Ruby SBOM Guide: Gems, Bundler, and Rails Security

# Install CycloneDX Ruby gem globally
gem install cyclonedx-ruby

# Verify installation
cyclonedx-ruby --version

# Check bundler integration
bundle exec cyclonedx-ruby --help

# Gemfile
group :development do
  gem 'cyclonedx-ruby', require: false
end

# Or for security-focused projects
group :development, :test do
  gem 'cyclonedx-ruby', require: false
  gem 'bundler-audit', require: false
  gem 'license_finder', require: false
end

# Install project dependencies
bundle install

# Generate SBOM via bundle exec
bundle exec cyclonedx-ruby

# Install Syft with Ruby support
curl -sSfL https://get.anchore.io/syft | sh -s -- -b /usr/local/bin

# Test Ruby gem detection
syft . --catalogers ruby-gemfile-cataloger,ruby-gemspec-cataloger

# Verify Bundler.lock parsing
syft Gemfile.lock --catalogers ruby-gemfile-cataloger

# Install bundler-audit for security scanning
gem install bundler-audit

# Update vulnerability database
bundle-audit update

# Install license finder for compliance
gem install license_finder

# SPDX tooling is format-oriented rather than Bundler-specific
pip install spdx-tools

<!-- .idea/runConfigurations/Generate_SBOM.xml -->
<component name="ProjectRunConfigurationManager">
  <configuration default="false" name="Generate SBOM" type="RubyRunConfigurationType" factoryName="Ruby">
    <module name="$PROJECT_NAME$" />
    <RUBY_RUN_CONFIG NAME="RUBY_ARGS" VALUE="" />
    <RUBY_RUN_CONFIG NAME="WORK DIR" VALUE="$MODULE_DIR$" />
    <RUBY_RUN_CONFIG NAME="SHOULD_USE_SDK" VALUE="false" />
    <RUBY_RUN_CONFIG NAME="ALTERN_SDK_NAME" VALUE="" />
    <RUBY_RUN_CONFIG NAME="myPassParentEnvs" VALUE="true" />
    <EXTENSION ID="BundlerRunConfigurationExtension" BUNDLE_MODE="AUTO" bundleExecEnabled="true" />
    <RUBY_RUN_CONFIG NAME="SCRIPT_PATH" VALUE="$USER_HOME$/.gem/bin/cyclonedx-ruby" />
    <RUBY_RUN_CONFIG NAME="SCRIPT_ARGS" VALUE="--output sbom.json --format json" />
    <method v="2" />
  </configuration>
</component>

// .vscode/tasks.json
{
    "version": "2.0.0",
    "tasks": [
        {
            "label": "Generate Ruby SBOM",
            "type": "shell",
            "command": "bundle",
            "args": ["exec", "cyclonedx-ruby", "--output", "sbom.json"],
            "group": "build",
            "presentation": {
                "echo": true,
                "reveal": "always",
                "focus": false,
                "panel": "shared",
                "clear": true
            },
            "problemMatcher": []
        },
        {
            "label": "Security Audit",
            "type": "shell",
            "command": "bundle",
            "args": ["audit"],
            "group": "test",
            "presentation": {
                "echo": true,
                "reveal": "always"
            },
            "dependsOrder": "sequence",
            "dependsOn": ["Generate Ruby SBOM"]
        },
        {
            "label": "License Check",
            "type": "shell",
            "command": "license_finder",
            "args": ["--format", "json", "--save", "licenses.json"],
            "group": "build"
        }
    ]
}

#!/bin/bash
# .git/hooks/pre-commit - Ruby SBOM pre-commit hook

echo "🔍 Generating Ruby SBOM and running security checks..."

# Check if Gemfile or Gemfile.lock changed
if git diff --cached --name-only | grep -E "(Gemfile|Gemfile\.lock)" > /dev/null; then
    echo "📦 Bundle files changed, updating SBOM and security analysis..."

    # Ensure dependencies are installed
    if ! bundle check > /dev/null 2>&1; then
        echo "Installing bundle dependencies..."
        bundle install
    fi

    # Generate SBOM
    if command -v cyclonedx-ruby > /dev/null; then
        cyclonedx-ruby --output sbom.json --format json
        git add sbom.json
    else
        echo "⚠️  cyclonedx-ruby not found, using bundle exec"
        bundle exec cyclonedx-ruby --output sbom.json --format json
        git add sbom.json
    fi

    # Security audit
    if command -v bundle-audit > /dev/null; then
        echo "🔍 Running security audit..."
        bundle-audit check --update
        if [ $? -ne 0 ]; then
            echo "❌ Security vulnerabilities found! Please address before committing."
            exit 1
        fi
    fi

    echo "✅ SBOM generated and security check passed"
else
    echo "ℹ️  No bundle changes detected"
fi

# Navigate to Rails project
cd my-rails-app

# Generate basic SBOM
cyclonedx-ruby

# Generate with specific options
cyclonedx-ruby \
  --output rails-sbom.json \
  --format json \
  --app-name "My Rails App" \
  --app-version "1.0.0"

# Include only production gems
cyclonedx-ruby \
  --output production-sbom.json \
  --format json \
  --without development test

# Example Gemfile for modern Rails app
source 'https://rubygems.org'
git_source(:github) { |repo| "https://github.com/#{repo}.git" }

ruby '3.2.0'

# Core Rails gems
gem 'rails', '~> 7.1.0'
gem 'sprockets-rails', '>= 2.0.0'
gem 'pg', '~> 1.1'
gem 'puma', '>= 5.0'
gem 'importmap-rails'
gem 'turbo-rails'
gem 'stimulus-rails'
gem 'jbuilder'

# Authentication & Authorization
gem 'devise'
gem 'cancancan'

# Background Jobs
gem 'sidekiq'
gem 'redis', '>= 4.0.1'

# Monitoring & Performance
gem 'bootsnap', require: false
gem 'image_processing', '~> 1.2'

group :development, :test do
  gem 'debug', platforms: %i[ mri mingw x64_mingw ]
  gem 'rspec-rails'
  gem 'factory_bot_rails'
  gem 'capybara'
  gem 'selenium-webdriver'
end

group :development do
  gem 'web-console'
  gem 'listen', '~> 3.3'
  gem 'spring'

  # SBOM and security tools
  gem 'cyclonedx-ruby', require: false
  gem 'bundler-audit', require: false
  gem 'brakeman', require: false
end

# Generate environment-specific SBOMs
RAILS_ENV=production bundle exec cyclonedx-ruby --output production-sbom.json
RAILS_ENV=development bundle exec cyclonedx-ruby --output development-sbom.json
RAILS_ENV=test bundle exec cyclonedx-ruby --output test-sbom.json

# Example Sinatra Gemfile
source 'https://rubygems.org'

ruby '3.2.0'

# Core application
gem 'sinatra'
gem 'sinatra-contrib'
gem 'thin'

# Database
gem 'sequel'
gem 'pg'

# JSON handling
gem 'oj'
gem 'multi_json'

# HTTP client
gem 'faraday'
gem 'faraday-retry'

# Background processing
gem 'resque'

group :development do
  gem 'rerun'
  gem 'cyclonedx-ruby', require: false
end

group :test do
  gem 'rack-test'
  gem 'minitest'
end

# Generate Sinatra SBOM
cd sinatra-app
cyclonedx-ruby \
  --output sinatra-sbom.json \
  --format json \
  --app-name "Sinatra API" \
  --app-type application

# Jekyll Gemfile
source 'https://rubygems.org'

gem 'jekyll', '~> 4.3.0'

# Jekyll plugins
group :jekyll_plugins do
  gem 'jekyll-feed', '~> 0.12'
  gem 'jekyll-sitemap'
  gem 'jekyll-seo-tag'
  gem 'jekyll-archives'
  gem 'jekyll-paginate-v2'
end

# Development tools
group :development do
  gem 'webrick', '~> 1.7'
  gem 'cyclonedx-ruby', require: false
end

# Platform-specific gems
platforms :mingw, :x64_mingw, :mswin, :jruby do
  gem 'tzinfo', '>= 1', '< 3'
  gem 'tzinfo-data'
end

gem 'wdm', '~> 0.1.1', :platforms => [:mingw, :x64_mingw, :mswin]

# Generate Jekyll SBOM
cyclonedx-ruby \
  --output jekyll-sbom.json \
  --format json \
  --app-name "Jekyll Site" \
  --app-type library \
  --include-development

# Complex multi-platform Gemfile
source 'https://rubygems.org'

ruby '3.2.0'

# Core gems
gem 'rake'
gem 'thor'

# Database adapters by platform
gem 'pg', '~> 1.1', platforms: :ruby
gem 'activerecord-jdbcpostgresql-adapter', platforms: :jruby

# JSON parsing optimized by platform
gem 'oj', platforms: :ruby
gem 'json', platforms: :jruby

# Platform-specific native extensions
platforms :ruby do
  gem 'ffi'
  gem 'nio4r'
end

platforms :jruby do
  gem 'jruby-openssl'
end

# Windows-specific
platforms :mingw, :x64_mingw, :mswin do
  gem 'tzinfo-data'
  gem 'wdm', '>= 0.1.0'
end

group :development, :test do
  gem 'cyclonedx-ruby', require: false
  gem 'bundler-audit', require: false
end

# Generate platform-specific SBOMs
bundle lock --add-platform ruby
bundle lock --add-platform jruby
bundle lock --add-platform x64-mingw32

# Generate SBOM for specific platform
cyclonedx-ruby --output ruby-platform-sbom.json --platform ruby
cyclonedx-ruby --output jruby-platform-sbom.json --platform jruby
cyclonedx-ruby --output windows-platform-sbom.json --platform x64-mingw32

# lib/tasks/sbom.rake
namespace :sbom do
  desc "Generate SBOM for the Rails application"
  task generate: :environment do
    require 'cyclonedx/ruby'

    puts "🔍 Generating SBOM for #{Rails.application.class.module_parent_name}..."

