rbs 4.1.0 → 4.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0cb4ca04de969abdc9d7f58e67fb98a0ce0d39e6669dab1be23241ba08a1b883
-  data.tar.gz: c758f606ee5737b64c45fd4da9c99f6522f1a62a0b8a37b4023d37fcb69b6d59
+  metadata.gz: 3e76f94a794b829effcba20a9dc637da54915d4bb3a87fa1b4200c4091fa60a6
+  data.tar.gz: 5f6eb47e5f31023f56ccede03402493f223719fa5dc1033995fecc592e87e2f1
 SHA512:
-  metadata.gz: 26dbbd5af3941363c80a282d63dfda59d0aba521bea2c75e45c3dd58336a18920d859ef426b0c8bab67535be7e3651f8f2f83a78ed068477dd5ccf8adb09df4c
-  data.tar.gz: 0a5c85aa87e7ddb72519953952bb0bec098c8322cd379fb0e5e8dfb6ac0b1a8f4df70ee225cb3361b719d0b506b5d9eff0c43db08ce235d7ac233adb320d9d8a
+  metadata.gz: 168b150476b5515f06f4bc72a58854bc2c60cf073365761ceacf9dc48a5be22d41a0469c168e76ac9d85d03fbdb0e67ac2f7d3564ee6055191432514ff56b10c
+  data.tar.gz: 80e89dae7445279f1ee30c825280af61259363911fc78032812dfd1be5f4fc7677598732ca42b3366dff2bc1269fe8b7cd8e6bfa49ccd8a225fe318285bfdfb1

data/.gitattributes

@@ -0,0 +1 @@
+src/lexer.c linguist-generated

data/.github/dependabot.yml

@@ -21,4 +21,4 @@ updates:
     schedule:
       interval: 'weekly'
     labels:
-      - 'no-milestone'
+      - 'skip-changelog'

data/.github/workflows/bundle-update.yml

@@ -11,10 +11,10 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         with:
           ruby-version: '4.0'
 
@@ -58,6 +58,6 @@ jobs:
             --body "Automated weekly bundle update" \
             --head "$(git rev-parse --abbrev-ref HEAD)" \
             --base "${{ github.event.repository.default_branch }}" \
-            --label "no-milestone"
+            --label "skip-changelog"
 
           gh pr merge --auto --merge "$(git rev-parse --abbrev-ref HEAD)"

data/.github/workflows/c-check.yml

@@ -14,8 +14,8 @@ jobs:
   format-check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: ruby/setup-ruby@v1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         with:
           ruby-version: "4.0"
           bundler-cache: none

