Skip to content

Freeze release dependencies and add lockfile checksums - #1009

Merged
woodruffw merged 1 commit into
mainfrom
release-lockfile-safety
Jul 28, 2026
Merged

Freeze release dependencies and add lockfile checksums#1009
woodruffw merged 1 commit into
mainfrom
release-lockfile-safety

Conversation

@p-linnane

Copy link
Copy Markdown
Contributor

Bundler now writes package checksums by default. Refresh Gemfile.lock with
Bundler 4.0.16 and set BUNDLE_FROZEN=true for the release job so neither
bundle install nor rubygems/release-gem can rewrite the committed lockfile
during publication.

This prevents Bundler's clean-tree release guard from failing when the
runner's Bundler installation provenance would otherwise alter the lockfile's
self-checksum state.

Signed-off-by: Patrick Linnane <patrick@linnane.io>
Copilot AI review requested due to automatic review settings July 28, 2026 23:08
@woodruffw

Copy link
Copy Markdown
Member

Thanks @p-linnane!

@woodruffw
woodruffw merged commit 7261e92 into main Jul 28, 2026
16 checks passed
@woodruffw
woodruffw deleted the release-lockfile-safety branch July 28, 2026 23:10

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates the repository’s release-time dependency determinism by committing Bundler 4 lockfile checksums and attempting to prevent release automation from rewriting Gemfile.lock during gem publication.

Changes:

  • Refreshes Gemfile.lock with Bundler 4.0.16, adding the new CHECKSUMS section and updating the recorded Bundler version.
  • Sets BUNDLE_FROZEN=true in the GitHub Actions release job to prevent lockfile mutation during publication.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

File Description
Gemfile.lock Adds Bundler-written checksums and bumps BUNDLED WITH to 4.0.16 to stabilize lockfile integrity.
.github/workflows/release.yml Freezes Bundler during release to stop lockfile rewrites while publishing.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread .github/workflows/release.yml
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants