zsp/everything-claude-code
1
0
Fork 0
mirror of https://github.com/affaan-m/everything-claude-code.git synced 2026-06-11 02:33:10 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(rules/ruby): correct brakeman flag and unify bundle-audit invocation

Browse Source 
Two issues from the post-merge review of #1860:

1. **`brakeman --no-pager` is not a real flag.** Brakeman has no
   `--no-pager` option (that's `git` / `gh` style). It appeared in
   three locations:
   - `rules/ruby/hooks.md` L18 (bullet recommendation)
   - `rules/ruby/hooks.md` L32 (CI gate snippet)
   - `rules/ruby/security.md` L38 (dependency check snippet)

   Replaced with `--no-progress`, which is the closest valid option
   (suppresses the progress bar while keeping warning output —
   what hook contexts usually want). `-q` / `--no-color` would also
   be valid alternatives but `--no-progress` matches the original
   intent best.

2. **`bundle-audit` invocation was inconsistent across the two
   files.** `rules/ruby/security.md` L37 used the
   `bundle audit check --update` Bundler plugin subcommand form,
   while `rules/ruby/hooks.md` L20 used the direct
   `bundle exec bundle-audit check --update` binary form.

   Both invoke the same `bundler-audit` gem but look different
   enough to confuse readers. Standardized on the
   `bundle exec bundle-audit` form (the portable invocation that
   works across bundler-audit gem versions without depending on the
   plugin registering a `bundle audit` subcommand).

Both issues were also flagged in PR #1860 review comments (#1, #2 of
my comprehensive review; the bundle-audit one was independently
caught by greptile-apps and coderabbitai bots).

Full test suite (`node tests/run-all.js`): 2382 passed, 0 failed.
`markdownlint-cli` clean on both files.
This commit is contained in:
zomia
2026-05-14 09:27:59 +09:00
parent 6cdac19764
commit f3f63dee4e
2 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
rules/ruby/hooks.md
View File

@@ -15,7 +15,7 @@ paths:
Configure project-local hooks to prefer binstubs and checked-in tooling:
- **RuboCop**: run `bundle exec rubocop -A <file>` or the project's safer formatter command after Ruby edits.
- **Brakeman**: run `bundle exec brakeman --no-pager` after security-sensitive Rails changes.
- **Brakeman**: run `bundle exec brakeman --no-progress` after security-sensitive Rails changes.
- **Tests**: run the narrowest matching `bin/rails test ...` or `bundle exec rspec ...` command for touched files.
- **Bundler audit**: run `bundle exec bundle-audit check --update` when `Gemfile` or `Gemfile.lock` changes and the project has bundler-audit installed.
@@ -29,7 +29,7 @@ Configure project-local hooks to prefer binstubs and checked-in tooling:
```bash
bundle exec rubocop
bundle exec brakeman --no-pager
bundle exec brakeman --no-progress
bin/rails test
bundle exec rspec
```

4
rules/ruby/security.md
View File

@@ -34,8 +34,8 @@ paths:
- Run dependency checks when the lockfile changes:
```bash
bundle audit check --update
bundle exec brakeman --no-pager
bundle exec bundle-audit check --update
bundle exec brakeman --no-progress
```
- Review new gems for maintainer activity, native extension risk, transitive dependencies, and whether the same behavior can be implemented with Rails core.