gitlab-labkit 5.0.1 → 5.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9b21aead959e4aa6c524c23f11280395d258b3391f49ad6bf463920858eac8dd
-  data.tar.gz: 97887fe54e8c9ca91ae27e4b888e09268f3d409445b06ef68467482bf9f16039
+  metadata.gz: 517717fb252b6eecaa4ff8d584d51d2318c0ad2334937626d27c983c8008b82d
+  data.tar.gz: 72c7a73c0a08c7bdef92e0889123c6f96785a70f79cb01b9b83eb482acc3481c
 SHA512:
-  metadata.gz: 7e267477c643ac91a35df6fa593f66194610ae3404c01bd82c14d7932a1ce57437be02691e2a6f263201b458b53e74158a316e8f3decbde1332f4bb1d01b5c56
-  data.tar.gz: 80f34c4b29ada72c578cb13119a645cfefbc8ce06e8fca6f55bae1c5fad7d61a819a548b96386bceea786c17cb27dddf0f7469cf7be160bc67dd058c754d37f8
+  metadata.gz: dadc324d442f4a13bf2c3bf3e93797ecf8f4ebc44342ffc2dd7c88b415f59513e9ad558470d4bc085c1afe6979ee8f3bd23e8151f8fef02423509b07c40dc73b
+  data.tar.gz: f99e0cb9a2a2fd65dd2e63533987a6f349bd320b24441756c530079e672402400e4be7a3d9b7182d8f0ea4bc09b47e148d07a1ebfa6e84cfaf1f4e5fd803babf

data/.gitlab-ci.yml

@@ -19,13 +19,13 @@ include:
   # It includes standard checks, gitlab-scanners, validations and release processes
   # common to all projects using this template library.
   # see https://gitlab.com/gitlab-com/gl-infra/common-ci-tasks/-/blob/main/templates/standard.md
-  - component: $CI_SERVER_FQDN/gitlab-com/gl-infra/common-ci-tasks/standard-build@v4.36
+  - component: $CI_SERVER_FQDN/gitlab-com/gl-infra/common-ci-tasks/standard-build@v5.15
 
   # Runs rspec tests and rubocop on the project
   # see https://gitlab.com/gitlab-com/gl-infra/common-ci-tasks/-/blob/main/templates/ruby.md
-  - component: $CI_SERVER_FQDN/gitlab-com/gl-infra/common-ci-tasks/ruby-build@v4.36
+  - component: $CI_SERVER_FQDN/gitlab-com/gl-infra/common-ci-tasks/ruby-build@v5.15
 
-  - component: $CI_SERVER_FQDN/gitlab-com/gl-infra/common-ci-tasks/danger@v4.36
+  - component: $CI_SERVER_FQDN/gitlab-com/gl-infra/common-ci-tasks/danger@v5.15
 
 # Attach a redis service to the rspec job from common-ci-tasks/ruby-build.
 # GitLab merges keys when a local job has the same name as an included one,
@@ -59,3 +59,56 @@ deploy:
   stage: release
   script:
     - tools/deploy-rubygem.sh
+
+.conformance-trigger-paths:
+  changes:
+    - lib/**/*
+    - gitlab-labkit.gemspec
+    - Gemfile
+    - .gitlab-ci.yml
+
+# Run the labkit-spec conformance harness with its Ruby server built from this
+# checkout. labkit-spec pins released SDKs, so this is the only pre-merge check
+# against the spec.
+conformance:
+  stage: validate
+  image:
+    name: jdxcode/mise:2026.8.14
+    entrypoint: [""]
+  needs: []
+  services:
+    - name: redis:8-alpine
+      alias: redis
+  rules:
+    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
+    - if: $CI_COMMIT_BRANCH
+      changes: !reference [.conformance-trigger-paths, changes]
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+      changes: !reference [.conformance-trigger-paths, changes]
+  variables:
+    LABKIT_SPEC_REPO: https://gitlab.com/gitlab-org/quality/tooling/labkit-spec.git
+    LABKIT_SPEC_REF: main
+    LABKIT_SPEC_DIR: $CI_PROJECT_DIR/.labkit-spec
+    MISE_TRUSTED_CONFIG_PATHS: $LABKIT_SPEC_DIR
+    MISE_DATA_DIR: $CI_PROJECT_DIR/.mise-cache
+    BUNDLE_PATH: vendor/bundle
+    CONFORMANCE_REDIS_ADDR: redis:6379
+  cache:
+    key: conformance-servers
+    paths:
+      - .labkit-spec/conformance/servers/ruby/vendor/
+      - .mise-cache/
+  script:
+    # Not clone: the restored cache makes LABKIT_SPEC_DIR non-empty.
+    - git init -q "$LABKIT_SPEC_DIR"
+    - git -C "$LABKIT_SPEC_DIR" fetch -q --depth 1 "$LABKIT_SPEC_REPO" "$LABKIT_SPEC_REF"
+    - git -C "$LABKIT_SPEC_DIR" checkout -q FETCH_HEAD
+    - cd "$LABKIT_SPEC_DIR"
+    - mise install
+    # The gemspec lists files via `git ls-files`, so the path must be a git work tree.
+    # grep fails the job if the Gemfile line moved and sed matched nothing.
+    - |
+      sed -i 's|^gem "gitlab-labkit".*|gem "gitlab-labkit", path: "'"$CI_PROJECT_DIR"'"|' conformance/servers/ruby/Gemfile
+      grep -q 'gem "gitlab-labkit", path: "'"$CI_PROJECT_DIR"'"' conformance/servers/ruby/Gemfile
+    - mise run conformance:ruby
+  timeout: 15m