data/.github/workflows/changelog.yml

@@ -0,0 +1,121 @@
+name: Changelog
+
+# Prints the changelog template for a release, which is otherwise `rake gem:changelog`
+# on a laptop.
+#
+# The task asks GitHub which pull requests the commits came from, and it asks through
+# `gh`. A Claude Code on the web session cannot reach `api.github.com` at all -- the
+# refusal is keyed on the session, so neither installing `gh` nor rewriting the task
+# against REST gets around it -- and a runner has both `gh` and `github.token`. So the
+# same task runs here, and the release is prepared from a session that could not
+# otherwise produce this list.
+#
+# The ref selector picks the branch the changelog is for *and* the copy of the task
+# that computes it, which are the same thing: dispatch it on `aaa-X.Y.x` for a patch
+# release, on `master` otherwise.
+#
+# Nothing is written. The run reads the repository and prints.
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Where the changelog starts, if not the RBS::VERSION of the ref (e.g. 4.1.0)"
+        required: false
+        type: string
+      format:
+        description: "The changelog template, or the JSON its sections are sorted from"
+        required: false
+        default: list
+        type: choice
+        options:
+          - list
+          - json
+
+permissions:
+  contents: read
+
+jobs:
+  changelog:
+    name: changelog
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read # the history and the tags
+      pull-requests: read # what the commits came from
+    env:
+      # The inputs are read through the environment rather than interpolated into
+      # the script below.
+      VERSION: ${{ inputs.version }}
+      FORMAT: ${{ inputs.format }}
+      GH_TOKEN: ${{ github.token }}
+    steps:
+      # `changelog_base` resolves the previous release with `git describe`, the task
+      # walks the history back to it, and on a release branch it reads the `-x`
+      # trailers of the commits it finds -- so the full history and the tags are all
+      # needed. `fetch-depth: 0` fetches both.
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+
+      # Before the gems are installed, since a version that cannot be a version is
+      # cheapest to reject here.
+      - name: Check the input
+        run: |
+          version_pattern='^[0-9]+\.[0-9]+\.[0-9]+(\.(pre|dev)\.[0-9]+)?$'
+          if [ -n "$VERSION" ] && ! [[ "$VERSION" =~ $version_pattern ]]; then
+            echo "::error::\`$VERSION\` is not a version number."
+            exit 1
+          fi
+
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
+        with:
+          ruby-version: ruby
+          bundler: none
+      - name: Install gems
+        run: |
+          bundle config set --local without libs:profilers
+          bundle install --jobs 4 --retry 3
+
+      # Only the changelog goes to STDOUT; the task reports what it is doing, and
+      # which pull requests it skipped, on STDERR. `tee` keeps both in the log, in
+      # order, and puts the changelog on its own where the next step can read it.
+      - name: Print the changelog
+        run: |
+          if [ "$FORMAT" = "json" ]; then
+            task="gem:changelog:json"
+          else
+            task="gem:changelog"
+          fi
+          if [ -n "$VERSION" ]; then
+            task="$task[$VERSION]"
+          fi
+
+          echo "Running \`rake $task\` on $(git rev-parse --abbrev-ref HEAD)"
+          bundle exec rake "$task" | tee changelog.out
+
+      # Uploaded before it is rendered, so that the changelog survives whatever the
+      # summary makes of it. This is also what to reach for when the JSON is long
+      # enough to be truncated in the log.
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: changelog
+          path: changelog.out
+
+      # The log carries this too, but the summary renders it. A step summary is
+      # capped at 1MiB and the step fails if that is exceeded, which a long JSON
+      # could manage -- so past a comfortable fraction of it, link the artifact
+      # rather than lose the run over formatting.
+      - name: Render the changelog
+        run: |
+          if [ "$(wc -c < changelog.out)" -gt 900000 ]; then
+            echo "The changelog is too long to render here. Download the \`changelog\` artifact." \
+              >> "$GITHUB_STEP_SUMMARY"
+            exit 0
+          fi
+
+          {
+            echo '```markdown'
+            cat changelog.out
+            echo '```'
+          } >> "$GITHUB_STEP_SUMMARY"

data/.github/workflows/comments.yml

@@ -13,8 +13,8 @@ jobs:
     # env:
     #   RUBY_COMMIT: v4.0.0-preview2
     steps:
-      - uses: actions/checkout@v7
-      - uses: ruby/setup-ruby@v1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         with:
           ruby-version: "4.0.6"
           bundler: none

data/.github/workflows/dependabot.yml

@@ -17,7 +17,7 @@ jobs:
         uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0
         id: metadata
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
       - name: Abort if blocker files are changed

data/.github/workflows/jruby.yml

@@ -33,13 +33,13 @@ jobs:
     name: jruby
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - run: git fetch --depth=1 origin +refs/tags/*:refs/tags/*
 
       # Build the .wasm and fetch the Chicory jars with CRuby + the WASI SDK,
       # then run RBS itself on JRuby against those artifacts.
       - name: Set up Ruby (to assemble the WebAssembly runtime)
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         with:
           ruby-version: ruby
           bundler: none
@@ -59,17 +59,12 @@ jobs:
         run: bundle exec rake wasm:jruby_setup
 
