build(deps-dev): update rubyzip requirement from ~> 3.4.0 to ~> 3.5.0 in the development-dependencies group across 1 directory #3289
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: ci | |
| concurrency: | |
| group: "${{github.workflow}}-${{github.ref}}" | |
| cancel-in-progress: true | |
| on: | |
| workflow_dispatch: | |
| schedule: | |
| - cron: "0 8 * * 3" # At 08:00 on Wednesday # https://crontab.guru/#0_8_*_*_3 | |
| push: | |
| branches: | |
| - main | |
| - v*.*.x | |
| tags: | |
| - v*.*.* | |
| pull_request: | |
| types: [opened, synchronize] | |
| branches: | |
| - '*' | |
| permissions: {} | |
| env: | |
| # gnu.org has frequent downtime, so use the mirror at nokogiri.org | |
| NOKOGIRI_USE_MIRRORED_GNU_SOURCE: "t" | |
| jobs: | |
| # | |
| # SECTION pre-checks for fast feedback loops, and to gate the rest of the suite | |
| # | |
| rubocop: | |
| permissions: | |
| contents: read | |
| runs-on: ubuntu-latest | |
| container: | |
| image: ghcr.io/sparklemotion/nokogiri-test:mri-3.4 # zizmor: ignore[unpinned-images] -- CI container image; version tag is sufficient and digest pinning is impractical with the matrix tag scheme | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| submodules: true | |
| persist-credentials: false | |
| - run: bundle install --local || bundle install | |
| - run: bundle exec rake rubocop | |
| lint-actions: | |
| permissions: | |
| contents: read | |
| name: GitHub Actions audit | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Run actionlint | |
| uses: rhysd/actionlint@914e7df21a07ef503a81201c76d2b11c789d3fca # v1.7.12 | |
| - name: Run zizmor | |
| uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2 | |
| with: | |
| advanced-security: false | |
| basic: | |
| permissions: | |
| contents: read | |
| needs: ["rubocop", "lint-actions"] | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| image: ["ubuntu"] | |
| sys: ["enable"] | |
| runs-on: ubuntu-latest | |
| container: | |
| image: ghcr.io/sparklemotion/nokogiri-test:${{matrix.image}} # zizmor: ignore[unpinned-images] -- CI container image; version tag is sufficient and digest pinning is impractical with the matrix tag scheme | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| submodules: true | |
| persist-credentials: false | |
| - run: bundle install --local || bundle install | |
| - run: bundle exec rake compile -- --${{matrix.sys}}-system-libraries | |
| - run: bundle exec rake test | |
| - run: bundle exec rake test:bench | |
| gumbo: | |
| permissions: | |
| contents: read | |
| needs: ["rubocop", "lint-actions"] | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| plat: ["ubuntu", "windows", "macos"] | |
| runs-on: ${{matrix.plat}}-latest | |
| steps: | |
| - name: configure git crlf | |
| if: matrix.plat == 'windows' | |
| run: | | |
| git config --system core.autocrlf false | |
| git config --system core.eol lf | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| submodules: true | |
| persist-credentials: false | |
| - uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # zizmor: ignore[cache-poisoning] -- bundler cache is test tooling; branch-isolated so fork PRs cannot poison it # v1.321.0 | |
| with: | |
| ruby-version: "3.3" | |
| bundler-cache: true | |
| bundler: latest | |
| - run: bundle exec rake gumbo:test | |
| css: | |
| permissions: | |
| contents: read | |
| name: "css parser" | |
| needs: ["basic"] | |
| runs-on: ubuntu-latest | |
| container: | |
| image: ghcr.io/sparklemotion/nokogiri-test:ubuntu # zizmor: ignore[unpinned-images] -- CI container image; version tag is sufficient and digest pinning is impractical with the matrix tag scheme | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| submodules: true | |
| persist-credentials: false | |
| - run: bundle install --local || bundle install | |
| - run: bundle exec rake css:clean css:generate | |
| - run: bundle exec rake compile -- --enable-system-libraries | |
| - run: bundle exec rake test | |
| # | |
| # SECTION meta - control variables | |