    # Determine output file based on environment
    environment = Rails.env
    output_file = "sbom-#{environment}.json"

    # Generate SBOM with Rails context
    generator = CycloneDX::Ruby::BillOfMaterials.new(
      app_name: Rails.application.class.module_parent_name,
      app_version: app_version,
      app_type: 'application'
    )

    sbom = generator.generate

    # Add Rails-specific metadata
    sbom['metadata']['properties'] ||= []
    sbom['metadata']['properties'] += [
      { 'name' => 'rails.version', 'value' => Rails.version },
      { 'name' => 'rails.environment', 'value' => Rails.env },
      { 'name' => 'ruby.version', 'value' => RUBY_VERSION },
      { 'name' => 'ruby.platform', 'value' => RUBY_PLATFORM }
    ]

    # Write SBOM file
    File.write(output_file, JSON.pretty_generate(sbom))

    puts "✅ SBOM generated: #{output_file}"

    # Display summary
    component_count = sbom['components']&.length || 0
    puts "📦 Components: #{component_count}"

    # License summary
    licenses = extract_licenses(sbom)
    puts "📄 Unique licenses: #{licenses.length}"
    licenses.take(5).each { |license| puts "  • #{license}" }
  end

  desc "Generate SBOM for production environment"
  task production: :environment do
    ENV['RAILS_ENV'] = 'production'
    Rake::Task['sbom:generate'].invoke
  end

  desc "Generate and validate SBOM"
  task validate: :generate do
    output_file = "sbom-#{Rails.env}.json"

    puts "🔍 Validating SBOM..."

    begin
      sbom = JSON.parse(File.read(output_file))

      # Basic validation
      required_fields = %w[bomFormat specVersion serialNumber version metadata components]
      missing_fields = required_fields.reject { |field| sbom.key?(field) }

      if missing_fields.empty?
        puts "✅ SBOM validation passed"
      else
        puts "❌ SBOM validation failed - missing fields: #{missing_fields.join(', ')}"
        exit 1
      end

    rescue JSON::ParserError => e
      puts "❌ SBOM validation failed - invalid JSON: #{e.message}"
      exit 1
    end
  end

  desc "Security audit with SBOM context"
  task security: :generate do
    puts "🔍 Running security audit..."

    # Run bundler-audit
    system('bundle-audit check --update')
    audit_status = $?.exitstatus

    if audit_status == 0
      puts "✅ No known security vulnerabilities found"
    else
      puts "⚠️  Security vulnerabilities detected - check bundler-audit output"
    end

    # Enhanced security analysis using SBOM
    sbom_file = "sbom-#{Rails.env}.json"
    analyze_security_context(sbom_file)
  end

  private

  def app_version
    # Try multiple sources for version
    return ENV['APP_VERSION'] if ENV['APP_VERSION']

    # Try git describe
    begin
      version = `git describe --tags --abbrev=0 2>/dev/null`.strip
      return version unless version.empty?
    rescue
      # Git not available or no tags
    end

    # Fallback to timestamp
    Time.now.strftime('%Y%m%d.%H%M%S')
  end

  def extract_licenses(sbom)
    licenses = Set.new

    sbom['components']&.each do |component|
      component['licenses']&.each do |license|
        license_name = license.dig('license', 'name') || license.dig('license', 'id')
        licenses.add(license_name) if license_name
      end
    end

    licenses.to_a.sort
  end

  def analyze_security_context(sbom_file)
    return unless File.exist?(sbom_file)

    sbom = JSON.parse(File.read(sbom_file))
    components = sbom['components'] || []

    puts "\n📊 Security Context Analysis:"
    puts "=" * 40

    # Analyze component ages (would need external API calls)
    old_components = components.select { |c| component_old?(c) }
    if old_components.any?
      puts "⚠️  Old components (>2 years): #{old_components.length}"
      old_components.take(3).each do |comp|
        puts "  • #{comp['name']} (#{comp['version']})"
      end
    end

    # Check for pre-release versions
    prerelease_components = components.select { |c| prerelease_version?(c['version']) }
    if prerelease_components.any?
      puts "🚨 Pre-release components: #{prerelease_components.length}"
      prerelease_components.each do |comp|
        puts "  • #{comp['name']} (#{comp['version']})"
      end
    end

    # License risk analysis
    risky_licenses = %w[GPL-3.0 AGPL-3.0 GPL-2.0]
    risky_components = components.select do |comp|
      comp['licenses']&.any? do |license|
        license_id = license.dig('license', 'id') || license.dig('license', 'name')
        risky_licenses.include?(license_id)
      end
    end

    if risky_components.any?
      puts "⚖️  Components with restrictive licenses: #{risky_components.length}"
      risky_components.each do |comp|
        puts "  • #{comp['name']}"
      end
    end
  end

  def component_old?(component)
    # This would require API calls to RubyGems to get publish dates
    # Simplified check for now
    false
  end

  def prerelease_version?(version)
    return false unless version

    version.match?(/[a-zA-Z]/) # Contains letters (alpha, beta, rc, etc.)
  end
end

# config/initializers/sbom.rb
if Rails.env.development?
  Rails.application.configure do
    # Add SBOM generation to Rails commands
    config.generators do |g|
      g.after_generate do |files|
        if files.any? { |f| f.include?('Gemfile') }
          puts "Gemfile modified - consider regenerating SBOM"
        end
      end
    end
  end

  # Register SBOM middleware for development
  class SbomMiddleware
    def initialize(app)
      @app = app
    end

    def call(env)
      status, headers, response = @app.call(env)

      # Add SBOM endpoint in development
      if env['PATH_INFO'] == '/sbom.json'
        sbom_file = Rails.root.join('sbom-development.json')

        if File.exist?(sbom_file)
          sbom_content = File.read(sbom_file)
          return [
            200, 
            { 'Content-Type' => 'application/json' },
            [sbom_content]
          ]
        else
          return [
            404,
            { 'Content-Type' => 'text/plain' },
            ['SBOM not found - run: rails sbom:generate']
          ]
        end
      end

      [status, headers, response]
    end
  end

  Rails.application.config.middleware.use SbomMiddleware
end

# lib/sinatra/sbom.rb
require 'sinatra/base'
require 'json'

module Sinatra
  module SBOM
    module Helpers
      def sbom_info
        @sbom_info ||= load_sbom_info
      end

      def sbom_component_count
        sbom_info.dig('components')&.length || 0
      end

      def sbom_licenses
        licenses = Set.new

        sbom_info.dig('components')&.each do |component|
          component['licenses']&.each do |license|
            license_name = license.dig('license', 'name') || license.dig('license', 'id')
            licenses.add(license_name) if license_name
          end
        end

        licenses.to_a.sort
      end

      private

      def load_sbom_info
        sbom_file = File.join(settings.root, 'sbom.json')

        if File.exist?(sbom_file)
          JSON.parse(File.read(sbom_file))
        else
          generate_sbom_on_demand
        end
      end

      def generate_sbom_on_demand
        return {} unless development?

        puts "Generating SBOM on demand..."

        system('cyclonedx-ruby --output sbom.json --format json')

        if File.exist?('sbom.json')
          JSON.parse(File.read('sbom.json'))
        else
          {}
        end
      end
    end

    def self.registered(app)
      app.helpers SBOM::Helpers

      # Add SBOM endpoint
      app.get '/sbom' do
        content_type :json
        sbom_info.to_json
      end

      # SBOM summary endpoint
      app.get '/sbom/summary' do
        content_type :json

        {
          component_count: sbom_component_count,
          licenses: sbom_licenses,
          generated_at: sbom_info.dig('metadata', 'timestamp'),
          application: {
            name: sbom_info.dig('metadata', 'component', 'name'),
            version: sbom_info.dig('metadata', 'component', 'version')
          }
        }.to_json
      end
    end
  end

  register SBOM
end

# app.rb
require 'sinatra'
require_relative 'lib/sinatra/sbom'

class MyApp < Sinatra::Base
  register Sinatra::SBOM

  get '/' do
    erb :index
  end

  get '/health' do
    content_type :json

    {
      status: 'healthy',
      components: sbom_component_count,
      licenses: sbom_licenses.length,
      timestamp: Time.now.iso8601
    }.to_json
  end
end

# _plugins/sbom_generator.rb
require 'jekyll'
require 'json'
require 'fileutils'

module Jekyll
  class SbomGenerator < Generator
    safe true
    priority :low

    def generate(site)
      return unless site.config['sbom']&.fetch('enabled', false)

      puts "Generating SBOM for Jekyll site..."

      sbom_config = site.config['sbom'] || {}
      output_file = sbom_config.fetch('output', '_site/sbom.json')

      # Generate SBOM
      system("cyclonedx-ruby --output #{output_file} --format json --app-name '#{site.config['title']}' --app-type library")

      if File.exist?(output_file)
        # Add Jekyll-specific metadata
        enhance_sbom_with_jekyll_info(output_file, site)

        # Create SBOM page if requested
        if sbom_config.fetch('create_page', false)
          create_sbom_page(site, output_file)
        end

        puts "✅ SBOM generated: #{output_file}"
      else
        Jekyll.logger.warn "SBOM Generator", "Failed to generate SBOM"
      end
    end

    private

    def enhance_sbom_with_jekyll_info(sbom_file, site)
      sbom = JSON.parse(File.read(sbom_file))

      # Add Jekyll context
      sbom['metadata']['properties'] ||= []
      sbom['metadata']['properties'] += [
        { 'name' => 'jekyll.version', 'value' => Jekyll::VERSION },
        { 'name' => 'site.title', 'value' => site.config['title'] || 'Jekyll Site' },
        { 'name' => 'site.url', 'value' => site.config['url'] || '' },
        { 'name' => 'build.environment', 'value' => Jekyll.env },
        { 'name' => 'ruby.version', 'value' => RUBY_VERSION }
      ]

      # Add plugin information
      plugins = site.config['plugins'] || []
      plugins.each_with_index do |plugin, index|
        sbom['metadata']['properties'] << {
          'name' => "jekyll.plugin.#{index}",
          'value' => plugin
        }
      end

      File.write(sbom_file, JSON.pretty_generate(sbom))
    end

    def create_sbom_page(site, sbom_file)
      sbom = JSON.parse(File.read(sbom_file))

      sbom_page = PageWithoutAFile.new(site, site.source, '', 'sbom.html')
      sbom_page.data['layout'] = 'sbom'
      sbom_page.data['title'] = 'Software Bill of Materials'
      sbom_page.data['sbom'] = sbom

      site.pages << sbom_page
    end
  end

  # Tag for accessing SBOM data in templates
  class SbomTag < Liquid::Tag
    def initialize(tag_name, params, tokens)
      super
      @params = params.strip
    end

    def render(context)
      site = context.registers[:site]
      sbom_file = File.join(site.dest, 'sbom.json')

      return '' unless File.exist?(sbom_file)

      sbom = JSON.parse(File.read(sbom_file))

      case @params
      when 'component_count'
        sbom.dig('components')&.length || 0
      when 'licenses'
        extract_licenses(sbom).join(', ')
      when 'generated_at'
        sbom.dig('metadata', 'timestamp') || ''
      else
        sbom.to_json
      end
    end

    private

    def extract_licenses(sbom)
      licenses = Set.new

      sbom.dig('components')&.each do |component|
        component['licenses']&.each do |license|
          license_name = license.dig('license', 'name') || license.dig('license', 'id')
          licenses.add(license_name) if license_name
        end
      end

      licenses.to_a.sort
    end
  end
end

Liquid::Template.register_tag('sbom', Jekyll::SbomTag)

