Ruby 3.x, Rails 7, Rails 8, use Appraisals for tests

.github/workflows/test.yml

@@ -7,15 +7,39 @@ on:
   pull_request:
 
 jobs:
-  rspec:
+  tests:
+    name: "RSpec @ Ruby ${{ matrix.ruby }}, Rails ${{ matrix.rails }}"
     runs-on: ubuntu-latest
+    continue-on-error: true
+    env:
+      BUNDLE_GEMFILE: gemfiles/rails_${{ matrix.rails }}.gemfile
     strategy:
       matrix:
         ruby:
-          - "3.0.7"
-          - "3.1.5"
+          - "3.1"
+          - "3.2"
+          - "3.3"
+          - "3.4"
+          - "head"
+        rails:
+          - "6.1"
+          - "7.2"
+          - "8.0"
+        exclude:
+            - ruby: "3.2"
+              rails: "6.1"
+            - ruby: "3.3"
+              rails: "6.1"
+            - ruby: "3.4"
+              rails: "6.1"
+            - ruby: "head"
+              rails: "6.1"
+            - ruby: "3.1"
+              rails: "7.2"
+            - ruby: "3.1"
+              rails: "8.0"
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v4
     - name: Set up Ruby
       uses: ruby/setup-ruby@v1
       with:
@@ -24,15 +48,20 @@ jobs:
     - name: Run rspec
       run: bundle exec rake test
 
-  rubocop:
+  linters:
+    name: "Rubocop @ Ruby ${{ matrix.ruby }}, Rails ${{ matrix.rails }}"
     runs-on: ubuntu-latest
+    continue-on-error: true
+    env:
+      BUNDLE_GEMFILE: gemfiles/rails_${{ matrix.rails }}.gemfile
     strategy:
       matrix:
         ruby:
-          - "3.0.7"
-          - "3.1.5"
+          - "3.4"
+        rails:
+          - "7.2"
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v4
     - name: Set up Ruby
       uses: ruby/setup-ruby@v1
       with:

.gitignore

@@ -8,3 +8,5 @@
 /tmp/
 Gemfile.lock
 *.gem
+.ruby-version
+gemfiles/*.lock

.rubocop.yml

@@ -1,6 +1,6 @@
 AllCops:
   NewCops: enable
-  TargetRubyVersion: 2.6
+  TargetRubyVersion: 3.0
 
 Style/ClassAndModuleChildren:
   Exclude:
@@ -23,10 +23,6 @@ Style/TrailingCommaInHashLiteral:
   EnforcedStyleForMultiline: consistent_comma
 Style/AccessorGrouping:
   EnforcedStyle: separated
-Style/OpenStructUse:
-  Exclude:
-    - test/*_test.rb
-    - test/**/*_test.rb
 
 Layout/LineLength:
   Exclude:

Appraisals

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+SUPPORTED_RAILS_VERSIONS = %w[
+  6.1
+  7.1
+  7.2
+  8.0
+].freeze
+
+SUPPORTED_RAILS_VERSIONS.each do |version|
+  appraise "rails-#{version}" do
+    gem 'rails', "~> #{version}"
+  end
+end

Gemfile

@@ -5,9 +5,8 @@ source 'https://rubygems.org'
 # Specify your gem's dependencies in diffcrypt.gemspec
 gemspec
 
+gem 'appraisal'
 gem 'minitest', '~> 5.0'
 gem 'minitest-reporters', '~> 1.6.0'
 gem 'rake', '~> 13.2'
 gem 'rubocop', '~> 1.25.1'
-gem 'simplecov', '~> 0.22.0', require: false # CodeClimate not compatible with 0.18+ yet - https://github.com/codeclimate/test-reporter/issues/413
-gem 'simplecov-lcov', '< 0.9'

Rakefile

@@ -11,4 +11,4 @@ end
 task default: :test
 
 path = File.expand_path(__dir__)
-Dir.glob("#{path}/lib/diffcrypt/tasks/**/*.rake").sort.each { |f| load f }
+Dir.glob("#{path}/lib/diffcrypt/tasks/**/*.rake").each { load(_1) }

diffcrypt.gemspec

@@ -12,7 +12,7 @@ Gem::Specification.new do |spec|
   spec.description   = 'Diffable encrypted configuration files that can be safely committed into a git repository'
   spec.homepage      = 'https://github.com/diffcrypt/diffcrypt-ruby'
   spec.license       = 'MIT'
-  spec.required_ruby_version = Gem::Requirement.new('>= 2.6.0')
+  spec.required_ruby_version = Gem::Requirement.new('>= 3.0.0')
 
   # spec.metadata["allowed_push_host"] = "TODO: Set to 'http://mygemserver.com'"
 
@@ -29,7 +29,7 @@ Gem::Specification.new do |spec|
   spec.executables = %w[diffcrypt]
   spec.require_paths = ['lib']
 
-  spec.add_runtime_dependency 'activesupport', '>= 6.0', '< 7.2'
+  spec.add_runtime_dependency 'activesupport', '>= 6.0', '< 9.0'
   spec.add_runtime_dependency 'thor', '>= 0.20', '< 2'
   spec.metadata['rubygems_mfa_required'] = 'true'
 end

gemfiles/rails_6.1.gemfile

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+# This file was generated by Appraisal
+
+source 'https://rubygems.org'
+
+gem 'appraisal'
+gem 'concurrent-ruby', '1.3.4' # 1.3.5. breaks with Rails < 7, see https://github.com/ruby-concurrency/concurrent-ruby/commit/d7ce956dacd0b772273d39b8ed31a30cff7ecf38
+gem 'minitest', '~> 5.0'
+gem 'minitest-reporters', '~> 1.6.0'
+gem 'rails', '~> 6.1'
+gem 'rake', '~> 13.2'
+gem 'rubocop', '~> 1.25.1'
+
+gemspec path: '../'

gemfiles/rails_7.2.gemfile

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+# This file was generated by Appraisal
+
+source 'https://rubygems.org'
+
+gem 'appraisal'
+gem 'minitest', '~> 5.0'
+gem 'minitest-reporters', '~> 1.6.0'
+gem 'rails', '~> 7.2'
+gem 'rake', '~> 13.2'
+gem 'rubocop', '~> 1.25.1'
+
+gemspec path: '../'

gemfiles/rails_8.0.gemfile

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+# This file was generated by Appraisal
+
+source 'https://rubygems.org'
+
+gem 'appraisal'
+gem 'minitest', '~> 5.0'
+gem 'minitest-reporters', '~> 1.6.0'
+gem 'rails', '~> 8.0'
+gem 'rake', '~> 13.2'
+gem 'rubocop', '~> 1.25.1'
+
+gemspec path: '../'

lib/diffcrypt/encryptor.rb

@@ -34,16 +34,21 @@ def decrypt(contents)
 
     # @param [Hash] data
     # @return [Hash]
+    # rubocop:disable Metrics/MethodLength
     def decrypt_hash(data)
       data.each do |key, value|
-        data[key] = if value.is_a?(Hash) || value.is_a?(Array)
+        data[key] = case value
+                    when Hash
                       decrypt_hash(value)
+                    when Array
+                      value.map { |v| decrypt_hash(v) }
                     else
                       decrypt_string value
                     end
       end
       data
     end
+    # rubocop:enable Metrics/MethodLength
 
     # @param [String] contents The raw YAML string to be encrypted
     # @param [String, nil] original_encrypted_contents The original (encrypted) content to determine which keys have changed
@@ -73,14 +78,18 @@ def encrypt_string(value)
     end
 
     # TODO: Fix the complexity of this method
-    # rubocop:disable Metrics/PerceivedComplexity, Metrics/MethodLength, Metrics/CyclomaticComplexity
+    # rubocop:disable Metrics/MethodLength, Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity, Metrics/AbcSize
     # @param [Hash] keys
     # @return [Hash]
     def encrypt_values(data, original_data = nil)
       data.each do |key, value|
-        original_encrypted_value = original_data ? original_data[key] : nil
-        data[key] = if value.is_a?(Hash) || value.is_a?(Array)
+        original_encrypted_value = original_data&.dig(key)
+
+        data[key] = case value
+                    when Hash
                       encrypt_values(value, original_encrypted_value)
+                    when Array
+                      value.map.with_index { |v, i| encrypt_values(v, original_encrypted_value&.dig(i)) }
                     else
                       original_decrypted_value = original_encrypted_value ? decrypt_string(original_encrypted_value) : nil
                       key_changed = original_decrypted_value.nil? || original_decrypted_value != value
@@ -89,7 +98,7 @@ def encrypt_values(data, original_data = nil)
       end
       data.sort.to_h
     end
-    # rubocop:enable Metrics/PerceivedComplexity, Metrics/MethodLength, Metrics/CyclomaticComplexity
+    # rubocop:enable Metrics/MethodLength, Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity, Metrics/AbcSize
 
