activerecord-refined 0.5.1 → 0.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 98f198f59d3bb4b6f4c51a16940d4e7ee44b890aa7e033a327a650b73cb3dfbd
-  data.tar.gz: 5fb7cdd8964b82d6bb14ffdfecf1400ea875f1c5bc12d7fa4645c431caf47d19
+  metadata.gz: 7d179cda5b9633e349569aa64a129909938a377302ec7091d2dc342f1e809dc9
+  data.tar.gz: 94cd9271298ee1b67e53ebe53c1f9a7b3ab5548e796f18d3bd2ec3e8ec24f320
 SHA512:
-  metadata.gz: 5ea7a29d21b31e3bf5f262a54eacb8e4e27590d9031f560d8de635da958cf91e6c5ef0872e77caf7b4e32907d2985f13fcd2ff8492ffbeda0edff1d8b7f658f4
-  data.tar.gz: 4949bb4ce9b0e4cd0f964e7f2759460a72707734a56d746cbf1221f80f9f7a87161c4a494c0226b880d7ad905e6c83933b29254c5ce3e59c41de415339557f56
+  metadata.gz: d4a032b8a00105c9f1d655e1cd745e2b2c66e4c10a1f0ca737451bd1f4dabf519227cf4c86f79d17f47340f7f26071f386fd5e88bf7488bb4de31513380178c5
+  data.tar.gz: 42448bbad15330e96a8cb56760a463b17880256360d8f8f05684942ae758db148c24a3fb32c81c35bda840281265a21a120481aa9c5eaf3369d7b082ffc10e48

data/.github/workflows/sandbox.yml

@@ -33,13 +33,75 @@ jobs:
         with:
           node-version: '24'
 
+      # What the binary is made of: the gems with C extensions, the scripts
+      # that drive the build -- RUBY_REV and the toolchain versions are pinned
+      # in them -- the staged extension, and the host Ruby.  Not the gem's own
+      # lib and not the page, neither of which the binary contains; those are
+      # files the page fetches at startup.
+      #
+      # Naming the build after this rather than after the binary is what makes
+      # the URL stable.  The build is not reproducible to the byte -- the same
+      # tree twice over came out 1 KB apart, mtimes riding along in the packed
+      # filesystem -- so a hash of the output would change on every deploy and
+      # give every visitor 12 MB to fetch again for nothing.
+      - name: Identify the build
+        id: build
+        run: |
+          hash="${{ hashFiles('sandbox/.ruby-version', 'sandbox/Gemfile.lock', 'sandbox/bin/build-wasm', 'sandbox/bin/rbwasm-build.rb', 'sandbox/bin/install-wasi-sdk.rb', 'sandbox/ext/**') }}"
+
+          # hashFiles gives back an empty string when it matches nothing, and
+          # an empty hash would quietly name every build alike -- and hand out
+          # whichever binary happened to be uploaded first, for good.
+          if [ -z "$hash" ]; then
+            echo "::error::hashFiles matched none of the build inputs" >&2
+            exit 1
+          fi
+
+          echo "hash=$hash" >> "$GITHUB_OUTPUT"
+          echo "key=ruby-${hash:0:16}.wasm" >> "$GITHUB_OUTPUT"
+          echo "this build is ruby-${hash:0:16}.wasm"
+
+      # The binary for these inputs may already be in the bucket from an
+      # earlier deploy, in which case there is nothing to build: 12 MB comes
+      # down in a few seconds where a build takes two minutes warm and sixteen
+      # cold.  The examples are still checked against it below, which is what
+      # the deploy is really for.
+      #
+      # Anything at all going wrong here -- no credentials, as on a fork, a
+      # network failure, a half-written file -- falls through to building.
+      - name: Fetch this build from R2 if it is there
+        id: prebuilt
+        if: vars.R2_PUBLIC_URL != ''
+        env:
+          AWS_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
+          AWS_DEFAULT_REGION: auto
+          AWS_REQUEST_CHECKSUM_CALCULATION: when_required
+          AWS_RESPONSE_CHECKSUM_VALIDATION: when_required
+          ENDPOINT: https://${{ secrets.CLOUDFLARE_ACCOUNT_ID }}.r2.cloudflarestorage.com
+          BUCKET: ${{ vars.R2_BUCKET }}
+          KEY: ${{ steps.build.outputs.key }}
+        run: |
+          if aws s3api get-object \
+               --endpoint-url "$ENDPOINT" \
+               --bucket "$BUCKET" \
+               --key "$KEY" \
+               /tmp/ruby.wasm.gz \
+               --no-cli-pager > /dev/null 2>&1 &&
+             gunzip -c /tmp/ruby.wasm.gz > ruby.wasm
+          then
+            echo "found=true" >> "$GITHUB_OUTPUT"
+            echo "took $KEY from the bucket; not building"
+            ls -l ruby.wasm
+          else
+            rm -f ruby.wasm
+            echo "$KEY is not in the bucket; building it"
+          fi
+
       # The Ruby checkout and the build tree have to be cached together.  make
       # decides by mtime, so restoring objects next to a freshly cloned Ruby
-      # would rebuild everything.
-      #
-      # The build directory is keyed on the gems that have C extensions, so
-      # Gemfile.lock covers it; RUBY_REV is pinned in bin/build-wasm, and the
-      # staged extension comes from ext/ and the sqlite3 gem.
+      # would rebuild everything.  Keyed on the same inputs as the binary, so
+      # the two cannot drift apart.
       #
       # restore-keys is what keeps this worth caching -- a key change would
       # otherwise mean a cold 16-minute build rather than two minutes -- but it
@@ -48,16 +110,18 @@ jobs:
       # deleting the cache does.  bin/build-wasm rejects a ruby.wasm built from
       # such a tree, so it fails the run rather than shipping.
       - name: Restore the WASM build tree
+        if: steps.prebuilt.outputs.found != 'true'
         uses: actions/cache@v6
         with:
           path: sandbox/build
-          key: wasm-${{ runner.os }}-${{ hashFiles('sandbox/Gemfile.lock', 'sandbox/bin/build-wasm', 'sandbox/ext/**') }}
+          key: wasm-${{ runner.os }}-${{ steps.build.outputs.hash }}
           restore-keys: wasm-${{ runner.os }}-
 