# _config.yml
title: "My Jekyll Site"
description: "A static site built with Jekyll"

# SBOM configuration
sbom:
  enabled: true
  output: "_site/sbom.json"
  create_page: true

# Plugin configuration
plugins:
  - jekyll-feed
  - jekyll-sitemap
  - jekyll-seo-tag

# Build settings
markdown: kramdown
highlighter: rouge

<!-- _layouts/sbom.html -->
<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="utf-8">
  <title>{{ page.title }} | {{ site.title }}</title>
  <meta name="viewport" content="width=device-width, initial-scale=1">
  <style>
    body { font-family: system-ui, sans-serif; margin: 0; padding: 20px; }
    .container { max-width: 800px; margin: 0 auto; }
    table { width: 100%; border-collapse: collapse; margin-top: 20px; }
    th, td { padding: 12px; text-align: left; border-bottom: 1px solid #ddd; }
    th { background-color: #f5f5f5; }
    .summary { background-color: #f9f9f9; padding: 20px; border-radius: 8px; margin-bottom: 20px; }
  </style>
</head>
<body>
  <div class="container">
    <h1>{{ page.title }}</h1>

    <div class="summary">
      <h2>Summary</h2>
      <p><strong>Components:</strong> {{ page.sbom.components | size }}</p>
      <p><strong>Generated:</strong> {{ page.sbom.metadata.timestamp }}</p>
      <p><strong>Format:</strong> {{ page.sbom.bomFormat }} {{ page.sbom.specVersion }}</p>
    </div>

    <h2>Components</h2>
    <table>
      <thead>
        <tr>
          <th>Name</th>
          <th>Version</th>
          <th>Type</th>
          <th>Licenses</th>
        </tr>
      </thead>
      <tbody>
        {% for component in page.sbom.components %}
        <tr>
          <td>{{ component.name }}</td>
          <td>{{ component.version | default: "N/A" }}</td>
          <td>{{ component.type | default: "library" }}</td>
          <td>
            {% if component.licenses %}
              {% for license in component.licenses %}
                {{ license.license.name | default: license.license.id }}{% unless forloop.last %}, {% endunless %}
              {% endfor %}
            {% else %}
              Unknown
            {% endif %}
          </td>
        </tr>
        {% endfor %}
      </tbody>
    </table>

    <footer style="margin-top: 40px; padding-top: 20px; border-top: 1px solid #ddd; color: #666;">
      <p>Generated by Jekyll SBOM Plugin</p>
    </footer>
  </div>
</body>
</html>

# .github/workflows/ruby-sbom.yml
name: Ruby SBOM Generation and Security Analysis

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]
  schedule:
    - cron: '0 6 * * 1'  # Weekly Monday 6 AM

env:
  RUBY_VERSION: '3.2.0'
  BUNDLER_VERSION: '2.4.0'

jobs:
  sbom-generation:
    runs-on: ubuntu-latest

    outputs:
      sbom-file: ${{ steps.generate.outputs.sbom-file }}
      component-count: ${{ steps.generate.outputs.component-count }}
      ruby-version: ${{ steps.setup.outputs.ruby-version }}

    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Setup Ruby
      id: setup
      uses: ruby/setup-ruby@v1
      with:
        ruby-version: ${{ env.RUBY_VERSION }}
        bundler: ${{ env.BUNDLER_VERSION }}
        bundler-cache: true

    - name: Install SBOM tools
      run: |
        gem install cyclonedx-ruby
        gem install bundler-audit
        gem install license_finder

    - name: Generate application version
      id: version
      run: |
        if [[ "${{ github.ref }}" == refs/tags/* ]]; then
          VERSION=${GITHUB_REF#refs/tags/}
        elif [[ -f VERSION ]]; then
          VERSION=$(cat VERSION)
        else
          VERSION="${{ github.sha }}"
        fi
        echo "version=$VERSION" >> $GITHUB_OUTPUT
        echo "Generated version: $VERSION"

    - name: Generate SBOMs
      id: generate
      run: |
        echo "🔍 Generating Ruby SBOMs..."

        # Determine application name from gemspec or directory
        if [[ -f *.gemspec ]]; then
          APP_NAME=$(ls *.gemspec | head -1 | sed 's/.gemspec$//')
        elif [[ -f config/application.rb ]]; then
          APP_NAME=$(grep -o "module [A-Z][A-Za-z]*" config/application.rb | head -1 | cut -d' ' -f2)
        else
          APP_NAME=$(basename $(pwd))
        fi

        echo "Application name: $APP_NAME"

        # Generate production SBOM (without development/test groups)
        cyclonedx-ruby \
          --output sbom-production.json \
          --format json \
          --app-name "$APP_NAME" \
          --app-version "${{ steps.version.outputs.version }}" \
          --app-type application \
          --without development test

        # Generate development SBOM (all groups)
        cyclonedx-ruby \
          --output sbom-development.json \
          --format json \
          --app-name "$APP_NAME" \
          --app-version "${{ steps.version.outputs.version }}" \
          --app-type application

        # Generate SPDX format for compliance
        cyclonedx-ruby \
          --output sbom-production.spdx.json \
          --format spdx \
          --app-name "$APP_NAME" \
          --app-version "${{ steps.version.outputs.version }}" \
          --without development test

        # Output results
        COMPONENT_COUNT=$(jq '.components | length' sbom-production.json)
        echo "sbom-file=sbom-production.json" >> $GITHUB_OUTPUT
        echo "component-count=$COMPONENT_COUNT" >> $GITHUB_OUTPUT

        echo "✅ Generated SBOMs with $COMPONENT_COUNT production components"

    - name: Validate SBOMs
      run: |
        echo "🔍 Validating generated SBOMs..."

        for sbom in sbom-*.json; do
          echo "Validating $sbom"

          # JSON validation
          if ! jq empty "$sbom"; then
            echo "❌ Invalid JSON in $sbom"
            exit 1
          fi

          # CycloneDX structure validation
          required_fields=("bomFormat" "specVersion" "serialNumber" "version" "metadata" "components")

          for field in "${required_fields[@]}"; do
            if ! jq -e ".$field" "$sbom" > /dev/null; then
              echo "❌ Missing required field '$field' in $sbom"
              exit 1
            fi
          done

          # Component validation
          component_count=$(jq '.components | length' "$sbom")
          if [[ "$component_count" -eq 0 ]]; then
            echo "⚠️ Warning: No components found in $sbom"
          else
            echo "✅ $sbom: Valid with $component_count components"
          fi

          # License validation
          unlicensed_components=$(jq '[.components[] | select(.licenses == null or .licenses == [])] | length' "$sbom")
          if [[ "$unlicensed_components" -gt 0 ]]; then
            echo "⚠️ $unlicensed_components components without license information in $sbom"
          fi
        done

    - name: Generate SBOM summary report
      run: |
        echo "📊 Ruby SBOM Analysis Report" > sbom-report.md
        echo "============================" >> sbom-report.md
        echo "" >> sbom-report.md

        echo "**Repository**: ${{ github.repository }}" >> sbom-report.md
        echo "**Branch**: ${{ github.ref_name }}" >> sbom-report.md
        echo "**Commit**: ${{ github.sha }}" >> sbom-report.md
        echo "**Ruby Version**: ${{ steps.setup.outputs.ruby-version }}" >> sbom-report.md
        echo "**Generated**: $(date -u +'%Y-%m-%d %H:%M:%S UTC')" >> sbom-report.md
        echo "" >> sbom-report.md

        # Production dependencies
        echo "### Production Dependencies" >> sbom-report.md
        PROD_COUNT=$(jq '.components | length' sbom-production.json)
        echo "- **Components**: $PROD_COUNT" >> sbom-report.md

        # Development dependencies
        echo "### Development Dependencies" >> sbom-report.md
        DEV_COUNT=$(jq '.components | length' sbom-development.json)
        TOTAL_DEV_ONLY=$((DEV_COUNT - PROD_COUNT))
        echo "- **Total Components**: $DEV_COUNT" >> sbom-report.md
        echo "- **Development-only**: $TOTAL_DEV_ONLY" >> sbom-report.md

        echo "" >> sbom-report.md
        echo "### License Distribution" >> sbom-report.md

        # Extract and count licenses
        jq -r '.components[]?.licenses[]?.license.name // .components[]?.licenses[]?.license.id // "Unknown"' sbom-production.json | \
        sort | uniq -c | sort -nr | head -10 | \
        while read count license; do
          echo "- **$license**: $count gems" >> sbom-report.md
        done

        echo "" >> sbom-report.md
        echo "### Top Dependencies by Type" >> sbom-report.md

        # Framework gems
        FRAMEWORK_GEMS=$(jq -r '.components[] | select(.name | test("rails|sinatra|jekyll|rack")) | .name' sbom-production.json | head -5)
        if [[ -n "$FRAMEWORK_GEMS" ]]; then
          echo "**Framework gems**:" >> sbom-report.md
          echo "$FRAMEWORK_GEMS" | while read gem; do
            echo "- $gem" >> sbom-report.md
          done
        fi

    - name: Upload SBOM artifacts
      uses: actions/upload-artifact@v4
      with:
        name: ruby-sboms
        path: |
          sbom-*.json
          sbom-report.md
        retention-days: 30

  security-analysis:
    runs-on: ubuntu-latest
    needs: sbom-generation

    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Setup Ruby
      uses: ruby/setup-ruby@v1
      with:
        ruby-version: ${{ env.RUBY_VERSION }}
        bundler-cache: true

    - name: Install security tools
      run: |
        gem install bundler-audit
        gem install brakeman

    - name: Download SBOM artifacts
      uses: actions/download-artifact@v4
      with:
        name: ruby-sboms
        path: ./

    - name: Bundle audit security scan
      id: bundle-audit
      run: |
        echo "🔍 Running bundler-audit security scan..."

