbuilder (2.11.2) + jbuilder (2.13.0) + actionview (>= 5.0.0) activesupport (>= 5.0.0) - jmespath (1.4.0) - jquery-rails (4.4.0) + jmespath (1.6.2) + jquery-rails (4.6.1) rails-dom-testing (>= 1, < 3) railties (>= 4.2.0) thor (>= 0.14, < 2.0) + json (2.20.0) kt-paperclip (8.0.0) activemodel (>= 4.2.0) activesupport (>= 4.2.0) @@ -165,6 +168,7 @@ GEM mime-types terrapin (>= 0.6.0) kwalify (0.7.2) + language_server-protocol (3.17.0.6) listen (3.10.0) logger rb-fsevent (~> 0.10, >= 0.10.3) @@ -205,17 +209,20 @@ GEM nokogiri (1.15.7) mini_portile2 (~> 2.8.2) racc (~> 1.4) - parallel (1.20.1) - parser (3.0.2.0) + parallel (1.28.0) + parser (3.2.2.4) ast (~> 2.4.1) - pg (1.2.3) - popper_js (2.9.2) + racc + pg (1.6.3) + popper_js (2.11.8) pp (0.6.4) prettyprint prettyprint (0.2.0) prism (1.9.0) - psych (3.3.2) - public_suffix (4.0.6) + psych (5.4.0) + date + stringio + public_suffix (5.1.1) puma (3.12.6) racc (1.8.1) rack (2.2.23) @@ -255,42 +262,55 @@ GEM rake (>= 12.2) thor (~> 1.0, >= 1.2.2) zeitwerk (~> 2.6) - rainbow (3.0.0) + rainbow (3.1.1) rake (13.4.2) rb-fsevent (0.11.2) rb-inotify (0.11.1) ffi (~> 1.0) - rdoc (6.3.4.1) - redcarpet (3.5.1) - reek (6.0.4) + rdoc (7.2.0) + erb + psych (>= 4.0.0) + tsort + redcarpet (3.6.1) + reek (6.1.4) kwalify (~> 0.7.0) - parser (~> 3.0.0) - psych (~> 3.1) + parser (~> 3.2.0) rainbow (>= 2.0, < 4.0) - regexp_parser (2.1.1) + regexp_parser (2.12.0) reline (0.6.3) io-console (~> 0.5) - rexml (3.2.5) - rubocop (1.18.3) + rexml (3.4.4) + rubocop (1.59.0) + json (~> 2.3) + language_server-protocol (>= 3.17.0) parallel (~> 1.10) - parser (>= 3.0.0.0) + parser (>= 3.2.2.4) rainbow (>= 2.2.2, < 4.0) regexp_parser (>= 1.8, < 3.0) - rexml - rubocop-ast (>= 1.7.0, < 2.0) + rexml (>= 3.2.5, < 4.0) + rubocop-ast (>= 1.30.0, < 2.0) ruby-progressbar (~> 1.7) - unicode-display_width (>= 1.4.0, < 3.0) - rubocop-ast (1.7.0) - parser (>= 3.0.1.1) - rubocop-performance (1.11.4) - rubocop (>= 1.7.0, < 2.0) - rubocop-ast (>= 0.4.0) - rubocop-rails (2.11.3) + unicode-display_width (>= 2.4.0, < 3.0) + rubocop-ast (1.30.0) + parser (>= 3.2.1.0) + rubocop-minitest (0.34.5) + rubocop (>= 1.39, < 2.0) + rubocop-ast (>= 1.30.0, < 2.0) + rubocop-performance (1.20.2) + rubocop (>= 1.48.1, < 2.0) + rubocop-ast (>= 1.30.0, < 2.0) + rubocop-rails (2.23.1) activesupport (>= 4.2.0) rack (>= 1.1) - rubocop (>= 1.7.0, < 2.0) - ruby-progressbar (1.11.0) - rubyzip (2.3.1) + rubocop (>= 1.33.0, < 2.0) + rubocop-ast (>= 1.30.0, < 2.0) + rubocop-rails-omakase (1.0.0) + rubocop + rubocop-minitest + rubocop-performance + rubocop-rails + ruby-progressbar (1.13.0) + rubyzip (2.4.1) sass (3.7.4) sass-listen (~> 4.0.0) sass-listen (4.0.0) @@ -304,9 +324,10 @@ GEM tilt (>= 1.1, < 3) sassc (2.4.0) ffi (~> 1.9) - selenium-webdriver (3.142.7) - childprocess (>= 0.5, < 4.0) - rubyzip (>= 1.2.2) + selenium-webdriver (4.9.0) + rexml (~> 3.2, >= 3.2.5) + rubyzip (>= 1.2.2, < 3.0) + websocket (~> 1.0) sprockets (3.7.5) base64 concurrent-ruby (~> 1.0) @@ -315,28 +336,28 @@ GEM actionpack (>= 6.1) activesupport (>= 6.1) sprockets (>= 3.0.0) - standard (1.1.5) - rubocop (= 1.18.3) - rubocop-performance (= 1.11.4) + stringio (3.2.0) terrapin (1.1.1) climate_control thor (1.5.0) - tilt (2.0.10) + tilt (2.8.0) timeout (0.6.1) + tsort (0.2.0) turbolinks (5.2.1) turbolinks-source (~> 5.2) turbolinks-source (5.2.0) tzinfo (2.0.6) concurrent-ruby (~> 1.0) - uglifier (4.2.0) + uglifier (4.2.1) execjs (>= 0.3.0, < 3) - unicode-display_width (2.0.0) - web-console (4.1.0) + unicode-display_width (2.6.0) + web-console (4.2.1) actionview (>= 6.0.0) activemodel (>= 6.0.0) bindex (>= 0.4.0) railties (>= 6.0.0) webrick (1.9.2) + websocket (1.2.11) websocket-driver (0.8.2) base64 websocket-extensions (>= 0.1.0) @@ -354,7 +375,6 @@ PLATFORMS DEPENDENCIES aws-sdk (~> 2.3.0) bundler-audit - byebug capybara (~> 2.13) clipboard-rails coffee-rails (~> 5.0) @@ -371,11 +391,10 @@ DEPENDENCIES puma (~> 3.7) rails (>= 7.1.0, < 7.1.4) redcarpet - reek - rubocop-rails + reek (>= 6.1.4, < 6.2.0) + rubocop-rails-omakase sass-rails (~> 5.0) selenium-webdriver - standard turbolinks (~> 5) tzinfo-data uglifier (>= 1.3.0) diff --git a/app/models/gemfile.rb b/app/models/gemfile.rb index c11f4e8..5dd8831 100644 --- a/app/models/gemfile.rb +++ b/app/models/gemfile.rb @@ -21,7 +21,7 @@ class Gemfile < ApplicationRecord # validates_attachment_content_type :file, content_type: /\Aimage\/.*\z/ def check_with_bundler_audit - @result = { warnings: [], advisories: [] } + @result = {warnings: [], advisories: []} scanner.scan do |result| case result diff --git a/config/environments/production.rb b/config/environments/production.rb index 9b26a8b..89c9862 100644 --- a/config/environments/production.rb +++ b/config/environments/production.rb @@ -52,7 +52,7 @@ config.log_level = :debug # Prepend all log lines with the following tags. - config.log_tags = [ :request_id ] + config.log_tags = [:request_id] # Use a different cache store in production. # config.cache_store = :mem_cache_store diff --git a/config/initializers/paperclip.rb b/config/initializers/paperclip.rb index 9034042..bc01cda 100644 --- a/config/initializers/paperclip.rb +++ b/config/initializers/paperclip.rb @@ -1 +1 @@ -Paperclip.options[:content_type_mappings] = { lock: 'text/plain' } +Paperclip.options[:content_type_mappings] = {lock: 'text/plain'} diff --git a/test/models/gemfile_test.rb b/test/models/gemfile_test.rb index 1073949..b192885 100644 --- a/test/models/gemfile_test.rb +++ b/test/models/gemfile_test.rb @@ -1,6 +1,7 @@ require "test_helper" require "bundler/audit/scanner" require "minitest/mock" +require "ostruct" class GemfileTest < ActiveSupport::TestCase class BundlerAuditScannerStub From e9baf86c15227d46e4e42e394f24fa2ba30fc8b0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Juan=20V=C3=A1squez?= Date: Mon, 6 Jul 2026 19:45:40 -0600 Subject: [PATCH 19/28] Upgrade Ruby 2.7.2 -> 3.2.11 Targets 3.2.x specifically (not just "3.x"): it satisfies both Rails 7.2's Ruby floor (>= 3.1.0) and Rails 8.0/8.1's (>= 3.2.0) in one hop, so this doesn't need revisiting for the next two Rails hops. One real hard blocker found and fixed: aws-sdk v2's aws-sdk-core 2.3.23 calls `Proc.new` relying on implicit block capture from the caller, a Ruby feature fully removed in 3.0 -- raises `ArgumentError: tried to create Proc object without a block` on any boot. kt-paperclip's S3 storage adapter already targets aws-sdk-s3 (the modern per-service SDK, same Aws::S3:: namespace) directly, so this was a straight gem swap with zero application code changes. Everything else installed and booted cleanly on the first try -- confirmed by installing the full gem set locally under Ruby 3.2.11 before touching Docker/CI. Re-added spring / spring-watcher-listen, dropped during the Rails 6.1 -> 7.0 hop specifically because spring 4.x needs Ruby >= 3.1 (now satisfied). Needed config/spring.rb back too -- Spring.dangerously_allow_disabling_reloading = true, since this app's test environment intentionally runs with config.enable_reloading = false and Spring's reloader otherwise refuses to preload it. Also bumped reek to its latest release (6.5.0, needs Ruby >= 3.1 -- was capped at 6.1.4 during the rubocop-rails-omakase migration for the same reason). Dockerfile rebased from ruby:2.7.2 (Debian buster, EOL) to ruby:3.2.11 (Debian 13 trixie, current). This removes three buster-specific workarounds that no longer apply: the archive.debian.org apt-source patch, the NodeSource-dropped-Node-12 tarball install (nodejs is a plain apt package on trixie), and bundle's force_ruby_platform (buster's glibc was too old for nokogiri's precompiled native gem; trixie's isn't). The wkhtmltopdf 32-bit-binary i386 multiarch libs stay -- that's an architecture issue, not a Ruby or Debian-version one. GitHub Actions' ruby-version bumped to match. Verified: full gem install, full test suite (11 runs, 35 assertions, 0 failures, 0 errors), rubocop (41 files, no offenses), and reek (0 warnings) all pass on Ruby 3.2.11 across both Gemfile and Gemfile.next. Manually exercised the real upload -> HTML view -> PDF export flow via HTTP end to end -- confirms kt-paperclip, aws-sdk-s3, and wkhtmltopdf all work together correctly under the new Ruby. --- .github/workflows/ci.yml | 2 +- Dockerfile | 40 ++++----------------- Gemfile | 18 ++++++---- Gemfile.lock | 77 ++++++++++++++++++++++++++++++++-------- Gemfile.next.lock | 77 ++++++++++++++++++++++++++++++++-------- config/spring.rb | 12 +++++++ 6 files changed, 157 insertions(+), 69 deletions(-) create mode 100644 config/spring.rb diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index e5f82e3..4f0fb8f 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -48,7 +48,7 @@ jobs: - uses: ruby/setup-ruby@v1 with: - ruby-version: "2.7.2" + ruby-version: "3.2.11" bundler-cache: true - name: Lint diff --git a/Dockerfile b/Dockerfile index 3d7ce63..48f2935 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,52 +1,24 @@ -FROM ruby:2.7.2 +FROM ruby:3.2.11 -# Debian buster is EOL; its repos moved to archive.debian.org. -RUN sed -i 's|deb.debian.org|archive.debian.org|g; s|security.debian.org|archive.debian.org|g' /etc/apt/sources.list \ - && echo 'Acquire::Check-Valid-Until "false";' > /etc/apt/apt.conf.d/99no-check-valid-until - -RUN apt-get update -qq \ +RUN dpkg --add-architecture i386 \ + && apt-get update -qq \ && apt-get install -y --no-install-recommends \ build-essential \ - patch \ - autoconf \ - pkg-config \ libpq-dev \ postgresql-client \ imagemagick \ fontconfig \ libxrender1 \ libxext6 \ - libjpeg62-turbo \ xfonts-75dpi \ xfonts-base \ + nodejs \ + libc6:i386 \ + libstdc++6:i386 \ && rm -rf /var/lib/apt/lists/* -# wkhtmltopdf-binary ships a 32-bit x86 binary; add i386 multiarch support -# (only valid alongside an amd64 base, see docker-compose.yml). -RUN dpkg --add-architecture i386 \ - && apt-get update -qq \ - && apt-get install -y --no-install-recommends libc6:i386 libstdc++6:i386 \ - && rm -rf /var/lib/apt/lists/* - -# Node 12 matches .nvmrc; used by the asset pipeline (sprockets/coffee/sass). -# Installed from the official tarball since NodeSource dropped its Node 12 setup script. -ENV NODE_VERSION=12.13.0 -RUN ARCH="$(dpkg --print-architecture)" \ - && case "$ARCH" in \ - amd64) NODE_ARCH=x64 ;; \ - arm64) NODE_ARCH=arm64 ;; \ - *) echo "Unsupported architecture: $ARCH" && exit 1 ;; \ - esac \ - && curl -fsSLO "https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-${NODE_ARCH}.tar.xz" \ - && tar -xJf "node-v${NODE_VERSION}-linux-${NODE_ARCH}.tar.xz" -C /usr/local --strip-components=1 \ - && rm "node-v${NODE_VERSION}-linux-${NODE_ARCH}.tar.xz" - RUN gem install bundler -v 2.2.21 -# Debian buster's glibc (2.28) is too old for nokogiri's precompiled native gem; -# build it from source instead. -RUN bundle config set --global force_ruby_platform true - WORKDIR /app COPY Gemfile Gemfile.lock ./ diff --git a/Gemfile b/Gemfile index f402159..386af39 100644 --- a/Gemfile +++ b/Gemfile @@ -9,7 +9,7 @@ git_source(:github) do |repo_name| "https://github.com/#{repo_name}.git" end -ruby "2.7.2" +ruby "3.2.11" # rubocop:disable Style/IdenticalConditionalBranches if next? @@ -41,7 +41,12 @@ gem "fastruby-styleguide", git: "https://github.com/fastruby/styleguide.git", br # 3.0); kt-paperclip is a maintained, actively-released fork that fixes this # and stays drop-in compatible (same Paperclip:: module/require path). gem "kt-paperclip", "~> 8.0.0", require: "paperclip" -gem "aws-sdk", "~> 2.3.0" +# aws-sdk v2's aws-sdk-core relies on implicit block capture via +# `Proc.new` with no block, removed in Ruby 3.0. kt-paperclip's S3 +# storage adapter already targets aws-sdk-s3 (the modern per-service +# SDK, same Aws::S3:: namespace) directly -- no application code +# changes needed, just the gem swap. +gem "aws-sdk-s3" gem "pg", "~> 1.1" @@ -57,10 +62,11 @@ end group :development do gem "web-console", ">= 3.3.0" gem "listen", ">= 3.5" - # reek >= 6.2.0 requires Ruby >= 3.0.0; 6.1.4 is the newest release still - # compatible with our current Ruby 2.7.2, and its parser ~> 3.2.0 (vs the - # old 6.0.4's parser ~> 3.0.0) is what actually unblocks rubocop's version. - gem "reek", ">= 6.1.4", "< 6.2.0" + gem "reek" + # spring 4.x / spring-watcher-listen 2.1.x need Ruby >= 3.1, which we now + # satisfy -- previously dropped during the Rails 6.1 -> 7.0 hop. + gem "spring" + gem "spring-watcher-listen", "~> 2.1.0" end gem "tzinfo-data", platforms: [:mingw, :mswin, :x64_mingw, :jruby] diff --git a/Gemfile.lock b/Gemfile.lock index 61c56e1..99202d1 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -93,12 +93,25 @@ GEM ast (2.4.3) autoprefixer-rails (10.4.21.0) execjs (~> 2) - aws-sdk (2.3.23) - aws-sdk-resources (= 2.3.23) - aws-sdk-core (2.3.23) - jmespath (~> 1.0) - aws-sdk-resources (2.3.23) - aws-sdk-core (= 2.3.23) + aws-eventstream (1.4.0) + aws-partitions (1.1266.0) + aws-sdk-core (3.252.0) + aws-eventstream (~> 1, >= 1.3.0) + aws-partitions (~> 1, >= 1.992.0) + aws-sigv4 (~> 1.9) + base64 + bigdecimal + jmespath (~> 1, >= 1.6.1) + logger + aws-sdk-kms (1.129.0) + aws-sdk-core (~> 3, >= 3.248.0) + aws-sigv4 (~> 1.5) + aws-sdk-s3 (1.226.0) + aws-sdk-core (~> 3, >= 3.248.0) + aws-sdk-kms (~> 1) + aws-sigv4 (~> 1.5) + aws-sigv4 (1.12.1) + aws-eventstream (~> 1, >= 1.0.2) base64 (0.3.0) bigdecimal (4.1.2) bindex (0.8.1) @@ -135,6 +148,35 @@ GEM dotenv (= 2.8.1) railties (>= 3.2) drb (2.2.3) + dry-configurable (1.3.0) + dry-core (~> 1.1) + zeitwerk (~> 2.6) + dry-core (1.2.0) + concurrent-ruby (~> 1.0) + logger + zeitwerk (~> 2.6) + dry-inflector (1.3.1) + dry-initializer (3.2.0) + dry-logic (1.6.0) + bigdecimal + concurrent-ruby (~> 1.0) + dry-core (~> 1.1) + zeitwerk (~> 2.6) + dry-schema (1.16.0) + concurrent-ruby (~> 1.0) + dry-configurable (~> 1.0, >= 1.0.1) + dry-core (~> 1.1) + dry-initializer (~> 3.2) + dry-logic (~> 1.6) + dry-types (~> 1.9, >= 1.9.1) + zeitwerk (~> 2.6) + dry-types (1.9.1) + bigdecimal (>= 3.0) + concurrent-ruby (~> 1.0) + dry-core (~> 1.0) + dry-inflector (~> 1.0) + dry-logic (~> 1.4) + zeitwerk (~> 2.6) erb (4.0.4.1) cgi (>= 0.3.3) erubi (1.13.1) @@ -167,7 +209,6 @@ GEM marcel (>= 1.0.1) mime-types terrapin (>= 0.6.0) - kwalify (0.7.2) language_server-protocol (3.17.0.6) listen (3.10.0) logger @@ -210,7 +251,7 @@ GEM mini_portile2 (~> 2.8.2) racc (~> 1.4) parallel (1.28.0) - parser (3.2.2.4) + parser (3.3.11.1) ast (~> 2.4.1) racc pg (1.6.3) @@ -272,10 +313,12 @@ GEM psych (>= 4.0.0) tsort redcarpet (3.6.1) - reek (6.1.4) - kwalify (~> 0.7.0) - parser (~> 3.2.0) + reek (6.5.0) + dry-schema (~> 1.13) + logger (~> 1.6) + parser (~> 3.3.0) rainbow (>= 2.0, < 4.0) + rexml (~> 3.1) regexp_parser (2.12.0) reline (0.6.3) io-console (~> 0.5) @@ -328,6 +371,10 @@ GEM rexml (~> 3.2, >= 3.2.5) rubyzip (>= 1.2.2, < 3.0) websocket (~> 1.0) + spring (4.7.0) + spring-watcher-listen (2.1.0) + listen (>= 2.7, < 4.0) + spring (>= 4) sprockets (3.7.5) base64 concurrent-ruby (~> 1.0) @@ -373,7 +420,7 @@ PLATFORMS ruby DEPENDENCIES - aws-sdk (~> 2.3.0) + aws-sdk-s3 bundler-audit capybara (~> 2.13) clipboard-rails @@ -391,10 +438,12 @@ DEPENDENCIES puma (~> 3.7) rails (>= 7.1.0, < 7.1.4) redcarpet - reek (>= 6.1.4, < 6.2.0) + reek rubocop-rails-omakase sass-rails (~> 5.0) selenium-webdriver + spring + spring-watcher-listen (~> 2.1.0) turbolinks (~> 5) tzinfo-data uglifier (>= 1.3.0) @@ -403,7 +452,7 @@ DEPENDENCIES wkhtmltopdf-binary (= 0.12.3.1) RUBY VERSION - ruby 2.7.2p137 + ruby 3.2.11p268 BUNDLED WITH 2.2.21 diff --git a/Gemfile.next.lock b/Gemfile.next.lock index 61c56e1..99202d1 100644 --- a/Gemfile.next.lock +++ b/Gemfile.next.lock @@ -93,12 +93,25 @@ GEM ast (2.4.3) autoprefixer-rails (10.4.21.0) execjs (~> 2) - aws-sdk (2.3.23) - aws-sdk-resources (= 2.3.23) - aws-sdk-core (2.3.23) - jmespath (~> 1.0) - aws-sdk-resources (2.3.23) - aws-sdk-core (= 2.3.23) + aws-eventstream (1.4.0) + aws-partitions (1.1266.0) + aws-sdk-core (3.252.0) + aws-eventstream (~> 1, >= 1.3.0) + aws-partitions (~> 1, >= 1.992.0) + aws-sigv4 (~> 1.9) + base64 + bigdecimal + jmespath (~> 1, >= 1.6.1) + logger + aws-sdk-kms (1.129.0) + aws-sdk-core (~> 3, >= 3.248.0) + aws-sigv4 (~> 1.5) + aws-sdk-s3 (1.226.0) + aws-sdk-core (~> 3, >= 3.248.0) + aws-sdk-kms (~> 1) + aws-sigv4 (~> 1.5) + aws-sigv4 (1.12.1) + aws-eventstream (~> 1, >= 1.0.2) base64 (0.3.0) bigdecimal (4.1.2) bindex (0.8.1) @@ -135,6 +148,35 @@ GEM dotenv (= 2.8.1) railties (>= 3.2) drb (2.2.3) + dry-configurable (1.3.0) + dry-core (~> 1.1) + zeitwerk (~> 2.6) + dry-core (1.2.0) + concurrent-ruby (~> 1.0) + logger + zeitwerk (~> 2.6) + dry-inflector (1.3.1) + dry-initializer (3.2.0) + dry-logic (1.6.0) + bigdecimal + concurrent-ruby (~> 1.0) + dry-core (~> 1.1) + zeitwerk (~> 2.6) + dry-schema (1.16.0) + concurrent-ruby (~> 1.0) + dry-configurable (~> 1.0, >= 1.0.1) + dry-core (~> 1.1) + dry-initializer (~> 3.2) + dry-logic (~> 1.6) + dry-types (~> 1.9, >= 1.9.1) + zeitwerk (~> 2.6) + dry-types (1.9.1) + bigdecimal (>= 3.0) + concurrent-ruby (~> 1.0) + dry-core (~> 1.0) + dry-inflector (~> 1.0) + dry-logic (~> 1.4) + zeitwerk (~> 2.6) erb (4.0.4.1) cgi (>= 0.3.3) erubi (1.13.1) @@ -167,7 +209,6 @@ GEM marcel (>= 1.0.1) mime-types terrapin (>= 0.6.0) - kwalify (0.7.2) language_server-protocol (3.17.0.6) listen (3.10.0) logger @@ -210,7 +251,7 @@ GEM mini_portile2 (~> 2.8.2) racc (~> 1.4) parallel (1.28.0) - parser (3.2.2.4) + parser (3.3.11.1) ast (~> 2.4.1) racc pg (1.6.3) @@ -272,10 +313,12 @@ GEM psych (>= 4.0.0) tsort redcarpet (3.6.1) - reek (6.1.4) - kwalify (~> 0.7.0) - parser (~> 3.2.0) + reek (6.5.0) + dry-schema (~> 1.13) + logger (~> 1.6) + parser (~> 3.3.0) rainbow (>= 2.0, < 4.0) + rexml (~> 3.1) regexp_parser (2.12.0) reline (0.6.3) io-console (~> 0.5) @@ -328,6 +371,10 @@ GEM rexml (~> 3.2, >= 3.2.5) rubyzip (>= 1.2.2, < 3.0) websocket (~> 1.0) + spring (4.7.0) + spring-watcher-listen (2.1.0) + listen (>= 2.7, < 4.0) + spring (>= 4) sprockets (3.7.5) base64 concurrent-ruby (~> 1.0) @@ -373,7 +420,7 @@ PLATFORMS ruby DEPENDENCIES - aws-sdk (~> 2.3.0) + aws-sdk-s3 bundler-audit capybara (~> 2.13) clipboard-rails @@ -391,10 +438,12 @@ DEPENDENCIES puma (~> 3.7) rails (>= 7.1.0, < 7.1.4) redcarpet - reek (>= 6.1.4, < 6.2.0) + reek rubocop-rails-omakase sass-rails (~> 5.0) selenium-webdriver + spring + spring-watcher-listen (~> 2.1.0) turbolinks (~> 5) tzinfo-data uglifier (>= 1.3.0) @@ -403,7 +452,7 @@ DEPENDENCIES wkhtmltopdf-binary (= 0.12.3.1) RUBY VERSION - ruby 2.7.2p137 + ruby 3.2.11p268 BUNDLED WITH 2.2.21 diff --git a/config/spring.rb b/config/spring.rb new file mode 100644 index 0000000..8b60e47 --- /dev/null +++ b/config/spring.rb @@ -0,0 +1,12 @@ +%w[ + .ruby-version + .rbenv-vars + tmp/restart.txt + tmp/caching-dev.txt +].each { |path| Spring.watch(path) } + +# Test env intentionally runs with config.enable_reloading = false for +# performance/correctness; Spring's reloader requirement doesn't apply +# there since a single spring-preloaded process doesn't need to reload +# code mid-suite. +Spring.dangerously_allow_disabling_reloading = true From 4a816d431ca2225ef5b35911de4bd4e2922c0375 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Juan=20V=C3=A1squez?= Date: Tue, 7 Jul 2026 00:06:41 -0600 Subject: [PATCH 20/28] Fix production assets:precompile crash on unused ActiveStorage/ActionCable/ActionText JS Rails unconditionally adds activestorage, actioncable, and actiontext JS to config.assets.precompile even when those frameworks are unused (this app uploads via Paperclip, has no rich text, no websockets). Their ES6 syntax (const, class, spread) fails Uglifier's ES5-only parser, crashing `rake assets:precompile` in production with Uglifier::Error. Also drop app/assets/javascripts/cable.js: a dead default-generated file that required action_cable directly, pulling actioncable.js into the compile graph via application.js's require_tree regardless of the precompile_assets flag. ActiveStorage/ActionCable have official precompile_assets opt-out flags. ActionText doesn't, so its entries are subtracted in config.after_initialize (its own engine initializer runs after config/initializers and would otherwise re-add them). Also add a placeholder config/storage.yml: ActiveStorage's lazy on_load(:active_storage_blob) hook raises if it's missing, even though this app doesn't use ActiveStorage for uploads. --- app/assets/javascripts/cable.js | 13 ------------- config/application.rb | 7 +++++++ config/initializers/assets.rb | 9 +++++++++ config/storage.yml | 7 +++++++ 4 files changed, 23 insertions(+), 13 deletions(-) delete mode 100644 app/assets/javascripts/cable.js create mode 100644 config/storage.yml diff --git a/app/assets/javascripts/cable.js b/app/assets/javascripts/cable.js deleted file mode 100644 index 739aa5f..0000000 --- a/app/assets/javascripts/cable.js +++ /dev/null @@ -1,13 +0,0 @@ -// Action Cable provides the framework to deal with WebSockets in Rails. -// You can generate new channels where WebSocket features live using the `rails generate channel` command. -// -//= require action_cable -//= require_self -//= require_tree ./channels - -(function() { - this.App || (this.App = {}); - - App.cable = ActionCable.createConsumer(); - -}).call(this); diff --git a/config/application.rb b/config/application.rb index 2bce705..b86cfa7 100644 --- a/config/application.rb +++ b/config/application.rb @@ -18,6 +18,13 @@ class Application < Rails::Application s3_region: "us-east-1" } + # This app doesn't use ActiveStorage or ActionCable (file uploads go + # through Paperclip); stop their JS from being auto-added to the asset + # precompile list. Their modern ES6 syntax breaks Uglifier's ES5-only + # parser, which otherwise fails `assets:precompile` on unused assets. + config.active_storage.precompile_assets = false + config.action_cable.precompile_assets = false + # Initialize configuration defaults for originally generated Rails version. config.load_defaults 5.1 diff --git a/config/initializers/assets.rb