Updates from main

.github/FUNDING.yml

@@ -1,13 +1,13 @@
 # These are supported funding model platforms
 
+buy_me_a_coffee: pboling
+community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry
 github: [pboling] # Replace with up to 4 GitHub Sponsors-enabled usernames e.g., [user1, user2]
-patreon: galtzo # Replace with a single Patreon username
-open_collective: # Replace with a single Open Collective username
+issuehunt: pboling # Replace with a single IssueHunt username
 ko_fi: pboling # Replace with a single Ko-fi username
-tidelift: rubygems/version_gem # Replace with a single Tidelift platform-name/package-name e.g., npm/babel
-community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry
 liberapay: pboling # Replace with a single Liberapay username
-issuehunt: pboling # Replace with a single IssueHunt username
-otechie: # Replace with a single Otechie username
-lfx_crowdfunding: # Replace with a single LFX Crowdfunding project-name e.g., cloud-foundry
-custom: # Replace with up to 4 custom sponsorship URLs e.g., ['link1', 'link2']
+open_collective: # Replace with a single Open Collective username
+patreon: galtzo # Replace with a single Patreon username
+polar: pboling
+thanks_dev: gh/pboling
+tidelift: rubygems/version_gem # Replace with a single Tidelift platform-name/package-name e.g., npm/babel

.github/workflows/coverage.yml

@@ -1,16 +1,16 @@
-name: Code Coverage
+name: Ruby - Coverage
 
 env:
-  CI_CODECOV: true
-  COVER_ALL: true
+  K_SOUP_COV_MIN_BRANCH: 82
+  K_SOUP_COV_MIN_LINE: 94
+  K_SOUP_COV_MIN_HARD: true
 
 on:
   push:
     branches:
       - 'main'
-      - '*-maintenance'
-      - '*-dev'
       - '*-stable'
+      - '*-dev'
     tags:
       - '!*' # Do not execute on tags
   pull_request:
@@ -19,96 +19,92 @@ on:
   # Allow manually triggering the workflow.
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 # Cancels all previous workflow runs for the same branch that have not yet completed.
 concurrency:
   # The concurrency group contains the workflow name and the branch name.
-  group: ${{ github.workflow }}-${{ github.ref }}
+  group: "${{ github.workflow }}-${{ github.ref }}"
   cancel-in-progress: true
 
 jobs:
   test:
     name: Specs with Coverage - Ruby ${{ matrix.ruby }} ${{ matrix.name_extra || '' }}
     if: "!contains(github.event.commits[0].message, '[ci skip]') && !contains(github.event.commits[0].message, '[skip ci]')"
+    env: # $BUNDLE_GEMFILE must be set at the job level, so it is set for all steps
+      BUNDLE_GEMFILE: ${{ github.workspace }}/gemfiles/${{ matrix.gemfile }}.gemfile
+      CI_CODECOV: true
+      COVER_ALL: true
+    runs-on: ubuntu-latest
+    continue-on-error: ${{ matrix.experimental || endsWith(matrix.ruby, 'head') }}
     strategy:
-      fail-fast: false
       matrix:
-        experimental: [false]
         rubygems:
           - latest
         bundler:
           - latest
+        gemfile:
+          - coverage
         ruby:
-          - "2.7"
+          - '3.1'
 
-    runs-on: ubuntu-latest
-    continue-on-error: ${{ matrix.experimental || endsWith(matrix.ruby, 'head') }}
     steps:
-      - uses: amancevice/setup-code-climate@v0
-        name: CodeClimate Install
-        if: matrix.ruby == '2.7' && github.event_name != 'pull_request' && always()
+      - name: CodeClimate Install
+        uses: amancevice/setup-code-climate@v1
+        if: ${{ github.event_name != 'pull_request' }}
         with:
-          cc_test_reporter_id: ${{ secrets.CC_TEST_REPORTER_ID }}
+          cc_test_reporter_id: "${{ secrets.CC_TEST_REPORTER_ID }}"
 
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Setup Ruby & Bundle
         uses: ruby/setup-ruby@v1
         with:
-          ruby-version: ${{ matrix.ruby }}
-          rubygems: ${{ matrix.rubygems }}
-          bundler: ${{ matrix.bundler }}
+          ruby-version: "${{ matrix.ruby }}"
+          rubygems: "${{ matrix.rubygems }}"
+          bundler: "${{ matrix.bundler }}"
           bundler-cache: true
 