| # | |
| ruby_versions: | |
| permissions: {} | |
| needs: ["basic"] | |
| outputs: | |
| # these are usually the same, but are different once we get to ruby release candidates | |
| setup_ruby: "['3.2', '3.3', '3.4', '4.0']" | |
| setup_ruby_win: "['3.2', '3.3', '3.4', '4.0']" | |
| image_tag: "['3.2', '3.3', '3.4', '4.0']" | |
| runs-on: ubuntu-latest | |
| steps: | |
| - run: echo "generating rubies ..." | |
| rcd_image_version: | |
| permissions: | |
| contents: read | |
| needs: ["basic"] | |
| runs-on: ubuntu-latest | |
| outputs: | |
| rcd_image_version: ${{steps.rcd_image_version.outputs.rcd_image_version}} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # zizmor: ignore[cache-poisoning] -- bundler cache is test tooling; branch-isolated so fork PRs cannot poison it # v1.321.0 | |
| with: | |
| ruby-version: "3.4" | |
| bundler-cache: true | |
| bundler: latest | |
| - id: rcd_image_version | |
| run: bundle exec ruby -e 'require "rake_compiler_dock"; puts "rcd_image_version=#{RakeCompilerDock::IMAGE_VERSION}"' >> "$GITHUB_OUTPUT" | |
| # | |
| # SECTION run the test suite across a broad matrix of rubies, configs, and systems | |
| # | |
| linux: | |
| permissions: | |
| contents: read | |
| needs: ["basic", "ruby_versions"] | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| sys: ["enable", "disable"] | |
| ruby: ${{ fromJSON(needs.ruby_versions.outputs.image_tag) }} | |
| runs-on: ubuntu-latest | |
| container: | |
| image: ghcr.io/sparklemotion/nokogiri-test:mri-${{matrix.ruby}} # zizmor: ignore[unpinned-images] -- CI container image; version tag is sufficient and digest pinning is impractical with the matrix tag scheme | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| submodules: true | |
| persist-credentials: false | |
| - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # zizmor: ignore[cache-poisoning] -- branch-isolated cache; fork PRs cannot write the base-branch cache and the key has no attacker-controllable component # v6.1.0 | |
| if: matrix.sys == 'disable' | |
| with: | |
| path: ports | |
| key: ports-ubuntu-${{matrix.ruby}}-${{hashFiles('dependencies.yml', 'patches/**/*.patch', 'ext/nokogiri/extconf.rb')}} | |
| - run: bundle install --local || bundle install | |
| - run: bundle exec rake compile -- --${{matrix.sys}}-system-libraries | |
| - run: bundle exec rake test | |
| - run: bundle exec rake test:bench | |
| valgrind: | |
| permissions: | |
| contents: read | |
| needs: ["linux", "ruby_versions"] | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| sys: ["enable", "disable"] | |
| ruby: ${{ fromJSON(needs.ruby_versions.outputs.image_tag) }} | |
| mem: ["ruby"] | |
| include: | |
| - sys: "disable" | |
| ruby: "3.4" | |
| mem: "default" | |
| runs-on: ubuntu-latest | |
| container: | |
| image: ghcr.io/sparklemotion/nokogiri-test:mri-${{matrix.ruby}} # zizmor: ignore[unpinned-images] -- CI container image; version tag is sufficient and digest pinning is impractical with the matrix tag scheme | |
| env: | |
| NOKOGIRI_LIBXML_MEMORY_MANAGEMENT: ${{matrix.mem}} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| submodules: true | |
| persist-credentials: false | |
| - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # zizmor: ignore[cache-poisoning] -- branch-isolated cache; fork PRs cannot write the base-branch cache and the key has no attacker-controllable component # v6.1.0 | |
| if: matrix.sys == 'disable' | |
| with: | |
| path: ports | |
| key: ports-ubuntu-${{matrix.ruby}}-${{hashFiles('dependencies.yml', 'patches/**/*.patch', 'ext/nokogiri/extconf.rb')}} | |
| - run: bundle install --local || bundle install | |
| - run: bundle exec rake compile -- --${{matrix.sys}}-system-libraries | |
| - run: bundle exec rake test:valgrind | |
| musl: | |
| permissions: | |
| contents: read | |
| needs: ["basic"] | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| sys: ["enable", "disable"] | |
| runs-on: ubuntu-latest | |
| container: | |
