Routine maintenance 2026-07 - #88
Merged
Merged
Conversation
Local toolchain only. `.rubocop.yml`'s TargetRubyVersion and the gemspec's required_ruby_version deliberately stay at 3.3 — as a published gem, ears must keep enforcing compatibility with the oldest Ruby line it still supports, not the newest one it is developed on.
- rubocop 1.87.0 -> 1.88.2, rubocop-rspec 3.9.0 -> 3.10.2 - simplecov 0.22.0 -> 1.0.3 (major; drops the simplecov-html and simplecov_json_formatter dependencies) - json 2.19.7 -> 2.21.2, yard 0.9.44 -> 0.9.45, parser, rubocop-ast, rbtree rubocop-rspec 3.10.0 closed a false negative in RSpec/ExpectActual for matchers that take no arguments, which newly flags all 14 uses of `have_been_published` in its own spec. The matcher takes the search criteria as its subject rather than a value under test, so the pattern is intended and the cop is excluded for that spec instead of rewritten. Every consumer of the matcher hits this on the same rubocop-rspec bump, so the README documents the exclusion. simplecov 1.0 no longer counts spec files as relevant, so the coverage basis drops from 2298 to 653 lines. Both `minimum_coverage` thresholds still hold (97.54% line vs 97.17%, 80.17% branch vs 62.8%) and now measure lib/ only.
- prettier 3.8.3 -> 3.9.6 (no reformatting) - pnpm 11.5.1 -> 11.18.0 via the packageManager pin, which pnpm self-manages locally and pnpm/action-setup reads in CI pnpm-lock.yaml stays on lockfileVersion 9.0 and still satisfies `pnpm install --frozen-lockfile`.
- actions/checkout v6 -> v7 across all three workflows - build.yml node-version 24 -> 26, tracking the .tool-versions bump setup-node v6, ruby/setup-ruby v1, pnpm/action-setup v6, codeql-action v4, dependency-review-action v5 and both fac/* v2 actions are already on their latest major.
The `RSpec/ExpectActual` exclusion is incidental to using the matcher and does not warrant space in the public documentation. The exclusion for this repo's own spec stays in `.rubocop.yml`.
Corrects `Update CI` (01bedda), which claimed setup-node was already on its latest major. v7.0.0 and v6.5.0 were published five minutes apart on 2026-07-14, so ordering releases by publish date reports the v6 backport as newest; v7.0.0 is the one flagged `isLatest` and `refs/tags/v7` exists. v7.0.0 is an ESM migration plus dependency upgrades, two new cache outputs and the removal of a dummy NODE_AUTH_TOKEN export that only affected npm publishing. Nothing touches `node-version` or `cache: pnpm`.
simplecov 1.0 loads the test_frameworks profile by default, which filters `spec/`, so the coverage basis dropped from 2298 relevant lines to 653 and from 137 branches to 116. The old `branch: 62.8` was fitted to the inflated basis and left 20 branches of slack against an actual 80.17% — on the criterion `primary_coverage :branch` marks as primary, so coverage could regress 17 percentage points without CI noticing. `line: 97.17` stays: the line denominator is Ruby-version dependent (651 on the 3.3 leg vs 653 on 3.4 and 4.0), so a tighter line floor is brittle across the matrix. The branch denominator is 116 on every leg.
brerx
approved these changes
Aug 2, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Routine maintenance pass — runtime versions, gems, Node tooling and CI.
.tool-versions)actions/checkoutv6 → v7 across all three workflows,actions/setup-nodev6 → v7;build.ymlnode-version24 → 26branch62.8 → 75.0. simplecov 1.0 filtersspec/by default, dropping the basis from 2298 relevant lines to 653 and 137 branches to 116, which left the old floor 20 branches slack against an actual 80.17% — on the criterionprimary_coveragemarks as primary.linestays at 97.17 because that denominator is Ruby-version dependent (651 on the 3.3 leg vs 653 on 3.4/4.0).Deliberately unchanged
required_ruby_version >= 3.3.0, the CI matrix['3.3', '3.4', '4.0'], andTargetRubyVersion: 3.3. Per ruby-lang branches, 4.0 and 3.4 are in normal maintenance and 3.3 is in security maintenance (EOL expected 2027-03-31).TargetRubyVersionintentionally tracks the oldest supported line, not the Ruby the gem is developed on.bunny >= 3.0.0,connection_pool ~> 3.0,json >= 2.9.0). All three already resolve to the newest published versions (3.1.0 / 3.0.2 / 2.21.2), so there is nothing to widen — and narrowing a gem's constraints would propagate conflicts to every consuming app.ruby/setup-rubyv1,pnpm/action-setupv6,codeql-actionv4,dependency-review-actionv5 and bothfac/*v2 actions are already on their latest major. Note that for these, "newest release" is not a reliable signal — bothsetup-nodeandcodeql-actionpublish backports to the previous major after the newer major's release, so the majors were resolved from the floating tag and theisLatestflag rather than from release ordering.mainafter Routine maintenance 2026-06 #87 — which merged while0.26.0was already published to rubygems — theRelease Gemstep concludedsuccess, sofac/ruby-gem-push-actiontolerates an already-published version andmainwill not redden.One finding worth reviewer attention
RSpec/ExpectActualnow fires onhave_been_published. rubocop-rspec 3.10.0 closed a false negative for matchers that take no arguments, so the matcher's documented API (expect(routing_key: '…').to have_been_published, where the subject is a criteria hash, not a value under test) is now flagged 14 times in its own spec. The cop is excluded for that one spec in.rubocop.ymlrather than the specs being rewritten.The underlying signal is real: the matcher's API is inverted. Changing it would be a breaking change, so we're not doing that now.
🤖 Generated with Claude Code