Skip to content

Harden gemspec files list to an explicit git-tracked allowlist (herb-embedded-78l) #52

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jleo3 merged 1 commit into from
Aug 18, 2026
Merged

Harden gemspec files list to an explicit git-tracked allowlist (herb-embedded-78l) #52

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 12 additions & 1 deletion herb-embedded.gemspec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,18 @@ Gem::Specification.new do |spec|
spec.summary = "Embedded Herb linter for Ruby via a pluggable JavaScript engine adapter"
spec.required_ruby_version = ">= 3.2"

spec.files = Dir["lib/**/*.rb"] + Dir["vendor/**/*.js"] + Dir["js/**/*.js"] + Dir["exe/*"]
# An explicit git-tracked allowlist, not Dir[] globs: a pushed gem is
# public and widely mirrored, so a stray file that happens to match a
# broad glob (a local debug script, an untracked scratch file) would
# ship with no review catching it before `gem push` — and a published
# version can only be yanked, not recalled from whoever already has it.
# See guides.rubygems.org/security.
spec.files = `git ls-files -z`.split("\x0").select do |file|
file.match?(%r{\Alib/.*\.rb\z}) ||
file.match?(%r{\Avendor/.*\.js\z}) ||
file.match?(%r{\Ajs/.*\.js\z}) ||
file.match?(%r{\Aexe/[^/]+\z})
end
spec.require_paths = ["lib"]
spec.bindir = "exe"
spec.executables = ["herb-lint-rb"]
Expand Down
Loading