| image: ghcr.io/sparklemotion/nokogiri-test:alpine # zizmor: ignore[unpinned-images] -- CI container image; version tag is sufficient and digest pinning is impractical with the matrix tag scheme | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| submodules: true | |
| persist-credentials: false | |
| # skip cache because of https://github.com/actions/cache/issues/675 | |
| - run: bundle install --local || bundle install | |
| - run: bundle exec rake compile -- --${{matrix.sys}}-system-libraries | |
| - run: bundle exec rake test | |
| musl-valgrind: | |
| permissions: | |
| contents: read | |
| needs: ["musl"] | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| sys: ["disable"] | |
| runs-on: ubuntu-latest | |
| container: | |
| image: ghcr.io/sparklemotion/nokogiri-test:alpine # zizmor: ignore[unpinned-images] -- CI container image; version tag is sufficient and digest pinning is impractical with the matrix tag scheme | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| submodules: true | |
| persist-credentials: false | |
| # skip cache because of https://github.com/actions/cache/issues/675 | |
| - run: bundle install --local || bundle install | |
| - run: bundle exec rake compile -- --${{matrix.sys}}-system-libraries | |
| - run: bundle exec rake test:valgrind | |
| libxmlruby: | |
| permissions: | |
| contents: read | |
| needs: ["basic"] | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| sys: ["enable"] | |
| ruby: ["3.4"] | |
| env: | |
| BUNDLE_GEMFILE: "Gemfile-libxml-ruby" | |
| runs-on: ubuntu-latest | |
| container: | |
| image: ghcr.io/sparklemotion/nokogiri-test:mri-${{matrix.ruby}} # zizmor: ignore[unpinned-images] -- CI container image; version tag is sufficient and digest pinning is impractical with the matrix tag scheme | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| submodules: true | |
| persist-credentials: false | |
| - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # zizmor: ignore[cache-poisoning] -- branch-isolated cache; fork PRs cannot write the base-branch cache and the key has no attacker-controllable component # v6.1.0 | |
| if: matrix.sys == 'disable' | |
| with: | |
| path: ports | |
| key: ports-ubuntu-${{matrix.ruby}}-${{hashFiles('dependencies.yml', 'patches/**/*.patch', 'ext/nokogiri/extconf.rb')}} | |
| - run: bundle install --local || bundle install | |
| - run: bundle exec rake compile -- --${{matrix.sys}}-system-libraries | |
| - run: bundle exec rake test | |
| libxmlruby-valgrind: | |
| permissions: | |
| contents: read | |
| needs: ["libxmlruby"] | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| sys: ["disable"] | |
| ruby: ["3.4"] | |
| env: | |
| BUNDLE_GEMFILE: "Gemfile-libxml-ruby" | |
| runs-on: ubuntu-latest | |
| container: | |
| image: ghcr.io/sparklemotion/nokogiri-test:mri-${{matrix.ruby}} # zizmor: ignore[unpinned-images] -- CI container image; version tag is sufficient and digest pinning is impractical with the matrix tag scheme | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| submodules: true | |
| persist-credentials: false | |
| - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # zizmor: ignore[cache-poisoning] -- branch-isolated cache; fork PRs cannot write the base-branch cache and the key has no attacker-controllable component # v6.1.0 | |
| if: matrix.sys == 'disable' | |
| with: | |
| path: ports | |
| key: ports-ubuntu-${{matrix.ruby}}-${{hashFiles('dependencies.yml', 'patches/**/*.patch', 'ext/nokogiri/extconf.rb')}} | |
| - run: bundle install --local || bundle install | |
| - run: bundle exec rake compile -- --${{matrix.sys}}-system-libraries | |
| - run: bundle exec rake test:valgrind | |
| osx: | |
| permissions: | |
| contents: read | |
| needs: ["basic", "ruby_versions"] | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| sys: ["enable", "disable"] | |
| ruby: ${{ fromJSON(needs.ruby_versions.outputs.setup_ruby) }} | |
| os: [ macos-15-intel, macos-15 ] | |
| runs-on: ${{ matrix.os }} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| submodules: true | |
