CHEF-34831: Security scan packaging fixes and dependency updates (#342)

* CHEF-35087: Isolate security scan packaging and dependency fixes

Signed-off-by: nikhil2611 <ngupta@progress.com>

* Rename cleanup_lint_roller.rb to cleanup_gem_lockfiles.rb

The script handles multiple gems (lint_roller, stackprof-webnav, chef-cli),
so the filename should reflect its generic purpose.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Signed-off-by: nikhil2611 <ngupta@progress.com>

* removing chef-cli from list of lock file removal

Signed-off-by: nikhil2611 <ngupta@progress.com>

---------

Signed-off-by: nikhil2611 <ngupta@progress.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: nikhil2611

chef-cli.gemspec

@@ -45,7 +45,7 @@ Gem::Specification.new do |gem|
   gem.add_dependency "minitar", "~> 1.0"
   gem.add_dependency "chef", ">= 18.0", "< 20.0"
   gem.add_dependency "solve", "> 2.0", "< 5.0"
-  gem.add_dependency "addressable", ">= 2.3.5", "< 2.9"
+  gem.add_dependency "addressable", ">= 2.9.0", "< 3.0"
   gem.add_dependency "cookbook-omnifetch", "~> 0.5"
   gem.add_dependency "diff-lcs", "~> 1.6" # Newer verions of chef-client require diff-lcs ~> 1.6
   gem.add_dependency "pastel", "~> 0.7" # used for policyfile differ

cleanup_lint_roller.rb cleanup_gem_lockfiles.rbcleanup_lint_roller.rb renamed to cleanup_gem_lockfiles.rb

@@ -57,7 +57,7 @@ function Invoke-Build {
         gem install chef-cli-*.gem --no-document
 
         Write-BuildLine " ** Cleaning up lint_roller Gemfile.lock"
-        ruby ./cleanup_lint_roller.rb
+        ruby ./cleanup_gem_lockfiles.rb
         ruby ./post-bundle-install.rb
 
         If ($lastexitcode -ne 0) { Exit $lastexitcode }
@@ -110,4 +110,7 @@ function Invoke-After {
     # Remove the byproducts of compiling gems with extensions
     Get-ChildItem $pkg_prefix/vendor/gems -Include @("gem_make.out", "mkmf.log", "Makefile") -File -Recurse `
         | Remove-Item -Force
+    # Remove .github directories from vendored gems to avoid CVE false positives
+    Get-ChildItem $pkg_prefix/vendor/gems -Filter ".github" -Directory -Recurse `
+        | Remove-Item -Recurse -Force
 }

habitat/plan.ps1

@@ -45,7 +45,7 @@ do_build() {
     bundle install
     gem build chef-cli.gemspec
     gem install rspec-core -v '~> 3.12.3'
-    ruby ./cleanup_lint_roller.rb
+    ruby ./cleanup_gem_lockfiles.rb
     ruby ./post-bundle-install.rb
 }
 do_install() {
@@ -93,6 +93,12 @@ EOF
   chmod -v 755 "$bin"
 }
 
+do_after() {
+  build_line "Removing .github directories from vendored gems..."
+  find "$pkg_prefix/vendor/gems" -type d -name ".github" \
+      | while read github_dir; do rm -rf "$github_dir"; done
+}
+
 
 do_strip() {
   return 0