Route CI gem installs through a scanning registry mirror - #625
Merged
Conversation
`bundle install` resolved straight from rubygems.org over plaintext HTTP, with no install-time scanning of build dependencies. Two changes are needed, not one: - Point Bundler's rubygems.org mirror at the scanning registry, with the credential supplied by CI rather than committed. - Switch the Gemfile source to https. Bundler matches mirrors by exact source URI including scheme, so a `mirror.https://rubygems.org` setting does not apply to a Gemfile declaring `http://rubygems.org` — the mirror would have been configured but never used. The step fails the build if the mirror is not active. Forked pull requests are the exception: CI does not share credentials with forks, so those builds log that they are unrouted and continue rather than failing a contributor. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Bumping to 2.1 to share the mirror step across the three jobs errored the
pipeline: 2.1 validates job names against ^[A-Za-z][A-Za-z\s\d_-]*$ and the
existing names contain dots ("Test against Ruby 2.4").
Renaming them would change the status check names, so the step is repeated
per job on version 2 instead. Slightly more duplication, no behaviour change.
DecIntercom
enabled auto-merge (squash)
August 5, 2026 14:47
IslaHoe
approved these changes
Aug 5, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why?
CI installed gems over plaintext HTTP with no install-time scanning of build dependencies. This gem is published publicly, so an unscanned build dependency would sit upstream of a package others consume.
How?
Routes Bundler through a scanning registry mirror, with the credential supplied by CI rather than committed, and switches the Gemfile source to HTTPS. The build fails if the mirror is not active.
Notes for reviewers
The HTTPS change is load-bearing, not cosmetic. Bundler matches mirrors by exact source URI including scheme, so a mirror for
https://rubygems.orgwould never apply to a Gemfile declaringhttp://rubygems.org.Forked pull requests do not receive CI credentials, so those builds log that they are unrouted and continue rather than failing an outside contributor.
Generated with Claude Code