`bin/brakeman` added when running `rails app:update` even without brakeman in Gemfile

[etiennebarrie]

Steps to reproduce

Upgrading a Rails 7.1 application to Rails 7.2 adds a bin/brakeman when running bin/rails app:update after upgrading the gem.

Expected behavior

Either of these solutions would be acceptable:

• bin/brakeman is not added unless it's already in the Gemfile.
• brakeman is added to the Gemfile.

But the first one seems favorable.

Actual behavior

bin/brakeman is added but doesn't work:

$ bin/brakeman 
/Users/etienne/.gem/ruby/3.3.4/gems/bundler-2.5.17/lib/bundler/rubygems_integration.rb:265:in `block in replace_bin_path': can't find executable brakeman for gem brakeman. brakeman is not currently included in the bundle, perhaps you meant to add it to your Gemfile? (Gem::Exception)
	from /Users/etienne/.gem/ruby/3.3.4/gems/bundler-2.5.17/lib/bundler/rubygems_integration.rb:304:in `block in replace_bin_path'
	from bin/brakeman:7:in `<main>'

System configuration

Rails version:
7.1.3.4 then 7.2.0
Ruby version:
3.3.4

[etiennebarrie]

Options for the app generator when running app:update are here:

rails/railties/lib/rails/commands/app/update_command.rb

Lines 62 to 76 in d7f9347

	api: !!Rails.application.config.api_only,
	update: true,
	name: Rails.application.class.name.chomp("::Application").underscore,
	skip_active_job: !defined?(ActiveJob::Railtie),
	skip_active_record: !defined?(ActiveRecord::Railtie),
	skip_active_storage: !defined?(ActiveStorage::Engine),
	skip_action_mailer: !defined?(ActionMailer::Railtie),
	skip_action_mailbox: !defined?(ActionMailbox::Engine),
	skip_action_text: !defined?(ActionText::Engine),
	skip_action_cable: !defined?(ActionCable::Engine),
	skip_test: !defined?(Rails::TestUnitRailtie),
	skip_system_test: Rails.application.config.generators.system_tests.nil?,
	asset_pipeline: asset_pipeline,
	skip_asset_pipeline: asset_pipeline.nil?,
	skip_bootsnap: !defined?(Bootsnap),

However similar options are guessed based on whether the gems have been loaded already and have defined a constant, which we cannot do here because the gem isn't loaded by default:

rails/railties/lib/rails/generators/rails/app/templates/Gemfile.tt

Lines 49 to 50 in d7f9347

	# Static analysis for security vulnerabilities [https://brakemanscanner.org/]
	gem "brakeman", require: false

brakeman seems well behaved when being required, so maybe we could just try requiring it and use this to detect whether skip_brakeman should be used.

[Earlopain]

The same is probably true for rubocop as well. The first solution seems better to me too.

[etiennebarrie]

Good catch, bin/thrust as well.

Edit: bin/thrust is for Rails 8.0, not yet an issue.