| persist-credentials: false | |
| - uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # zizmor: ignore[cache-poisoning] -- bundler cache is test tooling; branch-isolated so fork PRs cannot poison it # v1.321.0 | |
| with: | |
| ruby-version: ${{matrix.ruby}} | |
| bundler-cache: true | |
| bundler: latest | |
| - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # zizmor: ignore[cache-poisoning] -- branch-isolated cache; fork PRs cannot write the base-branch cache and the key has no attacker-controllable component # v6.1.0 | |
| if: matrix.sys == 'disable' | |
| with: | |
| path: ports | |
| key: ports-macos-${{hashFiles('dependencies.yml', 'patches/**/*.patch', 'ext/nokogiri/extconf.rb')}} | |
| - run: bundle exec rake compile -- --${{matrix.sys}}-system-libraries | |
| - run: bundle exec rake test | |
| darwin-nix: | |
| permissions: | |
| contents: read | |
| needs: ["basic"] | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| sys: ["enable", "disable"] | |
| runs-on: macos-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| submodules: true | |
| persist-credentials: false | |
| - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1 | |
| with: | |
| nix_path: nixpkgs=channel:nixos-24.11 | |
| - run: nix-shell --packages ruby bundler --run 'bundle install' | |
| - if: matrix.sys == 'disable' | |
| run: nix-shell --packages ruby bundler --run 'bundle exec rake compile -- --disable-system-libraries --disable-xml2-legacy' | |
| - if: matrix.sys == 'disable' | |
| run: nix-shell --packages ruby bundler --run 'bundle exec rake test' | |
| # libxml2 headers are in a subdirectory for some reason so we need to add it to NIX_CFLAGS_COMPILE manually. | |
| # there are a bunch of examples of other packages doing this in nixpkgs so this seems to be expected. | |
| - if: matrix.sys == 'enable' | |
| run: | | |
| # shellcheck disable=SC2016 # ${libxml2.dev} is a Nix expression, not a shell variable; single quotes are intentional | |
| nix-shell \ | |
| --expr 'with import <nixpkgs> {}; mkShell { buildInputs = [ ruby bundler libxml2 libxslt ]; env.NIX_CFLAGS_COMPILE = "-I ${libxml2.dev}/include/libxml2"; }' \ | |
| --run 'bundle exec rake compile -- --enable-system-libraries --disable-xml2-legacy' | |
| - if: matrix.sys == 'enable' | |
| run: | | |
| nix-shell --packages ruby bundler libxml2 libxslt --run 'bundle exec rake test' | |
| windows: | |
| permissions: | |
| contents: read | |
| needs: ["basic", "ruby_versions"] | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| sys: ["enable", "disable"] | |
| ruby: ${{ fromJSON(needs.ruby_versions.outputs.setup_ruby_win) }} | |
| os: [ windows-2022 ] | |
| include: | |
| - sys: "enable" | |
| ruby: "3.4" | |
| os: windows-11-arm | |
| - sys: "disable" | |
| ruby: "3.4" | |
| os: windows-11-arm | |
| runs-on: ${{ matrix.os }} | |
| steps: | |
| - name: configure git crlf | |
| run: | | |
| git config --system core.autocrlf false | |
| git config --system core.eol lf | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| submodules: true | |
| persist-credentials: false | |
| - uses: ruby/setup-ruby-pkgs@2233d39c1315c667a2970436418b520a6300124e # v1.33.5 | |
| with: | |
| ruby-version: "${{matrix.ruby}}" | |
| mingw: "libxml2 libxslt" | |
| bundler-cache: true | |
| bundler: latest | |
| - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # zizmor: ignore[cache-poisoning] -- branch-isolated cache; fork PRs cannot write the base-branch cache and the key has no attacker-controllable component # v6.1.0 | |
| if: matrix.sys == 'disable' | |
| with: | |
| path: ports | |
| key: ports-windows-${{hashFiles('dependencies.yml', 'patches/**/*.patch', 'ext/nokogiri/extconf.rb')}} | |
| - run: bundle exec rake compile -- --${{matrix.sys}}-system-libraries | |
| - run: bundle exec rake test | |
| jruby: | |
| permissions: | |
| contents: read | |
| needs: ["basic"] | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| ruby: ["jruby-10.0"] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| submodules: true | |