       - name: CodeClimate Pre-build Notification
         run: cc-test-reporter before-build
-        if: matrix.ruby == '2.7' && github.event_name != 'pull_request' && always()
+        if: ${{ github.event_name != 'pull_request' }}
         continue-on-error: ${{ matrix.experimental != 'false' }}
 
       - name: Run tests
         run: bundle exec rake test
 
       - name: CodeClimate Post-build Notification
         run: cc-test-reporter after-build
-        if: matrix.ruby == '2.7' && github.event_name != 'pull_request' && always()
+        if: ${{ github.event_name != 'pull_request' }}
         continue-on-error: ${{ matrix.experimental != 'false' }}
 
       - name: Code Coverage Summary Report
-        uses: irongut/[email protected]
+        uses: irongut/[email protected]
+        if: ${{ github.event_name == 'pull_request' }}
         with:
           filename: ./coverage/coverage.xml
           badge: true
           fail_below_min: true
           format: markdown
-          hide_branch_rate: true
+          hide_branch_rate: false
           hide_complexity: true
           indicators: true
           output: both
-          thresholds: '86 88'
+          thresholds: '93 82'
         continue-on-error: ${{ matrix.experimental != 'false' }}
 
       - name: Add Coverage PR Comment
         uses: marocchino/sticky-pull-request-comment@v2
-        if: matrix.ruby == '2.7' && always()
+        if: ${{ github.event_name == 'pull_request' }}
         with:
           recreate: true
           path: code-coverage-results.md
         continue-on-error: ${{ matrix.experimental != 'false' }}
 
       - name: Coveralls
         uses: coverallsapp/github-action@master
-        if: matrix.ruby == '2.7' && github.event_name != 'pull_request' && always()
         with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
+          github-token: "${{ secrets.GITHUB_TOKEN }}"
         continue-on-error: ${{ matrix.experimental != 'false' }}
-
-#      Using the codecov gem instead.
-#      - name: CodeCov
-#        uses: codecov/codecov-action@v2
-#        if: matrix.ruby == '2.7' && github.event_name != 'pull_request' && always()
-#        with:
-#          files: ./coverage/coverage.xml
-#          flags: unittests
-#          name: codecov-upload
-#          fail_ci_if_error: true
-#        continue-on-error: ${{ matrix.experimental != 'false' }}

.github/workflows/dependency-review.yml

@@ -0,0 +1,20 @@
+# Dependency Review Action
+#
+# This Action will scan dependency manifest files that change as part of a Pull Request, surfacing known-vulnerable versions of the packages declared or updated in the PR. Once installed, if the workflow run is marked as required, PRs introducing known-vulnerable packages will be blocked from merging.
+#
+# Source repository: https://github.com/actions/dependency-review-action
+# Public documentation: https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/about-dependency-review#dependency-review-enforcement
+name: 'Dependency Review'
+on: [pull_request]
+
+permissions:
+  contents: read
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    steps:
+      - name: 'Checkout Repository'
+        uses: actions/checkout@v4
+      - name: 'Dependency Review'
+        uses: actions/dependency-review-action@v2

.github/workflows/heads.yml

@@ -1,11 +1,14 @@
-name: Ruby HEAD Support
+name: Ruby Heads Matrix
+
+env:
+  K_SOUP_COV_DO: false
 
 on:
   push:
     branches:
       - 'main'
-      - '*-dev'
       - '*-stable'
+      - '*-dev'
     tags:
       - '!*' # Do not execute on tags
   pull_request:
@@ -14,39 +17,48 @@ on:
   # Allow manually triggering the workflow.
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 # Cancels all previous workflow runs for the same branch that have not yet completed.
 concurrency:
   # The concurrency group contains the workflow name and the branch name.
-  group: ${{ github.workflow }}-${{ github.ref }}
+  group: "${{ github.workflow }}-${{ github.ref }}"
   cancel-in-progress: true
 
 jobs:
   test:
-    name: Ruby ${{ matrix.ruby }} ${{ matrix.name_extra || '' }}
+    name: Specs - Ruby ${{ matrix.ruby }} ${{ matrix.name_extra || '' }}
     if: "!contains(github.event.commits[0].message, '[ci skip]') && !contains(github.event.commits[0].message, '[skip ci]')"
+    env: # $BUNDLE_GEMFILE must be set at the job level, so it is set for all steps
+      BUNDLE_GEMFILE: ${{ github.workspace }}/gemfiles/${{ matrix.gemfile }}.gemfile
+    runs-on: ubuntu-latest
+    continue-on-error: ${{ matrix.experimental || endsWith(matrix.ruby, 'head') }}
     strategy:
-      fail-fast: false
+      fail-fast: true
       matrix:
-        experimental: [true]
         rubygems:
           - latest
         bundler:
           - latest
+        gemfile:
+          - vanilla
         ruby:
-          # rubocop supports JRuby, but I can't get it to work on jruby-head (and the problem might be in JRuby!)
           - "ruby-head"
+          # TODO: Use rspec-pending_for to exempt (and document) truffleruby-head from specific tests that are failing
+          # - truffleruby-head
 
