logtail 0.1.18 → 0.1.20

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 93f4739daeaac5fe30db5251e9463e4139adcb9fe1bb5cc06988bd2617827d1c
-  data.tar.gz: 7de7ff6b0b83de585e95c70c2fea5ce2e2c7067592d6f18f8d139db665525c75
+  metadata.gz: 0d8397873f23b58750258e46a3162866eaa3ab6ffaf551078d28b25b44b5ad69
+  data.tar.gz: 83a5def59147d9b94a890db6e7f07dd2107bdfa68ba7eb929ca47fa5a44a212b
 SHA512:
-  metadata.gz: 80fe56d644e5f07108859de6399c29f16fd26b7294b5ea63bc8b710b4ad9de757048e61c89e3e27837643c61d63525c79c60d9384c338c410daf8dacc840cac4
-  data.tar.gz: 64b96d54f5531470e8b87cb0e2ba4515266b25a5c03c20828cc3d1fb8e21ac81dc686057ac4b927b5bb55f571ef7c1f1b0e22265eaf342e5302d746d00ff0222
+  metadata.gz: d710225c254e58dbdfa66e6e87515167fcc651ce4cd14d7ddeb6cb682d9b547f8eba13c9729a939249ca565229fcd68e4f9867db17900e798051abe5b0699473
+  data.tar.gz: 5d785a4b048a73403e2d389780d5e83702b0ada279fb2dd727e2b192176f15133620668e6f2a6eccdb5b142a29d9283fd03a3058f2d3f31aace47f42794ca820

data/.github/workflows/release.yml

@@ -1,10 +1,11 @@
-# Publishes the gem to RubyGems.org from GitHub Actions, the way logtail-js and logtail-python
-# release their packages. The publish job runs in the "rubygems" environment, which only deploys
-# from main; anyone who can dispatch the workflow can release.
+# Publishes the gem to RubyGems.org from GitHub Actions with trusted publishing (OIDC), the way
+# logtail-js releases the @logtail/* packages to npm. No RubyGems.org API key exists anywhere:
+# the gem on rubygems.org trusts exactly this workflow file, run from this repository in the
+# "rubygems" environment, and the shared account's multi-factor authentication stays as it is.
 #
-# Authentication: the repository secret RUBYGEMS_CREDENTIALS holds the contents of a gem
-# credentials file for the shared rubygems.org account, i.e. ":rubygems_api_key: rubygems_…",
-# the line the manual process kept in ~/.local/share/gem/credentials.
+# One-time setup on rubygems.org, signed in as the gem's owner: the gem's page → Trusted publishers
+# → GitHub Actions, with the repository owner "logtail", this repository's name, the workflow
+# "release.yml" and the environment "rubygems".
 #
 # Repository settings this relies on: the "rubygems" environment with deployment branches limited
 # to main and no required reviewers (add reviewers there if releases should need an approval; a
@@ -17,15 +18,17 @@
 # both, pushes the gem to RubyGems.org and creates a GitHub release with auto-generated notes for
 # the tag; edit the notes afterwards if needed.
 #
-# Retry: if a release failed after the version commit was pushed, run "retry" right away from
-# main. It bumps nothing, rebuilds the tagged commit, pushes the gem if RubyGems.org is still
-# missing it and creates the GitHub release if it is still missing. Running patch or minor again
-# would release the next version instead.
+# Retry: if a release failed after the version commit was pushed, run "retry" from main. It bumps
+# nothing, checks out the tag of the version in lib/*/version.rb and rebuilds that commit, pushes
+# the gem if RubyGems.org is still missing it and creates the GitHub release if it is still
+# missing. Running patch or minor again would release the next version instead.
 #
-# Dry run: bumps in place without committing, builds the gem and checks the credentials secret,
-# publishes nothing. Every push that touches this file is a dry run, so a change to the workflow
-# proves itself on its pull request before it reaches main. A dry run can also be dispatched from
-# any branch.
+# Dry run: bumps in place without committing, builds the gem and, on main, exchanges the
+# workflow's OIDC token with RubyGems.org, which proves that the trusted publisher matches this
+# workflow. Nothing is pushed. Every push that touches this file is a dry run, so a change to the
+# workflow proves itself on its pull request before it reaches main, and the push that merges it
+# performs the token exchange as well, because the "rubygems" environment only admits main. A dry
+# run can also be dispatched from any branch.
 name: Release
 