       - run: bundle install --jobs 4
       - run: npm ci
 
       - name: Build ruby.wasm
+        if: steps.prebuilt.outputs.found != 'true'
         run: ./bin/build-wasm
 
       - name: Assemble the Ruby files served to the page
@@ -69,12 +133,13 @@ jobs:
       - name: Check the examples
         run: node --stack-size=4000 check-examples.mjs
 
-      # ruby.wasm is 40 MB, which a Cloudflare Pages asset may not be and which
-      # is nearly all of the bandwidth this page uses, so it is served from R2
-      # -- egress there is free -- and only the page itself from Pages.
+      # ruby.wasm is 40 MB and nearly all of the bandwidth this page uses, so
+      # it is served from R2 -- egress there is free -- and only the page
+      # itself from Pages.
       #
-      # The key carries a hash of the binary, so a rebuild lands on a new URL
-      # and nothing has to be purged.  R2 serves what it is given and does not
+      # Only when it was built here: found in the bucket, it is already up.
+      # The object is therefore written once and never rewritten, which is what
+      # the immutable caching claims.  R2 serves what it is given and does not
       # compress, hence gzip with the encoding recorded on the object: 40 MB
       # becomes 12 MB on the wire.
       #
@@ -88,36 +153,108 @@ jobs:
       # account, which is not what a public repository's CI should hold.
       - name: Upload ruby.wasm to R2
         id: r2
-        if: github.ref == 'refs/heads/master' && vars.R2_PUBLIC_URL != ''
+        if: >-
+          github.ref == 'refs/heads/master' && vars.R2_PUBLIC_URL != ''
+          && steps.prebuilt.outputs.found != 'true'
         env:
+          KEY: ${{ steps.build.outputs.key }}
           AWS_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
           AWS_DEFAULT_REGION: auto
           # R2 sends no checksum headers back, which newer AWS CLIs insist on.
           AWS_REQUEST_CHECKSUM_CALCULATION: when_required
           AWS_RESPONSE_CHECKSUM_VALIDATION: when_required
+          ENDPOINT: https://${{ secrets.CLOUDFLARE_ACCOUNT_ID }}.r2.cloudflarestorage.com
+          BUCKET: ${{ vars.R2_BUCKET }}
+          # How many builds to keep, the newest included.  A page loaded just
+          # before a deploy goes on finding its binary, and a bad build can be
+          # rolled back by hand; further back is 12 MB apiece for nothing.
+          KEEP: 3
         run: |
           gzip -9 -c ruby.wasm > /tmp/ruby.wasm.gz
 
-          # One key, overwritten each time, since only the newest build is of
-          # any use.  That rules out caching it as immutable: the URL no longer
-          # changes with the contents, so a long max-age would go on serving
-          # the previous binary.  Five minutes bounds how stale a visitor's
-          # copy can be just after a deploy, and revalidation costs a 304
-          # rather than 12 MB.
           aws s3api put-object \
-            --endpoint-url "https://${{ secrets.CLOUDFLARE_ACCOUNT_ID }}.r2.cloudflarestorage.com" \
-            --bucket "${{ vars.R2_BUCKET }}" \
-            --key ruby-head.wasm \
+            --endpoint-url "$ENDPOINT" \
+            --bucket "$BUCKET" \
+            --key "$KEY" \
             --body /tmp/ruby.wasm.gz \
             --content-type application/wasm \
             --content-encoding gzip \
-            --cache-control "public, max-age=300" \
+            --cache-control "public, max-age=31536000, immutable" \
             --no-cli-pager
 
-          echo '{"rubyWasmUrl":"${{ vars.R2_PUBLIC_URL }}/ruby-head.wasm"}' > config.json
           echo "uploaded=true" >> "$GITHUB_OUTPUT"
 