        # Update vulnerability database
        bundle-audit update

        # Run audit and capture results
        if bundle-audit check --format json > bundle-audit.json 2>&1; then
          echo "audit-status=passed" >> $GITHUB_OUTPUT
          echo "✅ No known security vulnerabilities found"
          VULN_COUNT=0
        else
          echo "audit-status=failed" >> $GITHUB_OUTPUT
          echo "⚠️ Security vulnerabilities detected"

          # Parse JSON output for vulnerability count
          if [[ -f bundle-audit.json ]]; then
            VULN_COUNT=$(jq '.results | length' bundle-audit.json 2>/dev/null || echo "unknown")
          else
            # Fallback to text parsing if JSON failed
            bundle-audit check --format text > bundle-audit.txt 2>&1 || true
            VULN_COUNT=$(grep -c "Name:" bundle-audit.txt 2>/dev/null || echo "unknown")
          fi
        fi

        echo "vulnerability-count=$VULN_COUNT" >> $GITHUB_OUTPUT
        echo "Found $VULN_COUNT vulnerabilities"

    - name: Static code analysis with Brakeman
      id: brakeman
      if: contains(github.repository, 'rails') || hashFiles('config/application.rb') != ''
      run: |
        echo "🔍 Running Brakeman static analysis..."

        if brakeman --format json --output brakeman.json --quiet; then
          echo "brakeman-status=passed" >> $GITHUB_OUTPUT
          echo "✅ Brakeman found no security issues"
          BRAKEMAN_WARNINGS=0
        else
          echo "brakeman-status=failed" >> $GITHUB_OUTPUT
          BRAKEMAN_WARNINGS=$(jq '.warnings | length' brakeman.json 2>/dev/null || echo "unknown")
          echo "⚠️ Brakeman found $BRAKEMAN_WARNINGS potential security issues"
        fi

        echo "warning-count=$BRAKEMAN_WARNINGS" >> $GITHUB_OUTPUT

    - name: Install Grype for SBOM vulnerability scanning
      run: |
        curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin

    - name: SBOM vulnerability scan with Grype
      id: grype-scan
      run: |
        echo "🔍 Scanning SBOM with Grype..."

        # Scan production SBOM
        grype sbom:sbom-production.json \
          --output json \
          --file grype-results.json

        grype sbom:sbom-production.json \
          --output table \
          --file grype-results.txt

        # Count vulnerabilities by severity
        CRITICAL=$(jq '[.matches[] | select(.vulnerability.severity == "Critical")] | length' grype-results.json)
        HIGH=$(jq '[.matches[] | select(.vulnerability.severity == "High")] | length' grype-results.json)
        MEDIUM=$(jq '[.matches[] | select(.vulnerability.severity == "Medium")] | length' grype-results.json)
        LOW=$(jq '[.matches[] | select(.vulnerability.severity == "Low")] | length' grype-results.json)

        echo "critical-count=$CRITICAL" >> $GITHUB_OUTPUT
        echo "high-count=$HIGH" >> $GITHUB_OUTPUT
        echo "medium-count=$MEDIUM" >> $GITHUB_OUTPUT
        echo "low-count=$LOW" >> $GITHUB_OUTPUT

        echo "🔍 Grype Vulnerability Summary:"
        echo "  Critical: $CRITICAL"
        echo "  High: $HIGH"
        echo "  Medium: $MEDIUM" 
        echo "  Low: $LOW"

        # Security gate logic
        if [[ "$CRITICAL" -gt 0 || "$HIGH" -gt 5 ]]; then
          echo "security-gate=failed" >> $GITHUB_OUTPUT
          echo "❌ Security gate failed: Too many critical/high vulnerabilities"
        else
          echo "security-gate=passed" >> $GITHUB_OUTPUT
          echo "✅ Security gate passed"
        fi

    - name: License compliance check
      id: license-check
      run: |
        echo "🔍 Checking license compliance..."

        # Define license policy
        cat > license-policy.json << 'EOF'
        {
          "approved": ["MIT", "Apache-2.0", "BSD-2-Clause", "BSD-3-Clause", "ISC"],
          "restricted": ["GPL-2.0", "GPL-3.0", "LGPL-2.1", "LGPL-3.0", "MPL-2.0"],
          "forbidden": ["AGPL-3.0", "GPL-2.0-only", "GPL-3.0-only"]
        }
        EOF

        # Extract licenses from SBOM
        jq -r '.components[]?.licenses[]?.license.name // .components[]?.licenses[]?.license.id // "Unknown"' sbom-production.json | \
        sort | uniq > found-licenses.txt

        # Check compliance
        FORBIDDEN_COUNT=0
        RESTRICTED_COUNT=0

        while IFS= read -r license; do
          if jq -e --arg license "$license" '.forbidden | index($license)' license-policy.json > /dev/null; then
            echo "❌ FORBIDDEN license found: $license"
            FORBIDDEN_COUNT=$((FORBIDDEN_COUNT + 1))
          elif jq -e --arg license "$license" '.restricted | index($license)' license-policy.json > /dev/null; then
            echo "⚠️ RESTRICTED license found: $license (requires review)"
            RESTRICTED_COUNT=$((RESTRICTED_COUNT + 1))
          fi
        done < found-licenses.txt

        echo "forbidden-licenses=$FORBIDDEN_COUNT" >> $GITHUB_OUTPUT
        echo "restricted-licenses=$RESTRICTED_COUNT" >> $GITHUB_OUTPUT

        if [[ "$FORBIDDEN_COUNT" -gt 0 ]]; then
          echo "license-compliance=failed" >> $GITHUB_OUTPUT
        elif [[ "$RESTRICTED_COUNT" -gt 0 ]]; then
          echo "license-compliance=review-required" >> $GITHUB_OUTPUT
        else
          echo "license-compliance=passed" >> $GITHUB_OUTPUT
        fi

    - name: Generate comprehensive security report
      run: |
        cat > security-report.md << EOF
        # Ruby Security Analysis Report

        **Repository**: ${{ github.repository }}
        **Scan Date**: $(date -u +'%Y-%m-%d %H:%M:%S UTC')
        **Ruby Version**: ${{ needs.sbom-generation.outputs.ruby-version }}
        **Components Analyzed**: ${{ needs.sbom-generation.outputs.component-count }}

        ## Bundle Audit Results
        - **Status**: ${{ steps.bundle-audit.outputs.audit-status }}
        - **Vulnerabilities**: ${{ steps.bundle-audit.outputs.vulnerability-count }}

        ## Grype SBOM Scan Results
        - **Critical**: ${{ steps.grype-scan.outputs.critical-count }}
        - **High**: ${{ steps.grype-scan.outputs.high-count }}
        - **Medium**: ${{ steps.grype-scan.outputs.medium-count }}
        - **Low**: ${{ steps.grype-scan.outputs.low-count }}

        EOF

        # Add Brakeman results if available
        if [[ "${{ steps.brakeman.outputs.brakeman-status }}" ]]; then
          cat >> security-report.md << EOF
        ## Brakeman Static Analysis
        - **Status**: ${{ steps.brakeman.outputs.brakeman-status }}
        - **Warnings**: ${{ steps.brakeman.outputs.warning-count }}

        EOF
        fi

        cat >> security-report.md << EOF
        ## License Compliance
        - **Status**: ${{ steps.license-check.outputs.license-compliance }}
        - **Forbidden Licenses**: ${{ steps.license-check.outputs.forbidden-licenses }}
        - **Restricted Licenses**: ${{ steps.license-check.outputs.restricted-licenses }}

        ## Overall Security Gate
        **Status**: ${{ steps.grype-scan.outputs.security-gate }}

        EOF

        # Add recommendations based on findings
        if [[ "${{ steps.grype-scan.outputs.security-gate }}" == "failed" ]]; then
          cat >> security-report.md << EOF
        ### ⚠️ Action Required
        Critical or high-severity vulnerabilities detected. Please review detailed reports and update affected gems.

        EOF
        fi

        if [[ "${{ steps.license-check.outputs.license-compliance }}" == "failed" ]]; then
          cat >> security-report.md << EOF
        ### ⚖️ License Compliance Issue
        Forbidden licenses detected. Please review and replace affected gems.

        EOF
        fi

    - name: Comment on PR
      if: github.event_name == 'pull_request'
      uses: actions/github-script@v7
      with:
        script: |
          const fs = require('fs');

          let comment = `## 🔍 Ruby SBOM Security Analysis\n\n`;

          // Add SBOM summary
          if (fs.existsSync('sbom-report.md')) {
            const summary = fs.readFileSync('sbom-report.md', 'utf8');
            comment += summary + '\n\n';
          }

          // Add security results
          if (fs.existsSync('security-report.md')) {
            const security = fs.readFileSync('security-report.md', 'utf8');
            comment += security;
          }

          comment += '\n\n📄 Detailed reports available in job artifacts.';

          github.rest.issues.createComment({
            issue_number: context.issue.number,
            owner: context.repo.owner,
            repo: context.repo.repo,
            body: comment
          });

    - name: Upload security analysis results
      uses: actions/upload-artifact@v4
      with:
        name: security-analysis
        path: |
          bundle-audit.*
          brakeman.json
          grype-results.*
          security-report.md
          license-policy.json
          found-licenses.txt

    - name: Security gate enforcement
      if: |
        steps.grype-scan.outputs.security-gate == 'failed' ||
        steps.license-check.outputs.license-compliance == 'failed' ||
        (steps.bundle-audit.outputs.audit-status == 'failed' && steps.bundle-audit.outputs.vulnerability-count != '0')
      run: |
        echo "❌ Security gate failed!"
        echo "Grype: ${{ steps.grype-scan.outputs.security-gate }}"
        echo "License: ${{ steps.license-check.outputs.license-compliance }}"
        echo "Bundle Audit: ${{ steps.bundle-audit.outputs.audit-status }}"
        echo ""
        echo "Please review security reports and address issues before merging."
        exit 1

  deploy-sbom:
    runs-on: ubuntu-latest
    needs: [sbom-generation, security-analysis]
    if: github.ref == 'refs/heads/main' && success()

    steps:
    - name: Download SBOM artifacts
      uses: actions/download-artifact@v4
      with:
        name: ruby-sboms
        path: ./

    - name: Sign SBOMs
      if: secrets.GPG_PRIVATE_KEY != ''
      run: |
        echo "${{ secrets.GPG_PRIVATE_KEY }}" | gpg --batch --import

        for sbom in sbom-production.*; do
          gpg --armor --detach-sign "$sbom"
          echo "✅ Signed: $sbom"
        done

    - name: Upload to GitHub Release
      if: startsWith(github.ref, 'refs/tags/')
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      run: |
        # Create release if it doesn't exist
        gh release create ${{ github.ref_name }} \
          --title "Release ${{ github.ref_name }}" \
          --notes "Includes Software Bill of Materials for supply chain transparency." \
          --generate-notes || true

