Use bundle-audit rake task from the gem #831

odlp · 2017-03-10T11:40:57Z

Instead of defining the audit task from scratch, we can now import the task from the gem itself.

One caveat: The task name changes from bundler:audit to bundle:audit as defined by the gem. We could make an alias between the old & new command but I suspect most use is just via the default Rake task.

Instead of defining the audit task from scratch, we can import the task from the gem itself.

houndci-bot · 2017-03-10T11:41:09Z

templates/bundler_audit.rake

-      end
-    end
-  end
+  require "bundler/audit/task"


Prefer single-quoted strings when you don't need string interpolation or special symbols.

houndci-bot · 2017-03-10T11:41:09Z

spec/features/new_project_spec.rb

@@ -29,6 +29,14 @@
    end
  end

+  it "includes the bundle:audit task" do


Prefer single-quoted strings when you don't need string interpolation or special symbols.

houndci-bot · 2017-03-10T11:41:09Z

lib/suspenders/app_builder.rb

@@ -401,7 +401,7 @@ def setup_segment

    def setup_bundler_audit
      copy_file "bundler_audit.rake", "lib/tasks/bundler_audit.rake"
-      append_file "Rakefile", %{\ntask default: "bundler:audit"\n}
+      append_file "Rakefile", %{\ntask default: "bundle:audit"\n}


Prefer single-quoted strings when you don't need string interpolation or special symbols.
%-literals should be delimited by ( and ).

Should this be task default: ["spec", "bundle:audit"]?

Although it may be clearer what's going on defined as one line, is it lumping together responsibilities? I think we should augment the default task with bundle:audit independently of expecting the specs to run.

Having said that, I did find Rake's behaviour of find the append (rather-than-redefine) mechanism confusing at first... it's not clear.

# Rakefile task :foo do puts "FOO" end task :bar do puts "BAR" end task(:default).clear task default: :foo task default: :bar

$ bundle exec rake FOO BAR

One way we could make this clearer is writing it as:

Rake::Task[:default].enhance ["bundle:audit"]

Then there's less confusion whether the task is being overwritten or modified.

@croaky also this comment on the original PR for context: #831 (comment)

Although it may be clearer what's going on defined as one line, is it lumping together responsibilities? I think we should augment the default task with bundle:audit independently of expecting the specs to run.

I think I'd expect rake in a Suspender-ized app to run spec then bundle:audit at this point. If that's what is happening via multiple task default: invocations, that's great.

Related: I learned about https://github.com/presidentbeef/brakeman last week. Seems like it covers security cases additional to Bundle Audit. Might be worth experimenting with on some apps.

@croaky we are using brakeman in our suspenders fork. I can cherry-pick and create a PR if you are interested!

houndci-bot · 2017-03-10T11:41:09Z

templates/bundler_audit.rake

-      end
-    end
-  end
+  require "bundler/audit/task"


Prefer single-quoted strings when you don't need string interpolation or special symbols.

houndci-bot · 2017-03-10T11:41:09Z

spec/features/new_project_spec.rb

@@ -29,6 +29,14 @@
    end
  end

+  it "includes the bundle:audit task" do


Prefer single-quoted strings when you don't need string interpolation or special symbols.

houndci-bot · 2017-03-10T11:41:09Z

lib/suspenders/app_builder.rb

@@ -401,7 +401,7 @@ def setup_segment

    def setup_bundler_audit
      copy_file "bundler_audit.rake", "lib/tasks/bundler_audit.rake"
-      append_file "Rakefile", %{\ntask default: "bundler:audit"\n}
+      append_file "Rakefile", %{\ntask default: "bundle:audit"\n}


Prefer single-quoted strings when you don't need string interpolation or special symbols.
%-literals should be delimited by ( and ).

odlp · 2017-03-10T11:47:35Z

Disregarding the Hound single-quoted strings warnings because the changes match the current formatting of the files changed, and the thoughtbot Ruby styleguide states:

Prefer double quotes for strings.

We could disable this check by adding a .rubocop.yml entry for this rule like this.

croaky

Nice! Do we need to update any generated RSpec task to reference bundle:audit now instead of bundler:audit? I think we configure it to run after the suite passes.

croaky · 2017-03-10T15:25:34Z

I like the idea of switching the Hound config to prefer double quotes strings and moving toward that over time as files are touched.

odlp · 2017-03-10T15:41:46Z

@croaky yes, the default Rake task (which has :spec defined a few lines above), gets the "bundle:audit" task appended to it. I've updated that as part of the PR on this line.

So ultimately the Rakefile in a new Suspenders project looks like this:

# Add your own tasks in files placed in lib/tasks ending in .rake,
# for example lib/tasks/capistrano.rake, and they will automatically be available to Rake.

require_relative 'config/application'

Rails.application.load_tasks
task(:default).clear
task default: [:spec]

if defined? RSpec
  task(:spec).clear
  RSpec::Core::RakeTask.new(:spec) do |t|
    t.verbose = false
  end
end

task default: "bundle:audit"

So task default ends up being [:spec, "bundle:audit"] because Rake appends to a pre-declared task.

Use bundle-audit rake task from the gem

08d1c05

Instead of defining the audit task from scratch, we can import the task from the gem itself.

houndci-bot reviewed Mar 10, 2017

View reviewed changes

croaky reviewed Mar 10, 2017

View reviewed changes

croaky approved these changes Mar 10, 2017

View reviewed changes

odlp merged commit ae2281e into master Mar 14, 2017

tysongach deleted the op-bundler-audit branch May 8, 2017 19:38

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Use bundle-audit rake task from the gem #831

Use bundle-audit rake task from the gem #831

odlp commented Mar 10, 2017

houndci-bot Mar 10, 2017

houndci-bot Mar 10, 2017

houndci-bot Mar 10, 2017

croaky Sep 8, 2017 •

edited

Loading

odlp Sep 11, 2017 •

edited

Loading

odlp Sep 11, 2017

croaky Sep 11, 2017

delphaber Sep 16, 2017

houndci-bot Mar 10, 2017

houndci-bot Mar 10, 2017

houndci-bot Mar 10, 2017

odlp commented Mar 10, 2017 •

edited

Loading

croaky left a comment

croaky commented Mar 10, 2017

odlp commented Mar 10, 2017

Use bundle-audit rake task from the gem #831

Use bundle-audit rake task from the gem #831

Conversation

odlp commented Mar 10, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

croaky Sep 8, 2017 • edited Loading

Choose a reason for hiding this comment

odlp Sep 11, 2017 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

odlp commented Mar 10, 2017 • edited Loading

croaky left a comment

Choose a reason for hiding this comment

croaky commented Mar 10, 2017

odlp commented Mar 10, 2017

croaky Sep 8, 2017 •

edited

Loading

odlp Sep 11, 2017 •

edited

Loading

odlp commented Mar 10, 2017 •

edited

Loading