+          # Distinct keys have nothing to remove them, so the oldest go here.
+          # Ordered by age rather than by name, since a key says which inputs
+          # built it but not which came first; the timestamps are UTC ISO 8601,
+          # so sorting them as text sorts them by time.  `head -n -KEEP` is
+          # every line but the last KEEP, and prints nothing until there are
+          # more.
+          #
+          # The listing is written out before it is sorted, so that what the if
+          # tests is the listing: a pipeline would report the sort, which
+          # succeeds on no input either way.  A failure is said rather than
+          # raised, since the binary is already up and a stale object left
+          # behind is no reason to hold back the deploy that needs the new one.
+          if aws s3api list-objects-v2 \
+               --endpoint-url "$ENDPOINT" \
+               --bucket "$BUCKET" \
+               --prefix ruby- \
+               --query "Contents[].[LastModified,Key]" \
+               --output text --no-cli-pager > /tmp/builds
+          then
+            sort /tmp/builds | head -n "-$KEEP" | cut -f2 | while read -r stale; do
+              # The one just uploaded is never stale, whatever the listing says
+              # of its age: it is the binary the page about to be deployed asks
+              # for.  Whatever else is under the prefix is not ours to delete.
+              case "$stale" in
+                "$KEY") echo "keeping $stale, which is this build"; continue ;;
+                ruby-*.wasm) ;;
+                *) echo "leaving $stale alone"; continue ;;
+              esac
+              echo "removing $stale"
+              aws s3api delete-object \
+                --endpoint-url "$ENDPOINT" \
+                --bucket "$BUCKET" \
+                --key "$stale" \
+                --no-cli-pager ||
+                echo "::warning::could not remove $stale"
+            done
+          else
+            echo "::warning::could not list $BUCKET; older builds were left in place"
+          fi
+
+      # The preload in the head is what the page fetches the binary by, and it
+      # ships pointing at the local build.  Naming R2 there rather than in a
+      # file the page has to read first is worth a round trip on every visit:
+      # the browser can start on the 12 MB while it is still parsing the head,
+      # instead of after the scripts have loaded and asked where to look.
+      #
+      # Done whether the binary went up in this run or was already there.  A
+      # checkout with no deployment behind it keeps the line as written, and
+      # the artifact carries the ruby.wasm beside it.
+      - name: Point the page at R2
+        id: r2url
+        if: steps.prebuilt.outputs.found == 'true' || steps.r2.outputs.uploaded == 'true'
+        env:
+          URL: ${{ vars.R2_PUBLIC_URL }}/${{ steps.build.outputs.key }}
+        run: |
+          before=$(grep -c 'id="ruby-wasm"' index.html)
+          if [ "$before" != 1 ]; then
+            echo "::error::expected one preload link in index.html, found $before" >&2
+            exit 1
+          fi
+
+          sed -i "s|\(<link id=\"ruby-wasm\"[^>]*href=\)\"[^\"]*\"|\1\"$URL\"|" index.html
+          grep '<link id="ruby-wasm"' index.html
+
+          if ! grep -q "href=\"$URL\"" index.html; then
+            echo "::error::the preload link was not rewritten" >&2
+            exit 1
+          fi
+          echo "served=true" >> "$GITHUB_OUTPUT"
+
       - uses: actions/upload-artifact@v7
         with:
           name: sandbox
@@ -126,8 +263,7 @@ jobs:
             sandbox/boot.rb
             sandbox/examples.js
             sandbox/manifest.json
-            sandbox/config.json
-            ${{ steps.r2.outputs.uploaded != 'true' && 'sandbox/ruby.wasm' || '' }}
+            ${{ steps.r2url.outputs.served != 'true' && 'sandbox/ruby.wasm' || '' }}
             sandbox/rb
             sandbox/assets
           if-no-files-found: ignore

data/.github/workflows/test.yml

@@ -48,8 +48,21 @@ jobs:
           bundler-cache: true
       - run: bundle exec rake test
 
+  # Both answer to the mysql2 adapter and they do not agree: MariaDB's json
+  # column is a checked longtext where MySQL's is a type of its own, and
+  # MariaDB casts to integer where MySQL knows only signed.  Each has passed
+  # while the other failed, so both run.
   mysql:
+    name: mysql (${{ matrix.image }})
     runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - image: mysql:8
+            health: mysqladmin ping -proot
+          - image: mariadb:11
+            health: healthcheck.sh --connect --innodb_initialized
     env:
       ADAPTER: mysql2
       # The suite creates its own database, which MYSQL_USER would not be
@@ -58,13 +71,13 @@ jobs:
       DB_PASSWORD: root
     services:
       mysql:
-        image: mysql:8
+        image: ${{ matrix.image }}
         env:
           MYSQL_ROOT_PASSWORD: root
         ports:
           - 3306:3306
         options: >-
-          --health-cmd "mysqladmin ping -proot"
+          --health-cmd "${{ matrix.health }}"
           --health-interval 10s
           --health-timeout 5s
           --health-retries 5