        # Upload SBOM files to release
        for file in sbom-production.*; do
          gh release upload ${{ github.ref_name }} "$file" --clobber
        done

        echo "✅ SBOMs uploaded to GitHub release"

    - name: Upload to SBOM registry
      if: secrets.SBOM_REGISTRY_URL != ''
      run: |
        for sbom in sbom-production.json; do
          echo "Uploading $sbom to SBOM registry..."

          curl -X POST \
            -H "Authorization: Bearer ${{ secrets.SBOM_REGISTRY_TOKEN }}" \
            -H "Content-Type: application/json" \
            --data-binary @"$sbom" \
            "${{ secrets.SBOM_REGISTRY_URL }}/api/v1/sboms/${{ github.repository }}/production/${{ github.sha }}" || true

          echo "✅ SBOM uploaded to registry"
        done

    - name: Update dependency tracking
      if: secrets.DEPENDENCY_TRACK_URL != ''
      run: |
        echo "📤 Uploading SBOM to Dependency-Track..."

        curl -X POST \
          -H "Content-Type: multipart/form-data" \
          -H "X-API-Key: ${{ secrets.DEPENDENCY_TRACK_API_KEY }}" \
          -F "bom=@sbom-production.json" \
          -F "projectName=${{ github.repository }}" \
          -F "projectVersion=${{ github.ref_name }}" \
          "${{ secrets.DEPENDENCY_TRACK_URL }}/api/v1/bom" || true

        echo "✅ SBOM uploaded to Dependency-Track"

# .gitlab-ci.yml
stages:
  - build
  - sbom
  - security
  - deploy

variables:
  RUBY_VERSION: "3.2.0"
  BUNDLER_VERSION: "2.4.0"
  BUNDLE_PATH: vendor/bundle
  BUNDLE_JOBS: "3"
  BUNDLE_RETRY: "3"

cache:
  key: 
    files:
      - Gemfile.lock
  paths:
    - vendor/bundle

before_script:
  - ruby --version
  - gem --version
  - bundle --version

build:
  stage: build
  image: ruby:${RUBY_VERSION}

  script:
    - bundle config path ${BUNDLE_PATH}
    - bundle install --jobs=${BUNDLE_JOBS} --retry=${BUNDLE_RETRY}

  artifacts:
    paths:
      - vendor/bundle
    expire_in: 1 hour

generate-sbom:
  stage: sbom
  image: ruby:${RUBY_VERSION}
  dependencies:
    - build

  before_script:
    - bundle config path ${BUNDLE_PATH}
    - gem install cyclonedx-ruby bundler-audit license_finder

  script:
    # Determine application name and version
    - |
      if [[ -f *.gemspec ]]; then
        APP_NAME=$(ls *.gemspec | head -1 | sed 's/.gemspec$//')
      elif [[ -f config/application.rb ]]; then
        APP_NAME=$(grep -o "module [A-Z][A-Za-z]*" config/application.rb | head -1 | cut -d' ' -f2)
      else
        APP_NAME=${CI_PROJECT_NAME}
      fi

      if [[ -f VERSION ]]; then
        APP_VERSION=$(cat VERSION)
      else
        APP_VERSION=${CI_COMMIT_SHA}
      fi

      echo "Application: $APP_NAME"
      echo "Version: $APP_VERSION"

    # Generate production SBOM
    - |
      cyclonedx-ruby \
        --output sbom-production.json \
        --format json \
        --app-name "$APP_NAME" \
        --app-version "$APP_VERSION" \
        --app-type application \
        --without development test

    # Generate development SBOM
    - |
      cyclonedx-ruby \
        --output sbom-development.json \
        --format json \
        --app-name "$APP_NAME" \
        --app-version "$APP_VERSION" \
        --app-type application

    # Generate SPDX format
    - |
      cyclonedx-ruby \
        --output sbom-production.spdx.json \
        --format spdx \
        --app-name "$APP_NAME" \
        --app-version "$APP_VERSION" \
        --without development test

    # Validate SBOMs
    - |
      for sbom in sbom-*.json; do
        echo "Validating $sbom"

        # JSON validation
        if ! ruby -e "require 'json'; JSON.parse(File.read('$sbom'))"; then
          echo "Invalid JSON in $sbom"
          exit 1
        fi

        # Count components
        component_count=$(ruby -e "require 'json'; puts JSON.parse(File.read('$sbom')).dig('components')&.length || 0")
        echo "$sbom: $component_count components"
      done

    # Generate summary
    - |
      echo "Ruby SBOM Generation Summary" > sbom-summary.txt
      echo "===========================" >> sbom-summary.txt
      echo "Application: $APP_NAME" >> sbom-summary.txt
      echo "Version: $APP_VERSION" >> sbom-summary.txt
      echo "Ruby Version: $(ruby --version)" >> sbom-summary.txt
      echo "Generated: $(date)" >> sbom-summary.txt
      echo "" >> sbom-summary.txt

      prod_count=$(ruby -e "require 'json'; puts JSON.parse(File.read('sbom-production.json')).dig('components')&.length || 0")
      dev_count=$(ruby -e "require 'json'; puts JSON.parse(File.read('sbom-development.json')).dig('components')&.length || 0")

      echo "Production components: $prod_count" >> sbom-summary.txt
      echo "Development components: $dev_count" >> sbom-summary.txt
      echo "Development-only: $((dev_count - prod_count))" >> sbom-summary.txt

  artifacts:
    paths:
      - sbom-*.json
      - sbom-summary.txt
    reports:
      cyclonedx: sbom-production.json
    expire_in: 1 week

security-audit:
  stage: security
  image: ruby:${RUBY_VERSION}
  dependencies:
    - build
    - generate-sbom

  before_script:
    - bundle config path ${BUNDLE_PATH}
    - gem install bundler-audit brakeman
    - apt-get update && apt-get install -y curl jq
    - curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin

  script:
    # Bundle audit for known vulnerabilities
    - echo "Running bundler-audit..."
    - bundle-audit update
    - bundle-audit check --format json > bundle-audit.json || AUDIT_EXIT_CODE=$?

    # Brakeman static analysis (if Rails app)
    - |
      if [[ -f config/application.rb ]]; then
        echo "Running Brakeman static analysis..."
        brakeman --format json --output brakeman.json --quiet || BRAKEMAN_EXIT_CODE=$?
      fi

    # Grype SBOM vulnerability scan
    - echo "Running Grype vulnerability scan..."
    - grype sbom:sbom-production.json --output json --file grype-results.json
    - grype sbom:sbom-production.json --output table > grype-results.txt

    # License compliance check
    - echo "Checking license compliance..."
    - |
      cat > license-policy.json << 'EOF'
      {
        "approved": ["MIT", "Apache-2.0", "BSD-2-Clause", "BSD-3-Clause", "ISC"],
        "restricted": ["GPL-2.0", "GPL-3.0", "LGPL-2.1", "LGPL-3.0", "MPL-2.0"],
        "forbidden": ["AGPL-3.0", "GPL-2.0-only", "GPL-3.0-only"]
      }
      EOF

    # Extract and validate licenses
    - |
      ruby -e "
      require 'json'
      sbom = JSON.parse(File.read('sbom-production.json'))
      licenses = Set.new

      sbom.dig('components')&.each do |component|
        component['licenses']&.each do |license|
          license_name = license.dig('license', 'name') || license.dig('license', 'id')
          licenses.add(license_name) if license_name
        end
      end

      File.write('found-licenses.txt', licenses.to_a.sort.join(\"\n\"))
      "

    # Analyze results and generate report
    - |
      echo "Security Analysis Results" > security-report.txt
      echo "========================" >> security-report.txt
      echo "Project: ${CI_PROJECT_NAME}" >> security-report.txt
      echo "Commit: ${CI_COMMIT_SHA}" >> security-report.txt
      echo "Date: $(date)" >> security-report.txt
      echo "" >> security-report.txt

      # Bundle audit results
      if [[ -f bundle-audit.json ]]; then
        vuln_count=$(jq '.results | length' bundle-audit.json 2>/dev/null || echo "0")
        echo "Bundle Audit Vulnerabilities: $vuln_count" >> security-report.txt
      fi

      # Grype results
      if [[ -f grype-results.json ]]; then
        critical=$(jq '[.matches[] | select(.vulnerability.severity == "Critical")] | length' grype-results.json)
        high=$(jq '[.matches[] | select(.vulnerability.severity == "High")] | length' grype-results.json)
        echo "Grype Critical: $critical" >> security-report.txt
        echo "Grype High: $high" >> security-report.txt

        # Security gate
        if [[ "$critical" -gt 0 || "$high" -gt 5 ]]; then
          echo "SECURITY_GATE=FAILED" >> security-report.txt
          echo "Security gate failed: $critical critical, $high high vulnerabilities"
          exit 1
        else
          echo "SECURITY_GATE=PASSED" >> security-report.txt
        fi
      fi

  artifacts:
    paths:
      - bundle-audit.json
      - brakeman.json
      - grype-results.*
      - security-report.txt
      - license-policy.json
      - found-licenses.txt
    expire_in: 1 week

  allow_failure: false

deploy-sbom:
  stage: deploy
  image: alpine:latest
  dependencies:
    - generate-sbom

  before_script:
    - apk add --no-cache curl jq gnupg

  script:
    # Sign SBOMs if GPG key available
    - |
      if [[ -n "$GPG_PRIVATE_KEY" ]]; then
        echo "Signing SBOMs..."
        echo "$GPG_PRIVATE_KEY" | gpg --batch --import

        for sbom in sbom-production.*; do
          gpg --armor --detach-sign "$sbom"
          echo "Signed: $sbom"
        done
      fi

    # Upload to SBOM registry
    - |
      if [[ -n "$SBOM_REGISTRY_URL" && -n "$SBOM_REGISTRY_TOKEN" ]]; then
        echo "Uploading SBOM to registry..."

        curl -X POST \
          -H "Authorization: Bearer $SBOM_REGISTRY_TOKEN" \
          -H "Content-Type: application/json" \
          --data-binary @sbom-production.json \
          "$SBOM_REGISTRY_URL/api/v1/sboms/${CI_PROJECT_PATH}/${CI_COMMIT_SHA}"

        echo "SBOM uploaded successfully"
      else
        echo "SBOM registry not configured, skipping upload"
      fi

    # Update dependency tracking
    - |
      if [[ -n "$DEPENDENCY_TRACK_URL" && -n "$DEPENDENCY_TRACK_API_KEY" ]]; then
        echo "Uploading to Dependency-Track..."