 on:
@@ -37,7 +40,7 @@ on:
         options: [patch, minor, retry]
         required: true
       dry_run:
-        description: "Dry run: bump and build, check the credentials, publish nothing"
+        description: "Dry run: bump and build, verify RubyGems.org accepts this workflow, publish nothing"
         type: boolean
         default: false
   push:
@@ -108,7 +111,9 @@ jobs:
           tagged = `git tag --points-at HEAD`.split.include?("v#{current}")
 
           if release == "retry"
-            abort("retry only finishes a release whose version commit v#{current} is HEAD") unless tagged
+            # main may have moved on since the version commit, so build what the tag points at
+            abort("retry only finishes a release whose version v#{current} is tagged") unless system("git", "rev-parse", "-q", "--verify", "refs/tags/v#{current}", out: File::NULL)
+            system("git", "checkout", "-q", "v#{current}") || abort("could not check out v#{current}")
             version = current
           else
             abort("HEAD is already released as v#{current}, there is nothing new to release") if tagged && !dry_run
@@ -126,6 +131,7 @@ jobs:
         env:
           VERSION: ${{ steps.version.outputs.version }}
         run: |
+          git diff --stat
           gem build *.gemspec
           gem=$(ls *.gem)
           case "$gem" in
@@ -134,18 +140,6 @@ jobs:
           esac
           echo "gem=$gem" >> "$GITHUB_OUTPUT"
 
-      - name: Dry run
-        if: ${{ env.DRY_RUN == 'true' }}
-        env:
-          RUBYGEMS_CREDENTIALS: ${{ secrets.RUBYGEMS_CREDENTIALS }}
-        run: |
-          git diff --stat
-          if ! grep -q '^:rubygems_api_key: [^ ]' <<< "$RUBYGEMS_CREDENTIALS"; then
-            echo "::error::The RUBYGEMS_CREDENTIALS secret must hold the contents of a gem credentials file: ':rubygems_api_key: rubygems_…'"
-            exit 1
-          fi
-          echo "RUBYGEMS_CREDENTIALS looks like a gem credentials file. A release pushes with it, nothing more to verify without pushing."
-
       - name: Commit and tag
         if: ${{ env.DRY_RUN != 'true' && env.RELEASE != 'retry' }}
         env:
@@ -166,11 +160,13 @@ jobs:
   release:
     name: Publish
     needs: build
-    if: ${{ github.event_name == 'workflow_dispatch' && !inputs.dry_run }}
+    # The rubygems environment only admits main, so dry runs from other branches stop after the build
+    if: ${{ github.ref == 'refs/heads/main' }}
     runs-on: ubuntu-24.04
     environment: rubygems
     permissions:
       contents: write # creates the GitHub release
+      id-token: write # OIDC token exchange with RubyGems.org
     env:
       VERSION: ${{ needs.build.outputs.version }}
       GEM: ${{ needs.build.outputs.gem }}
@@ -185,20 +181,28 @@ jobs:
         with:
           ruby-version: "3"
 
+      # Exchanges the job's OIDC token for a short-lived RubyGems.org API key and hands it to
+      # `gem push`. Fails when no trusted publisher on rubygems.org matches this workflow.
+      - uses: rubygems/configure-rubygems-credentials@v2.1.0
+
+      - name: Dry run
+        if: ${{ env.DRY_RUN == 'true' }}
+        run: |
+          ls -l "$GEM"
+          echo "RubyGems.org accepted the OIDC token: the trusted publisher matches this workflow. Nothing is pushed."
+
       - name: Push to RubyGems.org
-        env:
-          RUBYGEMS_CREDENTIALS: ${{ secrets.RUBYGEMS_CREDENTIALS }}
+        if: ${{ env.DRY_RUN != 'true' }}
         run: |
           name="${GEM%-$VERSION.gem}"
           if gem specification --remote "$name" --version "$VERSION" > /dev/null 2>&1; then
             echo "$name $VERSION is on rubygems.org already, finishing the release."
           else
-            mkdir -p ~/.gem
-            (umask 077 && printf '%s\n' "$RUBYGEMS_CREDENTIALS" > ~/.gem/credentials)
             gem push "$GEM"
           fi
 
