karafka-rdkafka 0.20.0.rc3-x86_64-linux-gnu

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 8d2a5aa11f12382418392f01e4ec107949661fec05506f0201346f126525c434
+  data.tar.gz: b55416183eeed99b3440c9d8f65d13748fce7cb3d315984e5b6fccb0e2b20b0a
+SHA512:
+  metadata.gz: e91fe7846b57967aeef2bce1cd3bf72e3ee206cfdb4ed50099684cbef1b1a347420cdda5d3002429d6ab0e94b78cc8a28864a6a6e1886f9223b60145706fbac0
+  data.tar.gz: d22c1226b32a671145323e52a9e22edb94aaa4e9188791912958d104f93e27a15e6b16883ba5f36e3beccaf9132e5155a67db5c2728381ec59b72220ba171ce1

data/.github/CODEOWNERS

@@ -0,0 +1,3 @@
+/.github @mensfeld
+/.github/workflows/ @mensfeld
+/.github/actions/ @mensfeld

data/.github/FUNDING.yml

@@ -0,0 +1 @@
+custom: ['https://karafka.io/#become-pro']

data/.github/workflows/ci_linux_x86_64_gnu.yml

@@ -0,0 +1,248 @@
+name: CI Linux x86_64 GNU
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+on:
+  pull_request:
+    branches: [ main, master ]
+  push:
+    branches: [ main, master ]
+  schedule:
+    - cron: '0 1 * * *'
+
+permissions:
+  contents: read
+
+env:
+  BUNDLE_RETRY: 6
+  BUNDLE_JOBS: 4
+
+jobs:
+  build_install:
+    timeout-minutes: 30
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          fetch-depth: 0
+      - name: Install package dependencies
+        run: "[ -e $APT_DEPS ] || sudo apt-get install -y --no-install-recommends $APT_DEPS"
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@a4effe49ee8ee5b8b5091268c473a4628afb5651 # v1.245.0
+        with:
+          ruby-version: '3.4'  # Use one Ruby version for building
+          bundler-cache: false
+      - name: Build gem with mini_portile
+        run: |
+          set -e
+          bundle install
+          cd ext && bundle exec rake
+          cd ..
+      - name: Upload built gem and bundle
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: rdkafka-built-gem
+          path: |
+            vendor/bundle/
+            .bundle/
+            ext/
+            lib/
+          retention-days: 1
+
+  specs_install:
+    timeout-minutes: 30
+    runs-on: ubuntu-latest
+    needs: build_install
+    strategy:
+      fail-fast: false
+      matrix:
+        ruby:
+          - '3.5.0-preview1'
+          - '3.4'
+          - '3.3'
+          - '3.2'
+          - '3.1'
+          - 'jruby-10.0'
+        include:
+          - ruby: '3.4'
+            coverage: 'true'
+          - ruby: 'jruby-10.0'
+            continue-on-error: true
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          fetch-depth: 0
+      - name: Download built gem
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: rdkafka-built-gem
+          path: ./
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@a4effe49ee8ee5b8b5091268c473a4628afb5651 # v1.245.0
+        with:
+          ruby-version: ${{matrix.ruby}}
+          bundler-cache: false
+      - name: Start Kafka with Docker Compose
+        run: |
+          docker compose up -d
+          echo "Waiting for Kafka to be ready..."
+
+          sleep 10
+
+          echo "=== Container status ==="
+          docker compose ps kafka
+
+          for i in {1..30}; do
+            echo "=== Attempt $i/30 ==="
+
+            echo "Testing kafka-topics command..."
+            if docker compose exec -T kafka kafka-topics --bootstrap-server localhost:9092 --list >/dev/null 2>&1; then
+              echo "Kafka topics command succeeded!"
+              break
+            else
+              echo "Kafka topics command failed (exit code: $?)"
+            fi
+
+            echo "Sleeping 2 seconds..."
+            sleep 2
+          done
+      - name: Install remaining dependencies
+        env:
+          RDKAFKA_EXT_PATH: ${{ github.workspace }}/ext
+        run: |
+          # Only install gems that aren't Ruby-version specific
+          bundle install
+      - name: Run all specs
+        env:
+          GITHUB_COVERAGE: ${{matrix.coverage}}
+          RDKAFKA_EXT_PATH: ${{ github.workspace }}/ext
+        continue-on-error: ${{ matrix.continue-on-error || false }}
+        run: |
+          bundle exec rspec
+
+  build_precompiled:
+    timeout-minutes: 30
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          fetch-depth: 0
+      - name: Install build dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends \
+            build-essential \
+            gcc \
+            make \
+            patch \
+            tar \
+            wget \
+            ca-certificates \
+            libsasl2-dev \
+            libssl-dev \
+            zlib1g-dev \
+            libzstd-dev
+      - name: Cache build-tmp directory
+        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
+        with:
+          path: ext/build-tmp
+          key: build-tmp-${{ runner.os }}-${{ hashFiles('ext/*.sh', 'ext/Rakefile') }}-v2
+      - name: Build precompiled librdkafka.so
+        run: |
+          cd ext
+          ./build_linux_x86_64_gnu.sh
+      - name: Upload precompiled library
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: librdkafka-precompiled-linux
+          path: ext/
+          retention-days: 1
+
+  specs_precompiled:
+    timeout-minutes: 30
+    runs-on: ubuntu-latest
+    needs: build_precompiled
+    strategy:
+      fail-fast: false
+      matrix:
+        ruby:
+          - '3.5.0-preview1'
+          - '3.4'
+          - '3.3'
+          - '3.2'
+          - '3.1'
+        include:
+          - ruby: '3.4'
+            coverage: 'true'
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          fetch-depth: 0
+      - name: Download precompiled library
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: librdkafka-precompiled-linux
+          path: ext/
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@a4effe49ee8ee5b8b5091268c473a4628afb5651 # v1.245.0
+        with:
+          ruby-version: ${{ matrix.ruby }}
+          bundler-cache: false
+      - name: Start Kafka with Docker Compose
+        run: |
+          docker compose up -d
+          echo "Waiting for Kafka to be ready..."
+
+          sleep 10
+
+          echo "=== Container status ==="
+          docker compose ps kafka
+
+          for i in {1..30}; do
+            echo "=== Attempt $i/30 ==="
+
+            echo "Testing kafka-topics command..."
+            if docker compose exec -T kafka kafka-topics --bootstrap-server localhost:9092 --list >/dev/null 2>&1; then
+              echo "Kafka topics command succeeded!"
+              break
+            else
+              echo "Kafka topics command failed (exit code: $?)"
+            fi
+
+            echo "Sleeping 2 seconds..."
+            sleep 2
+          done
+      - name: Install bundle with precompiled library
+        env:
+          GITHUB_COVERAGE: ${{ matrix.coverage }}
+          RDKAFKA_EXT_PATH: ${{ github.workspace }}/ext
+        run: |
+          bundle install
+          echo "Bundle install completed with precompiled library"
+      - name: Remove build dependencies to test static linking
+        continue-on-error: true
+        run: |
+          echo "Removing build dependencies to verify precompiled library is truly self-contained..."
+
+          # Remove packages one by one to avoid dependency conflicts
+          packages_to_remove="build-essential gcc g++ make patch tar wget libsasl2-dev libssl-dev zlib1g-dev libzstd-dev"
+
+          for package in $packages_to_remove; do
+            if dpkg -l | grep -q "^ii.*$package "; then
+              echo "Removing $package..."
+              sudo dpkg --remove --force-depends $package 2>/dev/null || echo "Could not remove $package"
+            else
+              echo "$package is not installed"
+            fi
+          done
+
+          echo "Build dependencies removal completed"
+          echo "Remaining build tools:"
+          which gcc g++ make 2>/dev/null || echo "No build tools found in PATH (good!)"
+      - name: Run specs with precompiled library
+        env:
+          GITHUB_COVERAGE: ${{ matrix.coverage }}
+          RDKAFKA_EXT_PATH: ${{ github.workspace }}/ext
+        run: |
+          bundle exec rspec