        curl -X POST \
          -H "Content-Type: multipart/form-data" \
          -H "X-API-Key: $DEPENDENCY_TRACK_API_KEY" \
          -F "bom=@sbom-production.json" \
          -F "projectName=${CI_PROJECT_PATH}" \
          -F "projectVersion=${CI_COMMIT_REF_NAME}" \
          "$DEPENDENCY_TRACK_URL/api/v1/bom"

        echo "Dependency-Track upload complete"
      fi

  only:
    - main
    - master
    - tags

#!/usr/bin/env ruby
# advanced_gem_security_analyzer.rb - Comprehensive Ruby gem security analysis

require 'json'
require 'net/http'
require 'uri'
require 'digest'
require 'bundler'
require 'date'

class AdvancedGemSecurityAnalyzer
  RUBYGEMS_API_BASE = 'https://rubygems.org/api/v1'
  ADVISORY_DB_URL = 'https://raw.githubusercontent.com/rubysec/ruby-advisory-db/master'

  def initialize(sbom_path, config = {})
    @sbom_path = sbom_path
    @config = default_config.merge(config)
    @sbom = load_sbom
    @security_findings = []
    @compliance_issues = []
  end

  def analyze
    puts "🔍 Advanced Ruby Gem Security Analysis"
    puts "======================================"

    analyze_gem_metadata
    check_vulnerability_databases
    analyze_dependency_freshness
    check_maintainer_security
    analyze_license_compliance
    generate_risk_scores

    generate_report
  end

  private

  def default_config
    {
      max_gem_age_days: 730,           # 2 years
      min_download_threshold: 1000,    # Minimum downloads for popularity
      check_prerelease_risk: true,
      license_policy: {
        approved: %w[MIT Apache-2.0 BSD-2-Clause BSD-3-Clause ISC],
        restricted: %w[GPL-2.0 GPL-3.0 LGPL-2.1 LGPL-3.0 MPL-2.0],
        forbidden: %w[AGPL-3.0 GPL-2.0-only GPL-3.0-only]
      },
      risk_thresholds: {
        low: 0.3,
        medium: 0.6,
        high: 0.8
      }
    }
  end

  def load_sbom
    JSON.parse(File.read(@sbom_path))
  rescue JSON::ParserError => e
    raise "Invalid SBOM JSON: #{e.message}"
  end

  def analyze_gem_metadata
    puts "📦 Analyzing gem metadata..."

    @sbom.dig('components')&.each do |component|
      next unless gem_component?(component)

      gem_name = component['name']
      gem_version = component['version']

      metadata = fetch_gem_metadata(gem_name)
      next unless metadata

      # Analyze gem age and maintenance
      analyze_gem_maintenance(gem_name, gem_version, metadata)

      # Check popularity and adoption
      analyze_gem_popularity(gem_name, metadata)

      # Check for pre-release versions
      check_prerelease_usage(gem_name, gem_version) if @config[:check_prerelease_risk]
    end
  end

  def check_vulnerability_databases
    puts "🚨 Checking vulnerability databases..."

    # Use bundler-audit database
    check_bundler_audit_advisories

    # Additional vulnerability sources
    check_rubysec_database
  end

  def analyze_dependency_freshness
    puts "📅 Analyzing dependency freshness..."

    @sbom.dig('components')&.each do |component|
      next unless gem_component?(component)

      gem_name = component['name']
      current_version = component['version']

      latest_version = fetch_latest_version(gem_name)
      next unless latest_version

      if version_outdated?(current_version, latest_version)
        add_finding(
          type: 'outdated_dependency',
          severity: calculate_staleness_severity(current_version, latest_version),
          gem: gem_name,
          current_version: current_version,
          latest_version: latest_version,
          message: "Gem '#{gem_name}' is outdated (#{current_version} vs #{latest_version})",
          recommendation: "Consider updating to latest version"
        )
      end
    end
  end

  def check_maintainer_security
    puts "👥 Analyzing maintainer security..."

    @sbom.dig('components')&.each do |component|
      next unless gem_component?(component)

      gem_name = component['name']
      owners = fetch_gem_owners(gem_name)

      next unless owners

      # Check for single maintainer risk
      if owners.length == 1
        add_finding(
          type: 'single_maintainer',
          severity: 'medium',
          gem: gem_name,
          message: "Gem '#{gem_name}' has only one maintainer",
          recommendation: "Monitor for maintainer changes and bus factor risks",
          owners: owners
        )
      end

      # Check for maintainer account age (would need additional API calls)
      check_maintainer_reputation(gem_name, owners)
    end
  end

  def analyze_license_compliance
    puts "⚖️ Analyzing license compliance..."

    @sbom.dig('components')&.each do |component|
      next unless gem_component?(component)

      gem_name = component['name']
      licenses = extract_licenses(component)

      licenses.each do |license|
        check_license_policy(gem_name, license)
      end
    end
  end

  def generate_risk_scores
    puts "📊 Generating risk scores..."

    @sbom.dig('components')&.each do |component|
      next unless gem_component?(component)

      risk_score = calculate_gem_risk_score(component)
      component['risk_analysis'] = {
        risk_score: risk_score,
        risk_level: risk_level_from_score(risk_score),
        analysis_timestamp: Time.now.iso8601
      }
    end
  end

  def gem_component?(component)
    component['type'] == 'library' && 
    (component['purl']&.include?('rubygems') || 
     component['name']&.match(/^[a-z][a-z0-9_\-]*$/))
  end

  def fetch_gem_metadata(gem_name)
    uri = URI("#{RUBYGEMS_API_BASE}/gems/#{gem_name}.json")
    response = Net::HTTP.get_response(uri)

    return nil unless response.code == '200'

    JSON.parse(response.body)
  rescue => e
    puts "Warning: Could not fetch metadata for #{gem_name}: #{e.message}"
    nil
  end

  def analyze_gem_maintenance(gem_name, version, metadata)
    # Check last update
    last_update = Date.parse(metadata['version_created_at']) rescue nil

    if last_update && (Date.today - last_update) > @config[:max_gem_age_days]
      add_finding(
        type: 'stale_gem',
        severity: 'medium',
        gem: gem_name,
        version: version,
        last_update: last_update,
        message: "Gem '#{gem_name}' hasn't been updated in #{(Date.today - last_update).to_i} days",
        recommendation: "Review if gem is still maintained or consider alternatives"
      )
    end
  end

  def analyze_gem_popularity(gem_name, metadata)
    downloads = metadata['downloads'] || 0

    if downloads < @config[:min_download_threshold]
      add_finding(
        type: 'low_popularity',
        severity: 'low',
        gem: gem_name,
        downloads: downloads,
        message: "Gem '#{gem_name}' has low download count (#{downloads})",
        recommendation: "Verify gem quality and consider popular alternatives"
      )
    end
  end

  def check_prerelease_usage(gem_name, version)
    if version.match?(/[a-zA-Z]/) # Contains alpha, beta, rc, etc.
      add_finding(
        type: 'prerelease_version',
        severity: 'high',
        gem: gem_name,
        version: version,
        message: "Using pre-release version of '#{gem_name}' (#{version})",
        recommendation: "Use stable releases in production environments"
      )
    end
  end

  def check_bundler_audit_advisories
    # This would integrate with bundler-audit
    system('bundle-audit check --format json > /tmp/bundler-audit.json 2>/dev/null')

    return unless File.exist?('/tmp/bundler-audit.json')

    begin
      audit_results = JSON.parse(File.read('/tmp/bundler-audit.json'))

      audit_results['results']&.each do |advisory|
        add_finding(
          type: 'known_vulnerability',
          severity: map_advisory_severity(advisory['criticality']),
          gem: advisory['gem'],
          version: advisory['version'],
          cve: advisory['cve'],
          advisory_id: advisory['advisory'],
          message: advisory['title'] || 'Known vulnerability',
          recommendation: "Update to version #{advisory['patched_versions']&.first}",
          advisory_url: advisory['url']
        )
      end
    rescue JSON::ParserError
      puts "Warning: Could not parse bundler-audit results"
    end
  end

  def check_rubysec_database
    # This would check against the ruby-advisory-db
    # Implementation would involve cloning/fetching the database
    # and checking against YAML advisory files
  end

  def fetch_latest_version(gem_name)
    metadata = fetch_gem_metadata(gem_name)
    metadata&.dig('version')
  end

  def version_outdated?(current, latest)
    return false if current == latest

    begin
      Gem::Version.new(current) < Gem::Version.new(latest)
    rescue
      false
    end
  end

  def calculate_staleness_severity(current_version, latest_version)
    begin
      current = Gem::Version.new(current_version)
      latest = Gem::Version.new(latest_version)

      # Major version behind
      return 'high' if latest.segments[0] > current.segments[0]

      # Minor versions behind  
      minor_diff = latest.segments[1].to_i - current.segments[1].to_i
      return 'medium' if minor_diff > 2
      return 'low' if minor_diff > 0

      'info'
    rescue
      'low'
    end
  end

  def fetch_gem_owners(gem_name)
    uri = URI("#{RUBYGEMS_API_BASE}/gems/#{gem_name}/owners.json")
    response = Net::HTTP.get_response(uri)

    return nil unless response.code == '200'

    JSON.parse(response.body)
  rescue => e
    puts "Warning: Could not fetch owners for #{gem_name}: #{e.message}"
    nil
  end

  def check_maintainer_reputation(gem_name, owners)
    # This would involve additional API calls to check:
    # - Account age
    # - Number of gems maintained
    # - GitHub activity
    # - Previous security incidents

    # Placeholder for advanced maintainer analysis
    owners.each do |owner|
      # Additional checks would go here
    end
  end

  def extract_licenses(component)
    licenses = []

    component['licenses']&.each do |license|
      license_name = license.dig('license', 'name') || license.dig('license', 'id')
      licenses << license_name if license_name
    end

    licenses
  end

  def check_license_policy(gem_name, license)
    if @config[:license_policy][:forbidden].include?(license)
      add_compliance_issue(
        type: 'forbidden_license',
        severity: 'critical',
        gem: gem_name,
        license: license,
        message: "Gem '#{gem_name}' uses forbidden license '#{license}'",
        recommendation: "Replace with compatible alternative or obtain legal approval"
      )
    elsif @config[:license_policy][:restricted].include?(license)
      add_compliance_issue(
        type: 'restricted_license',
        severity: 'medium',
        gem: gem_name,
        license: license,
        message: "Gem '#{gem_name}' uses restricted license '#{license}'",
        recommendation: "Obtain legal approval before production use"
      )
    end
  end

  def calculate_gem_risk_score(component)
    score = 0.0
    gem_name = component['name']