| persist-credentials: false | |
| - uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # zizmor: ignore[cache-poisoning] -- bundler cache is test tooling; branch-isolated so fork PRs cannot poison it # v1.321.0 | |
| with: | |
| ruby-version: ${{matrix.ruby}} | |
| bundler-cache: true | |
| bundler: latest | |
| - run: bundle exec rake compile | |
| - run: bundle exec rake test | |
| - run: bundle exec rake test:bench | |
| truffleruby: | |
| permissions: | |
| contents: read | |
| needs: ["basic"] | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| flags: | |
| - "--disable-system-libraries --disable-static" | |
| - "--disable-system-libraries --enable-static" | |
| - "--enable-system-libraries" | |
| include: | |
| - flags: "--enable-system-libraries" | |
| apt_packages: "libxml2-dev libxslt1-dev pkg-config" | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| submodules: true | |
| persist-credentials: false | |
| - uses: ruby/setup-ruby-pkgs@2233d39c1315c667a2970436418b520a6300124e # v1.33.5 | |
| with: | |
| ruby-version: truffleruby | |
| bundler-cache: true | |
| bundler: 2.5.10 | |
| apt-get: ${{ matrix.apt_packages }} | |
| - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # zizmor: ignore[cache-poisoning] -- branch-isolated cache; fork PRs cannot write the base-branch cache and the key has no attacker-controllable component # v6.1.0 | |
| with: | |
| path: ports/archives | |
| key: tarballs-ubuntu-${{hashFiles('dependencies.yml', 'patches/**/*.patch')}} | |
| - run: bundle exec rake compile -- ${{matrix.flags}} | |
| - run: bundle exec rake test | |
| bsd: | |
| permissions: | |
| contents: read | |
| needs: ["basic"] | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| sys: ["enable", "disable"] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| submodules: true | |
| persist-credentials: false | |
| - uses: vmactions/freebsd-vm@83b151f58c6047089f4c80eb5ba2039d158ce093 # v1.5.3 | |
| with: | |
| usesh: true | |
| copyback: false | |
| prepare: pkg install -y ruby devel/ruby-gems pkgconf libxml2 libxslt git | |
| run: | | |
| gem install bundler | |
| bundle install --local || bundle install | |
| bundle exec rake compile -- --${{matrix.sys}}-system-libraries | |
| bundle exec rake test | |
| # | |
| # SECTION let's look for memory leaks | |
| # | |
| memory_suite: | |
| permissions: | |
| contents: read | |
| continue-on-error: true # still pressure testing the value of this suite | |
| needs: ["basic"] | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| sys: ["disable"] | |
| ruby: ["3.4"] | |
| runs-on: ubuntu-latest | |
| container: | |
| image: ghcr.io/sparklemotion/nokogiri-test:mri-${{matrix.ruby}} # zizmor: ignore[unpinned-images] -- CI container image; version tag is sufficient and digest pinning is impractical with the matrix tag scheme | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| submodules: true | |
| persist-credentials: false | |
| - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # zizmor: ignore[cache-poisoning] -- branch-isolated cache; fork PRs cannot write the base-branch cache and the key has no attacker-controllable component # v6.1.0 | |
| if: matrix.sys == 'disable' | |
| with: | |
| path: ports | |
| key: ports-ubuntu-${{matrix.ruby}}-${{hashFiles('dependencies.yml', 'patches/**/*.patch', 'ext/nokogiri/extconf.rb')}} | |
| - run: bundle install --local || bundle install | |
| - run: bundle exec rake compile -- --${{matrix.sys}}-system-libraries | |
| - run: bundle exec rake test:memory_suite | |
| memcheck: | |
| permissions: | |
| contents: read | |
| needs: ["basic"] | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| sys: ["disable"] | |
| ruby: ["3.4"] | |
| runs-on: ubuntu-latest | |
| container: | |
| image: ghcr.io/sparklemotion/nokogiri-test:mri-${{matrix.ruby}} # zizmor: ignore[unpinned-images] -- CI container image; version tag is sufficient and digest pinning is impractical with the matrix tag scheme | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| submodules: true | |