data/.github/workflows/ci_macos_arm64.yml

@@ -0,0 +1,301 @@
+name: CI macOS ARM64
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+on:
+  pull_request:
+    branches: [ main, master ]
+  push:
+    branches: [ main, master ]
+  schedule:
+    - cron: '0 1 * * *'
+permissions:
+  contents: read
+env:
+  BUNDLE_RETRY: 6
+  BUNDLE_JOBS: 4
+  # Renovate can track and update this version
+  CONFLUENT_VERSION: "8.0.0"
+jobs:
+  build_install:
+    timeout-minutes: 30
+    runs-on: macos-latest
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          fetch-depth: 0
+      - name: Install Bash 4+ and Kerberos
+        run: |
+          brew install bash
+          brew list krb5 &>/dev/null || brew install krb5
+          echo "/opt/homebrew/bin" >> $GITHUB_PATH
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@a4effe49ee8ee5b8b5091268c473a4628afb5651 # v1.245.0
+        with:
+          ruby-version: '3.4'  # Use one Ruby version for building
+          bundler-cache: false
+      - name: Build gem with mini_portile
+        run: |
+          set -e
+          bundle install
+          cd ext && bundle exec rake
+          cd ..
+      - name: Upload built gem and bundle
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: rdkafka-built-gem-macos
+          path: |
+            vendor/bundle/
+            .bundle/
+            ext/
+            lib/
+          retention-days: 1
+
+  specs_install:
+    timeout-minutes: 30
+    runs-on: macos-latest
+    needs: build_install
+    strategy:
+      fail-fast: false
+      matrix:
+        ruby:
+          - '3.5.0-preview1'
+          - '3.4'
+          - '3.3'
+          - '3.2'
+          - '3.1'
+        include:
+          - ruby: '3.4'
+            coverage: 'true'
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          fetch-depth: 0
+      - name: Download built gem
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: rdkafka-built-gem-macos
+          path: ./
+      - name: Install Bash 4+ and Kerberos
+        run: |
+          brew install bash
+          brew list krb5 &>/dev/null || brew install krb5
+          echo "/opt/homebrew/bin" >> $GITHUB_PATH
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@a4effe49ee8ee5b8b5091268c473a4628afb5651 # v1.245.0
+        with:
+          ruby-version: ${{matrix.ruby}}
+          bundler-cache: false
+      - name: Install and Start Confluent Community Kafka (KRaft)
+        run: |
+          brew install openjdk@17
+          export PATH="/opt/homebrew/opt/openjdk@17/bin:$PATH"
+          export JAVA_HOME="/opt/homebrew/opt/openjdk@17"
+
+          curl -O "https://packages.confluent.io/archive/8.0/confluent-community-${CONFLUENT_VERSION}.tar.gz"
+          tar -xzf "confluent-community-${CONFLUENT_VERSION}.tar.gz"
+
+          export CONFLUENT_HOME="$(pwd)/confluent-${CONFLUENT_VERSION}"
+          export PATH="$CONFLUENT_HOME/bin:$PATH"
+          cd "$CONFLUENT_HOME"
+
+          # Find the correct server config
+          KRAFT_CONFIG=""
+          for config in "etc/kafka/kraft/server.properties" "config/kraft/server.properties" "etc/kafka/server.properties"; do
+            if [ -f "$config" ]; then
+              KRAFT_CONFIG="$config"
+              echo "Found config: $KRAFT_CONFIG"
+              break
+            fi
+          done
+
+          if [ -z "$KRAFT_CONFIG" ]; then
+            echo "❌ No server config found"
+            exit 1
+          fi
+
+          # Configure KRaft for single-node setup
+          cat >> "$KRAFT_CONFIG" << 'EOF'
+
+          # KRaft mode configuration for single-node setup
+          process.roles=broker,controller
+          node.id=1
+          controller.quorum.voters=1@127.0.0.1:9093
+          listeners=PLAINTEXT://127.0.0.1:9092,CONTROLLER://127.0.0.1:9093
+          controller.listener.names=CONTROLLER
+          inter.broker.listener.name=PLAINTEXT
+          log.dirs=/tmp/kraft-combined-logs
+
+          # Enable simple ACL authorization for testing
+          authorizer.class.name=org.apache.kafka.metadata.authorizer.StandardAuthorizer
+          super.users=User:ANONYMOUS
+          allow.everyone.if.no.acl.found=true
+          EOF
+
+          echo "Updated KRaft configuration"
+
+          CLUSTER_ID=$(bin/kafka-storage random-uuid)
+          bin/kafka-storage format -t "$CLUSTER_ID" -c "$KRAFT_CONFIG"
+          bin/kafka-server-start "$KRAFT_CONFIG" &
+
+          sleep 20
+
+          for i in {1..30}; do
+            if bin/kafka-topics --bootstrap-server 127.0.0.1:9092 --list >/dev/null 2>&1; then
+              echo "✅ Confluent Community ${CONFLUENT_VERSION} (KRaft) is ready!"
+              break
+            fi
+            [ $i -eq 30 ] && { echo "❌ Kafka failed to start"; exit 1; }
+            sleep 2
+          done
+      - name: Install remaining dependencies
+        env:
+          RDKAFKA_EXT_PATH: ${{ github.workspace }}/ext
+        run: |
+          # Only install gems that aren't Ruby-version specific
+          bundle install