    # Base score from findings
    gem_findings = @security_findings.select { |f| f[:gem] == gem_name }

    gem_findings.each do |finding|
      score += case finding[:severity]
               when 'critical' then 0.4
               when 'high' then 0.3
               when 'medium' then 0.2
               when 'low' then 0.1
               else 0.05
               end
    end

    # Compliance issues add to score
    gem_compliance_issues = @compliance_issues.select { |i| i[:gem] == gem_name }
    score += gem_compliance_issues.length * 0.1

    # Normalize to 0-1 scale
    [1.0, score].min
  end

  def risk_level_from_score(score)
    case score
    when 0...@config[:risk_thresholds][:low]
      'low'
    when @config[:risk_thresholds][:low]...@config[:risk_thresholds][:medium]
      'medium'
    when @config[:risk_thresholds][:medium]...@config[:risk_thresholds][:high]
      'high'
    else
      'critical'
    end
  end

  def add_finding(finding)
    @security_findings << finding
  end

  def add_compliance_issue(issue)
    @compliance_issues << issue
  end

  def map_advisory_severity(criticality)
    case criticality&.downcase
    when 'critical' then 'critical'
    when 'high' then 'high'
    when 'medium' then 'medium'
    when 'low' then 'low'
    else 'medium'
    end
  end

  def generate_report
    report = {
      analysis_metadata: {
        sbom_file: @sbom_path,
        analysis_timestamp: Time.now.iso8601,
        analyzer_version: '1.0.0',
        components_analyzed: @sbom.dig('components')&.length || 0
      },
      summary: {
        total_findings: @security_findings.length,
        critical_findings: @security_findings.count { |f| f[:severity] == 'critical' },
        high_findings: @security_findings.count { |f| f[:severity] == 'high' },
        medium_findings: @security_findings.count { |f| f[:severity] == 'medium' },
        low_findings: @security_findings.count { |f| f[:severity] == 'low' },
        compliance_issues: @compliance_issues.length,
        high_risk_gems: high_risk_gems.length
      },
      security_findings: @security_findings,
      compliance_issues: @compliance_issues,
      high_risk_gems: high_risk_gems,
      recommendations: generate_recommendations
    }

    # Write enhanced SBOM with risk analysis
    enhanced_sbom = @sbom.dup
    enhanced_sbom['security_analysis'] = report

    output_file = @sbom_path.sub('.json', '-enhanced.json')
    File.write(output_file, JSON.pretty_generate(enhanced_sbom))

    # Write separate analysis report
    analysis_file = @sbom_path.sub('.json', '-analysis.json')
    File.write(analysis_file, JSON.pretty_generate(report))

    puts "\n📊 Analysis Complete!"
    puts "===================="
    puts "Total findings: #{report[:summary][:total_findings]}"
    puts "Critical: #{report[:summary][:critical_findings]}"
    puts "High: #{report[:summary][:high_findings]}"
    puts "Medium: #{report[:summary][:medium_findings]}"
    puts "Low: #{report[:summary][:low_findings]}"
    puts "Compliance issues: #{report[:summary][:compliance_issues]}"
    puts "High-risk gems: #{report[:summary][:high_risk_gems]}"
    puts ""
    puts "Enhanced SBOM: #{output_file}"
    puts "Analysis report: #{analysis_file}"

    report
  end

  def high_risk_gems
    @sbom.dig('components')&.select do |component|
      next false unless gem_component?(component)

      risk_analysis = component['risk_analysis']
      risk_analysis && risk_analysis['risk_level'] == 'critical'
    end || []
  end

  def generate_recommendations
    recommendations = []

    critical_count = @security_findings.count { |f| f[:severity] == 'critical' }
    high_count = @security_findings.count { |f| f[:severity] == 'high' }

    if critical_count > 0
      recommendations << "URGENT: Address #{critical_count} critical security findings immediately"
    end

    if high_count > 5
      recommendations << "Consider comprehensive security review - #{high_count} high-severity issues found"
    end

    outdated_gems = @security_findings.select { |f| f[:type] == 'outdated_dependency' }
    if outdated_gems.length > 10
      recommendations << "Implement regular dependency update schedule"
    end

    prerelease_gems = @security_findings.select { |f| f[:type] == 'prerelease_version' }
    if prerelease_gems.any?
      recommendations << "Replace pre-release gems with stable versions for production"
    end

    forbidden_licenses = @compliance_issues.select { |i| i[:type] == 'forbidden_license' }
    if forbidden_licenses.any?
      recommendations << "Immediate action required: Remove gems with forbidden licenses"
    end

    recommendations
  end
end

# CLI usage
if __FILE__ == $0
  if ARGV.length < 1
    puts "Usage: #{$0} <sbom-file.json> [config.json]"
    exit 1
  end

  sbom_file = ARGV[0]
  config_file = ARGV[1]

  config = {}
  if config_file && File.exist?(config_file)
    config = JSON.parse(File.read(config_file), symbolize_names: true)
  end

  analyzer = AdvancedGemSecurityAnalyzer.new(sbom_file, config)
  analyzer.analyze
end

# Run advanced security analysis
ruby advanced_gem_security_analyzer.rb sbom-production.json

# With custom configuration
cat > security-config.json << 'EOF'
{
  "max_gem_age_days": 365,
  "min_download_threshold": 5000,
  "check_prerelease_risk": true,
  "license_policy": {
    "approved": ["MIT", "Apache-2.0", "BSD-3-Clause"],
    "restricted": ["GPL-3.0", "LGPL-3.0"],
    "forbidden": ["AGPL-3.0"]
  }
}
EOF

ruby advanced_gem_security_analyzer.rb sbom-production.json security-config.json

# fiber_sbom_generator.rb - Modern Ruby 3.3+ SBOM generation with Fibers
require 'fiber'
require 'async'
require 'json'
require 'net/http'

class FiberBasedSbomGenerator
  def initialize(gemfile_lock_path)
    @gemfile_lock_path = gemfile_lock_path
    @components = []
  end

  def generate_async
    Async do |task|
      gems = parse_gemfile_lock

      # Process gems concurrently using Fibers
      tasks = gems.map do |gem_spec|
        task.async do |subtask|
          analyze_gem_with_fiber(gem_spec)
        end
      end

      # Wait for all analysis to complete
      @components = tasks.map(&:wait).compact

      build_sbom
    end
  end

  private

  def analyze_gem_with_fiber(gem_spec)
    Fiber.new do
      # Enhanced gem analysis using modern Ruby features
      component = {
        type: 'library',
        'bom-ref': "gem-#{gem_spec[:name]}-#{gem_spec[:version]}",
        name: gem_spec[:name],
        version: gem_spec[:version],
        purl: "pkg:gem/#{gem_spec[:name]}@#{gem_spec[:version]}",
        scope: gem_spec[:group] || 'required'
      }

      # Fetch metadata asynchronously
      metadata = fetch_gem_metadata_async(gem_spec[:name])

      if metadata
        component[:description] = metadata['info']
        component[:homepage] = metadata['homepage_uri']
        component[:licenses] = extract_licenses_from_metadata(metadata)
        component[:author] = metadata['authors']

        # Modern Ruby pattern matching for metadata processing
        case metadata
        in { 'source_code_uri' => String => source_url }
          component[:externalReferences] = [{
            type: 'vcs',
            url: source_url
          }]
        else
          # No source code URI available
        end
      end

      component
    end.resume
  end

  def fetch_gem_metadata_async(gem_name)
    # Modern async HTTP with Fiber scheduling
    Async do
      uri = URI("https://rubygems.org/api/v1/gems/#{gem_name}.json")

      begin
        response = Net::HTTP.get_response(uri)
        response.code == '200' ? JSON.parse(response.body) : nil
      rescue => e
        puts "Warning: Could not fetch metadata for #{gem_name}: #{e.message}"
        nil
      end
    end.wait
  end

  def parse_gemfile_lock
    # Enhanced parsing with pattern matching
    lockfile_content = File.read(@gemfile_lock_path)
    gems = []
    current_group = nil

    lockfile_content.each_line do |line|
      case line.strip
      in /^GEM$/
        current_section = :gems
      in /^  specs:$/
        current_subsection = :specs
      in /^    (.+) \((.+)\)$/ if current_subsection == :specs
        gem_name, version = $1, $2
        gems << { name: gem_name, version: version, group: current_group }
      in /^([A-Z_]+)$/
        current_section = $1.downcase.to_sym
      else
        # Skip other lines
      end
    end

    gems
  end

  def build_sbom
    {
      bomFormat: 'CycloneDX',
      specVersion: '1.7',
      serialNumber: "urn:uuid:#{SecureRandom.uuid}",
      version: 1,
      metadata: {
        timestamp: Time.now.iso8601,
        tools: [{
          name: 'FiberBasedSbomGenerator',
          version: '1.0.0'
        }],
        component: {
          type: 'application',
          name: File.basename(Dir.pwd),
          version: determine_app_version
        },
        properties: [
          { name: 'ruby.version', value: RUBY_VERSION },
          { name: 'ruby.platform', value: RUBY_PLATFORM },
          { name: 'bundler.version', value: Bundler::VERSION }
        ]
      },
      components: @components
    }
  end

  def determine_app_version
    # Modern Ruby file reading with better error handling
    version_files = ['VERSION', 'version.rb', 'lib/version.rb']

    version_files.each do |file|
      return File.read(file).strip if File.exist?(file)
    rescue => e
      next
    end

    # Fallback to git
    `git describe --tags --abbrev=0 2>/dev/null`.strip.then do |version|
      version.empty? ? '1.0.0' : version
    end
  end
end

# Usage with modern Ruby async patterns
generator = FiberBasedSbomGenerator.new('Gemfile.lock')
sbom = generator.generate_async

puts JSON.pretty_generate(sbom)

# sbom_service.rb - Cloud-native Ruby SBOM generation service
require 'sinatra/base'
require 'json'
require 'prometheus/client'
require 'prometheus/middleware/collector'
require 'prometheus/middleware/exporter'

class SbomMicroservice < Sinatra::Base
  use Prometheus::Middleware::Collector
  use Prometheus::Middleware::Exporter

  # Prometheus metrics
  @@sbom_requests = Prometheus::Client::Counter.new(
    :sbom_requests_total,
    docstring: 'Total SBOM generation requests',
    labels: [:method, :status]
  )