       - name: Set up JRuby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         with:
           ruby-version: jruby
           bundler: none
       - name: Install runtime and test gems
-        # rdoc 8.0.0 added a runtime dependency on rbs, which pulls the released
-        # C-extension rbs gem and fails to build on JRuby. Pin rdoc below 8 until
-        # a -java rbs gem is published.
-        run: |
-          gem install prism rake rake-compiler test-unit rspec minitest json-schema pry --no-document
-          gem install rdoc -v "< 8" --no-document
+        run: gem install prism rake rake-compiler test-unit rdoc rspec minitest json-schema pry --no-document
       # jar-dependencies resolves through the JVM, so download the Chicory/ASM
       # jars into ~/.m2 here on JRuby (jar-dependencies is not available in the
       # CRuby step above).

data/.github/workflows/release-gems.yml

@@ -0,0 +1,234 @@
+name: Release gems
+
+# Builds, publishes, and announces a release. Dispatch it with the commit being
+# released and the version that commit declares.
+#
+# Everything is built from `commit`, not from wherever the default branch happens to
+# be when the run starts, so the release describes a state that is already immutable.
+# `version` is the same fact stated a second time -- the run stops before anything is
+# built unless it matches the `RBS::VERSION` of that commit, so dispatching the wrong
+# commit, or the right one under the wrong name, is a failed run rather than a gem
+# that has to be yanked.
+#
+# `dry_run` builds and checks both gems and stops before the tag, which is how the
+# build is exercised without releasing anything.
+#
+# | Gem                  | Platform      | Parser                           |
+# | -------------------- | ------------- | -------------------------------- |
+# | `rbs-X.Y.Z.gem`      | `ruby` (MRI)  | C extension, compiled on install |
+# | `rbs-X.Y.Z-java.gem` | `java` (JRuby)| `rbs_parser.wasm`, prebuilt here |
+#
+# See docs/release.md. The `java` gem is built on CRuby: the platform comes from
+# `RBS_PLATFORM`, not from the engine running `gem build`. JRuby is only needed to
+# run the result, which the workflow does before it would publish anything.
+#
+# One job on purpose. Tagging, pushing the gems, and opening the GitHub release
+# all belong to a single release, and keeping them in one place keeps their order
+# readable -- the tag is created once both gems are known to build and run, and
+# before anything is published, so the reversible step comes before the irreversible
+# one.
+#
+# The file name is what the RubyGems trusted publisher for `rbs` is registered
+# against, so it cannot be renamed without registering the new name first.
+
+on:
+  workflow_dispatch:
+    inputs:
+      commit:
+        description: "Commit to release, as a full 40-character SHA"
+        required: true
+      version:
+        description: "Version to release, without the leading `v` (e.g. `4.1.2`)"
+        required: true
+      dry_run:
+        description: "Build and check the gems without tagging or publishing anything"
+        type: boolean
+        default: false
+
+permissions:
+  contents: read
+
+env:
+  # Keep in sync with .github/workflows/wasm.yml and .github/workflows/jruby.yml.
+  WASI_SDK_VERSION: "33"
+  WASI_SDK_RELEASE: "33.0"
+
+jobs:
+  release:
+    name: release
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write # push the tag, publish the GitHub release
+      id-token: write # trusted publishing to RubyGems
+    env:
+      # The inputs are read through the environment rather than interpolated into
+      # the scripts below.
+      COMMIT: ${{ inputs.commit }}
+      VERSION: ${{ inputs.version }}
+      TAG: v${{ inputs.version }}
+    steps:
+      # The gemspec takes its file list from `git ls-files`, so both gems are built
+      # from the committed state -- of the dispatched commit, since that is what is
+      # checked out. The full history is needed to tell which branches contain it.
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.commit }}
+          fetch-depth: 0
+
+      # Before anything is installed or built: these are the two things the release
+      # is named after and built from, and a mistake in either is cheapest to catch
+      # here.
+      - name: Check the inputs
+        run: |
+          if [[ ! "$COMMIT" =~ ^[0-9a-f]{40}$ ]]; then
+            echo "::error::\`$COMMIT\` is not a full 40-character SHA. A release names one exact commit."
+            exit 1
+          fi
+          if [[ ! "$VERSION" =~ ^[0-9][0-9a-zA-Z.]*$ ]]; then
+            echo "::error::\`$VERSION\` is not a version number. Pass it without the leading \`v\`."
+            exit 1
+          fi
+
+          # A release proper is cut from the default branch, while a patch release can
+          # be cut from a release branch, so which branch the commit is on is not this
+          # workflow's business. That it is on one is: a commit no branch contains is
+          # one that nothing in the repository leads to any more.
+          git fetch --no-tags origin "+refs/heads/*:refs/remotes/origin/*"
+          branches=$(git branch --remotes --contains "$COMMIT" --format "%(refname:lstrip=3)")
+          if [ -z "$branches" ]; then
+            echo "::error::$COMMIT is not on any branch."
+            exit 1
+          fi
+          echo "Branches containing $COMMIT:"
+          printf '%s\n' "$branches"
+
+      # A tag that already exists is a version that has already been released, and
+      # pushing it would fail after the build rather than before it.
+      - name: Check that the tag does not exist
+        if: ${{ !inputs.dry_run }}
+        run: |
+          if git ls-remote --exit-code --tags origin "refs/tags/$TAG" > /dev/null; then
+            echo "::error::$TAG already exists, so $VERSION has been released."
+            exit 1
+          fi
+
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
+        with:
+          ruby-version: ruby
+          bundler: none
+      - name: Update rubygems & bundler
+        run: gem update --system
+      - name: Install gems
+        run: |
+          bundle config set --local without libs:profilers
+          bundle install --jobs 4 --retry 3
+
+      # Fails before a minute is spent on the build, and before anything is pushed:
+      # the version has to be the one the released commit declares, and -- unless
+      # this is a `.dev.N` release -- the one CHANGELOG.md is written up for.
+      - name: Check the version and the changelog
+        run: bundle exec rake "gem:check_release[$VERSION]"
+
+      - name: Build the ruby gem
+        run: |
+          mkdir -p pkg
+          gem build rbs.gemspec -o "pkg/rbs-$VERSION.gem"
+
+      # `rake wasm:jruby_setup` compiles src/**/*.c to WebAssembly and copies the
+      # result to lib/rbs/wasm/, where the gemspec picks it up. clang runs as a
+      # subprocess, so this works on CRuby.
+      - name: Install the WASI SDK
+        run: |
+          url="https://github.com/WebAssembly/wasi-sdk/releases/download/wasi-sdk-${WASI_SDK_VERSION}/wasi-sdk-${WASI_SDK_RELEASE}-x86_64-linux.tar.gz"
+          mkdir -p "$HOME/wasi-sdk"
+          curl -sSL "$url" | tar xz --strip-components=1 -C "$HOME/wasi-sdk"
+          echo "WASI_SDK_PATH=$HOME/wasi-sdk" >> "$GITHUB_ENV"
+      - name: Build rbs_parser.wasm
