develoz-rails 0.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: ee93be7d4583674313e36b90ee84aaecf4f65d08eb23659e179b419608cd38dd
+  data.tar.gz: 5e9dc27ad205be346f3c71740e0572294dabbd63357abe6b6ad788589faa9e13
+SHA512:
+  metadata.gz: 4c2c7a71236567800a089344d3b15dbae4d42eceed06b3234e8d24bd5ef1c7e115c1ba79c0d5eb473f03696a5de86cc6f5d2759b1b56628da40c2ba1452fcbb9
+  data.tar.gz: 8e942cdcb7d0a22f2df4eb50c31bb1719e0ff904d7b0a5c04dbdab69ce0c93e408588973643516f2069d0de2ea1e0e6ba938f11c54e29a78d1a1cbc5083972de

data/.github/workflows/ci.yml

@@ -0,0 +1,31 @@
+name: CI
+
+on:
+  push:
+    branches: [main, develop]
+  pull_request:
+    branches: [main, develop]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: 4.0.5
+          bundler-cache: true
+
+      - name: Run CI checks
+        run: bin/ci
+
+      - name: Upload coverage
+        uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: coverage-report
+          path: coverage/
+          retention-days: 30

data/.github/workflows/release.yml

@@ -0,0 +1,459 @@
+name: Release
+
+on:
+  release:
+    types: [published]
+
+permissions: {}
+
+concurrency:
+  group: release-${{ github.event.release.tag_name }}
+  cancel-in-progress: false
+
+jobs:
+  validate:
+    if: ${{ github.event.release.prerelease == false }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+
+    steps:
+      - name: Check out release tag
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd
+        with:
+          ref: ${{ github.event.release.tag_name }}
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@003a5c4d8d6321bd302e38f6f0ec593f77f06600
+        with:
+          ruby-version: 4.0.5
+          bundler-cache: true
+
+      - name: Validate release identity
+        env:
+          RELEASE_SHA: ${{ github.sha }}
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+          REPOSITORY: ${{ github.repository }}
+        run: |
+          set -euo pipefail
+
+          fail() {
+            echo "::error::$1"
+            exit 1
+          }
+
+          [[ "$REPOSITORY" == "develoz-com/rails-template" ]] ||
+            fail "release workflow must run in develoz-com/rails-template"
+          [[ "$RELEASE_TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]] ||
+            fail "release tag must match vX.Y.Z"
+
+          tag_sha="$(git rev-parse --verify "refs/tags/${RELEASE_TAG}^{commit}")"
+          head_sha="$(git rev-parse --verify HEAD)"
+          main_sha="$(git rev-parse --verify "refs/remotes/origin/main^{commit}")"
+
+          [[ "$tag_sha" == "$head_sha" ]] ||
+            fail "checked-out commit does not match ${RELEASE_TAG}"
+          [[ "$tag_sha" == "$RELEASE_SHA" ]] ||
+            fail "${RELEASE_TAG} does not match the release event SHA"
+          [[ "$tag_sha" == "$main_sha" ]] ||
+            fail "${RELEASE_TAG} is not the current origin/main commit"
+
+          version="$(ruby -Ilib -rdeveloz/version -e 'print Develoz::VERSION')"
+          [[ "$RELEASE_TAG" == "v${version}" ]] ||
+            fail "${RELEASE_TAG} does not match Develoz::VERSION ${version}"
+
+      - name: Run CI
+        run: bin/ci
+
+      - name: Validate changelog update
+        env:
+          PUBLISHED_AT: ${{ github.event.release.published_at }}
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+          REPOSITORY: ${{ github.repository }}
+        run: |
+          set -euo pipefail
+
+          release_date="${PUBLISHED_AT%%T*}"
+          [[ "$release_date" =~ ^[0-9]{4}-[0-9]{2}-[0-9]{2}$ ]] || {
+            echo "::error::release published_at must contain a YYYY-MM-DD date"
+            exit 1
+          }
+
+          bin/update_changelog \
+            --tag "$RELEASE_TAG" \
+            --date "$release_date" \
+            --repository "$REPOSITORY" \
+            --check \
+            CHANGELOG.md
+
+  publish:
+    needs: validate
+    if: ${{ github.event.release.prerelease == false && needs.validate.result == 'success' }}