| persist-credentials: false | |
| - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # zizmor: ignore[cache-poisoning] -- branch-isolated cache; fork PRs cannot write the base-branch cache and the key has no attacker-controllable component # v6.1.0 | |
| if: matrix.sys == 'disable' | |
| with: | |
| path: ports | |
| key: ports-ubuntu-${{matrix.ruby}}-${{hashFiles('dependencies.yml', 'patches/**/*.patch', 'ext/nokogiri/extconf.rb')}} | |
| - run: bundle install --local || bundle install | |
| - run: bundle exec rake compile -- --${{matrix.sys}}-system-libraries | |
| - run: bundle exec rake test:memcheck | |
| # | |
| # SECTION the end-to-end gem installation tests | |
| # | |
| generic-package: | |
| permissions: | |
| contents: read | |
| needs: ["rcd_image_version"] | |
| name: "generic-package" | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| submodules: true | |
| persist-credentials: false | |
| - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # zizmor: ignore[cache-poisoning] -- branch-isolated cache; fork PRs cannot write the base-branch cache and the key has no attacker-controllable component # v6.1.0 | |
| with: | |
| path: ports/archives | |
| key: tarballs-ubuntu-${{hashFiles('dependencies.yml', 'patches/**/*.patch')}} | |
| - env: | |
| RCD_IMAGE_VERSION: ${{needs.rcd_image_version.outputs.rcd_image_version}} | |
| run: | | |
| docker run --rm -v "$(pwd):/nokogiri" -w /nokogiri \ | |
| "ghcr.io/rake-compiler/rake-compiler-dock-image:${RCD_IMAGE_VERSION}-mri-x86_64-linux-gnu" \ | |
| ./scripts/test-gem-build gems ruby | |
| - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: generic-gem | |
| path: gems | |
| retention-days: 1 | |
| generic-linux-install: | |
| permissions: | |
| contents: read | |
| needs: ["generic-package", "ruby_versions"] | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| sys: ["enable", "disable"] | |
| ruby: ${{ fromJSON(needs.ruby_versions.outputs.setup_ruby) }} | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| submodules: true | |
| persist-credentials: false | |
| - uses: ruby/setup-ruby-pkgs@2233d39c1315c667a2970436418b520a6300124e # v1.33.5 | |
| with: | |
| ruby-version: "${{matrix.ruby}}" | |
| apt-get: "libxml2-dev libxslt1-dev pkg-config" | |
| - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: generic-gem | |
| path: gems | |
| - run: ./scripts/test-gem-install gems --${{matrix.sys}}-system-libraries | |
| generic-darwin-install: | |
| permissions: | |
| contents: read | |
| needs: ["generic-package", "ruby_versions"] | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| sys: ["enable", "disable"] | |
| ruby: ${{ fromJSON(needs.ruby_versions.outputs.setup_ruby) }} | |
| os: [ macos-15-intel, macos-15 ] | |
| runs-on: ${{ matrix.os }} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| submodules: true | |
| persist-credentials: false | |
| - uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0 | |
| with: | |
| ruby-version: "${{matrix.ruby}}" | |
| - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: generic-gem | |
| path: gems | |
| - run: ./scripts/test-gem-install gems --${{matrix.sys}}-system-libraries | |
| generic-windows-install: | |
| permissions: | |
| contents: read | |
| needs: ["generic-package", "ruby_versions"] | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| sys: ["enable", "disable"] | |
| ruby: ${{ fromJSON(needs.ruby_versions.outputs.setup_ruby_win) }} | |
| os: [ windows-2022 ] | |
| include: | |
| - sys: "enable" | |
| ruby: "3.4" | |
| os: windows-11-arm | |
| - sys: "disable" | |
| ruby: "3.4" | |
| os: windows-11-arm | |
| runs-on: ${{ matrix.os }} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| submodules: true | |
| persist-credentials: false | |
| - uses: ruby/setup-ruby-pkgs@2233d39c1315c667a2970436418b520a6300124e # v1.33.5 | |
| with: | |
| ruby-version: "${{matrix.ruby}}" | |
| mingw: "libxml2 libxslt" | |
| - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: generic-gem | |