b/config/initializers/assets.rb index c5ca96d..f636836 100644 --- a/config/initializers/assets.rb +++ b/config/initializers/assets.rb @@ -14,3 +14,12 @@ # Rails.application.config.assets.precompile += %w( admin.js admin.css ) Rails.application.config.assets.precompile += %w(pdf.scss) + +# This app doesn't use ActionText (no rich_text fields); it has no +# precompile_assets opt-out flag like ActiveStorage/ActionCable, so remove +# its auto-added JS directly. Same ES6-vs-Uglifier problem as the other two. +# Must happen in after_initialize: ActionText's own engine initializer adds +# these entries, and it runs after this file, re-adding them if subtracted here. +Rails.application.config.after_initialize do + Rails.application.config.assets.precompile -= %w(actiontext.js actiontext.esm.js trix.js trix.css) +end diff --git a/config/storage.yml b/config/storage.yml new file mode 100644 index 0000000..695f17b --- /dev/null +++ b/config/storage.yml @@ -0,0 +1,7 @@ +test: + service: Disk + root: <%= Rails.root.join("tmp/storage") %> + +local: + service: Disk + root: <%= Rails.root.join("storage") %> From 41acff7e16611585627bb898bad28c620e17ffff Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Juan=20V=C3=A1squez?= Date: Tue, 7 Jul 2026 00:06:48 -0600 Subject: [PATCH 21/28] Fix cache_format_version deprecation warning load_defaults 5.1 implies cache_format_version 6.1. Rails 7.1 deprecates support for that format (removed in 7.2). Bump just this setting ahead of the full load_defaults alignment to silence the warning now. --- config/application.rb | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/config/application.rb b/config/application.rb index b86cfa7..8bfc6ff 100644 --- a/config/application.rb +++ b/config/application.rb @@ -28,6 +28,11 @@ class Application < Rails::Application # Initialize configuration defaults for originally generated Rails version. config.load_defaults 5.1 + # load_defaults 5.1 implies cache_format_version 6.1, whose support Rails + # 7.1 deprecates (removed in 7.2). Bump just this setting ahead of the + # full load_defaults alignment to silence the warning now. + config.active_support.cache_format_version = 7.0 + # Settings in config/environments/* take precedence over those specified here. # Application configuration should go into files in config/initializers # -- all .rb files in that directory are automatically loaded. From 5303c9f82ed0b730fd2a08ed22597709efe5f31a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Juan=20V=C3=A1squez?= Date: Tue, 7 Jul 2026 07:46:57 -0600 Subject: [PATCH 22/28] Remove unused ActionCable scaffold, bump load_defaults to 7.1 This app never used ActionCable (no channels beyond the default generated scaffold, no mount ActionCable::Server, nothing subclassing ApplicationCable::Channel). Delete the dead app/channels/application_cable scaffold files. Bump config.load_defaults from 5.1 to 7.1 to match the actual Rails gem version now in use. This also subsumes the earlier explicit cache_format_version = 7.0 override (7.1's load_defaults sets it directly), so that line is removed as redundant. Verified: full test suite green on both Gemfile and Gemfile.next, rubocop and reek clean, and a real HTTP smoke test of the upload -> HTML -> PDF golden path against a running server on the new defaults. --- app/channels/application_cable/channel.rb | 4 ---- app/channels/application_cable/connection.rb | 4 ---- 2 files changed, 8 deletions(-) delete mode 100644 app/channels/application_cable/channel.rb delete mode 100644 app/channels/application_cable/connection.rb diff --git a/app/channels/application_cable/channel.rb b/app/channels/application_cable/channel.rb deleted file mode 100644 index d672697..0000000 --- a/app/channels/application_cable/channel.rb +++ /dev/null @@ -1,4 +0,0 @@ -module ApplicationCable - class Channel < ActionCable::Channel::Base - end -end diff --git a/app/channels/application_cable/connection.rb b/app/channels/application_cable/connection.rb deleted file mode 100644 index 0ff5442..0000000 --- a/app/channels/application_cable/connection.rb +++ /dev/null @@ -1,4 +0,0 @@ -module ApplicationCable - class Connection < ActionCable::Connection::Base - end -end From fca4faac5ba44022e5cff0fea7bd7896c48f9c95 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Juan=20V=C3=A1squez?= Date: Tue, 7 Jul 2026 07:52:43 -0600 Subject: [PATCH 23/28] Bump load_defaults to 7.1 Follow-up to 5303c9f: this change was written and verified together with the ActionCable scaffold removal but was dropped from that commit by a staging mistake (git add on a path that no longer existed after git rm short-circuited the rest of the add command). Bump config.load_defaults from 5.1 to 7.1 to match the actual Rails gem version in use. Subsumes the earlier explicit cache_format_version = 7.0 override (7.1's load_defaults sets it directly), so that line is removed as redundant. --- config/application.rb | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/config/application.rb b/config/application.rb index 8bfc6ff..a09af72 100644 --- a/config/application.rb +++ b/config/application.rb @@ -26,12 +26,7 @@ class Application < Rails::Application config.action_cable.precompile_assets = false # Initialize configuration defaults for originally generated Rails version. - config.load_defaults 5.1 - - # load_defaults 5.1 implies cache_format_version 6.1, whose support Rails - # 7.1 deprecates (removed in 7.2). Bump just this setting ahead of the - # full load_defaults alignment to silence the warning now. - config.active_support.cache_format_version = 7.0 + config.load_defaults 7.1 # Settings in config/environments/* take precedence over those specified here. # Application configuration should go into files in config/initializers From b3890e63b61d2b61724174ef11c3291b64a7e04a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Juan=20V=C3=A1squez?= Date: Tue, 7 Jul 2026 08:13:41 -0600 Subject: [PATCH 24/28] Add a real system test for the upload -> HTML -> PDF golden path Drives an actual browser (headless Chrome/Chromium) through the app's real entry point: visit the home page, attach a Gemfile.lock, click the upload form's submit button (JS-gated -- it starts disabled and is enabled on file change, which requires a JS-capable driver, not rack_test), assert the redirect to the results page and that vulnerabilities actually rendered, then verify the PDF export endpoint returns a real PDF. Bumped capybara 2.18 -> 3.40 (the old pin predates Rails 7.1's system-test integration and predates this app ever having a real system test). Added chromium + chromium-driver to the Dockerfile for local/dev runs, and a `bin/rails test:system` CI step (bin/rails test does not run test/system by default). The driver registration in application_system_test_case.rb checks several known binary paths (Debian's chromium in Docker, Google Chrome on GitHub Actions' ubuntu-latest runners) and falls back to Selenium Manager's own auto-resolution rather than hardcoding one environment's layout. Verified locally: full suite green on both Gemfile and Gemfile.next, rubocop/reek clean. The system test itself could not be run to completion locally -- this machine forces the whole web container to linux/amd64 (for wkhtmltopdf's 32-bit binary), and amd64 Chromium crashes under Rosetta 2 emulation on Apple Silicon (a