       - name: Create GitHub release
+        if: ${{ env.DRY_RUN != 'true' }}
         env:
           GH_TOKEN: ${{ github.token }}
           GH_REPO: ${{ github.repository }}

data/lib/logtail/config.rb

@@ -32,6 +32,10 @@ module Logtail
 
     attr_writer :http_body_limit
 
+    def initialize
+      @debug_logger = nil
+    end
+
     # Whether a particular {Logtail::LogEntry} should be sent to Better Stack
     def send_to_better_stack?(log_entry)
       !@better_stack_filters&.any? { |blocker| blocker.call(log_entry) }

data/lib/logtail/log_devices/http.rb

@@ -22,6 +22,8 @@ module Logtail
       DEFAULT_INGESTING_SCHEME = "https".freeze
       CONTENT_TYPE = "application/msgpack".freeze
       USER_AGENT = "Logtail Ruby/#{Logtail::VERSION} (HTTP)".freeze
+      INITIAL_RECONNECT_WAIT = 1 # second
+      MAX_RECONNECT_WAIT = 30 # seconds
 
       # Instantiates a new HTTP log device that can be passed to {Logtail::Logger#initialize}.
       #
@@ -83,6 +85,7 @@ module Logtail
         @request_queue = options[:request_queue] || FlushableDroppingSizedQueue.new(25)
         @successive_error_count = 0
         @requests_in_flight = 0
+        @reconnect_wait = INITIAL_RECONNECT_WAIT
       end
 
       # Write a new log line message to the buffer, and flush asynchronously if the
@@ -119,13 +122,13 @@ module Logtail
       # Closes the log device, cleans up, and attempts one last delivery.
       def close
         # Kill the flush thread immediately since we are about to flush again.
-        @flush_thread.kill if @flush_thread
+        @flush_thread.kill.join if @flush_thread
 
         # Flush all remaining messages
         flush
 
         # Kill the request queue thread. Flushing ensures that no requests are pending.
-        @request_outlet_thread.kill if @request_outlet_thread
+        @request_outlet_thread.kill.join if @request_outlet_thread
       end
 
       def deliver_one(msg)
@@ -298,15 +301,19 @@ Logtail::Config.instance.debug_logger = ::Logger.new(STDOUT)
           http
         end
 
-        # Creates a loop that processes the `@request_queue` on an interval.
+        # Creates a loop that processes the `@request_queue` on an interval. After a failed
+        # connection it waits before reconnecting, twice as long after every consecutive
+        # failure up to {MAX_RECONNECT_WAIT}, so an unreachable host is not retried in a busy
+        # loop. A delivered request starts the wait over (see {#deliver_requests}).
         def request_outlet
           loop do
             http = build_http
+            connection_healthy = false
 
             begin
               Logtail::Config.instance.debug { "Starting HTTP connection" }
 
-              http.start do |conn|
+              connection_healthy = http.start do |conn|
                 deliver_requests(conn)
               end
             rescue => e
@@ -315,6 +322,12 @@ Logtail::Config.instance.debug_logger = ::Logger.new(STDOUT)
               Logtail::Config.instance.debug { "Finishing HTTP connection" }
               http.finish if http.started?
             end
+
+            next if connection_healthy
+
+            Logtail::Config.instance.debug { "Reconnecting in #{@reconnect_wait} seconds" }
+            sleep(@reconnect_wait)
+            @reconnect_wait = [@reconnect_wait * 2, MAX_RECONNECT_WAIT].min
           end
         end
 
@@ -360,6 +373,7 @@ Logtail::Config.instance.debug_logger = ::Logger.new(STDOUT)
               num_reqs += 1
 
               @last_resp = resp
+              @reconnect_wait = INITIAL_RECONNECT_WAIT
 
               Logtail::Config.instance.debug do
                 if resp.code == "202"

data/lib/logtail/version.rb

@@ -1,3 +1,3 @@
 module Logtail
-  VERSION = "0.1.18"
+  VERSION = "0.1.20"
 end

data/spec/logtail/config_spec.rb

@@ -0,0 +1,16 @@
+require "spec_helper"
+
+describe Logtail::Config do
+  describe "#debug_logger" do
+    # Ruby before 3.0 warns under `ruby -w` when an unset instance variable is read, and the
+    # HTTP device reads the debug logger on every connection attempt.
+    it "can be read before it is set without an uninitialized instance variable warning" do
+      config = described_class.send(:new)
+      verbose, $VERBOSE = $VERBOSE, true
+
+      expect { config.debug_logger }.not_to output.to_stderr
+    ensure
+      $VERBOSE = verbose
+    end
+  end
+end

data/spec/logtail/log_devices/http_spec.rb

@@ -57,10 +57,8 @@ describe Logtail::LogDevices::HTTP do
       http.send(:ensure_flush_threads_are_started)
       http.close
       thread = http.instance_variable_get(:@flush_thread)
-      sleep 0.1 # too fast!
       expect(thread).to_not be_alive
       thread = http.instance_variable_get(:@request_outlet_thread)
-      sleep 0.1 # too fast!
       expect(thread).to_not be_alive
     end
 
