Add some linters specifically for the Gemfile

[dkniffin]

It'd be awesome if there were some linters specifically geared towards the Gemfile.

There's probably a bunch of ones that could be made, but here's some ideas off the top of my head:

• Make sure a gem group isn't defined twice
• Enforce alphabetization of "groups" of gems (lines that are next to each other)
• Make sure a gem is only listed once (although this is actually built into bundler)
• Specify requirements for gem versions.
  • Require a version for every gem
  • Require versions to only be at the "major" level
  • Require no versions to be specified, unless it has a comment with it (related blog post)
• require the ruby version to be specified
• require source 'http://rubygems.org' at the top of the file
• A check specifically for this vulnerability

[mikegee]

I think this is a great idea. Some of those checks will need configurability, of course. (For instance, where I work apps are required to pull from the local gem server, not rubygems.)

A check specifically for this vulnerability would be cool, too.

[dkniffin]

Interesting. I hadn't heard of that vulnerability. I think it'd be worthwhile to have a check for it. I'll add it to the list in my original post.

[bbatsov]

I agree. I'd accept Gemfile linters if someone is willing to write them. :-)

[jmks]

Make sure a gem is only listed once

I'll give this one a go

[RKushnir]

The idea of enforcing an order in a Gemfile is just wrong. The order is important because the gems are loaded as they are listed and may contain logic dependent on the gems already in memory.

[mikegee]

@RKushnir, the new cop enforces ordering of groups of adjacent gems, not the whole Gemfile. No one has reported it breaking their app in the six months since it was added.

[RKushnir]

@mikegee I see, I didn't immediately grasp what is a group. Then it assumes the dependent gems are placed in different "batches". So if you need to enforce a specific order, you have to put a newline between them.

[bbatsov]

We've got some cops in this group already, so I guess we can close this one.

[vassilevsky]

I don't understand why gems have to be sorted alphabetically.

[dkniffin]

@vassilevsky They don't have to be. You can disable that linter config (cop). The reason you might want it is so that you can quickly scan down the list visually and see whether a gem is there or not.

[vassilevsky]

Yeah that's one reason to have them sorted :)