| path: gems | |
| - run: ./scripts/test-gem-install gems --${{matrix.sys}}-system-libraries | |
| shell: bash | |
| cruby-package: | |
| permissions: | |
| contents: read | |
| needs: ["rcd_image_version"] | |
| name: "cruby-package" | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| plat: | |
| - "aarch64-linux-gnu" | |
| - "aarch64-linux-musl" | |
| - "arm-linux-gnu" | |
| - "arm-linux-musl" | |
| - "arm64-darwin" | |
| - "aarch64-mingw-ucrt" | |
| - "x64-mingw-ucrt" | |
| - "x86_64-darwin" | |
| - "x86_64-linux-gnu" | |
| - "x86_64-linux-musl" | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| submodules: true | |
| persist-credentials: false | |
| - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # zizmor: ignore[cache-poisoning] -- branch-isolated cache; fork PRs cannot write the base-branch cache and the key has no attacker-controllable component # v6.1.0 | |
| with: | |
| path: ports/archives | |
| key: tarballs-ubuntu-${{hashFiles('dependencies.yml', 'patches/**/*.patch')}} | |
| - env: | |
| RCD_IMAGE_VERSION: ${{needs.rcd_image_version.outputs.rcd_image_version}} | |
| PLAT: ${{matrix.plat}} | |
| run: | | |
| docker run --rm -v "$(pwd):/nokogiri" -w /nokogiri \ | |
| -e NOKOGIRI_USE_MIRRORED_GNU_SOURCE \ | |
| "ghcr.io/rake-compiler/rake-compiler-dock-image:${RCD_IMAGE_VERSION}-mri-${PLAT}" \ | |
| ./scripts/test-gem-build gems "$PLAT" | |
| - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: "cruby-${{matrix.plat}}-gem" | |
| path: gems | |
| retention-days: 1 | |
| cruby-install-with-setup-ruby: | |
| permissions: | |
| contents: read | |
| needs: ["cruby-package", "ruby_versions"] | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| ruby: ${{ fromJSON(needs.ruby_versions.outputs.setup_ruby) }} | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| submodules: true | |
| persist-credentials: false | |
| - uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0 | |
| with: | |
| ruby-version: "${{matrix.ruby}}" | |
| - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: cruby-x86_64-linux-gnu-gem | |
| path: gems | |
| - run: ./scripts/test-gem-install gems | |
| cruby-linux-install-matrix: | |
| permissions: | |
| contents: read | |
| needs: ["cruby-package", "ruby_versions"] | |
| name: "cruby-${{ matrix.platform }}-install (${{ matrix.ruby }})" | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| platform: | |
| - aarch64-linux-gnu | |
| - aarch64-linux-musl | |
| - arm-linux-gnu | |
| - arm-linux-musl | |
| - x86_64-linux-gnu | |
| - x86_64-linux-musl | |
| ruby: ${{ fromJSON(needs.ruby_versions.outputs.image_tag) }} | |
| include: | |
| # declare docker image for each platform | |
| - { runner: ubuntu-latest, platform: aarch64-linux-musl, docker_tag: "-alpine", bootstrap: "apk add bash build-base &&" } | |
| - { runner: ubuntu-latest, platform: arm-linux-musl, docker_tag: "-alpine", bootstrap: "apk add bash build-base &&" } | |
| - { runner: ubuntu-latest, platform: x86_64-linux-musl, docker_tag: "-alpine", bootstrap: "apk add bash build-base &&" } | |
| # declare docker platform for each platform | |
| - { runner: ubuntu-24.04-arm, platform: aarch64-linux-gnu, docker_platform: "--platform=linux/arm64/v8" } | |
| - { runner: ubuntu-24.04-arm, platform: aarch64-linux-musl, docker_platform: "--platform=linux/arm64/v8" } | |
| - { runner: ubuntu-24.04-arm, platform: arm-linux-gnu, docker_platform: "--platform=linux/arm/v7" } | |
| - { runner: ubuntu-24.04-arm, platform: arm-linux-musl, docker_platform: "--platform=linux/arm/v7" } | |
| runs-on: ${{ matrix.runner || 'ubuntu-latest' }} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| submodules: true | |
| persist-credentials: false | |
| - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: cruby-${{ matrix.platform }}-gem | |
| path: gems | |
| - env: | |
| DOCKER_PLATFORM: ${{ matrix.docker_platform }} | |
| RUBY_VERSION: ${{ matrix.ruby }} | |
| DOCKER_TAG: ${{ matrix.docker_tag }} | |
| BOOTSTRAP: ${{ matrix.bootstrap }} | |