+        run: bundle exec rake wasm:jruby_setup
+
+      - name: Build the java gem
+        env:
+          RBS_PLATFORM: java
+        run: gem build rbs.gemspec -o "pkg/rbs-$VERSION-java.gem"
+
+      # `git ls-files` vouches for everything else, but rbs_parser.wasm is a build
+      # artifact, so the java gem is the one that can come out quietly wrong.
+      - name: Check the built gems
+        run: |
+          ruby -rrubygems/package -e '
+            ruby_gem, java_gem = ARGV.map { Gem::Package.new(_1).spec }
+
+            raise "unexpected platform: #{ruby_gem.platform}" unless ruby_gem.platform.to_s == "ruby"
+            raise "the C extension is not declared" if ruby_gem.extensions.empty?
+
+            raise "unexpected platform: #{java_gem.platform}" unless java_gem.platform.to_s == "java"
+            raise "rbs_parser.wasm is missing" unless java_gem.files.include?("lib/rbs/wasm/rbs_parser.wasm")
+            raise "the java gem must not declare an extension" unless java_gem.extensions.empty?
+
+            [ruby_gem, java_gem].each { puts "#{_1.full_name}: #{_1.files.size} files" }
+          ' "pkg/rbs-$VERSION.gem" "pkg/rbs-$VERSION-java.gem"
+
+      # The checks above cannot tell whether rbs_parser.wasm actually runs. Install
+      # the gem the way a user would -- jar-dependencies fetches Chicory and ASM
+      # from Maven during the install -- and parse something with it, so the
+      # WebAssembly runtime is exercised end to end before anything is published.
+      - name: Set up JRuby
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
+        with:
+          ruby-version: jruby
+          bundler: none
+      - name: Check the java gem on JRuby
+        run: |
+          gem install "pkg/rbs-$VERSION-java.gem"
+          ruby -e '
+            require "rbs"
+            _, _, decls = RBS::Parser.parse_signature("class Foo end")
+            names = decls.map { _1.name.to_s }
+            raise "parsed #{names.inspect}, expected [\"Foo\"]" unless names == ["Foo"]
+            puts "#{RUBY_ENGINE} #{RUBY_VERSION}: rbs #{RBS::VERSION} parses through the WebAssembly runtime"
+          '
+
+      - name: Switch back to CRuby
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
+        with:
+          ruby-version: ruby
+          bundler: none
+
+      # Uploaded before publishing, so a failed push still leaves the gems behind.
+      # This is also where a dry run ends.
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: gems
+          path: pkg/*.gem
+          if-no-files-found: error
+
+      # Everything below runs only for a real release.
+
+      # The tag comes after the gems are known to build and run, and before anything
+      # is published: a tag can be deleted, while a version pushed to RubyGems can
+      # only be yanked. What it names was decided by the checkout rather than by the
+      # tagging, so nothing rests on it being created first.
+      - name: Tag the release
+        if: ${{ !inputs.dry_run }}
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          bundle exec rake gem:tag
+
+      - name: Configure RubyGems credentials
+        if: ${{ !inputs.dry_run }}
+        uses: rubygems/configure-rubygems-credentials@dc5a8d8553e6ee01fc26761a49e99e733d17954a # v2.1.0
+
+      - name: Push the gems
+        if: ${{ !inputs.dry_run }}
+        run: |
+          gem push "pkg/rbs-$VERSION.gem"
+          gem push "pkg/rbs-$VERSION-java.gem"
+
+      # Last, so that a failed push never announces a release that has no gems.
+      - name: Publish the GitHub release
+        if: ${{ !inputs.dry_run }}
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: bundle exec rake gem:gh_release