+      - name: Run all specs
+        env:
+          GITHUB_COVERAGE: ${{matrix.coverage}}
+          RDKAFKA_EXT_PATH: ${{ github.workspace }}/ext
+        run: |
+          bundle exec rspec
+
+  build_precompiled:
+    timeout-minutes: 45
+    runs-on: macos-latest
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          fetch-depth: 0
+      - name: Install Bash 4+ and Kerberos
+        run: |
+          brew install bash
+          brew list krb5 &>/dev/null || brew install krb5
+          echo "/opt/homebrew/bin" >> $GITHUB_PATH
+      - name: Cache build-tmp directory
+        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
+        with:
+          path: ext/build-tmp-macos
+          key: build-tmp-${{ runner.os }}-${{ hashFiles('ext/*.sh', 'ext/Rakefile') }}-v2
+      - name: Build precompiled librdkafka for macOS ARM64
+        run: |
+          cd ext
+          /opt/homebrew/bin/bash ./build_macos_arm64.sh
+      - name: Upload precompiled library
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: librdkafka-precompiled-macos
+          path: ext/
+          retention-days: 1
+
+  specs_precompiled:
+    timeout-minutes: 30
+    runs-on: macos-latest
+    needs: build_precompiled
+    strategy:
+      fail-fast: false
+      matrix:
+        ruby:
+          - '3.5.0-preview1'
+          - '3.4'
+          - '3.3'
+          - '3.2'
+          - '3.1'
+        include:
+          - ruby: '3.4'
+            coverage: 'true'
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          fetch-depth: 0
+      - name: Download precompiled library
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: librdkafka-precompiled-macos
+          path: ext/
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@a4effe49ee8ee5b8b5091268c473a4628afb5651 # v1.245.0
+        with:
+          ruby-version: ${{ matrix.ruby }}
+          bundler-cache: false
+      - name: Install Bash 4+ and Kerberos
+        run: |
+          brew install bash
+          brew list krb5 &>/dev/null || brew install krb5
+          echo "/opt/homebrew/bin" >> $GITHUB_PATH
+      - name: Install and Start Confluent Community Kafka (KRaft)
+        run: |
+          brew install openjdk@17
+          export PATH="/opt/homebrew/opt/openjdk@17/bin:$PATH"
+          export JAVA_HOME="/opt/homebrew/opt/openjdk@17"
+
+          curl -O "https://packages.confluent.io/archive/8.0/confluent-community-${CONFLUENT_VERSION}.tar.gz"
+          tar -xzf "confluent-community-${CONFLUENT_VERSION}.tar.gz"
+
+          export CONFLUENT_HOME="$(pwd)/confluent-${CONFLUENT_VERSION}"
+          export PATH="$CONFLUENT_HOME/bin:$PATH"
+          cd "$CONFLUENT_HOME"
+
+          # Find the correct server config
+          KRAFT_CONFIG=""
+          for config in "etc/kafka/kraft/server.properties" "config/kraft/server.properties" "etc/kafka/server.properties"; do
+            if [ -f "$config" ]; then
+              KRAFT_CONFIG="$config"
+              echo "Found config: $KRAFT_CONFIG"
+              break
+            fi
+          done
+
+          if [ -z "$KRAFT_CONFIG" ]; then
+            echo "❌ No server config found"
+            exit 1
+          fi
+
+          # Configure KRaft for single-node setup
+          cat >> "$KRAFT_CONFIG" << 'EOF'
+
+          # KRaft mode configuration for single-node setup
+          process.roles=broker,controller
+          node.id=1
+          controller.quorum.voters=1@127.0.0.1:9093
+          listeners=PLAINTEXT://127.0.0.1:9092,CONTROLLER://127.0.0.1:9093
+          controller.listener.names=CONTROLLER
+          inter.broker.listener.name=PLAINTEXT
+          log.dirs=/tmp/kraft-combined-logs
+
+          # Enable simple ACL authorization for testing
+          authorizer.class.name=org.apache.kafka.metadata.authorizer.StandardAuthorizer
+          super.users=User:ANONYMOUS
+          allow.everyone.if.no.acl.found=true
+          EOF
+
+          echo "Updated KRaft configuration"
+
+          CLUSTER_ID=$(bin/kafka-storage random-uuid)
+          bin/kafka-storage format -t "$CLUSTER_ID" -c "$KRAFT_CONFIG"
+          bin/kafka-server-start "$KRAFT_CONFIG" &
+
+          sleep 20
+
+          for i in {1..30}; do
+            if bin/kafka-topics --bootstrap-server 127.0.0.1:9092 --list >/dev/null 2>&1; then
+              echo "✅ Confluent Community ${CONFLUENT_VERSION} (KRaft) is ready!"
+              break
+            fi
+            [ $i -eq 30 ] && { echo "❌ Kafka failed to start"; exit 1; }
+            sleep 2
+          done
+      - name: Install bundle with precompiled library
+        env:
+          GITHUB_COVERAGE: ${{ matrix.coverage }}
+          RDKAFKA_EXT_PATH: ${{ github.workspace }}/ext
+        run: |
+          bundle install
+          echo "Bundle install completed with precompiled library"
+      - name: Run specs with precompiled library
+        env:
+          GITHUB_COVERAGE: ${{ matrix.coverage }}
+          RDKAFKA_EXT_PATH: ${{ github.workspace }}/ext
+        run: |
+          bundle exec rspec