+    runs-on: ubuntu-latest
+    environment: rubygems
+    permissions:
+      contents: read
+      id-token: write
+
+    steps:
+      - name: Check out immutable release commit
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd
+        with:
+          ref: ${{ github.sha }}
+          fetch-depth: 0
+          fetch-tags: true
+          persist-credentials: false
+
+      - name: Validate immutable release refs
+        env:
+          RELEASE_SHA: ${{ github.sha }}
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+          REPOSITORY: ${{ github.repository }}
+        run: |
+          set -euo pipefail
+
+          fail() {
+            echo "::error::$1"
+            exit 1
+          }
+
+          [[ "$REPOSITORY" == "develoz-com/rails-template" ]] ||
+            fail "release workflow must run in develoz-com/rails-template"
+          [[ "$RELEASE_TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]] ||
+            fail "release tag must match vX.Y.Z"
+
+          tag_sha="$(git rev-parse --verify "refs/tags/${RELEASE_TAG}^{commit}")"
+          head_sha="$(git rev-parse --verify HEAD)"
+          main_sha="$(git rev-parse --verify "refs/remotes/origin/main^{commit}")"
+
+          [[ "$head_sha" == "$RELEASE_SHA" ]] ||
+            fail "checked-out commit does not match the release event SHA"
+          [[ "$tag_sha" == "$RELEASE_SHA" ]] ||
+            fail "${RELEASE_TAG} does not match the release event SHA"
+          [[ "$main_sha" == "$RELEASE_SHA" ]] ||
+            fail "${RELEASE_TAG} is not the current origin/main commit"
+
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@003a5c4d8d6321bd302e38f6f0ec593f77f06600
+        with:
+          ruby-version: 4.0.5
+          bundler: none
+
+      - name: Validate gem version
+        env:
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+        run: |
+          set -euo pipefail
+
+          version="$(ruby -Ilib -rdeveloz/version -e 'print Develoz::VERSION')"
+          if [[ "$RELEASE_TAG" != "v${version}" ]]; then
+            echo "::error::${RELEASE_TAG} does not match Develoz::VERSION ${version}"
+            exit 1
+          fi
+          printf 'VERSION=%s\n' "$version" >> "$GITHUB_ENV"
+
+      - name: Build exact gem
+        run: |
+          set -euo pipefail
+
+          gem_path="pkg/develoz-rails-${VERSION}.gem"
+          mkdir -p pkg
+          rm -f -- "$gem_path"
+          gem build develoz-rails.gemspec --output "$gem_path"
+          [[ -f "$gem_path" ]] || {
+            echo "::error::gem build did not create ${gem_path}"
+            exit 1
+          }
+          printf 'GEM_PATH=%s\n' "$gem_path" >> "$GITHUB_ENV"
+
+      - name: Inspect built gem
+        run: |
+          ruby -rrubygems/package <<'RUBY'
+          gem_path = ENV.fetch("GEM_PATH")
+          version = ENV.fetch("VERSION")
+          package = Gem::Package.new(gem_path)
+          package.verify
+          specification = package.spec
+
+          abort "expected gem name develoz-rails, got #{specification.name}" unless specification.name == "develoz-rails"
+          abort "expected gem version #{version}, got #{specification.version}" unless specification.version.to_s == version
+          abort "expected ruby platform, got #{specification.platform}" unless specification.platform.to_s == "ruby"
+          abort "expected only the develoz executable" unless specification.executables == ["develoz"]
+
+          files = package.contents
+          required_files = %w[
+            CHANGELOG.md
+            README.md
+            config/generators.yml
+            exe/develoz
+            lib/develoz.rb
+            lib/develoz/version.rb
+            lib/generators/develoz/ci/templates/.github/workflows/ci.yml.tt
+            templates/pull_request_template.md.tt
+          ]
+          missing_files = required_files - files
+          abort "gem is missing required files: #{missing_files.join(', ')}" unless missing_files.empty?
