-
Notifications
You must be signed in to change notification settings - Fork 250
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
chore: Raise test_gem ruby/setup-ruby version #1510
chore: Raise test_gem ruby/setup-ruby version #1510
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
ℹ️ it is possible to setup dependabot for actions, I can try to setup that if welcomed in separate PR
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
👍🏻 Newer is Better!
I approve newer ... and while we're on the subject, the setup-ruby maintainers recommend riding the lightning and tracking the v1 branch instead of specific pinned versions. Have we considered and rejected that idea already at some time in the past?
We had similar discussion in rubygems.org. Per https://securityscorecards.dev/, GitHub Actions should be pinned to actual commit, not to version, to minimise the risk of pulling in unexpected changes (potentially with security concerns). That works well combined with dependabot. That way you can scan the changelog at least (or changes), but get updated often. I can try to configure both if welcomed - https://github.com/ossf/scorecard-action and monthly/weekly dependabot for actions. |
Thanks, all! I've added a note to chat about how we want to set the https://docs.google.com/document/d/1D15bO8o340sQm2CVZiukEJuCO_XMMHKPuTznoEhyFqE/edit |
I'm trying to use SimpleCov in #1509, but TruffleRuby raises an error about
Coverage.running?
not being implemented. There's a fix for this in TruffleRuby 22.TruffleRuby 22 isn't accessible with the
test_gem
action's current version ofruby/setup-ruby
. However, TruffleRuby 23 is available on the latestruby/setup-ruby
version. Usingv1.152.0
fixed the problem.Example action failure: https://github.com/open-telemetry/opentelemetry-ruby/actions/runs/5744430524/job/15570701339?pr=1509#step:7:150