| run: | | |
| # shellcheck disable=SC2086 # DOCKER_PLATFORM and BOOTSTRAP intentionally word-split (platform flags / optional shell prefix) | |
| docker run --rm -v "$PWD:/nokogiri" -w /nokogiri \ | |
| $DOCKER_PLATFORM "ruby:${RUBY_VERSION}${DOCKER_TAG}" \ | |
| sh -c " | |
| $BOOTSTRAP | |
| ./scripts/test-gem-install gems | |
| " | |
| cruby-darwin-install-matrix: | |
| permissions: | |
| contents: read | |
| needs: ["cruby-package", "ruby_versions"] | |
| name: "cruby-${{ matrix.platform }}-install (${{ matrix.ruby }})" | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| platform: | |
| - arm64-darwin | |
| - x86_64-darwin | |
| ruby: ${{ fromJSON(needs.ruby_versions.outputs.setup_ruby) }} | |
| include: | |
| - { platform: arm64-darwin, os: macos-15 } | |
| - { platform: x86_64-darwin, os: macos-15-intel } | |
| runs-on: ${{ matrix.os }} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| submodules: true | |
| persist-credentials: false | |
| - uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0 | |
| with: | |
| ruby-version: "${{ matrix.ruby }}" | |
| - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: cruby-${{ matrix.platform }}-gem | |
| path: gems | |
| - run: ./scripts/test-gem-install gems | |
| cruby-x64-mingw-ucrt-install: | |
| permissions: | |
| contents: read | |
| needs: ["cruby-package", "ruby_versions"] | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| ruby: ${{ fromJSON(needs.ruby_versions.outputs.setup_ruby_win) }} | |
| runs-on: windows-2022 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| submodules: true | |
| persist-credentials: false | |
| - uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0 | |
| with: | |
| ruby-version: "${{matrix.ruby}}" | |
| - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: cruby-x64-mingw-ucrt-gem | |
| path: gems | |
| - run: ./scripts/test-gem-install gems | |
| shell: bash | |
| cruby-aarch64-mingw-ucrt-install: | |
| permissions: | |
| contents: read | |
| needs: ["cruby-package", "ruby_versions"] | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| ruby: ["3.4"] | |
| runs-on: windows-11-arm | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| submodules: true | |
| persist-credentials: false | |
| - uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0 | |
| with: | |
| ruby-version: "${{matrix.ruby}}" | |
| - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: cruby-aarch64-mingw-ucrt-gem | |
| path: gems | |
| - run: ./scripts/test-gem-install gems | |
| shell: bash | |
| jruby-package: | |
| permissions: | |
| contents: read | |
| needs: ["rcd_image_version"] | |
| runs-on: ubuntu-latest | |
| container: | |
| image: "ghcr.io/rake-compiler/rake-compiler-dock-image:${{needs.rcd_image_version.outputs.rcd_image_version}}-jruby" # zizmor: ignore[unpinned-images] -- CI container image; version tag is sufficient and digest pinning is impractical with the matrix tag scheme | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| submodules: true | |
| persist-credentials: false | |
| - run: ./scripts/test-gem-build gems java | |
| - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: jruby-gem | |
| path: gems | |
| retention-days: 1 | |
| jruby-install: | |
| permissions: | |
| contents: read | |
| needs: ["jruby-package"] | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| jruby: ["10.0"] | |
| jre: ["21", "25"] | |
| name: "jruby-${{matrix.jruby}}-jre${{matrix.jre}}-install" | |
| runs-on: ubuntu-latest | |
| container: | |
| image: "jruby:${{matrix.jruby}}-jre${{matrix.jre}}" # zizmor: ignore[unpinned-images] -- CI container image; version tag is sufficient and digest pinning is impractical with the matrix tag scheme | |
| steps: | |
| - run: apt update && apt install -y build-essential git | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| submodules: true | |
| persist-credentials: false | |
| - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: jruby-gem | |
| path: gems | |
| - run: ./scripts/test-gem-install gems |