+
+          excluded_files = %w[.gitignore .rspec Gemfile develoz-rails.gemspec]
+          excluded_prefixes = %w[bin/ spec/]
+          unexpected_files = files.select do |file|
+            excluded_files.include?(file) || excluded_prefixes.any? { |prefix| file.start_with?(prefix) }
+          end
+          abort "gem contains excluded files: #{unexpected_files.join(', ')}" unless unexpected_files.empty?
+          RUBY
+
+      - name: Check RubyGems version state
+        id: version-state
+        env:
+          RUN_ATTEMPT: ${{ github.run_attempt }}
+        run: |
+          set -euo pipefail
+
+          [[ "$RUN_ATTEMPT" =~ ^[1-9][0-9]*$ ]] || {
+            echo "::error::invalid workflow run attempt ${RUN_ATTEMPT}"
+            exit 1
+          }
+
+          api_url="https://rubygems.org/api/v2/rubygems/develoz-rails/versions/${VERSION}.json"
+          checks=1
+          if (( RUN_ATTEMPT > 1 )); then
+            checks=12
+          fi
+
+          status=""
+          for ((check = 1; check <= checks; check++)); do
+            status="$(curl \
+              --silent \
+              --show-error \
+              --location \
+              --connect-timeout 10 \
+              --max-time 30 \
+              --output /dev/null \
+              --write-out '%{http_code}' \
+              "$api_url")"
+
+            if [[ "$status" == "200" ]]; then
+              break
+            fi
+            [[ "$status" == "404" ]] || {
+              echo "::error::RubyGems API returned HTTP ${status}"
+              exit 1
+            }
+            if (( check < checks )); then
+              sleep 5
+            fi
+          done
+
+          if [[ "$status" == "200" ]]; then
+            if (( RUN_ATTEMPT == 1 )); then
+              echo "::error::develoz-rails ${VERSION} already exists on RubyGems during the first run attempt"
+              exit 1
+            fi
+            echo "should-push=false" >> "$GITHUB_OUTPUT"
+            echo "develoz-rails ${VERSION} is already visible; skipping gem push on rerun"
+          else
+            echo "should-push=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Configure RubyGems credentials
+        if: ${{ steps.version-state.outputs.should-push == 'true' }}
+        uses: rubygems/configure-rubygems-credentials@dc5a8d8553e6ee01fc26761a49e99e733d17954a
+
+      - name: Push exact gem
+        if: ${{ steps.version-state.outputs.should-push == 'true' }}
+        run: gem push "pkg/develoz-rails-${VERSION}.gem"
+
+      - name: Verify RubyGems API visibility
+        run: |
+          set -euo pipefail
+
+          api_url="https://rubygems.org/api/v2/rubygems/develoz-rails/versions/${VERSION}.json"
+          api_response="$RUNNER_TEMP/develoz-rails-${VERSION}.json"
+          status=""
+
+          for ((check = 1; check <= 18; check++)); do
+            status="$(curl \
+              --silent \
+              --show-error \
+              --location \
+              --connect-timeout 10 \
+              --max-time 30 \
+              --output "$api_response" \
+              --write-out '%{http_code}' \
+              "$api_url")"
+
+            if [[ "$status" == "200" ]]; then
+              break
+            fi
+            [[ "$status" == "404" ]] || {
+              echo "::error::RubyGems API returned HTTP ${status}"
+              exit 1
+            }
+            if (( check < 18 )); then
+              sleep 5
+            fi
+          done
+
+          [[ "$status" == "200" ]] || {
+            echo "::error::develoz-rails ${VERSION} did not become visible through the RubyGems API"
