Harden CI and add trusted publishing

Bring akami's workflows and tooling to the savonrb standard.

* SHA-pin GitHub actions, drop GITHUB_TOKEN to read-only,
  persist-credentials: false, and add audit (bundle-audit +
  ruby-audit), zizmor and standardrb jobs
* Extend the test matrix to 3.4/4.0/truffleruby and add a
  provisional jruby-9.4.8 build
* upload coverage to Coveralls from the 3.4 build
* gem_push.yml: publish via trusted publishing
* dependabot.yml: track the github-actions ecosystem weekly
  with a 7-day cooldown

Author: rubiii

.github/dependabot.yml

@@ -1,12 +1,14 @@
-# To get started with Dependabot version updates, you'll need to specify which
-# package ecosystems to update and where the package manifests are located.
-# Please see the documentation for more information:
-# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
-# https://containers.dev/guide/dependabot
-
 version: 2
 updates:
- - package-ecosystem: "devcontainers"
-   directory: "/"
-   schedule:
-     interval: weekly
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
+  - package-ecosystem: "devcontainers"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7

.github/workflows/ci.yml

@@ -1,24 +1,86 @@
-name: Ruby
+name: CI
 
 on:
   - push
   - pull_request
 
+permissions:
+  contents: read # checkout only, nothing else
+
 jobs:
+  audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: ruby/setup-ruby@d45b1a4e94b71acab930e56e79c6aa188764e7f9 # v1.316.0
+        with:
+          ruby-version: "3.4"
+          bundler-cache: true
+      - name: Audit dependencies
+        run: bundle exec bundle-audit check --update
+      - name: Audit Ruby runtime
+        # CVE-2026-41316 is an ERB flaw fixed in Ruby 4.0.3 and not yet backported.
+        # Ignored on affected rubies only. See:
+        # https://www.ruby-lang.org/en/news/2026/04/21/erb-cve-2026-41316/
+        # https://github.com/advisories/GHSA-q339-8rmv-2mhv
+        run: |
+          ignore=""
+          if ruby -e 'exit 1 unless Gem::Version.new(RUBY_VERSION) < Gem::Version.new("4.0.3")'; then
+            ignore="--ignore CVE-2026-41316"
+          fi
+          bundle exec ruby-audit check $ignore
+
+  zizmor:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - name: Audit workflows
+        uses: zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa # v0.5.7
+        with:
+          advanced-security: false # fail the build on findings instead of uploading SARIF
+
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: ruby/setup-ruby@d45b1a4e94b71acab930e56e79c6aa188764e7f9 # v1.316.0
+        with:
+          ruby-version: "3.4"
+          bundler-cache: true
+      - name: Standard
+        run: bundle exec standardrb
+
   test:
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
       matrix:
-        ruby: [3.0, 3.1, 3.2, 3.3, head, truffleruby-head]
-    env:
-      RAILS_ENV: test
+        ruby: ['3.0', 3.1, 3.2, 3.3, 3.4, '4.0', truffleruby, head, truffleruby-head, jruby-9.4.8]
+    # Head builds surface upstream regressions early and should not block.
+    # jruby is included provisionally: akami's OpenSSL-based signing and GOST
+    # engine make its jruby support unverified, so it does not block either
+    # until a green run proves it can be promoted to a required build.
+    continue-on-error: ${{ matrix.ruby == 'head' || matrix.ruby == 'truffleruby-head' || matrix.ruby == 'jruby-9.4.8' }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
       - name: Set up Ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@d45b1a4e94b71acab930e56e79c6aa188764e7f9 # v1.316.0
         with:
           ruby-version: ${{ matrix.ruby }}
           bundler-cache: true # bundle installs and caches dependencies
       - name: Run tests
         run: bundle exec rake --trace
+      - name: Upload coverage to Coveralls
+        if: matrix.ruby == '3.4'
+        uses: coverallsapp/github-action@5cbfd81b66ca5d10c19b062c04de0199c215fb6e # v2.3.7
+        with:
+          file: coverage/.resultset.json
+          format: simplecov

.github/workflows/gem_push.yml

@@ -0,0 +1,22 @@
+name: Push gem
+on:
+  release:
+    types: [published]
+jobs:
+  push:
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: write
+    environment: release
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: ruby/setup-ruby@d45b1a4e94b71acab930e56e79c6aa188764e7f9 # v1.316.0
+        with:
+          ruby-version: "3"
+          bundler-cache: false
+      - name: Install dependencies
+        run: bundle install
+      - uses: rubygems/release-gem@052cc82692552de3ef2b81fd670e41d13cba8092 # v1.4.0

Gemfile

@@ -1,4 +1,8 @@
 source "https://rubygems.org"
 gemspec
 
+gem "bundler-audit", "~> 0.9.3", require: false
+# ruby_audit 3.x requires Ruby >= 3.1. Only the CI audit job needs it.
+gem "ruby_audit", "~> 3.1", require: false if RUBY_VERSION >= "3.1.0"
+gem "simplecov", require: false
 gem "standard", require: false

spec/spec_helper.rb

@@ -1,3 +1,10 @@
+unless RUBY_PLATFORM.match?(/java/)
+  require "simplecov"
+  SimpleCov.start do
+    add_filter "spec"
+  end
+end
+
 require "bundler"
 Bundler.require :default, :development