data/.github/workflows/ruby.yml

@@ -40,8 +40,8 @@ jobs:
     env:
       RANDOMIZE_STDLIB_TEST_ORDER: "true"
     steps:
-      - uses: actions/checkout@v7
-      - uses: ruby/setup-ruby@v1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         with:
           ruby-version: ${{ matrix.ruby }}
           bundler: none
@@ -90,11 +90,11 @@ jobs:
       matrix:
         ruby: ['4.0', head]
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install dependencies
         run: |
           brew install ruby-build
-      - uses: ruby/setup-ruby@v1
+      - uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         with:
           ruby-version: ${{ matrix.ruby }}
           bundler: none
@@ -127,11 +127,11 @@ jobs:
       matrix:
         ruby: ['4.0', head]
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install dependencies
         run: |
           brew install ruby-build
-      - uses: ruby/setup-ruby@v1
+      - uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         with:
           ruby-version: ${{ matrix.ruby }}
           bundler: none

data/.github/workflows/rust.yml

@@ -26,10 +26,10 @@ jobs:
       matrix:
         os: [ubuntu-latest, macos-latest, windows-latest]
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - run: git fetch --depth=1 origin +refs/tags/*:refs/tags/*
       - name: Set up Ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         with:
           ruby-version: ruby
           bundler: none
@@ -45,7 +45,7 @@ jobs:
         run: |
           rustup update --no-self-update stable
           rustup default stable
-      - uses: actions/cache@v6
+      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             ~/.cargo/registry
@@ -64,14 +64,14 @@ jobs:
     runs-on: ubuntu-latest
     continue-on-error: true
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - run: git fetch --depth=1 origin +refs/tags/*:refs/tags/*
       - name: Set up git identity
         run: |
           git config user.name "GitHub Actions"
           git config user.email "actions@github.com"
       - name: Set up Ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         with:
           ruby-version: ruby
           bundler: none
@@ -87,7 +87,7 @@ jobs:
         run: |
           rustup update --no-self-update stable
           rustup default stable
-      - uses: actions/cache@v6
+      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             ~/.cargo/registry
@@ -106,14 +106,14 @@ jobs:
     runs-on: ubuntu-latest
     continue-on-error: true
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - run: git fetch --depth=1 origin +refs/tags/*:refs/tags/*
       - name: Set up git identity
         run: |
           git config user.name "GitHub Actions"
           git config user.email "actions@github.com"
       - name: Set up Ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         with:
           ruby-version: ruby
           bundler: none
@@ -129,7 +129,7 @@ jobs:
         run: |
           rustup update --no-self-update stable
           rustup default stable
-      - uses: actions/cache@v6
+      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             ~/.cargo/registry
@@ -147,10 +147,10 @@ jobs:
     name: cargo:lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - run: git fetch --depth=1 origin +refs/tags/*:refs/tags/*
       - name: Set up Ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         with:
           ruby-version: ruby
           bundler: none
@@ -167,7 +167,7 @@ jobs:
           rustup update --no-self-update stable
           rustup default stable
           rustup component add --toolchain stable clippy rustfmt
-      - uses: actions/cache@v6
+      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             ~/.cargo/registry

data/.github/workflows/truffleruby.yml

@@ -24,8 +24,8 @@ jobs:
       # TruffleRuby warns and falls back to US-ASCII unless the locale is UTF-8.
       LANG: "en_US.UTF-8"
     steps:
-      - uses: actions/checkout@v7
-      - uses: ruby/setup-ruby@v1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         with:
           ruby-version: ${{ matrix.ruby }}
           bundler: none

data/.github/workflows/typecheck.yml

@@ -16,8 +16,8 @@ jobs:
     strategy:
       fail-fast: false
     steps:
-      - uses: actions/checkout@v7
-      - uses: ruby/setup-ruby@v1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         with:
           ruby-version: "4.0"
           bundler: none

data/.github/workflows/wasm.yml

@@ -28,10 +28,10 @@ jobs:
     name: wasm:check
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - run: git fetch --depth=1 origin +refs/tags/*:refs/tags/*
       - name: Set up Ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         with:
           ruby-version: ruby
           bundler: none
@@ -48,7 +48,7 @@ jobs:
           curl -sSL "$url" | tar xz --strip-components=1 -C "$HOME/wasi-sdk"
           echo "WASI_SDK_PATH=$HOME/wasi-sdk" >> "$GITHUB_ENV"
       - name: Install wasmtime
-        uses: bytecodealliance/actions/wasmtime/setup@v1
+        uses: bytecodealliance/actions/wasmtime/setup@9152e710e9f7182e4c29ad218e4f335a7b203613 # v1.1.3
         with:
           version: ${{ env.WASMTIME_VERSION }}
       - name: Build and smoke-test the WebAssembly module

data/.github/workflows/windows.yml

@@ -18,9 +18,9 @@ jobs:
       matrix:
         ruby: ['4.0', ucrt, mswin]
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: load ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         with:
           ruby-version: ${{ matrix.ruby }}
 

data/.rubocop.yml

@@ -3,7 +3,6 @@ plugins:
   - rubocop-on-rbs
 
 AllCops:
-  TargetRubyVersion: 3.4
   DisabledByDefault: true
   Exclude:
     - 'vendor/bundle/**/*'