Core simplification, README/security overhaul, Dockerfile + coverage badge CI

.github/workflows/coverage-main.yml

@@ -1,17 +1,22 @@
 name: Coverage Main
 
 on:
+  push:
+    branches: [main]
   workflow_dispatch:
 
 jobs:
   coverage:
     runs-on: ubuntu-latest
 
+    permissions:
+      contents: write
+
     steps:
       - uses: actions/checkout@v4
 
       - name: Install libvips
-        run: sudo apt-get update && sudo apt-get install -y libvips
+        run: sudo apt-get update && sudo apt-get install -y libvips librsvg2-2
 
       - name: Set up Ruby
         uses: ruby/setup-ruby@v1
@@ -35,3 +40,43 @@ jobs:
         with:
           name: main-coverage-reports
           path: coverage/
+
+      - name: Generate coverage badge JSON
+        run: |
+          mkdir -p /tmp/badge
+          ruby <<'RUBY' > /tmp/badge/coverage.json
+          require "json"
+          data = JSON.parse(File.read("coverage/.last_run.json"))
+          line = data.dig("result", "line").to_f
+          color =
+            case line
+            when 90.. then "brightgreen"
+            when 75.. then "green"
+            when 60.. then "yellow"
+            when 40.. then "orange"
+            else "red"
+            end
+          puts JSON.generate(
+            schemaVersion: 1,
+            label: "coverage",
+            message: format("%.2f%%", line),
+            color: color
+          )
+          RUBY
+          cat /tmp/badge/coverage.json
+
+      - name: Publish badge to badges branch
+        if: github.ref == 'refs/heads/main'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -e
+          git config --global user.name "github-actions[bot]"
+          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          cd /tmp/badge
+          git init -q --initial-branch=badges
+          git add coverage.json
+          git commit -q -m "ci: update coverage badge [skip ci]"
+          git push --force --quiet \
+            "https://x-access-token:${GH_TOKEN}@github.com/${{ github.repository }}.git" \
+            badges:badges

.rubocop.yml

@@ -1,5 +1,5 @@
 AllCops:
-  TargetRubyVersion: 2.7
+  TargetRubyVersion: 3.1
   NewCops: enable
   SuggestExtensions: false
   Exclude:

CHANGELOG.md

@@ -1,6 +1,62 @@
 # Changelog
 
+## Unreleased
+
+### Added
+- Security warning in README clarifying that LogoSoup is intended for trusted
+  asset pipelines only — not for user uploads or other untrusted sources.
+- `Dockerfile` for development and CI, with Ruby 3.3 + libvips + librsvg.
+- Auto-updating coverage badge. The `Coverage Main` workflow now runs on
+  every push to `main`, generates a shields.io endpoint JSON from
+  `coverage/.last_run.json`, and publishes it to an orphan `badges` branch.
+  The README badge points to that file via `shields.io/endpoint`; no external
+  coverage service signup required.
+
+### Changed
+- `LogoSoup.style` now warns to stderr when callers pass unknown option keys
+  (typos like `align:` instead of `align_by:`), surfacing what used to be a
+  silent footgun.
+- `image_bytes:` that is neither a `String` nor an IO-like object now raises
+  `ArgumentError` instead of producing a cryptic libvips error.
+- SVG bytes coming in via `image_bytes:` + `content_type: "image/svg+xml"` are
+  now safely transcoded to UTF-8 (replacing invalid sequences) instead of being
+  bare `force_encoding`'d, so SVGs with a BOM or in a non-UTF-8 encoding parse
+  without crashing.
+- Internal refactor: replaced `Tempfile` round-trips with
+  `Vips::Image.new_from_buffer` for SVG and raster bytes; removed a duplicate
+  vips decode in `handle_image_path`; switched pixel loops from
+  `Array<Integer>` (`String#bytes`) to binary `String` + `String#getbyte` to
+  reduce per-call allocations.
+- Bumped `.rubocop.yml` `TargetRubyVersion` from 2.7 to 3.1 to match the
+  gemspec's `required_ruby_version`.
+
+### Fixed
+- `SvgDimensions.numeric_dimension` no longer calls `String#blank?` from
+  ActiveSupport (a dev-only dep); replaced with stdlib `nil? || empty?`. The
+  previous code would raise `NoMethodError` at runtime for SVGs without a
+  viewBox.
+- `ImageLoader.ensure_rgba_uchar` no longer crashes on a theoretical 0-band
+  image; behaviour for 0-band input now matches the original implementation
+  (no-op).
+
+## 0.1.3
+
+- Use isotype logo for better light/dark mode README compatibility.
+- Add Codeminer42 logo and reference to the original Logo Soup article.
+
+## 0.1.2
+
+- Bump version (no behavioural change).
+- Relax nokogiri version constraint to allow 1.19.
+
+## 0.1.1
+
+- Rename gem entry point from `logo_soup` to `logosoup` and migrate lib paths.
+- Pin explicit version constraints for `rake`, `rubocop-github`, and
+  `rubocop-performance`.
+
 ## 0.1.0
 
-- Initial gem scaffold
-- `LogoSoup.style` supports SVG strings and raster image paths
+- Initial gem scaffold.
+- `LogoSoup.style` supports SVG strings, raster image paths, and image bytes.
+- Visual-center alignment, density-aware sizing, and graceful fallback.

Dockerfile

@@ -0,0 +1,33 @@
+# Development image for LogoSoup.
+# Provides Ruby + libvips + librsvg so contributors can run specs and develop
+# without installing system dependencies locally.
+#
+# Build:  docker build -t logosoup-dev .
+# Test:   docker run --rm -v "$PWD":/app logosoup-dev bundle exec rspec
+# Shell:  docker run --rm -it -v "$PWD":/app logosoup-dev
+
+FROM ruby:3.3-slim
+
+ENV DEBIAN_FRONTEND=noninteractive \
+    BUNDLE_PATH=/usr/local/bundle
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends \
+        build-essential \
+        pkg-config \
+        libvips42 \
+        libvips-dev \
+        librsvg2-2 \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /app
+
+# Bake gem dependencies into the image. BUNDLE_PATH lives outside /app, so
+# they survive when the working tree is bind-mounted over /app at runtime.
+# version.rb is required because the gemspec loads it during install.
+COPY Gemfile Gemfile.lock logosoup.gemspec ./
+COPY lib/logosoup/version.rb ./lib/logosoup/version.rb
+
+RUN bundle install
+
+CMD ["bash"]

Gemfile.lock

@@ -1,8 +1,8 @@
 PATH
   remote: .
   specs:
-    logosoup (0.1.1)
-      nokogiri (>= 1.15, <= 1.19)
+    logosoup (0.1.3)
+      nokogiri (>= 1.15, < 2)
       ruby-vips (>= 2.2, < 3)
 
 GEM
@@ -149,10 +149,10 @@ PLATFORMS
   x86_64-linux-musl
 
 DEPENDENCIES
-  activesupport (>= 6.1, < 7.1)
+  activesupport (>= 6.1, < 8)
   brakeman (~> 6.1)
   logosoup!
-  minitest (>= 5, < 5.26)
+  minitest (~> 5.1)
   rake (~> 13.0)
   rspec (~> 3.12)
   rubocop (~> 1.50)