data/.github/workflows/push_linux_x86_64_gnu.yml

@@ -0,0 +1,60 @@
+name: Push Linux x86_64 GNU Platform Gem
+on:
+  push:
+    tags:
+      - v*
+permissions:
+  contents: read
+env:
+  BUNDLE_RETRY: 6
+  BUNDLE_JOBS: 4
+jobs:
+  push:
+    if: github.repository_owner == 'karafka'
+    timeout-minutes: 30
+    runs-on: ubuntu-latest
+    environment: deployment
+    permissions:
+      contents: write
+      id-token: write
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          fetch-depth: 0
+      - name: Install build dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends \
+            build-essential \
+            gcc \
+            make \
+            patch \
+            tar \
+            wget \
+            ca-certificates \
+            libsasl2-dev \
+            libssl-dev \
+            zlib1g-dev \
+            libzstd-dev
+      - name: Cache build-tmp directory
+        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
+        with:
+          path: ext/build-tmp
+          key: build-tmp-${{ runner.os }}-${{ hashFiles('ext/*.sh') }}
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@a4effe49ee8ee5b8b5091268c473a4628afb5651 # v1.245.0
+        with:
+          ruby-version: '3.4'
+          bundler-cache: false
+      - name: Build precompiled librdkafka.so
+        run: |
+          cd ext
+          ./build_linux_x86_64_gnu.sh
+      - name: Configure trusted publishing credentials
+        uses: rubygems/configure-rubygems-credentials@v1.0.0
+      - name: Build and push platform-specific gem
+        run: |
+          gem build *.gemspec
+          gem push *.gem
+        env:
+          RUBY_PLATFORM: 'x86_64-linux-gnu'

data/.github/workflows/push_ruby.yml

@@ -0,0 +1,37 @@
+name: Push Ruby Platform Gem
+
+on:
+  push:
+    tags:
+      - v*
+
+permissions:
+  contents: read
+
+jobs:
+  push:
+    if: github.repository_owner == 'karafka'
+    runs-on: ubuntu-latest
+    environment: deployment
+
+    permissions:
+      contents: write
+      id-token: write
+
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          fetch-depth: 0
+
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@a4effe49ee8ee5b8b5091268c473a4628afb5651 # v1.245.0
+        with:
+          bundler-cache: false
+
+      - name: Build rdkafka-ruby
+        run: |
+          set -e
+          bundle install
+          cd ext && bundle exec rake
+
+      - uses: rubygems/release-gem@a25424ba2ba8b387abc8ef40807c2c85b96cbe32 # v1.1.1

data/.github/workflows/verify-action-pins.yml

@@ -0,0 +1,16 @@
+name: Verify Action Pins
+on:
+  pull_request:
+    paths:
+      - '.github/workflows/**'
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Check SHA pins
+        run: |
+          if grep -E -r "uses: .*/.*@(v[0-9]+|main|master)($|[[:space:]]|$)" --include="*.yml" --include="*.yaml" .github/workflows/ | grep -v "#"; then
+            echo "::error::Actions should use SHA pins, not tags or branch names"
+            exit 1
+          fi

data/.gitignore

@@ -0,0 +1,15 @@
+# Ignore bundler config.
+/.bundle
+
+Gemfile.lock
+ext/ports
+ext/tmp
+ext/librdkafka.*
+ext/build-tmp
+*.gem
+.yardoc
+doc
+coverage
+vendor
+.idea/
+out/

data/.rspec

@@ -0,0 +1,2 @@
+--require spec_helper
+--format documentation