Ruby Collector
Analyze Ruby projects to collect Bundler metadata, dependencies, Ruby version, and CI/CD command tracking. Detects Gemfile, .ruby-version, Rakefile, and gemspec files.
ruby to your lunar-config.yml:uses: github://earthly/lunar-lib/collectors/ruby@v1.0.5
What This Integration Collects
This integration includes 7 collectors that gather metadata from your systems.
project
Analyzes Ruby project structure by detecting Gemfile, Gemfile.lock, .ruby-version, Rakefile, and .gemspec files. Extracts the Ruby version from .ruby-version or the Gemfile ruby directive. Detects build systems (Bundler, Rake). Writes project metadata to .lang.ruby.
dependencies
Extracts direct and development dependencies from Gemfile and Gemfile.lock. Captures gem name, version constraint, and dependency group (default, development, test). Writes dependency data to .lang.ruby.dependencies.
cicd
Records every ruby command executed in CI pipelines along with the Ruby runtime version. Writes command strings and version info to .lang.ruby.cicd for audit trails and build reproducibility analysis.
bundler-cicd
Records every bundle command executed in CI pipelines along with the Bundler version. Writes command strings and version info to .lang.ruby.bundler.cicd.
rake-cicd
Records every rake command executed in CI pipelines along with the Rake version. Writes command strings and version info to .lang.ruby.rake.cicd.
bundler-audit
Runs bundler-audit against Gemfile.lock to check for known vulnerabilities in gem dependencies. Requires Gemfile.lock to be present. Writes advisory details including gem name, version, CVE, and severity to .lang.ruby.bundler_audit.
bundler-audit-cicd
Parses bundle audit results after the command completes in CI. Extracts vulnerability advisories including gem name, installed version, advisory ID, and severity. Writes results to .lang.ruby.bundler_audit.
How Collectors Fit into Lunar
Lunar watches your code and CI/CD systems to collect SDLC data from config files, test results, IaC, deployment configurations, security scans, and more.
Collectors are the automatic data-gathering layer. They extract structured metadata from your repositories and pipelines, feeding it into Lunar's centralized database where guardrails evaluate it to enforce your engineering standards.
Learn How Lunar Works →Example Collected Data
This collector writes structured metadata to the Component JSON. Here's an example of the data it produces:
{
"lang": {
"ruby": {
"version": "3.2.2",
"build_systems": ["bundler", "rake"],
"gemfile_exists": true,
"gemfile_lock_exists": true,
"ruby_version_file_exists": true,
"rakefile_exists": true,
"gemspec_files": ["my_gem.gemspec"],
"source": { "tool": "ruby", "integration": "code" },
"cicd": {
"cmds": [
{ "cmd": "ruby app.rb", "version": "3.2.2" }
]
},
"bundler": {
"cicd": {
"cmds": [
{ "cmd": "bundle install", "version": "2.4.22" }
]
}
},
"rake": {
"cicd": {
"cmds": [
{ "cmd": "rake test", "version": "13.1.0" }
]
}
},
"bundler_audit": {
"vulnerabilities": [
{
"gem": "actionpack",
"version": "7.0.4",
"advisory": "CVE-2023-22795",
"title": "ReDoS vulnerability in Accept header parsing",
"criticality": "High"
}
],
"source": { "tool": "bundler-audit", "integration": "ci" }
},
"dependencies": {
"direct": [
{ "name": "rails", "version": "7.1.3", "group": "default" },
{ "name": "pg", "version": "1.5.4", "group": "default" }
],
"development": [
{ "name": "rspec", "version": "3.12.0", "group": "development" },
{ "name": "rubocop", "version": "1.60.0", "group": "development" }
],
"source": { "tool": "bundler", "integration": "code" }
}
}
}
}Documentation
View on GitHubRuby Collector
Collects Ruby project information, CI/CD commands, dependencies, and bundler-audit results.
Overview
This collector gathers metadata about Ruby projects including Bundler configuration, dependency graphs, Ruby version detection, and CI/CD command tracking. It detects Gemfile, Gemfile.lock, .ruby-version, Rakefile, and .gemspec files. The CI-hook collectors observe and collect data from ruby, bundle, and rake commands that your CI pipeline already runs.
Collected Data
This collector writes to the following Component JSON paths:
| Path | Type | Description |
|---|---|---|
.lang.ruby |
object | Ruby project metadata (version, build systems) |
.lang.ruby.version |
string | Ruby version from .ruby-version or Gemfile |
.lang.ruby.build_systems |
array | Build systems detected (e.g., ["bundler", "rake"]) |
.lang.ruby.gemfile_exists |
boolean | Gemfile detected |
.lang.ruby.gemfile_lock_exists |
boolean | Gemfile.lock detected |
.lang.ruby.ruby_version_file_exists |
boolean | .ruby-version file detected |
.lang.ruby.rakefile_exists |
boolean | Rakefile detected |
.lang.ruby.gemspec_files |
array | List of .gemspec files found |
.lang.ruby.cicd |
object | CI/CD ruby command tracking with version |
.lang.ruby.bundler.cicd |
object | CI/CD bundle command tracking with version |
.lang.ruby.rake.cicd |
object | CI/CD rake command tracking with version |
.lang.ruby.bundler_audit |
object | Bundler-audit vulnerability results |
.lang.ruby.dependencies |
object | Direct and development dependencies |
Collectors
This plugin provides the following collectors (use include to select a subset):
| Collector | Hook Type | Description |
|---|---|---|
project |
code | Collects project structure, Ruby version, build systems, gemspec files |
dependencies |
code | Collects dependency graph from Gemfile and Gemfile.lock |
cicd |
ci-before-command | Tracks ruby commands run in CI with version info |
bundler-cicd |
ci-before-command | Tracks bundle commands run in CI with version info |
rake-cicd |
ci-before-command | Tracks rake commands run in CI with version info |
bundler-audit |
code | Auto-runs bundler-audit against Gemfile.lock for vulnerability detection |
bundler-audit-cicd |
ci-after-command | Parses bundler-audit vulnerability results from CI |
Installation
Add to your lunar-config.yml:
collectors:
- uses: github://earthly/lunar-lib/collectors/ruby@main
on: ["domain:your-domain"] # replace with your own domain or tags
# include: [project, dependencies] # Only include specific subcollectors
The CI-hook collectors (cicd, bundler-cicd, rake-cicd, bundler-audit-cicd) require a GitHub Actions workflow that runs on a Lunar-enabled runner. Example steps:
jobs:
build:
runs-on: your-lunar-runner
steps:
- uses: actions/checkout@v4
- run: bundle install
- run: ruby --version
- run: bundle exec rake
- run: |
gem install bundler-audit --no-document
bundle audit update
bundle audit check || true
Each step triggers the corresponding CI hook collector, which captures command versions and output for the Component JSON.
Open Source
This collector is open source and available on GitHub. Contribute improvements, report issues, or fork it for your own use.
Common Use Cases
Explore guardrails that use data from Ruby Collector.
Ready to Automate Your Standards?
See how Lunar can turn your AGENTS.md, engineering wiki, compliance docs, or postmortem action items into automated guardrails with our 100+ built-in guardrails.
AI agent rules & prompt files
Post-mortem action items
Security & compliance policies
Testing & quality requirements