Skip to content

Commit f109cef

Browse files
MichaelGHSegMichaelGHSeg
committed
fix(ci): select Ruby from the runner tool cache instead of ruby/setup-ruby
The org Actions policy admits GitHub-owned actions only, so ruby/setup-ruby could never resolve and every workflow referencing it failed at startup with no check reported. The runner image already caches 3.2/3.3/3.4, so a local composite action can select one without downloading anything. Gem install also moves after the Artifactory OIDC step. setup-ruby's bundler-cache option ran bundle install before it, resolving from rubygems.org and bypassing the curated mirror. Matrix is now 3.2/3.3/3.4: 3.1 is absent from the image and left upstream support in March 2025. deploy.yml still references rubygems/release-gem, which needs an allow-list entry before a release can run.
1 parent 8cbbd29 commit f109cef

4 files changed

Lines changed: 108 additions & 15 deletions

File tree

‎.github/actions/setup-ruby/action.yml‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
name: "Setup Ruby"
2+
description: "Put a Ruby from the runner's tool cache on PATH"
3+
4+
# The org Actions policy allows GitHub-owned actions/* only — no Marketplace, no
5+
# verified creators — so ruby/setup-ruby is unavailable here. The runner image
6+
# already ships a Ruby tool cache, so nothing is downloaded: this only selects
7+
# from what is on the box.
8+
#
9+
# Deliberately does NOT install gems. Bundler must run after the Artifactory OIDC
10+
# step has pointed it at the curated mirror; ruby/setup-ruby's `bundler-cache`
11+
# ran `bundle install` before that step, resolving straight from rubygems.org.
12+
13+
inputs:
14+
ruby-version:
15+
description: "MAJOR.MINOR to select, e.g. '3.3'. The newest matching patch in the tool cache wins."
16+
required: true
17+
18+
outputs:
19+
ruby-version:
20+
description: "Exact version selected, e.g. '3.3.12'"
21+
value: ${{ steps.select.outputs.ruby-version }}
22+
23+
runs:
24+
using: "composite"
25+
steps:
26+
- name: Select Ruby from the tool cache
27+
id: select
28+
shell: bash
29+
env:
30+
REQUESTED: ${{ inputs.ruby-version }}
31+
run: |
32+
set -euo pipefail
33+
34+
case "$(uname -m)" in
35+
x86_64) ARCH=x64 ;;
36+
aarch64|arm64) ARCH=arm64 ;;
37+
*) echo "::error::Unsupported runner architecture $(uname -m)"; exit 1 ;;
38+
esac
39+
40+
CACHE="${RUNNER_TOOL_CACHE}/Ruby"
41+
if [ ! -d "${CACHE}" ]; then
42+
echo "::error::No Ruby tool cache at ${CACHE}. This runner image does not ship one; the matrix must be pinned to a version it does provide."
43+
exit 1
44+
fi
45+
46+
# sort -V so 3.3.10 ranks above 3.3.9.
47+
SELECTED=""
48+
while IFS= read -r candidate; do
49+
[ -x "${candidate}/${ARCH}/bin/ruby" ] && SELECTED="${candidate}"
50+
done < <(find "${CACHE}" -mindepth 1 -maxdepth 1 -type d -name "${REQUESTED}.*" | sort -V)
51+
52+
if [ -z "${SELECTED}" ]; then
53+
echo "::error::Ruby ${REQUESTED}.x is not in the tool cache. Available: $(find "${CACHE}" -mindepth 1 -maxdepth 1 -type d -printf '%f ' 2>/dev/null)"
54+
exit 1
55+
fi
56+
57+
echo "${SELECTED}/${ARCH}/bin" >> "${GITHUB_PATH}"
58+
echo "ruby-version=$(basename "${SELECTED}")" >> "${GITHUB_OUTPUT}"
59+
echo "Selected Ruby $(basename "${SELECTED}") (${ARCH}) from the tool cache"
60+
61+
- name: Verify toolchain
62+
shell: bash
63+
run: |
64+
set -euo pipefail
65+
ruby --version
66+
gem --version
67+
bundle --version

‎.github/workflows/ci.yml‎

Lines changed: 37 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -23,10 +23,16 @@ jobs:
2323
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
2424

2525
- name: Set up Ruby
26-
uses: ruby/setup-ruby@14594264cd68ce8a2345dd349bc3d138a4ef85c8 # v1
26+
uses: ./.github/actions/setup-ruby
2727
with:
2828
ruby-version: '3.3'
29-
bundler-cache: true
29+
30+
- name: Restore gem cache
31+
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
32+
with:
33+
path: vendor/bundle
34+
key: bundle-${{ runner.os }}-ruby3.3-${{ hashFiles('Gemfile.lock') }}
35+
restore-keys: bundle-${{ runner.os }}-ruby3.3-
3036

3137
- name: Authenticate with Artifactory
3238
if: ${{ !github.event.pull_request.head.repo.fork }}
@@ -35,7 +41,9 @@ jobs:
3541
artifactory_url: ${{ env.ARTIFACTORY_URL }}
3642

3743
- name: Install dependencies
38-
run: bundle install
44+
run: |
45+
bundle config set --local path vendor/bundle
46+
bundle install --jobs 4
3947
4048
- name: Run RuboCop
4149
run: bundle exec rubocop
@@ -46,17 +54,26 @@ jobs:
4654
strategy:
4755
fail-fast: false
4856
matrix:
49-
ruby-version: ['3.1', '3.2', '3.3']
57+
# Bounded by what the runner image caches — see .github/actions/setup-ruby.
58+
# 3.1 was dropped when ruby/setup-ruby went away: it left upstream support
59+
# in March 2025 and the image does not carry it.
60+
ruby-version: ['3.2', '3.3', '3.4']
5061

5162
steps:
5263
- name: Checkout
5364
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
5465

5566
- name: Set up Ruby
56-
uses: ruby/setup-ruby@14594264cd68ce8a2345dd349bc3d138a4ef85c8 # v1
67+
uses: ./.github/actions/setup-ruby
5768
with:
5869
ruby-version: ${{ matrix.ruby-version }}
59-
bundler-cache: true
70+
71+
- name: Restore gem cache
72+
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
73+
with:
74+
path: vendor/bundle
75+
key: bundle-${{ runner.os }}-ruby${{ matrix.ruby-version }}-${{ hashFiles('Gemfile.lock') }}
76+
restore-keys: bundle-${{ runner.os }}-ruby${{ matrix.ruby-version }}-
6077

6178
- name: Authenticate with Artifactory
6279
if: ${{ !github.event.pull_request.head.repo.fork }}
@@ -65,7 +82,9 @@ jobs:
6582
artifactory_url: ${{ env.ARTIFACTORY_URL }}
6683

6784
- name: Install dependencies
68-
run: bundle install
85+
run: |
86+
bundle config set --local path vendor/bundle
87+
bundle install --jobs 4
6988
7089
- name: Run tests
7190
run: bundle exec rake
@@ -80,10 +99,16 @@ jobs:
8099
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
81100

82101
- name: Set up Ruby
83-
uses: ruby/setup-ruby@14594264cd68ce8a2345dd349bc3d138a4ef85c8 # v1
102+
uses: ./.github/actions/setup-ruby
84103
with:
85104
ruby-version: '3.3'
86-
bundler-cache: true
105+
106+
- name: Restore gem cache
107+
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
108+
with:
109+
path: vendor/bundle
110+
key: bundle-${{ runner.os }}-ruby3.3-${{ hashFiles('Gemfile.lock') }}
111+
restore-keys: bundle-${{ runner.os }}-ruby3.3-
87112

88113
- name: Authenticate with Artifactory
89114
if: ${{ !github.event.pull_request.head.repo.fork }}
@@ -92,7 +117,9 @@ jobs:
92117
artifactory_url: ${{ env.ARTIFACTORY_URL }}
93118

94119
- name: Install dependencies
95-
run: bundle install
120+
run: |
121+
bundle config set --local path vendor/bundle
122+
bundle install --jobs 4
96123
97124
- name: Build gem
98125
run: gem build analytics-ruby.gemspec

‎.github/workflows/deploy.yml‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -21,10 +21,9 @@ jobs:
2121
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
2222

2323
- name: Set up Ruby
24-
uses: ruby/setup-ruby@14594264cd68ce8a2345dd349bc3d138a4ef85c8 # v1
24+
uses: ./.github/actions/setup-ruby
2525
with:
2626
ruby-version: '3.3'
27-
bundler-cache: true
2827

2928
- name: Authenticate with Artifactory
3029
uses: ./.github/actions/artifactory-oidc
@@ -51,7 +50,7 @@ jobs:
5150
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
5251

5352
- name: Set up Ruby
54-
uses: ruby/setup-ruby@14594264cd68ce8a2345dd349bc3d138a4ef85c8 # v1
53+
uses: ./.github/actions/setup-ruby
5554
with:
5655
ruby-version: '3.3'
5756

‎.github/workflows/e2e-tests.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -38,12 +38,12 @@ jobs:
3838
path: sdk-e2e-tests
3939

4040
- name: Setup Ruby
41-
uses: ruby/setup-ruby@14594264cd68ce8a2345dd349bc3d138a4ef85c8 # v1
41+
uses: ./.github/actions/setup-ruby
4242
with:
4343
ruby-version: '3.3'
4444

4545
- name: Setup Node.js
46-
uses: actions/setup-node@v4
46+
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
4747
with:
4848
node-version: '20'
4949

0 commit comments

Comments
 (0)