fix(docker): pre-create /db directory and fix parent dir creation in download()

- Set GEM_AUDIT_DB=/db with a pre-created /db directory in the image,
  replacing the previous default of ~/.local/share/ruby-advisory-db which
  does not exist in distroless containers
- download() now calls create_dir_all on the parent path before cloning
  to prevent gix failures when parent directories are absent
- Bump version to 2.3.3

Author: 7a6163

CHANGELOG.md

@@ -1,3 +1,16 @@
+### 2.3.3 / 2026-03-01
+
+#### Fixed
+
+* `download()` now calls `create_dir_all` on the parent directory before
+  cloning, preventing failures when the default path (`/root/.local/share/`)
+  does not exist in the container.
+* Docker image default `GEM_AUDIT_DB` changed from `~/.local/share/ruby-advisory-db`
+  to `/db`, a pre-created writable directory in the image that works without
+  any volume mount or environment override.
+
+---
+
 ### 2.3.2 / 2026-03-01
 
 #### Fixed

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "gem-audit"
-version = "2.3.2"
+version = "2.3.3"
 edition = "2024"
 description = "Fast, standalone security auditor for Gemfile.lock"
 license = "MIT"

Cargo.toml

@@ -12,6 +12,11 @@ FROM gcr.io/distroless/cc-debian13:debug
 
 COPY --from=builder /build/target/release/gem-audit /usr/local/bin/gem-audit
 
+# Pre-create a writable directory for the advisory database.
+# Override with GEM_AUDIT_DB (e.g. in GitLab CI point to $CI_PROJECT_DIR).
+RUN ["/busybox/mkdir", "-p", "/db"]
+ENV GEM_AUDIT_DB=/db
+
 WORKDIR /workspace
 
 ENTRYPOINT ["gem-audit"]

Dockerfile

@@ -51,6 +51,11 @@ impl Database {
 
     /// Download the ruby-advisory-db to the given path.
     pub fn download(path: &Path, _quiet: bool) -> Result<Self, DatabaseError> {
+        // Ensure the parent directory exists; gix does not create it automatically.
+        if let Some(parent) = path.parent() {
+            std::fs::create_dir_all(parent).map_err(DatabaseError::Io)?;
+        }
+
         let (mut checkout, _outcome) = gix::prepare_clone(ADVISORY_DB_URL, path)
             .map_err(|e| DatabaseError::DownloadFailed(e.to_string()))?
             .fetch_then_checkout(gix::progress::Discard, &gix::interrupt::IS_INTERRUPTED)