CHEF-35087: Isolate security scan packaging and dependency fixes

Signed-off-by: nikhil2611 <ngupta@progress.com>

Author: nikhil2611

chef-cli.gemspec

@@ -45,7 +45,7 @@ Gem::Specification.new do |gem|
   gem.add_dependency "minitar", "~> 1.0"
   gem.add_dependency "chef", ">= 18.0", "< 20.0"
   gem.add_dependency "solve", "> 2.0", "< 5.0"
-  gem.add_dependency "addressable", ">= 2.3.5", "< 2.9"
+  gem.add_dependency "addressable", ">= 2.9.0", "< 3.0"
   gem.add_dependency "cookbook-omnifetch", "~> 0.5"
   gem.add_dependency "diff-lcs", "~> 1.6" # Newer verions of chef-client require diff-lcs ~> 1.6
   gem.add_dependency "pastel", "~> 0.7" # used for policyfile differ

cleanup_lint_roller.rb

@@ -3,7 +3,7 @@
 require "rubygems"
 
 # List of gems that ship with Gemfile.lock files that should be removed
-GEMS_WITH_LOCKFILES = %w{lint_roller stackprof-webnav}.freeze
+GEMS_WITH_LOCKFILES = %w{lint_roller stackprof-webnav chef-cli}.freeze
 
 def cleanup_gem_lockfile(gem_name)
   puts "Cleaning up #{gem_name} Gemfile.lock..."

habitat/plan.ps1

@@ -110,4 +110,7 @@ function Invoke-After {
     # Remove the byproducts of compiling gems with extensions
     Get-ChildItem $pkg_prefix/vendor/gems -Include @("gem_make.out", "mkmf.log", "Makefile") -File -Recurse `
         | Remove-Item -Force
+    # Remove .github directories from vendored gems to avoid CVE false positives
+    Get-ChildItem $pkg_prefix/vendor/gems -Filter ".github" -Directory -Recurse `
+        | Remove-Item -Recurse -Force
 }

habitat/plan.sh

@@ -93,6 +93,12 @@ EOF
   chmod -v 755 "$bin"
 }
 
+do_after() {
+  build_line "Removing .github directories from vendored gems..."
+  find "$pkg_prefix/vendor/gems" -type d -name ".github" \
+      | while read github_dir; do rm -rf "$github_dir"; done
+}
+
 
 do_strip() {
   return 0