ci: audit every matrix resolution against the advisory database

.github/workflows/ci.yml

@@ -103,6 +103,12 @@ jobs:
         with:
           ruby-version: ${{ matrix.ruby }}
           bundler-cache: true
+      # The matrix gemfiles have no lockfile of their own: setup-ruby's bundle
+      # install resolved this entry and wrote one next to the gemfile
+      # (gemfiles/standalone.gemfile.lock, gitignored). rake spec:standalone
+      # audits that resolution first (audit:advisories -> bin/audit-advisories,
+      # wired in the Rakefile): an advisory fails this entry even when the
+      # specs would pass.
       - name: Compile + RSpec (spec/gem without Rails)
         run: bundle exec rake spec:standalone
 
@@ -205,6 +211,11 @@ jobs:
         with:
           ruby-version: ${{ matrix.ruby }}
           bundler-cache: true
+      # The matrix gemfiles have no lockfile of their own: setup-ruby's bundle
+      # install resolved this entry and wrote one next to the gemfile
+      # (gemfiles/standalone.gemfile.lock, gitignored). rake spec:standalone
+      # audits that resolution first (audit:advisories -> bin/audit-advisories):
+      # an advisory fails this entry even when the specs would pass.
       # spec:standalone compiles first: on JRuby that builds the Java escaper
       # jar (ext/java), on TruffleRuby extconf.rb no-ops (pure Ruby is faster).
       - name: RSpec (spec/gem without Rails)
@@ -244,7 +255,13 @@ jobs:
         with:
           ruby-version: .ruby-version
           bundler-cache: true
-      - run: bundle exec rake compile
+      # The matrix gemfiles have no lockfile of their own: setup-ruby's bundle
+      # install resolved this entry and wrote one next to the gemfile
+      # (gemfiles/rails.gemfile.lock, gitignored). rake compile audits that
+      # resolution first (audit:advisories -> bin/audit-advisories): an
+      # advisory fails this entry before anything compiles or runs.
+      - name: Compile
+        run: bundle exec rake compile
       - name: Resolved versions
         run: bundle list | grep -E ' (rails|view_component|phlex-rails|rspec-rails|sqlite3) '
       - name: RSpec (integration specs)

AGENTS.md

@@ -114,6 +114,7 @@ Writing ruby2html templates/components (here or in a user app)? Load [`llms.txt`
 11. Public API used downstream — `Render.new(ctx, &blk)`, `#render`, `#plain`, `#component`, tag methods, `Ruby2html.escape_html`, `Ruby2html.native?`, `Ruby2html::Component`, `RailsHelper#html`, `ComponentHelper#html` / `#__ruby2html_renderer__`, the `.rb` handler, `HtmlBeautifierMiddleware` — breaking changes need a CHANGELOG entry ("Upgrading to 2.0") and a major bump.
 12. Style: rubocop-rails_config, single quotes, `# frozen_string_literal: true`, nested modules, Rails-style indented `private` methods. C: gnu99, no warnings under `-Wall -Wextra`.
 13. Never commit `lib/ruby2html/*.so`, `*.jar`, `*.class`, `tmp/`, `pkg/`, `*.gem`, `log/`.
+14. **Accepted advisories are a last resort, not a mute button**: `bin/audit-advisories` accepts only advisories that upstream patched for newer lines than the ones CI tests (the Rails 7.2 floor, Active Support 7.2.x on Ruby 3.1), each scoped to the exact reviewed version the lockfile resolves — a moved resolution drops every exception and fails the audit until the list is re-reviewed, and `spec/ci/advisory_audit_spec.rb` pins the list. Keep the root lock and every matrix resolution on patched releases, and drop an entry as soon as upstream ships a patch for the line it covers. After every Rails or Ruby bump, re-derive the list with the exceptions **switched off** — `bundle-audit check --update --gemfile-lock <matrix lock>` with no `--ignore` (temporarily empty `ACCEPTED_ADVISORIES`): what it still reports needs an entry scoped to the resolved version, what it stops reporting is stale and its entry must go (re-running the audit *with* the exceptions cannot show this). A new floor line joining the generated matrix inherits no exceptions: audit its resolution with the exceptions switched off before it joins.
 
 ## Maintenance model
 

CHANGELOG.md

@@ -9,6 +9,7 @@ Entries before 1.6.6 were reconstructed from `git log` and RubyGems release date
 ### Changed
 
 - CI now audits every matrix entry's resolved dependency set against the Ruby advisory database — the `audit` job only checked the committed root `Gemfile.lock`, which keeps its own `bundle-audit` job. The matrix jobs install an unlocked gemfile, so Bundler resolves it during the job and writes the lockfile next to it (`gemfiles/standalone.gemfile.lock`, `gemfiles/rails.gemfile.lock`); the audit of that resolved lockfile rides on `rake compile` (`audit:advisories` → `bin/audit-advisories`), the task every matrix entry already runs, so each entry audits the set it actually installed, in the job that installed it. An advisory now fails the matrix entry and, with it, the aggregate `CI OK` job — except the advisories of the floor lines the matrix resolves on purpose (Rails 7.2.x, Active Support 7.2.x on Ruby 3.1, where Active Support 8 does not install): upstream patches those lines no more, so they are listed by advisory id in `bin/audit-advisories` and accepted only when the lockfile resolves the exact reviewed version (the five Rails-line components at 7.2.3, pinned by the rails 7.2 gem; Active Support, which the standalone gemfile on Ruby 3.1 resolves unlocked, additionally at 7.2.4 — that patch fixes three of its four advisories, while the `safe_constantize` DoS (`GHSA-8474-xrp6-wh69`) is fixed only in the 8.x lines) — a moved resolution drops every exception and fails the audit until the list is re-reviewed. The audit also rides on the `spec` tasks, so `SKIP_COMPILE=1` (strict extension builds, the pure-Ruby fallback) cannot drop it, and a signal-killed `bundle-audit` is reported as killed instead of looking like an advisory result. Every other line (Rails 8.0, 8.1, Active Support 8) is audited without any exception, and an advisory that is not listed still fails the entry.
+- Development dependencies: the root `Gemfile.lock` moves to Rails 8.1.4.1 (a security patch release). No gem code changed.
 
 ### Fixed