  @@sbom_generation_duration = Prometheus::Client::Histogram.new(
    :sbom_generation_duration_seconds,
    docstring: 'SBOM generation duration in seconds',
    labels: [:project_type]
  )

  Prometheus::Client.registry.register(@@sbom_requests)
  Prometheus::Client.registry.register(@@sbom_generation_duration)

  configure do
    set :bind, '0.0.0.0'
    set :port, ENV.fetch('PORT', 8080)
    set :environment, ENV.fetch('RACK_ENV', 'production')
  end

  before do
    content_type :json

    # Request logging
    logger.info "#{request.request_method} #{request.path_info} - #{request.ip}"
  end

  after do
    # Record metrics
    @@sbom_requests.increment(
      labels: { 
        method: request.request_method,
        status: response.status.to_s[0] + 'xx'
      }
    )
  end

  # Health check endpoint
  get '/health' do
    {
      status: 'healthy',
      timestamp: Time.now.iso8601,
      version: ENV.fetch('APP_VERSION', '1.0.0'),
      ruby_version: RUBY_VERSION
    }.to_json
  end

  # Readiness check
  get '/ready' do
    # Check dependencies
    ready = check_dependencies

    status ready ? 200 : 503
    {
      ready: ready,
      timestamp: Time.now.iso8601
    }.to_json
  end

  # Generate SBOM from uploaded Gemfile.lock
  post '/sbom/generate' do
    start_time = Time.now

    begin
      # Parse request
      payload = JSON.parse(request.body.read)
      gemfile_lock_content = payload['gemfile_lock']
      project_type = payload['project_type'] || 'ruby'
      options = payload['options'] || {}

      halt 400, { error: 'gemfile_lock content required' }.to_json unless gemfile_lock_content

      # Generate SBOM
      sbom = generate_sbom_from_content(gemfile_lock_content, options)

      # Record success metrics
      duration = Time.now - start_time
      @@sbom_generation_duration.observe(duration, labels: { project_type: project_type })

      logger.info "SBOM generated successfully in #{duration.round(3)}s"

      {
        status: 'success',
        sbom: sbom,
        metadata: {
          generation_time: duration.round(3),
          component_count: sbom[:components]&.length || 0,
          timestamp: Time.now.iso8601
        }
      }.to_json

    rescue JSON::ParserError
      halt 400, { error: 'Invalid JSON payload' }.to_json
    rescue => e
      logger.error "SBOM generation failed: #{e.message}"
      logger.error e.backtrace.join("\n")

      halt 500, { 
        error: 'SBOM generation failed',
        message: e.message 
      }.to_json
    end
  end

  # Generate SBOM from git repository
  post '/sbom/generate/git' do
    start_time = Time.now

    begin
      payload = JSON.parse(request.body.read)
      repo_url = payload['repository_url']
      ref = payload['ref'] || 'main'

      halt 400, { error: 'repository_url required' }.to_json unless repo_url

      # Clone and analyze repository
      sbom = generate_sbom_from_git(repo_url, ref)

      duration = Time.now - start_time
      @@sbom_generation_duration.observe(duration, labels: { project_type: 'git' })

      {
        status: 'success',
        sbom: sbom,
        metadata: {
          repository_url: repo_url,
          ref: ref,
          generation_time: duration.round(3),
          timestamp: Time.now.iso8601
        }
      }.to_json

    rescue => e
      logger.error "Git SBOM generation failed: #{e.message}"
      halt 500, { error: 'Git SBOM generation failed', message: e.message }.to_json
    end
  end

  # Batch SBOM generation
  post '/sbom/batch' do
    payload = JSON.parse(request.body.read)
    projects = payload['projects'] || []

    halt 400, { error: 'projects array required' }.to_json if projects.empty?
    halt 400, { error: 'too many projects (max 10)' }.to_json if projects.length > 10

    results = projects.map do |project|
      begin
        sbom = generate_sbom_from_content(project['gemfile_lock'], project['options'] || {})
        {
          project_id: project['id'],
          status: 'success',
          sbom: sbom
        }
      rescue => e
        {
          project_id: project['id'],
          status: 'error',
          error: e.message
        }
      end
    end

    {
      status: 'completed',
      results: results,
      summary: {
        total: results.length,
        successful: results.count { |r| r[:status] == 'success' },
        failed: results.count { |r| r[:status] == 'error' }
      }
    }.to_json
  end

  private

  def check_dependencies
    # Check external dependencies
    begin
      # Check RubyGems API
      uri = URI('https://rubygems.org/api/v1/api_key')
      response = Net::HTTP.get_response(uri)

      response.code.start_with?('2') || response.code == '401' # API available
    rescue
      false
    end
  end

  def generate_sbom_from_content(gemfile_lock_content, options = {})
    # Parse Gemfile.lock content
    gems = parse_gemfile_lock_content(gemfile_lock_content)

    # Build SBOM
    {
      bomFormat: 'CycloneDX',
      specVersion: '1.7',
      serialNumber: "urn:uuid:#{SecureRandom.uuid}",
      version: 1,
      metadata: {
        timestamp: Time.now.iso8601,
        tools: [{
          name: 'SBOM Microservice',
          version: ENV.fetch('APP_VERSION', '1.0.0')
        }],
        component: {
          type: 'application',
          name: options['project_name'] || 'Ruby Application',
          version: options['project_version'] || '1.0.0'
        }
      },
      components: gems.map { |gem| build_component(gem) }
    }
  end

  def generate_sbom_from_git(repo_url, ref)
    # Clone repository to temporary directory
    temp_dir = Dir.mktmpdir('sbom-git-')

    begin
      system("git clone --depth 1 --branch #{ref} #{repo_url} #{temp_dir}")

      gemfile_lock_path = File.join(temp_dir, 'Gemfile.lock')
      halt 404, { error: 'Gemfile.lock not found in repository' }.to_json unless File.exist?(gemfile_lock_path)

      gemfile_lock_content = File.read(gemfile_lock_path)

      # Extract project info from repository
      project_name = File.basename(repo_url, '.git')

      generate_sbom_from_content(gemfile_lock_content, {
        'project_name' => project_name,
        'repository_url' => repo_url
      })

    ensure
      FileUtils.rm_rf(temp_dir)
    end
  end

  def parse_gemfile_lock_content(content)
    gems = []
    in_specs = false

    content.each_line do |line|
      line = line.strip

      if line == 'specs:'
        in_specs = true
        next
      end

      next unless in_specs
      break if line.empty? && !line.start_with?('    ')

      if match = line.match(/^    (.+) \((.+)\)$/)
        gem_name, version = match[1], match[2]
        gems << { name: gem_name, version: version }
      end
    end

    gems
  end

  def build_component(gem)
    {
      type: 'library',
      'bom-ref' => "gem-#{gem[:name]}-#{gem[:version]}",
      name: gem[:name],
      version: gem[:version],
      purl: "pkg:gem/#{gem[:name]}@#{gem[:version]}",
      scope: 'required'
    }
  end
end

# Kubernetes deployment configuration
if ENV['KUBERNETES_SERVICE_HOST']
  # Running in Kubernetes - add additional cloud-native features

  # Graceful shutdown
  trap('TERM') do
    puts 'Received SIGTERM, shutting down gracefully...'
    exit 0
  end

  # Additional health checks for Kubernetes
  SbomMicroservice.get '/metrics/detailed' do
    content_type 'application/json'

    {
      ruby: {
        version: RUBY_VERSION,
        platform: RUBY_PLATFORM,
        gc_stats: GC.stat
      },
      memory: {
        rss: `ps -o rss= -p #{$$}`.strip.to_i
      },
      process: {
        pid: $$,
        uptime: Time.now - @start_time
      }
    }.to_json
  end
end

# Start the service
if __FILE__ == $0
  @start_time = Time.now
  SbomMicroservice.run!
end

# k8s-ruby-sbom-service.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: ruby-sbom-service
  namespace: sbom-tools
  labels:
    app: ruby-sbom-service
    version: v1.0.0
spec:
  replicas: 3
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 1
      maxSurge: 1
  selector:
    matchLabels:
      app: ruby-sbom-service
  template:
    metadata:
      labels:
        app: ruby-sbom-service
        version: v1.0.0
      annotations:
        prometheus.io/scrape: "true"
        prometheus.io/port: "8080"
        prometheus.io/path: "/metrics"
    spec:
      containers:
      - name: sbom-service
        image: ruby-sbom-service:1.0.0
        ports:
        - containerPort: 8080
          name: http
          protocol: TCP
        env:
        - name: PORT
          value: "8080"
        - name: RACK_ENV
          value: "production"
        - name: APP_VERSION
          value: "1.0.0"
        livenessProbe:
          httpGet:
            path: /health
            port: http
          initialDelaySeconds: 30
          periodSeconds: 30
          timeoutSeconds: 10
          failureThreshold: 3
        readinessProbe:
          httpGet:
            path: /ready
            port: http
          initialDelaySeconds: 5
          periodSeconds: 10
          timeoutSeconds: 5
          failureThreshold: 3
        resources:
          requests:
            memory: "256Mi"
            cpu: "100m"
          limits:
            memory: "512Mi"
            cpu: "500m"
        securityContext:
          allowPrivilegeEscalation: false
          runAsNonRoot: true
          runAsUser: 1000
          capabilities:
            drop:
              - ALL

---
apiVersion: v1
kind: Service
metadata:
  name: ruby-sbom-service
  namespace: sbom-tools
  labels:
    app: ruby-sbom-service
spec:
  type: ClusterIP
  ports:
  - port: 80
    targetPort: http
    protocol: TCP
    name: http
  selector:
    app: ruby-sbom-service

---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ruby-sbom-service-ingress
  namespace: sbom-tools
  annotations:
    nginx.ingress.kubernetes.io/rate-limit: "100"
    nginx.ingress.kubernetes.io/rate-limit-window: "1m"
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
spec:
  tls:
  - hosts:
    - sbom-api.company.com
    secretName: sbom-api-tls
  rules:
  - host: sbom-api.company.com
    http:
      paths:
      - path: /ruby
        pathType: Prefix
        backend:
          service:
            name: ruby-sbom-service
            port:
              number: 80

---
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: ruby-sbom-service-hpa
  namespace: sbom-tools
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: ruby-sbom-service
  minReplicas: 2
  maxReplicas: 10
  metrics:
  - type: Resource
    resource:
      name: cpu
      target:
        type: Utilization
        averageUtilization: 70
  - type: Resource
    resource:
      name: memory
      target:
        type: Utilization
        averageUtilization: 80