Remove outdated comment #30
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| - push | |
| - pull_request | |
| permissions: | |
| contents: read # checkout only, nothing else | |
| jobs: | |
| audit: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - uses: ruby/setup-ruby@d45b1a4e94b71acab930e56e79c6aa188764e7f9 # v1.316.0 | |
| with: | |
| ruby-version: "3.4" | |
| bundler-cache: true | |
| - name: Audit dependencies | |
| run: bundle exec bundle-audit check --update | |
| - name: Audit Ruby runtime | |
| # CVE-2026-41316 is an ERB flaw fixed in Ruby 4.0.3 and not yet backported. | |
| # Ignored on affected rubies only. See: | |
| # https://www.ruby-lang.org/en/news/2026/04/21/erb-cve-2026-41316/ | |
| # https://github.com/advisories/GHSA-q339-8rmv-2mhv | |
| run: | | |
| ignore="" | |
| if ruby -e 'exit 1 unless Gem::Version.new(RUBY_VERSION) < Gem::Version.new("4.0.3")'; then | |
| ignore="--ignore CVE-2026-41316" | |
| fi | |
| bundle exec ruby-audit check $ignore | |
| zizmor: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - name: Audit workflows | |
| uses: zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa # v0.5.7 | |
| with: | |
| advanced-security: false # fail the build on findings instead of uploading SARIF | |
| lint: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - uses: ruby/setup-ruby@d45b1a4e94b71acab930e56e79c6aa188764e7f9 # v1.316.0 | |
| with: | |
| ruby-version: "3.4" | |
| bundler-cache: true | |
| - name: Standard | |
| run: bundle exec standardrb | |
| test: | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| ruby: ['3.0', 3.1, 3.2, 3.3, 3.4, '4.0', truffleruby, head, truffleruby-head, jruby-9.4.8] | |
| # Head builds surface upstream regressions early and should not block. | |
| continue-on-error: ${{ matrix.ruby == 'head' || matrix.ruby == 'truffleruby-head' }} | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - name: Set up Ruby | |
| uses: ruby/setup-ruby@d45b1a4e94b71acab930e56e79c6aa188764e7f9 # v1.316.0 | |
| with: | |
| ruby-version: ${{ matrix.ruby }} | |
| bundler-cache: true # bundle installs and caches dependencies | |
| - name: Run tests | |
| run: bundle exec rake --trace | |
| - name: Upload coverage to Coveralls | |
| if: matrix.ruby == '3.4' | |
| uses: coverallsapp/github-action@5cbfd81b66ca5d10c19b062c04de0199c215fb6e # v2.3.7 | |
| with: | |
| file: coverage/.resultset.json | |
| format: simplecov |