From 2bf5711f4cfc0df6b8051d03c0c88a2869313021 Mon Sep 17 00:00:00 2001 From: Igor Zubkov Date: Tue, 3 Oct 2023 16:19:03 +0200 Subject: [PATCH 1/4] Use: ruby file: ".ruby-version" --- Gemfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Gemfile b/Gemfile index b6378b38..9920e27f 100644 --- a/Gemfile +++ b/Gemfile @@ -2,7 +2,7 @@ source "https://rubygems.org" -ruby File.read(".ruby-version") +ruby file: ".ruby-version" gem "rails", "7.0.8" gem "sprockets-rails" From bb042d98beae4922aced5e1e88fb6a479746d409 Mon Sep 17 00:00:00 2001 From: Igor Zubkov Date: Tue, 3 Oct 2023 16:22:38 +0200 Subject: [PATCH 2/4] Add binstubs --- bin/bundle-audit | 27 +++++++++++++++++++++++++++ bin/bundler-audit | 27 +++++++++++++++++++++++++++ 2 files changed, 54 insertions(+) create mode 100755 bin/bundle-audit create mode 100755 bin/bundler-audit diff --git a/bin/bundle-audit b/bin/bundle-audit new file mode 100755 index 00000000..a0e7ba0e --- /dev/null +++ b/bin/bundle-audit @@ -0,0 +1,27 @@ +#!/usr/bin/env ruby +# frozen_string_literal: true + +# +# This file was generated by Bundler. +# +# The application 'bundle-audit' is installed as part of a gem, and +# this file is here to facilitate running it. +# + +ENV["BUNDLE_GEMFILE"] ||= File.expand_path("../Gemfile", __dir__) + +bundle_binstub = File.expand_path("bundle", __dir__) + +if File.file?(bundle_binstub) + if File.read(bundle_binstub, 300).include?("This file was generated by Bundler") + load(bundle_binstub) + else + abort("Your `bin/bundle` was not generated by Bundler, so this binstub cannot run. +Replace `bin/bundle` by running `bundle binstubs bundler --force`, then run this command again.") + end +end + +require "rubygems" +require "bundler/setup" + +load Gem.bin_path("bundler-audit", "bundle-audit") diff --git a/bin/bundler-audit b/bin/bundler-audit new file mode 100755 index 00000000..334a7378 --- /dev/null +++ b/bin/bundler-audit @@ -0,0 +1,27 @@ +#!/usr/bin/env ruby +# frozen_string_literal: true + +# +# This file was generated by Bundler. +# +# The application 'bundler-audit' is installed as part of a gem, and +# this file is here to facilitate running it. +# + +ENV["BUNDLE_GEMFILE"] ||= File.expand_path("../Gemfile", __dir__) + +bundle_binstub = File.expand_path("bundle", __dir__) + +if File.file?(bundle_binstub) + if File.read(bundle_binstub, 300).include?("This file was generated by Bundler") + load(bundle_binstub) + else + abort("Your `bin/bundle` was not generated by Bundler, so this binstub cannot run. +Replace `bin/bundle` by running `bundle binstubs bundler --force`, then run this command again.") + end +end + +require "rubygems" +require "bundler/setup" + +load Gem.bin_path("bundler-audit", "bundler-audit") From 564ce099e64a2b7f0e63271570b80af97ce8f0d5 Mon Sep 17 00:00:00 2001 From: Igor Zubkov Date: Tue, 3 Oct 2023 16:22:51 +0200 Subject: [PATCH 3/4] Add bundler-audit gem --- Gemfile | 1 + Gemfile.lock | 4 ++++ 2 files changed, 5 insertions(+) diff --git a/Gemfile b/Gemfile index 9920e27f..9281be31 100644 --- a/Gemfile +++ b/Gemfile @@ -34,4 +34,5 @@ group :development do gem "standard", "1.31.1", require: false gem "brakeman", require: false gem "fasterer", require: false + gem "bundler-audit", require: false end diff --git a/Gemfile.lock b/Gemfile.lock index 036435af..f7ba3fb9 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -72,6 +72,9 @@ GEM msgpack (~> 1.2) brakeman (6.0.1) builder (3.2.4) + bundler-audit (0.9.1) + bundler (>= 1.2.0, < 3) + thor (~> 1.0) coderay (1.1.3) colorize (0.8.1) concurrent-ruby (1.2.2) @@ -287,6 +290,7 @@ PLATFORMS DEPENDENCIES bootsnap brakeman + bundler-audit dotenv-rails fasterer license_finder From a5b3422eb14186c1877493a9366862aaa1252141 Mon Sep 17 00:00:00 2001 From: Igor Zubkov Date: Tue, 3 Oct 2023 16:25:09 +0200 Subject: [PATCH 4/4] Update --- .github/workflows/bundler-audit.yml | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/.github/workflows/bundler-audit.yml b/.github/workflows/bundler-audit.yml index eb00c19a..27e73243 100644 --- a/.github/workflows/bundler-audit.yml +++ b/.github/workflows/bundler-audit.yml @@ -16,5 +16,9 @@ jobs: steps: - uses: actions/checkout@v4 - - name: "Bundler Audit" - uses: andrewmcodes/bundler-audit-action@main + - name: Set up Ruby + uses: ruby/setup-ruby@v1 + with: + bundler-cache: true + - run: bin/bundle-audit update + - run: bin/bundle-audit check