     # @param [String] value The encrypted value that needs decrypting
     # @return [String]

test/diffcrypt/encryptor_test.rb

@@ -46,12 +46,21 @@ def test_it_encrypts_root_values
   def test_it_decrypts_nested_structures
     encrypted_content = <<~CONTENT
       data:
+        array:
+        - item1: 7HJjrwQ6KqH+jvu1pOZGqQ==--E2ipnCNCszD6oixM--QZapG/8wrPtwbUVDe9evsw==
+          subitem: oNNLBGwL45VvOv7elkRTHZTcNQ==--iFBc53R3F26zsvTK--6iEtqH7TR7TSS6fJOHwfPg==
+        - item2: IvwdxcAV+38MvNsKYdNCEg==--6y7Aj4nmFLOTGrx3--rRH8ni3yks2eid91jde2hg==
         secret_key_base: 88Ry6HESUoXBr6QUFXmni9zzfCIYt9qGNFvIWFcN--4xoecI5mqbNRBibI--62qPJbkzzh5h8lhFEFOSaQ==
         aws:
           access_key_id: Ot/uCTEL+8kp61EPctnxNlg=--Be6sg7OdvjZlfxgR--7qRbbf0lA4VgjnUGUrrFwg==
+
     CONTENT
     expected = <<~CONTENT
       ---
+      array:
+      - item1: value1
+        subitem: value sub
+      - item2: value2
       secret_key_base: secret_key_base_test
       aws:
         access_key_id: AKIAXXX
@@ -66,8 +75,12 @@ def test_it_encrypts_nested_structures
       secret_key_base: secret_key_base_test
       aws:
         access_key_id: AKIAXXX
+      array:
+      - item1: value1
+        subitem: value sub
+      - item2: value2
     CONTENT
-    expected_pattern = /---\naws:\n  access_key_id: #{ENCRYPTED_VALUE_PATTERN}\nsecret_key_base: #{ENCRYPTED_VALUE_PATTERN}\n/
+    expected_pattern = /---\narray:\n- item1: #{ENCRYPTED_VALUE_PATTERN}\n  subitem: #{ENCRYPTED_VALUE_PATTERN}\n- item2: #{ENCRYPTED_VALUE_PATTERN}\naws:\n  access_key_id: #{ENCRYPTED_VALUE_PATTERN}\nsecret_key_base: #{ENCRYPTED_VALUE_PATTERN}/
 
     assert_match expected_pattern, Diffcrypt::Encryptor.new(TEST_KEY_128, cipher: 'aes-128-gcm').encrypt_data(content).to_yaml
   end
@@ -82,6 +95,14 @@ def test_it_only_updates_changed_values
     assert_match expected_pattern, Diffcrypt::Encryptor.new(TEST_KEY_128, cipher: 'aes-128-gcm').encrypt_data(updated_content, original_encrypted_content).to_yaml
   end
 
+  def test_it_only_updates_changed_values_for_arrays
+    original_encrypted_content = "---\ndata:\n  array:\n  - item1: 7HJjrwQ6KqH+jvu1pOZGqQ==--E2ipnCNCszD6oixM--QZapG/8wrPtwbUVDe9evsw==\n  - item2: IvwdxcAV+38MvNsKYdNCEg==--6y7Aj4nmFLOTGrx3--rRH8ni3yks2eid91jde2hg==\n"
+    updated_content = "---\narray:\n  - item1: value1\n  - item2: value2"
+    expected_pattern = %r{---\narray:\n- item1: 7HJjrwQ6KqH\+jvu1pOZGqQ==--E2ipnCNCszD6oixM--QZapG/8wrPtwbUVDe9evsw==\n- item2: IvwdxcAV\+38MvNsKYdNCEg==--6y7Aj4nmFLOTGrx3--rRH8ni3yks2eid91jde2hg==\n}
+
+    assert_match expected_pattern, Diffcrypt::Encryptor.new(TEST_KEY_128, cipher: 'aes-128-gcm').encrypt_data(updated_content, original_encrypted_content).to_yaml
+  end
+
   def test_it_assumes_changed_when_no_original_value
     original_encrypted_content = "---\ndata:\n  secret_key_base_1: 88Ry6HESUoXBr6QUFXmni9zzfCIYt9qGNFvIWFcN--4xoecI5mqbNRBibI--62qPJbkzzh5h8lhFEFOSaQ==\n"
     updated_content = "---\nsecret_key_base_1: secret_key_base_test\naws:\n  access_key_id: new_value\n"

test/diffcrypt/rails/application_helper_test.rb

@@ -7,10 +7,10 @@
 class MockApplication
   include Diffcrypt::Rails::ApplicationHelper
 
+  Config = Struct.new(:require_master_key)
+
   def config
-    OpenStruct.new(
-      require_master_key: true,
-    )
+    Config.new(true)
   end
 end
 

test/test_helper.rb

@@ -1,19 +1,5 @@
 # frozen_string_literal: true
 
-require 'simplecov'
-require 'simplecov-lcov'
-SimpleCov::Formatter::LcovFormatter.config.report_with_single_file = true
-SimpleCov::Formatter::LcovFormatter.config do |c|
-  c.single_report_path = 'coverage/lcov.info'
-end
-SimpleCov.formatters = SimpleCov::Formatter::MultiFormatter.new(
-  [
-    SimpleCov::Formatter::HTMLFormatter,
-    SimpleCov::Formatter::LcovFormatter,
-  ],
-)
-SimpleCov.start
-
 $LOAD_PATH.unshift File.expand_path('../lib', __dir__)
 require 'diffcrypt'