@@ -150,6 +148,87 @@ describe Logtail::LogDevices::HTTP do
 
       http.close
     end
+
+    context "when connecting or delivering fails" do
+      # Raised from the stubs below to leave the outlet's endless loop. It is not a
+      # StandardError, so the outlet's own `rescue => e` lets it through.
+      let(:stop_outlet) { Class.new(Exception) }
+      let(:http_device) { described_class.new("MYKEY", flush_continuously: false, requests_per_conn: 1) }
+      let(:request_queue) { http_device.instance_variable_get(:@request_queue) }
+      let(:waits) { [] }
+
+      before do
+        allow(http_device).to receive(:sleep) { |seconds| waits << seconds }
+      end
+
+      it "waits before reconnecting, twice as long after every refused connection, up to 30 seconds" do
+        connection_attempts = 0
+        allow_any_instance_of(Net::HTTP).to receive(:start) do
+          connection_attempts += 1
+          raise stop_outlet if connection_attempts > 7
+          raise Errno::ECONNREFUSED
+        end
+
+        expect { http_device.send(:request_outlet) }.to raise_error(stop_outlet)
+        expect(waits).to eq([1, 2, 4, 8, 16, 30, 30])
+      end
+
+      it "waits the same way when a request fails on an open connection, and still drops it after 3 attempts" do
+        request_queue.enq(Logtail::LogDevices::HTTP::RequestAttempt.new(Net::HTTP::Post.new("/")))
+        request_attempts = 0
+        allow_any_instance_of(Net::HTTP).to receive(:request) do
+          request_attempts += 1
+          raise Errno::ECONNRESET
+        end
+        allow(http_device).to receive(:sleep) do |seconds|
+          waits << seconds
+          raise stop_outlet if waits.size == 3
+        end
+
+        expect { http_device.send(:request_outlet) }.to raise_error(stop_outlet)
+        expect(waits).to eq([1, 2, 4])
+        expect(request_attempts).to eq(3)
+        expect(request_queue.size).to eq(0)
+      end
+
+      it "starts over at 1 second once a request is delivered" do
+        request_queue.enq(Logtail::LogDevices::HTTP::RequestAttempt.new(Net::HTTP::Post.new("/")))
+        connection = double("connection", request: double("response", code: "202"))
+        connections = [:refused, :refused, :delivers, :refused, :refused]
+        allow_any_instance_of(Net::HTTP).to receive(:start) do |_http, &block|
+          case connections.shift
+          when :refused then raise Errno::ECONNREFUSED
+          when :delivers then block.call(connection)
+          else raise stop_outlet
+          end
+        end
+
+        expect { http_device.send(:request_outlet) }.to raise_error(stop_outlet)
+        expect(waits).to eq([1, 2, 1, 2])
+      end
+    end
+
+    it "lets close stop the outlet while it waits to reconnect" do
+      connection_attempts = 0
+      allow_any_instance_of(Net::HTTP).to receive(:start) do
+        connection_attempts += 1
+        raise Errno::ECONNREFUSED
+      end
+      http_device = described_class.new("MYKEY")
+      http_device.send(:ensure_flush_threads_are_started)
+      outlet = http_device.instance_variable_get(:@request_outlet_thread)
+      # Up to 5 seconds for the thread's first attempt, which is slow on a cold TruffleRuby.
+      500.times do
+        break if connection_attempts > 0 && outlet.status == "sleep"
+        sleep 0.01
+      end
+
+      closing = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+      http_device.close
+      expect(Process.clock_gettime(Process::CLOCK_MONOTONIC) - closing).to be < 0.5
+      expect(outlet).not_to be_alive
+      expect(connection_attempts).to eq(1)
+    end
   end
 
   describe "#deliver_requests" do

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: logtail
 version: !ruby/object:Gem::Version
-  version: 0.1.18
+  version: 0.1.20
 platform: ruby
 authors:
 - Better Stack
@@ -188,6 +188,7 @@ files:
 - lib/logtail/version.rb
 - logtail.gemspec
 - spec/README.md
+- spec/logtail/config_spec.rb
 - spec/logtail/current_context_spec.rb
 - spec/logtail/events/controller_call_spec.rb
 - spec/logtail/events/error_spec.rb