+            exit 1
+          }
+
+          API_RESPONSE="$api_response" ruby -rjson -rdigest <<'RUBY'
+          payload = JSON.parse(File.read(ENV.fetch("API_RESPONSE")))
+          version = ENV.fetch("VERSION")
+          gem_path = ENV.fetch("GEM_PATH")
+          expected_sha = Digest::SHA256.file(gem_path).hexdigest
+
+          abort "RubyGems API returned the wrong gem name" unless payload.fetch("name") == "develoz-rails"
+          abort "RubyGems API returned the wrong version" unless payload.fetch("version") == version
+          abort "RubyGems API returned the wrong platform" unless payload.fetch("platform") == "ruby"
+          abort "RubyGems API reports the release as yanked" if payload.fetch("yanked")
+          abort "RubyGems API SHA does not match the built gem" unless payload.fetch("sha") == expected_sha
+          RUBY
+
+  finalize-changelog:
+    needs: publish
+    if: ${{ github.event.release.prerelease == false && needs.publish.result == 'success' }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    steps:
+      - name: Check out main
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd
+        with:
+          ref: main
+          fetch-depth: 0
+
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@003a5c4d8d6321bd302e38f6f0ec593f77f06600
+        with:
+          ruby-version: 4.0.5
+          bundler: none
+
+      - name: Validate main and release tag
+        env:
+          RELEASE_SHA: ${{ github.sha }}
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+          REPOSITORY: ${{ github.repository }}
+        run: |
+          set -euo pipefail
+
+          fail() {
+            echo "::error::$1"
+            exit 1
+          }
+
+          [[ "$REPOSITORY" == "develoz-com/rails-template" ]] ||
+            fail "release workflow must run in develoz-com/rails-template"
+          [[ "$RELEASE_TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]] ||
+            fail "release tag must match vX.Y.Z"
+
+          tag_sha="$(git rev-parse --verify "refs/tags/${RELEASE_TAG}^{commit}")"
+          head_sha="$(git rev-parse --verify HEAD)"
+          main_sha="$(git rev-parse --verify "refs/remotes/origin/main^{commit}")"
+
+          [[ "$tag_sha" == "$RELEASE_SHA" ]] ||
+            fail "${RELEASE_TAG} no longer matches the release event SHA"
+          [[ "$head_sha" == "$main_sha" ]] ||
+            fail "checked-out main does not match origin/main"
+
+          if [[ "$main_sha" == "$RELEASE_SHA" ]]; then
+            finalize_state="fresh"
+          else
+            parents="$(git show -s --format=%P "$main_sha")"
+            [[ "$parents" == "$RELEASE_SHA" ]] ||
+              fail "main is not the release commit or its single direct child"
+
+            subject="$(git show -s --format=%s "$main_sha")"
+            expected_subject="docs: finalize ${RELEASE_TAG} changelog"
+            [[ "$subject" == "$expected_subject" ]] ||
+              fail "the commit after the release has an unexpected subject"
+
+            changed_files="$(git diff-tree --no-commit-id --name-only -r "$main_sha")"
+            [[ "$changed_files" == "CHANGELOG.md" ]] ||
+              fail "the commit after the release must change only CHANGELOG.md"
+
+            finalize_state="already-finalized"
+          fi
+
+          version="$(ruby -Ilib -rdeveloz/version -e 'print Develoz::VERSION')"
+          [[ "$RELEASE_TAG" == "v${version}" ]] ||
+            fail "${RELEASE_TAG} does not match Develoz::VERSION ${version}"
+          printf 'FINALIZE_STATE=%s\n' "$finalize_state" >> "$GITHUB_ENV"
+
+      - name: Finalize changelog
