Made Brakeman CI config stricter

[igor-alexandrov]

Made Brakeman execution stricter:

• --ensure-latest ensures that the latest version of Brakeman is used
• --no-pager is better for CI execution

[rafaelfranca]

This file is just the generated binstub by bundler, we should not change its content. If this is a better default, we should be wither changing Breakman to always use it.

If we can't, let's pass it in the ci.yml file.

[igor-alexandrov]

@rafaelfranca I agree with your concerns, however default Rails binstubs are not equal to those which are generated by bundler. Please take a look at file that is generated by bundle binstubs rubocop.

ENV["BUNDLE_GEMFILE"] ||= File.expand_path("../Gemfile", __dir__)

bundle_binstub = File.expand_path("bundle", __dir__)

if File.file?(bundle_binstub)
  if File.read(bundle_binstub, 300).include?("This file was generated by Bundler")
    load(bundle_binstub)
  else
    abort("Your `bin/bundle` was not generated by Bundler, so this binstub cannot run.
Replace `bin/bundle` by running `bundle binstubs bundler --force`, then run this command again.")
  end
end

require "rubygems"
require "bundler/setup"

load Gem.bin_path("rubocop", "rubocop")

At the same time default Rails bin/rubocop has the default param which gave me the idea.

require "rubygems"
require "bundler/setup"

# explicit rubocop config increases performance slightly while avoiding config confusion.
ARGV.unshift("--config", File.expand_path("../.rubocop.yml", __dir__))

load Gem.bin_path("rubocop", "rubocop")

[igor-alexandrov]

I think that probably we should change both bin/brakeman and force required params in .github/ci.yml.

[rafaelfranca]

Nah. I'm fine with this then.

[rafaelfranca]

Nah. I'm fine with this then.