Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 24 additions & 0 deletions .github/workflows/ci.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@
name: CI

on:
push:
branches: [main]
pull_request:

jobs:
test:
runs-on: ubuntu-latest
strategy:
fail-fast: false
matrix:
ruby: ["3.1", "3.4"]
steps:
- uses: actions/checkout@v5

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Restrict and avoid persisting the workflow token.

actions/checkout leaves the token in local git config by default; later PR-controlled dependency installation can access it. Set read-only permissions and disable credential persistence.

Proposed fix
 jobs:
   test:
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
@@
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- uses: actions/checkout@v5
jobs:
test:
permissions:
contents: read
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v5
with:
persist-credentials: false
🧰 Tools
🪛 zizmor (1.28.0)

[warning] 16-16: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci.yml at line 16, Update the actions/checkout step in the
CI workflow to disable persisted credentials and restrict the workflow token to
read-only permissions. Configure checkout with persist-credentials disabled and
set the job or workflow permissions to only the minimum required read access,
preserving the existing checkout behavior.

Source: Linters/SAST tools

- uses: ruby/setup-ruby@v1
with:
ruby-version: ${{ matrix.ruby }}
- run: bundle install --jobs 4 --retry 3
- run: bundle exec rspec
- run: bundle exec rubocop
- run: bundle exec ruby scripts/resource_audit.rb
- run: gem build featbit-server-sdk.gemspec
10 changes: 10 additions & 0 deletions .gitignore
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
/.bundle/
/coverage/
/pkg/
/vendor/bundle/
/*.gem
/Gemfile.lock
/examples/*/.bundle/
/examples/*/Gemfile.lock
/examples/Rails/log/
/examples/Rails/tmp/
50 changes: 50 additions & 0 deletions .rubocop.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,50 @@
AllCops:
TargetRubyVersion: 3.1
NewCops: enable
SuggestExtensions: false
Exclude:
- "vendor/**/*"

Layout/EndOfLine:
Enabled: false

Layout/LineLength:
Max: 140

Style/StringLiterals:
EnforcedStyle: double_quotes

Style/Documentation:
Enabled: false

Metrics/AbcSize:
Max: 100

Metrics/ClassLength:
Max: 250

Metrics/BlockLength:
Exclude:
- "spec/**/*"

Metrics/CyclomaticComplexity:
Max: 50

Metrics/MethodLength:
Max: 35

Metrics/PerceivedComplexity:
Max: 50

Metrics/ParameterLists:
Max: 20

Style/OptionalBooleanParameter:
Enabled: false

Naming/PredicateMethod:
AllowedMethods:
- close
- enqueue
- flush
- post_batch
11 changes: 11 additions & 0 deletions CHANGELOG.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
# Changelog

## 0.1.0

- Initial FeatBit Ruby Server SDK.
- Local typed evaluation with variation IDs and evaluation reasons.
- WebSocket data synchronization, event batching, status listeners, offline bootstrap, and safe public APIs.
- Console and Rails examples aligned with the .NET Server SDK documentation.
- Hardened event shutdown, reconnect cleanup, cyclic segment evaluation, immutable users, and per-entity patch versions.
- Fixed live WebSocket token encoding and callback context handling.
- Matched FeatBit's event wire types and enforced configured batch limits during explicit flush.
9 changes: 9 additions & 0 deletions Gemfile
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
# frozen_string_literal: true

source "https://rubygems.org"

gemspec

gem "rake", "~> 13.2"
gem "rspec", "~> 3.13"
gem "rubocop", "~> 1.75", require: false
77 changes: 77 additions & 0 deletions Gemfile.lock
Original file line number Diff line number Diff line change
@@ -0,0 +1,77 @@
PATH
remote: .
specs:
featbit-server-sdk (0.1.0)
logger (~> 1.6)
websocket-client-simple (~> 0.9)

GEM
remote: https://rubygems.org/
specs:
ast (2.4.3)
base64 (0.3.0)
diff-lcs (1.6.2)
event_emitter (0.2.6)
json (2.21.1)
language_server-protocol (3.17.0.6)
lint_roller (1.1.0)
logger (1.6.4)
mutex_m (0.3.0)
parallel (2.1.0)
parser (3.3.12.0)
ast (~> 2.4.1)
racc
prism (1.9.0)
racc (1.8.1)
rainbow (3.1.1)
rake (13.4.2)
regexp_parser (2.12.0)
rspec (3.13.2)
rspec-core (~> 3.13.0)
rspec-expectations (~> 3.13.0)
rspec-mocks (~> 3.13.0)
rspec-core (3.13.6)
rspec-support (~> 3.13.0)
rspec-expectations (3.13.5)
diff-lcs (>= 1.2.0, < 2.0)
rspec-support (~> 3.13.0)
rspec-mocks (3.13.8)
diff-lcs (>= 1.2.0, < 2.0)
rspec-support (~> 3.13.0)
rspec-support (3.13.7)
rubocop (1.88.2)
json (~> 2.3)
language_server-protocol (~> 3.17.0.2)
lint_roller (~> 1.1.0)
parallel (>= 1.10)
parser (>= 3.3.0.2)
rainbow (>= 2.2.2, < 4.0)
regexp_parser (>= 2.9.3, < 3.0)
rubocop-ast (>= 1.49.0, < 2.0)
ruby-progressbar (~> 1.7)
unicode-display_width (>= 2.4.0, < 4.0)
rubocop-ast (1.50.0)
parser (>= 3.3.7.2)
prism (~> 1.7)
ruby-progressbar (1.13.0)
unicode-display_width (3.2.0)
unicode-emoji (~> 4.1)
unicode-emoji (4.2.0)
websocket (1.2.11)
websocket-client-simple (0.9.0)
base64
event_emitter
mutex_m
websocket

PLATFORMS
x64-mingw-ucrt

DEPENDENCIES
featbit-server-sdk!
rake (~> 13.2)
rspec (~> 3.13)
rubocop (~> 1.75)

BUNDLED WITH
2.6.9
Loading