Update Bundle to Clear Dependabot Alerts and Troubleshoot Build Dependency Failures
We forgot to set up Dependabot alerts for the project when we first created the repository. (We set it up offline between videos.) Now that we have it set up, there are 20 Dependabot alerts for us to take care of.
Before trying to clear them, we provide a quick overview of how we set them up and look at some of the other items on the Security tab.
In a best-case scenario, just running a bundle update will solve the issues and clear the Dependabot alerts. Because we just set RuboCop to enable new cops in the previous video, we need to remediate any new violations that crop up when we update the versions of the various RuboCop gems in our Gemfile. There are new violations, but they're straightforward we dispatch them quickly. We run our full test suite, and it looks like it's going to be an easy and straightforward configuration update video. Right?
Wrong.
When we push to our branch, our GitHub action build fails, saying that the debug Gem revealed dependencies not in the API or the lockfile (irb , reline).
The first path we explore is seeing if we can account for it in the GitHub action configuration, but this doesn't seem like the right solution.
We try running the bundle commands with --full-index. No dice.
We try adding irb to the Gemfile. This puts both gems in the Gemfile.lock, but it still won't build.
Finally we decide to downgrade the debug gem and set a pessimistic constraint on it. The build passes, and we can re-evaluate the constraint in the future.
This video covers:
00:00:12 Introduction
00:02:07 Add a backlog item to create a security policy
00:03:58 Take a look at current Gemfile.lock, Rails post about upgrade to 7.0.4.2, and discuss plan of action
00:06:07 Check out a new branch and run `bundle update`
00:07:23 Run RuboCop, examine results, and fix new violations
00:11:11 Run the full test suite
00:11:40 Review the diff, commit, and push
00:15:13 Build fails. Retry. Also fails. Troubleshoot build failure in console. Problem is the debug gem is not writing its dependencies to the Gemfile.lock correctly
00:16:59 Explore trying to modify the GitHub action to solve the problem. Not the right solution.
00:18:10 Try running bundle commands with --full-index. No change
00:19:39 Take a look at the debug gem on rubygems.org
00:21:20 Try throwing in irb as a development and test dependency.
00:23:10 Amend commit and force push.
00:25:00 Build still fails. Downgrade the debug gem and set a pessimistic constraint on it
00:28:02 Amend commit and force push again. Take a look at issues on debug gem while the build is running
00:30:48 Build is passing. Open and merge pull request.
00:32:20 Verify that all the security alerts have been cleared and close issue
00:33:49 Conclusion
#ruby #rails7 #rails #rubyonrails #rubygems #codecast #screencast #github #opensource #minitest #TDD #agile #NerdDice #DnD #roleplaying #softwaredevelopment #learntocode #tailwind #postgresql #rubocop #devise #turbo #controllers #views #selenium #capybara #systemtest #bundler #debug
See other related StatelessCode videos:
Getting Started with Rails 7 27: Add a Stimulus Controller for Client-Side Interaction • Codecast: Getting Started with Rails 7 27:...
Change RuboCop Config to Enable New Cops By Default for a Rails Application • Change RuboCop Config to Enable New Cops B...
Resources that we relied upon for this solution:
RubyGems https://rubygems.org
Debug Gem repo https://github.com/ruby/debug
This video is CC0 - No rights reserved. (YouTube doesn't allow this option when publishing.) All code is released under the UNLICENSE. Stateless Code denies the concept of "intellectual property". Copying is not stealing.