+        env:
+          PUBLISHED_AT: ${{ github.event.release.published_at }}
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+          REPOSITORY: ${{ github.repository }}
+        run: |
+          set -euo pipefail
+
+          release_date="${PUBLISHED_AT%%T*}"
+          [[ "$release_date" =~ ^[0-9]{4}-[0-9]{2}-[0-9]{2}$ ]] || {
+            echo "::error::release published_at must contain a YYYY-MM-DD date"
+            exit 1
+          }
+
+          bin/update_changelog \
+            --tag "$RELEASE_TAG" \
+            --date "$release_date" \
+            --repository "$REPOSITORY" \
+            CHANGELOG.md
+
+      - name: Commit changelog if changed
+        env:
+          RELEASE_SHA: ${{ github.sha }}
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+        run: |
+          set -euo pipefail
+
+          if [[ "$FINALIZE_STATE" == "already-finalized" ]]; then
+            working_tree="$(git status --porcelain --untracked-files=all)"
+            if [[ -n "$working_tree" ]]; then
+              echo "::error::changelog updater was not idempotent on the finalized commit"
+              exit 1
+            fi
+            echo "CHANGELOG.md is already finalized for ${RELEASE_TAG}"
+            exit 0
+          fi
+
+          [[ "$FINALIZE_STATE" == "fresh" ]] || {
+            echo "::error::unexpected changelog finalization state ${FINALIZE_STATE}"
+            exit 1
+          }
+
+          if git diff --quiet -- CHANGELOG.md; then
+            echo "CHANGELOG.md is already finalized for ${RELEASE_TAG}"
+            exit 0
+          fi
+
+          unexpected_files="$(git diff --name-only -- . ':(exclude)CHANGELOG.md')"
+          [[ -z "$unexpected_files" ]] || {
+            echo "::error::changelog finalization changed unexpected files: ${unexpected_files}"
+            exit 1
+          }
+          git diff --check
+
+          git add -- CHANGELOG.md
+          staged_files="$(git diff --cached --name-only)"
+          [[ "$staged_files" == "CHANGELOG.md" ]] || {
+            echo "::error::only CHANGELOG.md may be committed"
+            exit 1
+          }
+
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git commit -m "docs: finalize ${RELEASE_TAG} changelog" -- CHANGELOG.md
+
+          tag_sha="$(git rev-parse --verify "refs/tags/${RELEASE_TAG}^{commit}")"
+          [[ "$tag_sha" == "$RELEASE_SHA" ]] || {
+            echo "::error::release tag changed during changelog finalization"
+            exit 1
+          }
+
+          git push origin HEAD:main

data/.rubocop.yml

@@ -0,0 +1,52 @@
+plugins:
+  - rubocop-rails
+  - rubocop-rspec
+  - rubocop-performance
+
+AllCops:
+  TargetRubyVersion: 3.4
+  NewCops: enable
+  SuggestExtensions: false
+  Exclude:
+    - "bin/**/*"
+    - "exe/**/*"
+    - "vendor/**/*"
+    - ".git/**/*"
+    - "config/**/*"
+    - "spec/fixtures/canonical/**/*"
+
+# Gem-specific relaxations
+Metrics/BlockLength:
+  Exclude:
+    - "spec/**/*"
+
+Metrics/MethodLength:
+  Max: 20
+
+RSpec/ExampleLength:
+  Max: 15
+
+RSpec/MultipleExpectations:
+  Max: 3
+
+# CLI/generator gem legitimately writes to stdout; puts/say is the interface
+Rails/Output:
+  Enabled: false
+
+# Development dependencies intentionally declared in gemspec per gem best practices
+Gemspec/DevelopmentDependencies:
+  Enabled: false
+
+# Many small classes across generators; top-level doc comments add noise
+Style/Documentation:
+  Enabled: false
+
+Style/StringLiterals:
+  EnforcedStyle: double_quotes
+
+Style/FrozenStringLiteralComment:
+  Enabled: true
+
+Rails/RakeEnvironment:
+  Exclude:
+    - "Rakefile"