data/.pre-commit-config.yaml

@@ -25,7 +25,7 @@ repos:
   # Documentation available at
   # https://gitlab.com/gitlab-com/gl-infra/common-ci-tasks/-/blob/main/docs/pre-commit.md
   - repo: https://gitlab.com/gitlab-com/gl-infra/common-ci-tasks
-    rev: v4.36  # renovate:managed
+    rev: v5.15  # renovate:managed
 
     hooks:
       - id: shellcheck  # Run shellcheck for changed Shell files

data/README.md

@@ -55,6 +55,27 @@ To opt out of autostart (e.g. you've started Redis some other way), set
 `LABKIT_TEST_REDIS_URL` to a reachable instance, or
 `LABKIT_TEST_REDIS_NO_AUTOSTART=1` to fail loudly instead of spawning.
 
+The `conformance` CI job runs the
+[labkit-spec](https://gitlab.com/gitlab-org/quality/tooling/labkit-spec)
+conformance harness against the spec's Ruby server, with the `gitlab-labkit`
+gem installed from your branch instead of the released version. A change to
+logging, lifecycle, or rate limiting is therefore checked against the
+cross-SDK scenarios before it merges. To run it locally, clone labkit-spec and
+replace the `gitlab-labkit` line in `conformance/servers/ruby/Gemfile` with
+
+```ruby
+gem "gitlab-labkit", path: "/path/to/labkit-ruby"
+```
+
+then run `mise run conformance:ruby` from the spec checkout (the rate-limit
+aspect needs Docker or `CONFORMANCE_REDIS_ADDR`).
+
+If your change also needs a labkit-spec change (a new scenario, or an update
+to its Ruby server), open that MR first and point `LABKIT_SPEC_REF` in
+`.gitlab-ci.yml` at its branch so this job validates both together. Set it
+back to `main` once the spec MR merges; a non-`main` ref must not reach
+`master`.
+
 Please also review the [development section of the LabKit (go) README](https://gitlab.com/gitlab-org/labkit#developing-labkit) for details of the LabKit architectural philosophy.
 
 To work on some of the scripts we use for releasing a new version,

data/lib/labkit/rate_limit/README.md

@@ -514,6 +514,7 @@ flooding).
 | `gitlab_labkit_rate_limiter_checks_total`           | counter | `rate_limiter`, `action`, `matched`, `error` | Exactly one increment per `check` call, including fail-open. `action` is what the caller should do (`"allow"` or `"block"`); `matched` and `error` are `"true"`/`"false"`. |
 | `gitlab_labkit_rate_limiter_rule_evaluations_total` | counter | `rate_limiter`, `rule`, `action`, `result`   | One increment per evaluated rule (plus one per matched `:skip` rule). `action` is the configured rule action (`"limit"`, `"log"`, `"skip"`); `result` is what the evaluation decided (`"allow"`, `"block"`, `"log"`, `"skip"`, `"banned"` — see the Actions table). |
 | `gitlab_labkit_rate_limiter_peeks_total`            | counter | `rate_limiter`, `error`                      | Exactly one increment per `peek` call, including fail-open. `error` is `"true"`/`"false"`. |
+| `gitlab_labkit_rate_limiter_enforced_total`         | counter | `rate_limiter`, `rule`                       | One increment per request the caller rejected on a `:block`. Emitted by the caller, not the evaluator: a rollout gate may observe a block without enforcing it. |
 | `gitlab_labkit_rate_limiter_limit`                  | gauge   | `rate_limiter`, `rule`                       | Resolved limit at the last check (useful when `limit:` is callable). |
 | `gitlab_labkit_rate_limiter_period_seconds`         | gauge   | `rate_limiter`, `rule`                       | Resolved period at the last check.                                   |
 

data/lib/labkit/rate_limit/metrics.rb

@@ -71,6 +71,16 @@ module Labkit
         )
       end
 
+      # Emitted by the caller, once per rejected request: only the caller knows
+      # whether it acted on a :block (a rollout gate may observe without enforcing).
+      def enforced_total
+        Labkit::Metrics::Client.counter(
+          :gitlab_labkit_rate_limiter_enforced_total,
+          'Total number of requests rejected on a rate limit block',
+          { rate_limiter: nil, rule: nil }
+        )
+      end
+
       def limit_gauge
         Labkit::Metrics::Client.gauge(
           :gitlab_labkit_rate_limiter_limit,

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: gitlab-labkit
 version: !ruby/object:Gem::Version
-  version: 5.0.1
+  version: 5.1.0
 platform: ruby
 authors:
 - Andrew Newdigate