From 11e25b4f6c0607bad5e70dac970d6d7d080d2025 Mon Sep 17 00:00:00 2001
From: DecIntercom <declan.mcmullen@intercom.io>
Date: Wed, 5 Aug 2026 14:06:09 +0100
Subject: [PATCH] Route CI gem installs through a scanning registry mirror
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`bundle install` resolved straight from rubygems.org over plaintext HTTP,
with no install-time scanning of build dependencies.

Two changes are needed, not one:

- Point Bundler's rubygems.org mirror at the scanning registry, with the
  credential supplied by CI rather than committed.
- Switch the Gemfile source to https. Bundler matches mirrors by exact
  source URI including scheme, so a `mirror.https://rubygems.org` setting
  does not apply to a Gemfile declaring `http://rubygems.org` — the mirror
  would have been configured but never used.

The step fails the build if the mirror is not active. Forked pull requests
are the exception: CI does not share credentials with forks, so those builds
log that they are unrouted and continue rather than failing a contributor.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .circleci/config.yml | 25 +++++++++++++++++++++++++
 Gemfile              |  2 +-
 2 files changed, 26 insertions(+), 1 deletion(-)

diff --git a/.circleci/config.yml b/.circleci/config.yml
index 465eccf..d1b44d4 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -8,5 +8,30 @@ jobs:
 
     steps:
       - checkout
+      - run:
+          name: Route Bundler through the Socket Firewall registry
+          command: |
+            set -euo pipefail
+            if [ -z "${SOCKET_GEM_URL:-}" ]; then
+              # CircleCI does not share context credentials with forked PRs, so a
+              # fork cannot be routed. Say so rather than failing the contributor.
+              if [ -n "${CIRCLE_PR_REPONAME:-}" ]; then
+                echo "Forked PR: no Socket Firewall credentials available, gems will come from rubygems.org."
+                exit 0
+              fi
+              echo "FATAL: SOCKET_GEM_URL is required (provided by the socket-firewall context)"
+              exit 1
+            fi
+            bundle config set --global mirror.https://rubygems.org "$SOCKET_GEM_URL"
+            bundle config get mirror.https://rubygems.org | grep -q socket-firewall-registry \
+              || { echo "FAIL: bundler mirror not pointing at Socket Firewall"; exit 1; }
       - run: bundle install
       - run: bundle exec rake
+
+workflows:
+  version: 2
+  build_and_test:
+    jobs:
+      - build:
+          context:
+            - socket-firewall
diff --git a/Gemfile b/Gemfile
index c80ee36..b4e2a20 100644
--- a/Gemfile
+++ b/Gemfile
@@ -1,3 +1,3 @@
-source "http://rubygems.org"
+source "https://rubygems.org"
 
 gemspec