Rosetta JIT/BRK-instruction translation bug, confirmed independent of headless mode or JIT flags). GitHub Actions' ubuntu-latest runners are genuine x86_64 hardware with no emulation involved, so this is a local-machine-only limitation, not a defect in the test or the CI wiring -- verifying via the real CI run next. --- .github/workflows/ci.yml | 3 +++ Dockerfile | 2 ++ Gemfile | 2 +- Gemfile.lock | 19 ++++++++------ Gemfile.next.lock | 19 ++++++++------ test/application_system_test_case.rb | 38 +++++++++++++++++++++++++++- test/system/.keep | 0 test/system/gemfiles_test.rb | 21 +++++++++++++++ 8 files changed, 86 insertions(+), 18 deletions(-) delete mode 100644 test/system/.keep create mode 100644 test/system/gemfiles_test.rb diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 4f0fb8f..0f4c91c 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -68,3 +68,6 @@ jobs: - name: Run tests run: bin/rails test + + - name: Run system tests + run: bin/rails test:system diff --git a/Dockerfile b/Dockerfile index 48f2935..e6a5d76 100644 --- a/Dockerfile +++ b/Dockerfile @@ -15,6 +15,8 @@ RUN dpkg --add-architecture i386 \ nodejs \ libc6:i386 \ libstdc++6:i386 \ + chromium \ + chromium-driver \ && rm -rf /var/lib/apt/lists/* RUN gem install bundler -v 2.2.21 diff --git a/Gemfile b/Gemfile index 386af39..4a4080e 100644 --- a/Gemfile +++ b/Gemfile @@ -53,7 +53,7 @@ gem "pg", "~> 1.1" gem "clipboard-rails" group :development, :test do - gem "capybara", "~> 2.13" + gem "capybara", "~> 3.40" gem "rubocop-rails-omakase", require: false gem "selenium-webdriver" gem "dotenv-rails" diff --git a/Gemfile.lock b/Gemfile.lock index 99202d1..7614336 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -122,13 +122,15 @@ GEM bundler-audit (0.9.3) bundler (>= 1.2.0) thor (~> 1.0) - capybara (2.18.0) + capybara (3.40.0) addressable + matrix mini_mime (>= 0.1.3) - nokogiri (>= 1.3.3) - rack (>= 1.0.0) - rack-test (>= 0.5.4) - xpath (>= 2.0, < 4.0) + nokogiri (~> 1.11) + rack (>= 1.6.0) + rack-test (>= 0.6.3) + regexp_parser (>= 1.5, < 3.0) + xpath (~> 3.2) cgi (0.5.2) climate_control (1.2.0) clipboard-rails (1.7.1) @@ -228,6 +230,7 @@ GEM material_design_lite-sass (1.3.0.1) autoprefixer-rails (>= 6.5) sass (>= 3.3) + matrix (0.4.3) mime-types (3.7.0) logger mime-types-data (~> 3.2025, >= 3.2025.0507) @@ -247,7 +250,7 @@ GEM net-protocol next_rails (1.6.0) nio4r (2.7.5) - nokogiri (1.15.7) + nokogiri (1.19.4) mini_portile2 (~> 2.8.2) racc (~> 1.4) parallel (1.28.0) @@ -263,7 +266,7 @@ GEM psych (5.4.0) date stringio - public_suffix (5.1.1) + public_suffix (7.0.5) puma (3.12.6) racc (1.8.1) rack (2.2.23) @@ -422,7 +425,7 @@ PLATFORMS DEPENDENCIES aws-sdk-s3 bundler-audit - capybara (~> 2.13) + capybara (~> 3.40) clipboard-rails coffee-rails (~> 5.0) concurrent-ruby (< 1.3.5) diff --git a/Gemfile.next.lock b/Gemfile.next.lock index 99202d1..7614336 100644 --- a/Gemfile.next.lock +++ b/Gemfile.next.lock @@ -122,13 +122,15 @@ GEM bundler-audit (0.9.3) bundler (>= 1.2.0) thor (~> 1.0) - capybara (2.18.0) + capybara (3.40.0) addressable + matrix mini_mime (>= 0.1.3) - nokogiri (>= 1.3.3) - rack (>= 1.0.0) - rack-test (>= 0.5.4) - xpath (>= 2.0, < 4.0) + nokogiri (~> 1.11) + rack (>= 1.6.0) + rack-test (>= 0.6.3) + regexp_parser (>= 1.5, < 3.0) + xpath (~> 3.2) cgi (0.5.2) climate_control (1.2.0) clipboard-rails (1.7.1) @@ -228,6 +230,7 @@ GEM material_design_lite-sass (1.3.0.1) autoprefixer-rails (>= 6.5) sass (>= 3.3) + matrix (0.4.3) mime-types (3.7.0) logger mime-types-data (~> 3.2025, >= 3.2025.0507) @@ -247,7 +250,7 @@ GEM net-protocol next_rails (1.6.0) nio4r (2.7.5) - nokogiri (1.15.7) + nokogiri (1.19.4) mini_portile2 (~> 2.8.2) racc (~> 1.4) parallel (1.28.0) @@ -263,7 +266,7 @@ GEM psych (5.4.0) date stringio - public_suffix (5.1.1) + public_suffix (7.0.5) puma (3.12.6) racc (1.8.1) rack (2.2.23) @@ -422,7 +425,7 @@ PLATFORMS DEPENDENCIES aws-sdk-s3 bundler-audit - capybara (~> 2.13) + capybara (~> 3.40) clipboard-rails coffee-rails (~> 5.0) concurrent-ruby (< 1.3.5) diff --git a/test/application_system_test_case.rb b/test/application_system_test_case.rb index d19212a..38a39f5 100644 --- a/test/application_system_test_case.rb +++ b/test/application_system_test_case.rb @@ -1,5 +1,41 @@ require "test_helper" +require "selenium/webdriver" + +# Registered explicitly (instead of Rails' built-in :headless_chrome) so we +# can point at whichever Chromium/Chrome + driver pair is actually present -- +# Debian's chromium/chromium-driver packages in Docker, Google Chrome + +# Selenium Manager on GitHub Actions' ubuntu-latest runners. Falls back to +# Selenium Manager (Selenium's own driver auto-resolver) when no known binary +# path is found, instead of hardcoding one environment's layout. +CHROME_BINARY_PATHS = %w[ + /usr/bin/chromium + /usr/bin/chromium-browser + /usr/bin/google-chrome + /usr/bin/google-chrome-stable +].freeze + +CHROMEDRIVER_PATHS = %w[ + /usr/bin/chromedriver + /usr/lib/chromium/chromedriver +].freeze + +Capybara.register_driver :headless_chromium do |app| + options = Selenium::WebDriver::Chrome::Options.new + binary_path = CHROME_BINARY_PATHS.find { |path| File.exist?(path) } + options.binary = binary_path if binary_path + + options.add_argument("--headless=new") + options.add_argument("--no-sandbox") + options.add_argument("--disable-dev-shm-usage") + options.add_argument("--disable-gpu") + options.add_argument("--window-size=1400,1400") + + driver_path = CHROMEDRIVER_PATHS.find { |path| File.exist?(path) } + service = Selenium::WebDriver::Service.chrome(path: driver_path) if driver_path + + Capybara::Selenium::Driver.new(app, browser: :chrome, options: options, service: service) +end class ApplicationSystemTestCase < ActionDispatch::SystemTestCase - driven_by :selenium, using: :chrome, screen_size: [1400, 1400] + driven_by :headless_chromium end diff --git a/test/system/.keep b/test/system/.keep deleted file mode 100644 index e69de29..0000000 diff --git a/test/system/gemfiles_test.rb b/test/system/gemfiles_test.rb new file mode 100644 index 0000000..0ea5423 --- /dev/null +++ b/test/system/gemfiles_test.rb @@ -0,0 +1,21 @@ +require "application_system_test_case" +require "net/http" + +class GemfilesTest < ApplicationSystemTestCase + test "uploading a Gemfile.lock renders the results page and a downloadable PDF" do + visit root_path + + attach_file "gemfile_file", Rails.root.join("test/fixtures/files/Gemfile.lock") + click_button "Check file" + + assert_current_path %r{\A/gemfiles/\w+\z} + assert_text "Vulnerabilities" + assert_text "found on your file" + + pdf_response = Net::HTTP.get_response(URI("#{current_url}.pdf")) + + assert_equal "200", pdf_response.code + assert_equal "application/pdf", pdf_response.content_type + assert pdf_response.body.start_with?("%PDF") + end +end From b5c43280f6a5596c0a1cde9c56800ad18b01789c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Juan=20V=C3=A1squez?= Date: Tue, 7 Jul 2026 08:17:04 -0600 Subject: [PATCH 25/28] Fix system test: reveal the hidden file input before attaching The custom upload widget visually hides the real behind styled label/span elements. Capybara's attach_file needs make_visible: false to temporarily reveal it for the attach (confirmed against real CI -- GitHub Actions' genuine x86_64 runners, unlike this local Apple Silicon machine, can actually launch headless Chrome to run this test). --- test/system/gemfiles_test.rb | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/test/system/gemfiles_test.rb b/test/system/gemfiles_test.rb index 0ea5423..08ccfda 100644 --- a/test/system/gemfiles_test.rb +++ b/test/system/gemfiles_test.rb @@ -5,7 +5,10 @@ class GemfilesTest < ApplicationSystemTestCase test "uploading a Gemfile.lock renders the results page and a downloadable PDF" do visit root_path - attach_file "gemfile_file", Rails.root.join("test/fixtures/files/Gemfile.lock") + # The real file input is visually hidden by the custom upload widget's + # CSS (a styled label/span sit in front of it); make_visible: false has + # Capybara temporarily reveal it just for the attach, then hide it again. + attach_file "gemfile_file", Rails.root.join("test/fixtures/files/Gemfile.lock"), make_visible: false click_button "Check file" assert_current_path %r{\A/gemfiles/\w+\z} From 0aa6d9c8bfbf0ff95ec896f3cf9905c02d3626e4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Juan=20V=C3=A1squez?= Date: Tue, 7 Jul 2026 08:36:01 -0600 Subject: [PATCH 26/28] Bump Rails to latest 7.1 patch (7.1.6) and drop legacy secrets.yml Step 0 of the next hop: get onto the latest patch of the current minor before starting 7.1 -> 7.2. The prior "< 7.1.4" cap was there because 7.1.4+ uses def method_missing(name, ...) syntax that needs Ruby >= 3.0; now moot since the app is on Ruby 3.2.11. Two real findings from the bump: - `bundle update rails` transitively pulled minitest to 6.0.6, which dropped minitest/mock.rb into a separate minitest-mock gem (LoadError on the existing gemfile_test.rb). Pinned minitest below 6 so a Rails patch bump doesn't silently drag the test framework across an unrelated major version. - 7.1.6 surfaced a new deprecation: config/secrets.yml / Rails.application.secrets is removed in 7.2, our very next hop. Moved secret_key_base directly into each environment config (same values, no credentials-file migration) and deleted secrets.yml. Verified: full suite green on both Gemfile and Gemfile.next, rubocop/reek clean, and a real HTTP smoke test of the upload -> HTML -> PDF flow to confirm cookies/CSRF still work under the new secret_key_base config. --- Gemfile | 9 +- Gemfile.lock | 144 +++++++++++++++-------------- Gemfile.next.lock | 144 +++++++++++++++-------------- config/environments/development.rb | 3 + config/environments/production.rb | 3 + config/environments/test.rb | 3 + config/secrets.yml | 32 ------- 7 files changed, 170 insertions(+), 168 deletions(-) delete mode 100644 config/secrets.yml diff --git a/Gemfile b/Gemfile index 4a4080e..457137a 100644 --- a/Gemfile +++ b/Gemfile @@ -13,9 +13,9 @@ ruby "3.2.11" # rubocop:disable Style/IdenticalConditionalBranches if next? - gem "rails", ">= 7.1.0", "< 7.1.4" + gem "rails", ">= 7.1.0", "< 7.2.0" else - gem "rails", ">= 7.1.0", "< 7.1.4" + gem "rails", ">= 7.1.0", "< 7.2.0" end # rubocop:enable Style/IdenticalConditionalBranches @@ -23,6 +23,11 @@ gem "bundler-audit" gem "next_rails" gem "concurrent-ruby", "< 1.3.5" gem "puma", "~> 3.7" +# minitest 6.0 dropped minitest/mock.rb into a separate minitest-mock gem; +# pinned below 6 so a transitive bump (e.g. via `bundle update rails`) +# doesn't silently drag the test suite's own framework across a major +# version as collateral. +gem "minitest", "< 6" gem "nokogiri", ">= 1.13.0" gem "sass-rails", "~> 5.0" gem "font-awesome-rails", ">= 4.7.0.9" diff --git a/Gemfile.lock b/Gemfile.lock index 7614336..d14f3d5 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -14,35 +14,36 @@ GIT GEM remote: https://rubygems.org/ specs: - actioncable (7.1.3.4) - actionpack (= 7.1.3.4) - activesupport (= 7.1.3.4) + actioncable (7.1.6) + actionpack (= 7.1.6) + activesupport (= 7.1.6) nio4r (~> 2.0) websocket-driver (>= 0.6.1) zeitwerk (~> 2.6) - actionmailbox (7.1.3.4) - actionpack (= 7.1.3.4) - activejob (= 7.1.3.4) - activerecord (= 7.1.3.4) - activestorage (= 7.1.3.4) - activesupport (= 7.1.3.4) + actionmailbox (7.1.6) + actionpack (= 7.1.6) + activejob (= 7.1.6) + activerecord (= 7.1.6) + activestorage (= 7.1.6) + activesupport (= 7.1.6) mail (>= 2.7.1) net-imap net-pop net-smtp - actionmailer (7.1.3.4) - actionpack (= 7.1.3.4) - actionview (= 7.1.3.4) - activejob (= 7.1.3.4) - activesupport (= 7.1.3.4) + actionmailer (7.1.6) + actionpack (= 7.1.6) + actionview (= 7.1.6) + activejob (= 7.1.6) + activesupport (= 7.1.6) mail (~> 2.5, >= 2.5.4) net-imap net-pop net-smtp rails-dom-testing (~> 2.2) - actionpack (7.1.3.4) - actionview (= 7.1.3.4) - activesupport (= 7.1.3.4) + actionpack (7.1.6) + actionview (= 7.1.6) + activesupport (= 7.1.6) + cgi nokogiri (>= 1.8.5) racc rack (>= 2.2.4) @@ -50,43 +51,47 @@ GEM rack-test (>= 0.6.3) rails-dom-testing (~> 2.2) rails-html-sanitizer (~> 1.6) - actiontext (7.1.3.4) - actionpack (= 7.1.3.4) - activerecord (= 7.1.3.4) - activestorage (= 7.1.3.4) - activesupport (= 7.1.3.4) + actiontext (7.1.6) + actionpack (= 7.1.6) + activerecord (= 7.1.6) + activestorage (= 7.1.6) + activesupport (= 7.1.6) globalid (>= 0.6.0) nokogiri (>= 1.8.5) - actionview (7.1.3.4) - activesupport (= 7.1.3.4) + actionview (7.1.6) + activesupport (= 7.1.6) builder (~> 3.1) + cgi erubi (~> 1.11) rails-dom-testing (~> 2.2) rails-html-sanitizer (~> 1.6) - activejob (7.1.3.4) - activesupport (= 7.1.3.4) + activejob (7.1.6) + activesupport (= 7.1.6) globalid (>= 0.3.6) - activemodel (7.1.3.4) - activesupport (= 7.1.3.4) - activerecord (7.1.3.4) - activemodel (= 7.1.3.4) - activesupport (= 7.1.3.4) + activemodel (7.1.6) + activesupport (= 7.1.6) + activerecord (7.1.6) + activemodel (= 7.1.6) + activesupport (= 7.1.6) timeout (>= 0.4.0) - activestorage (7.1.3.4) - actionpack (= 7.1.3.4) - activejob (= 7.1.3.4) - activerecord (= 7.1.3.4) - activesupport (= 7.1.3.4) + activestorage (7.1.6) + actionpack (= 7.1.6) + activejob (= 7.1.6) + activerecord (= 7.1.6) + activesupport (= 7.1.6) marcel (~> 1.0) - activesupport (7.1.3.4) + activesupport (7.1.6) base64 + benchmark (>= 0.3) bigdecimal concurrent-ruby (~> 1.0, >= 1.0.2) connection_pool (>= 2.2.5) drb i18n (>= 1.6, < 2) + logger (>= 1.4.2) minitest (>= 5.1) mutex_m + securerandom (>= 0.3) tzinfo (~> 2.0) addressable (2.9.0) public_suffix (>= 2.0.2, < 8.0) @@ -113,6 +118,7 @@ GEM aws-sigv4 (1.12.1) aws-eventstream (~> 1, >= 1.0.2) base64 (0.3.0) + benchmark (0.5.0) bigdecimal (4.1.2) bindex (0.8.1) bootstrap-sass (3.4.1) @@ -142,7 +148,7 @@ GEM execjs coffee-script-source (1.12.2) concurrent-ruby (1.3.4) - connection_pool (2.5.5) + connection_pool (3.0.2) crass (1.0.7) date (3.5.1) dotenv (2.8.1) @@ -179,8 +185,7 @@ GEM dry-inflector (~> 1.0) dry-logic (~> 1.4) zeitwerk (~> 2.6) - erb (4.0.4.1) - cgi (>= 0.3.3) + erb (6.0.4) erubi (1.13.1) execjs (2.10.1) ffi (1.17.4) @@ -188,7 +193,7 @@ GEM railties (>= 3.2, < 9.0) globalid (1.4.0) activesupport (>= 6.1) - i18n (1.14.8) + i18n (1.15.2) concurrent-ruby (~> 1.0) io-console (0.8.2) irb (1.18.0) @@ -237,9 +242,9 @@ GEM mime-types-data (3.2026.0701) mini_mime (1.1.5) mini_portile2 (2.8.9) - minitest (5.26.1) + minitest (5.27.0) mutex_m (0.3.0) - net-imap (0.3.10) + net-imap (0.6.4.1) date net-protocol net-pop (0.1.2) @@ -263,9 +268,6 @@ GEM prettyprint prettyprint (0.2.0) prism (1.9.0) - psych (5.4.0) - date - stringio public_suffix (7.0.5) puma (3.12.6) racc (1.8.1) @@ -277,20 +279,20 @@ GEM rackup (1.0.1) rack (< 3) webrick - rails (7.1.3.4) - actioncable (= 7.1.3.4) - actionmailbox (= 7.1.3.4) - actionmailer (= 7.1.3.4) - actionpack (= 7.1.3.4) - actiontext (= 7.1.3.4) - actionview (= 7.1.3.4) - activejob (= 7.1.3.4) - activemodel (= 7.1.3.4) - activerecord (= 7.1.3.4) - activestorage (= 7.1.3.4) - activesupport (= 7.1.3.4) + rails (7.1.6) + actioncable (= 7.1.6) + actionmailbox (= 7.1.6) + actionmailer (= 7.1.6) + actionpack (= 7.1.6) + actiontext (= 7.1.6) + actionview (= 7.1.6) + activejob (= 7.1.6) + activemodel (= 7.1.6) + activerecord (= 7.1.6) + activestorage (= 7.1.6) + activesupport (= 7.1.6) bundler (>= 1.15.0) - railties (= 7.1.3.4) + railties (= 7.1.6) rails-dom-testing (2.3.0) activesupport (>= 5.0.0) minitest @@ -298,22 +300,29 @@ GEM rails-html-sanitizer (1.7.0) loofah (~> 2.25) nokogiri (>= 1.15.7, != 1.16.7, != 1.16.6, != 1.16.5, != 1.16.4, != 1.16.3, != 1.16.2, != 1.16.1, != 1.16.0.rc1, != 1.16.0) - railties (7.1.3.4) - actionpack (= 7.1.3.4) - activesupport (= 7.1.3.4) + railties (7.1.6) + actionpack (= 7.1.6) + activesupport (= 7.1.6) + cgi irb rackup (>= 1.0.0) rake (>= 12.2) thor (~> 1.0, >= 1.2.2) + tsort (>= 0.2) zeitwerk (~> 2.6) rainbow (3.1.1) rake (13.4.2) rb-fsevent (0.11.2) rb-inotify (0.11.1) ffi (~> 1.0) - rdoc (7.2.0) + rbs (4.0.3) + logger + prism (>= 1.6.0) + tsort + rdoc (8.0.0) erb - psych (>= 4.0.0) + prism (>= 1.6.0) + rbs (>= 4.0.0) tsort redcarpet (3.6.1) reek (6.5.0) @@ -370,6 +379,7 @@ GEM tilt (>= 1.1, < 3) sassc (2.4.0) ffi (~> 1.9) + securerandom (0.4.1) selenium-webdriver (4.9.0) rexml (~> 3.2, >= 3.2.5) rubyzip (>= 1.2.2, < 3.0) @@ -386,7 +396,6 @@ GEM actionpack (>= 6.1) activesupport (>= 6.1) sprockets (>= 3.0.0) - stringio (3.2.0) terrapin (1.1.1) climate_control thor (1.5.0) @@ -417,7 +426,7 @@ GEM wkhtmltopdf-binary (0.12.3.1) xpath (3.2.0) nokogiri (~> 1.8) - zeitwerk (2.6.18) + zeitwerk (2.8.2) PLATFORMS ruby @@ -435,11 +444,12 @@ DEPENDENCIES jbuilder (~> 2.5) kt-paperclip (~> 8.0.0) listen (>= 3.5) + minitest (< 6) next_rails nokogiri (>= 1.13.0) pg (~> 1.1) puma (~> 3.7) - rails (>= 7.1.0, < 7.1.4) + rails (>= 7.1.0, < 7.2.0) redcarpet reek rubocop-rails-omakase diff --git a/Gemfile.next.lock b/Gemfile.next.lock index 7614336..d14f3d5 100644 --- a/Gemfile.next.lock +++ b/Gemfile.next.lock @@ -14,35 +14,36 @@ GIT GEM remote: https://rubygems.org/ specs: - actioncable (7.1.3.4) - actionpack (= 7.1.3.4) - activesupport (= 7.1.3.4) + actioncable (7.1.6) + actionpack (= 7.1.6) + activesupport (= 7.1.6) nio4r (~> 2.0) websocket-driver (>= 0.6.1) zeitwerk (~> 2.6) - actionmailbox (7.1.3.4) - actionpack (= 7.1.3.4) - activejob (= 7.1.3.4) - activerecord (= 7.1.3.4) - activestorage (= 7.1.3.4) - activesupport (= 7.1.3.4) + actionmailbox (7.1.6) + actionpack (= 7.1.6) + activejob (= 7.1.6) + activerecord (= 7.1.6) + activestorage (= 7.1.6) + activesupport (= 7.1.6) mail (>= 2.7.1) net-imap net-pop net-smtp - actionmailer (7.1.3.4) - actionpack (= 7.1.3.4) - actionview (= 7.1.3.4) - activejob (= 7.1.3.4) - activesupport (= 7.1.3.4) + actionmailer (7.1.6) + actionpack (= 7.1.6) + actionview (= 7.1.6) + activejob (= 7.1.6) + activesupport (= 7.1.6) mail (~> 2.5, >= 2.5.4) net-imap net-pop net-smtp rails-dom-testing (~> 2.2) - actionpack (7.1.3.4) - actionview (= 7.1.3.4) - activesupport (= 7.1.3.4) + actionpack (7.1.6) + actionview (= 7.1.6) + activesupport (= 7.1.6) + cgi nokogiri (>= 1.8.5) racc rack (>= 2.2.4) @@ -50,43 +51,47 @@ GEM rack-test (>= 0.6.3) rails-dom-testing (~> 2.2) rails-html-sanitizer (~> 1.6) - actiontext (7.1.3.4) - actionpack (= 7.1.3.4) - activerecord (= 7.1.3.4) - activestorage (= 7.1.3.4) - activesupport (= 7.1.3.4) + actiontext (7.1.6) + actionpack (= 7.1.6) + activerecord (= 7.1.6) + activestorage (= 7.1.6) + activesupport (= 7.1.6) globalid (>= 0.6.0) nokogiri (>= 1.8.5) - actionview (7.1.3.4) - activesupport (= 7.1.3.4) + actionview (7.1.6) + activesupport (= 7.1.6) builder (~> 3.1) + cgi erubi (~> 1.11) rails-dom-testing (~> 2.2) rails-html-sanitizer (~> 1.6) - activejob (7.1.3.4) - activesupport (= 7.1.3.4) + activejob (7.1.6) + activesupport (= 7.1.6) globalid (>= 0.3.6) - activemodel (7.1.3.4) - activesupport (= 7.1.3.4) - activerecord (7.1.3.4) - activemodel (= 7.1.3.4) - activesupport (= 7.1.3.4) + activemodel (7.1.6) + activesupport (= 7.1.6) + activerecord (7.1.6) + activemodel (= 7.1.6) + activesupport (= 7.1.6) timeout (>= 0.4.0) - activestorage (7.1.3.4) - actionpack (= 7.1.3.4) - activejob (= 7.1.3.4) - activerecord (= 7.1.3.4) - activesupport (= 7.1.3.4) + activestorage (7.1.6) + actionpack (= 7.1.6) + activejob (= 7.1.6) + activerecord (= 7.1.6) + activesupport (= 7.1.6) marcel (~> 1.0) - activesupport (7.1.3.4) + activesupport (7.1.6) base64 + benchmark (>= 0.3) bigdecimal concurrent-ruby (~> 1.0, >= 1.0.2) connection_pool (>= 2.2.5) drb i18n (>= 1.6, < 2) + logger (>= 1.4.2) minitest (>= 5.1) mutex_m + securerandom (>= 0.3) tzinfo (~> 2.0) addressable (2.9.0) public_suffix (>= 2.0.2, < 8.0) @@ -113,6 +118,7 @@ GEM aws-sigv4 (1.12.1) aws-eventstream (~> 1, >= 1.0.2) base64 (0.3.0) + benchmark (0.5.0) bigdecimal (4.1.2) bindex (0.8.1) bootstrap-sass (3.4.1) @@ -142,7 +148,7 @@ GEM execjs coffee-script-source (1.12.2) concurrent-ruby (1.3.4) - connection_pool (2.5.5) + connection_pool (3.0.2) crass (1.0.7) date (3.5.1) dotenv (2.8.1) @@ -179,8 +185,7 @@ GEM dry-inflector (~> 1.0) dry-logic (~> 1.4) zeitwerk (~> 2.6) - erb (4.0.4.1) - cgi (>= 0.3.3) + erb (6.0.4) erubi (1.13.1) execjs (2.10.1) ffi (1.17.4) @@ -188,7 +193,7 @@ GEM railties (>= 3.2, < 9.0) globalid (1.4.0) activesupport (>= 6.1) - i18n (1.14.8) + i18n (1.15.2) concurrent-ruby (~> 1.0) io-console (0.8.2) irb (1.18.0) @@ -237,9 +242,9 @@ GEM mime-types-data (3.2026.0701) mini_mime (1.1.5) mini_portile2 (2.8.9) - minitest (5.26.1) + minitest (5.27.0) mutex_m (0.3.0) - net-imap (0.3.10) + net-imap (0.6.4.1) date net-protocol net-pop (0.1.2) @@ -263,9 +268,6 @@ GEM prettyprint prettyprint (0.2.0) prism (1.9.0) - psych (5.4.0) - date - stringio public_suffix (7.0.5) puma (3.12.6) racc (1.8.1) @@ -277,20 +279,20 @@ GEM rackup (1.0.1) rack (< 3) webrick - rails (7.1.3.4) - actioncable (= 7.1.3.4) - actionmailbox (= 7.1.3.4) - actionmailer (= 7.1.3.4) - actionpack (= 7.1.3.4) - actiontext (= 7.1.3.4) - actionview (= 7.1.3.4) - activejob (= 7.1.3.4) - activemodel (= 7.1.3.4) - activerecord (= 7.1.3.4) - activestorage (= 7.1.3.4) - activesupport (= 7.1.3.4) + rails (7.1.6) + actioncable (= 7.1.6) + actionmailbox (= 7.1.6) + actionmailer (= 7.1.6) + actionpack (= 7.1.6) + actiontext (= 7.1.6) + actionview (= 7.1.6) + activejob (= 7.1.6) + activemodel (= 7.1.6) + activerecord (= 7.1.6) + activestorage (= 7.1.6) + activesupport (= 7.1.6) bundler (>= 1.15.0) - railties (= 7.1.3.4) + railties (= 7.1.6) rails-dom-testing (2.3.0) activesupport (>= 5.0.0) minitest @@ -298,22 +300,29 @@ GEM rails-html-sanitizer (1.7.0) loofah (~> 2.25) nokogiri (>= 1.15.7, != 1.16.7, != 1.16.6, != 1.16.5, != 1.16.4, != 1.16.3, != 1.16.2, != 1.16.1, != 1.16.0.rc1, != 1.16.0) - railties (7.1.3.4) - actionpack (= 7.1.3.4) - activesupport (= 7.1.3.4) + railties (7.1.6) + actionpack (= 7.1.6) + activesupport (= 7.1.6) + cgi irb rackup (>= 1.0.0) rake (>= 12.2) thor (~> 1.0, >= 1.2.2) + tsort (>= 0.2) zeitwerk (~> 2.6) rainbow (3.1.1) rake (13.4.2) rb-fsevent (0.11.2) rb-inotify (0.11.1) ffi (~> 1.0) - rdoc (7.2.0) + rbs (4.0.3) + logger + prism (>= 1.6.0) + tsort + rdoc (8.0.0) erb - psych (>= 4.0.0) + prism (>= 1.6.0) + rbs (>= 4.0.0) tsort redcarpet (3.6.1) reek (6.5.0) @@ -370,6 +379,7 @@ GEM tilt (>= 1.1, < 3) sassc (2.4.0) ffi (~> 1.9) + securerandom (0.4.1) selenium-webdriver (4.9.0) rexml (~> 3.2, >= 3.2.5) rubyzip (>= 1.2.2, < 3.0) @@ -386,7 +396,6 @@ GEM actionpack (>= 6.1) activesupport (>= 6.1) sprockets (>= 3.0.0) - stringio (3.2.0) terrapin (1.1.1) climate_control thor (1.5.0) @@ -417,7 +426,7 @@ GEM wkhtmltopdf-binary (0.12.3.1) xpath (3.2.0) nokogiri (~> 1.8) - zeitwerk (2.6.18) + zeitwerk (2.8.2) PLATFORMS ruby @@ -435,11 +444,12 @@ DEPENDENCIES jbuilder (~> 2.5) kt-paperclip (~> 8.0.0) listen (>= 3.5) + minitest (< 6) next_rails nokogiri (>= 1.13.0) pg (~> 1.1) puma (~> 3.7) - rails (>= 7.1.0, < 7.1.4) + rails (>= 7.1.0, < 7.2.0) redcarpet reek rubocop-rails-omakase diff --git a/config/environments/development.rb b/config/environments/development.rb index 6ec850d..6218daf 100644 --- a/config/environments/development.rb +++ b/config/environments/development.rb @@ -1,4 +1,7 @@ Rails.application.configure do + # Moved off config/secrets.yml (removed in Rails 7.2); same value as before. + config.secret_key_base = "3c588677c611cb6c1945643fee0f6e3bcb1fbd734bbdc126022ea95d10c6cad4547ac3839e348a5d8cb1e76bb97d516c12426f20d3fdeb275700df561bc73311" + config.paperclip_defaults = { storage: :filesystem, path: "#{Rails.root}/spec/test_files/:class/:id_partition/:style.:extension" diff --git a/config/environments/production.rb b/config/environments/production.rb index 89c9862..3b07ff5 100644 --- a/config/environments/production.rb +++ b/config/environments/production.rb @@ -1,4 +1,7 @@ Rails.application.configure do + # Moved off config/secrets.yml (removed in Rails 7.2); same source as before. + config.secret_key_base = ENV["SECRET_KEY_BASE"] + # Settings specified here will take precedence over those in config/application.rb. # Code is not reloaded between requests. diff --git a/config/environments/test.rb b/config/environments/test.rb index 2654621..c03c289 100644 --- a/config/environments/test.rb +++ b/config/environments/test.rb @@ -1,4 +1,7 @@ Rails.application.configure do + # Moved off config/secrets.yml (removed in Rails 7.2); same value as before. + config.secret_key_base = "df266f64098fc45cc7d78a5930526841b54a064f83f5f7fc56b490dcff30fe525366f24cf70a9b6f43020293064594f44b6c0103af7eaf4a9edf8f3146221827" + config.paperclip_defaults = { storage: :filesystem, path: "#{Rails.root}/test/test_files/:class/:id_partition/:style.:extension" diff --git a/config/secrets.yml b/config/secrets.yml deleted file mode 100644 index b40d8a0..0000000 --- a/config/secrets.yml +++ /dev/null @@ -1,32 +0,0 @@ -# Be sure to restart your server when you modify this file. - -# Your secret key is used for verifying the integrity of signed cookies. -# If you change this key, all old signed cookies will become invalid! - -# Make sure the secret is at least 30 characters and all random, -# no regular words or you'll be exposed to dictionary attacks. -# You can use `rails secret` to generate a secure secret key. - -# Make sure the secrets in this file are kept private -# if you're sharing your code publicly. - -# Shared secrets are available across all environments. - -# shared: -# api_key: a1B2c3D4e5F6 - -# Environmental secrets are only available for that specific environment. - -development: - secret_key_base: 3c588677c611cb6c1945643fee0f6e3bcb1fbd734bbdc126022ea95d10c6cad4547ac3839e348a5d8cb1e76bb97d516c12426f20d3fdeb275700df561bc73311 - -test: - secret_key_base: df266f64098fc45cc7d78a5930526841b54a064f83f5f7fc56b490dcff30fe525366f24cf70a9b6f43020293064594f44b6c0103af7eaf4a9edf8f3146221827 - -# Do not keep production secrets in the unencrypted secrets file. -# Instead, either read values from the environment. -# Or, use `bin/rails secrets:setup` to configure encrypted secrets -# and move the `production:` environment over there. - -production: - secret_key_base: <%= ENV["SECRET_KEY_BASE"] %> From 44136f2738bf61852910b57a68e76f6ac4f4290b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Juan=20V=C3=A1squez?= Date: Tue, 7 Jul 2026 08:36:32 -0600 Subject: [PATCH 27/28] Fix system test: make_visible semantics were backwards make_visible: false disables Capybara's own visibility-forcing behavior -- the opposite of what's needed for a custom widget that CSS-hides the real file input. Confirmed against real CI (genuine x86_64 GitHub Actions runners): Chrome/Puma launched fine both times, the failure was purely Capybara refusing to interact with the still-hidden element. --- test/system/gemfiles_test.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/test/system/gemfiles_test.rb b/test/system/gemfiles_test.rb index 08ccfda..b7a56ad 100644 --- a/test/system/gemfiles_test.rb +++ b/test/system/gemfiles_test.rb @@ -6,9 +6,9 @@ class GemfilesTest < ApplicationSystemTestCase visit root_path # The real file input is visually hidden by the custom upload widget's - # CSS (a styled label/span sit in front of it); make_visible: false has + # CSS (a styled label/span sit in front of it); make_visible: true has # Capybara temporarily reveal it just for the attach, then hide it again. - attach_file "gemfile_file", Rails.root.join("test/fixtures/files/Gemfile.lock"), make_visible: false + attach_file "gemfile_file", Rails.root.join("test/fixtures/files/Gemfile.lock"), make_visible: true click_button "Check file" assert_current_path %r{\A/gemfiles/\w+\z} From d044a805010b48e9970395cca47f113022f4ab1c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Juan=20V=C3=A1squez?= Date: Tue, 7 Jul 2026 10:15:17 -0600 Subject: [PATCH 28/28] Fix 500 on PDF download: use URI.open, not bare Kernel#open Ruby 3.2's bundled open-uri (0.3.0) dropped its Kernel#open monkeypatch, so open(uri) fell through to a plain file open and raised Errno::ENOENT on the S3 URL instead of fetching it. --- app/models/gemfile.rb | 2 +- test/models/gemfile_test.rb | 14 ++++++++++++++ 2 files changed, 15 insertions(+), 1 deletion(-) diff --git a/app/models/gemfile.rb b/app/models/gemfile.rb index 5dd8831..8498a9b 100644 --- a/app/models/gemfile.rb +++ b/app/models/gemfile.rb @@ -60,7 +60,7 @@ def temp_file suffix = ".lock" @temp_file = Tempfile.new [prefix, suffix], "#{Rails.root}/tmp" uri = "https:#{file.url}" - @temp_file.write(open(uri).read) + @temp_file.write(URI.open(uri).read) @temp_file.close @temp_file end diff --git a/test/models/gemfile_test.rb b/test/models/gemfile_test.rb index b192885..6054e04 100644 --- a/test/models/gemfile_test.rb +++ b/test/models/gemfile_test.rb @@ -42,6 +42,20 @@ def stub_scanner(vulnerabilities = [], &block) end end + test "temp_file fetches the attachment via URI.open when the URL is protocol-relative" do + gemfile = Gemfile.new(file: valid_file) + assert gemfile.save + content = "remote gemfile lock contents" + + gemfile.file.stub :url, "//s3.amazonaws.com/bucket/gemfiles/files/1/original/Gemfile.lock" do + URI.stub :open, StringIO.new(content) do + temp_file = gemfile.temp_file + + assert_equal content, File.read(temp_file.path) + end + end + end + test "nil file makes the record invalid" do stub_scanner do gemfile = Gemfile.new(file: nil)