-    runs-on: ubuntu-latest
-    continue-on-error: ${{ matrix.experimental || endsWith(matrix.ruby, 'head') }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
+
       - name: Setup Ruby & Bundle
         uses: ruby/setup-ruby@v1
         with:
-          ruby-version: ${{ matrix.ruby }}
-          rubygems: ${{ matrix.rubygems }}
-          bundler: ${{ matrix.bundler }}
+          ruby-version: "${{ matrix.ruby }}"
+          rubygems: "${{ matrix.rubygems }}"
+          bundler: "${{ matrix.bundler }}"
           bundler-cache: true
+
       - name: Run tests
         run: bundle exec rake test

.github/workflows/legacy.yml

@@ -4,9 +4,8 @@ on:
   push:
     branches:
       - 'main'
-      - '*-maintenance'
-      - '*-dev'
       - '*-stable'
+      - '*-dev'
     tags:
       - '!*' # Do not execute on tags
   pull_request:
@@ -25,6 +24,8 @@ jobs:
   test:
     name: Ruby ${{ matrix.ruby }} ${{ matrix.name_extra || '' }}
     if: "!contains(github.event.commits[0].message, '[ci skip]') && !contains(github.event.commits[0].message, '[skip ci]')"
+    env: # $BUNDLE_GEMFILE must be set at the job level, so it is set for all steps
+      BUNDLE_GEMFILE: ${{ github.workspace }}/gemfiles/${{ matrix.gemfile }}.gemfile
     strategy:
       fail-fast: false
       matrix:
@@ -33,11 +34,14 @@ jobs:
           - "2.7.11"
         bundler:
           - none
+        gemfile:
+          - vanilla
         ruby:
+          - "3.0"
+          - "2.7"
           - "2.6"
           - "2.5"
           - "2.4"
-          - "2.3"
     runs-on: ubuntu-20.04
     continue-on-error: ${{ matrix.experimental || endsWith(matrix.ruby, 'head') }}
     steps:

.github/workflows/style.yml

@@ -1,12 +1,15 @@
-name: Code Style Checks
+# RuboCop Gradual isn't able to parse something in this repo.
+# Not sure what exactly, and reported here:
+# https://github.com/skryukov/rubocop-gradual/issues/12
+# As a result this workflow must allow failure.
+name: Ruby - Style
 
 on:
   push:
     branches:
       - 'main'
-      - '*-maintenance'
-      - '*-dev'
       - '*-stable'
+      - '*-dev'
     tags:
       - '!*' # Do not execute on tags
   pull_request:
@@ -15,24 +18,32 @@ on:
 
 jobs:
   rubocop:
-    name: Rubocop
-    if: "!contains(github.event.commits[0].message, '[ci skip]') && !contains(github.event.commits[0].message, '[skip ci]')"
+    name: RuboCop
     strategy:
       fail-fast: false
       matrix:
-        experimental: [false]
+        experimental: [true]
+        rubygems:
+          - latest
+        bundler:
+          - latest
+        gemfile:
+          - style
         ruby:
-          - "2.2"
-    runs-on: ubuntu-20.04
+          - "3.2"
+    runs-on: ubuntu-latest
+    continue-on-error: ${{ matrix.experimental || endsWith(matrix.ruby, 'head') }}
+    env: # $BUNDLE_GEMFILE must be set at the job level, so it is set for all steps
+      BUNDLE_GEMFILE: ${{ github.workspace }}/gemfiles/${{ matrix.gemfile }}.gemfile
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
       - name: Setup Ruby & Bundle
         uses: ruby/setup-ruby@v1
         with:
           ruby-version: ${{ matrix.ruby }}
           rubygems: ${{ matrix.rubygems }}
           bundler: ${{ matrix.bundler }}
           bundler-cache: true
-      - name: Run Rubocop
-        run: bundle exec rubocop -DES
+      - name: Run RuboCop
+        run: bundle exec rake rubocop_gradual:check