Skip to content

feat: unflag Ruby gem support and add e2e bundler tests#41

Merged
mikolalysenko merged 4 commits intomainfrom
feat/unflag-gem-support
Mar 20, 2026
Merged

feat: unflag Ruby gem support and add e2e bundler tests#41
mikolalysenko merged 4 commits intomainfrom
feat/unflag-gem-support

Conversation

@mikolalysenko
Copy link
Contributor

Summary

  • Remove the gem feature flag so Ruby gem support is always compiled into every release binary (matching npm/PyPI behavior)
  • Remove all #[cfg(feature = "gem")] gates across crawler module, Ecosystem enum, PURL functions, and ecosystem dispatch
  • Rewrite e2e_gem.rs with full bundler lifecycle tests targeting activestorage@5.2.0 (CVE-2022-21831, 3-file hash verification)
  • Add Ruby 3.2 setup step in CI for e2e_gem suite
  • Update READMEs to reflect gem as default, not feature-flagged

Test plan

  • cargo clippy --workspace -- -D warnings passes (gem code always compiled)
  • cargo test --workspace passes (gem tests no longer need --features gem)
  • cargo test -p socket-patch-cli --test e2e_gem scan tests pass (no network needed)
  • cargo test -p socket-patch-cli --test e2e_gem -- --ignored full lifecycle with bundler + API
  • cargo build --release includes gem support without --features

🤖 Generated with Claude Code

Remove the `gem` feature flag so Ruby gem support is always compiled in,
matching npm and PyPI which are already default-on. This ensures gem
support ships in every release binary built with `cargo build --release`.

- Remove `gem = []` from both Cargo.toml feature sections
- Remove all `#[cfg(feature = "gem")]` gates from crawler module,
  Ecosystem enum, PURL functions, and ecosystem dispatch
- Rewrite e2e_gem.rs with full bundler lifecycle tests targeting
  activestorage@5.2.0 (CVE-2022-21831) with 3-file hash verification
- Add Ruby 3.2 setup step in CI for e2e_gem suite
- Update READMEs to reflect gem as default, not feature-flagged

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@socket-security-staging
Copy link

socket-security-staging bot commented Mar 19, 2026

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Addedgithub/​ruby/​setup-ruby@​319994f95fa847cf3fb3cd3dbe89f6dcde9f178f96100100100100

View full report

@socket-security
Copy link

socket-security bot commented Mar 19, 2026

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Addedgithub/​ruby/​setup-ruby@​319994f95fa847cf3fb3cd3dbe89f6dcde9f178f96100100100100

View full report

mikolalysenko and others added 3 commits March 20, 2026 12:50
- Move clippy into a dedicated `clippy` job so it runs independently
  from tests and is separately visible in PR checks
- Remove `components: clippy` from the test job (no longer needed)
- Fix 2 pre-existing test failures in package_json::update::tests:
  assertions checked for "socket patch apply" (space) but the
  SOCKET_PATCH_COMMAND writes "socket-patch apply" (hyphen)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
GitHub org policy requires all actions to be pinned to full-length
commit SHAs. Pin ruby/setup-ruby@v1 to its current SHA.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Instead of hardcoded before/after hashes (which were incorrect
placeholders), read expected hashes from the manifest after `get`
and record original hashes dynamically after install. This matches
the pattern used by the pypi e2e tests.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@mikolalysenko mikolalysenko merged commit 9294068 into main Mar 20, 2026
18 checks passed
@mikolalysenko mikolalysenko deleted the feat/unflag-gem-support branch March 20, 2026 19:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant