redis-objects-periodical 0.7.0 → 0.8.0

data/.github/scripts/dependabot-policy.cjs

@@ -0,0 +1,132 @@
+'use strict';
+
+const developmentGems = new Set([
+  'pry-byebug', 'rake', 'rspec', 'rspec_junit_formatter', 'rubocop',
+  'rubocop-performance', 'rubocop-rspec', 'simplecov', 'timecop', 'yard',
+]);
+const officialActions = new Set([
+  'actions/checkout', 'actions/upload-artifact', 'actions/download-artifact',
+  'actions/github-script',
+]);
+const requiredChecks = [
+  'checks / build_on_ruby_3.3', 'checks / build_on_ruby_3.4', 'checks / build_on_ruby_4.0',
+  'checks / rubocop', 'yardoc', 'upload-coverage', 'active-support-timezone', 'dependabot-policy',
+];
+
+function changedLines(file) {
+  if (file.status !== 'modified' || !file.patch) return null;
+  const lines = file.patch.split('\n');
+  const removed = lines.filter(line => line.startsWith('-')).map(line => line.slice(1));
+  const added = lines.filter(line => line.startsWith('+')).map(line => line.slice(1));
+  // Missing or truncated patches must never turn an incomplete inspection into approval.
+  if (removed.length !== file.deletions || added.length !== file.additions) return null;
+  return { removed, added };
+}
+
+function protectedLockEntries(lock) {
+  // Runtime dependencies from the gemspec and their locked dependency closure.
+  const entries = [...lock.matchAll(/^    (?:redis-objects-periodical|redis-objects|redis|redis-client|connection_pool) \([^\n]+\)\n(?: {6}[^\n]+\n)*/gm)];
+  return entries.map(entry => entry[0]).sort();
+}
+
+function assessUpdate({ metadata, files, baseLock = '', headLock = '' }) {
+  const smallUpdate = ['version-update:semver-patch', 'version-update:semver-minor'];
+  if (!smallUpdate.includes(metadata.updateType)) return false;
+  const names = metadata.dependencyNames.split(',').map(name => name.trim()).filter(Boolean);
+  if (names.length === 0 || files.length === 0) return false;
+
+  if (metadata.ecosystem === 'bundler') {
+    if (!names.every(name => developmentGems.has(name))) return false;
+    // Manifest/constraint edits, optional integration dependencies, and Bundler stay manual.
+    if (files.length !== 1 || files[0].filename !== 'Gemfile.lock') return false;
+    const lines = changedLines(files[0]);
+    if (!lines || !baseLock || !headLock) return false;
+    const before = protectedLockEntries(baseLock);
+    const after = protectedLockEntries(headLock);
+    if (before.length !== 5 || JSON.stringify(before) !== JSON.stringify(after)) return false;
+    // Only gem spec/version and dependency requirement lines may change, never sources,
+    // platforms, direct constraints, PATH entries, or BUNDLED WITH.
+    return [...lines.removed, ...lines.added].every(line =>
+      /^    [\w-]+ \([0-9][^)]*\)$/.test(line) || /^      [\w-]+(?: \([^)]*\))?$/.test(line));
+  }
+
+  if (metadata.ecosystem !== 'github_actions' || !names.every(name => officialActions.has(name))) {
+    return false;
+  }
+  return files.every(file => {
+    if (!/^\.github\/workflows\/[^/]+\.ya?ml$/.test(file.filename)) return false;
+    const lines = changedLines(file);
+    if (!lines || lines.removed.length === 0 || lines.removed.length !== lines.added.length) return false;
+    const signature = line => {
+      const match = line.match(/^(\s*(?:-\s*)?uses:\s*)(actions\/[\w-]+)@[a-f0-9]{40}(?:\s+#.*)?$/);
+      return match && names.includes(match[2]) ? match[1] + match[2] : null;
+    };
+    const removed = lines.removed.map(signature);
+    const added = lines.added.map(signature);
+    return !removed.includes(null) && !added.includes(null) &&
+      JSON.stringify(removed.sort()) === JSON.stringify(added.sort());
+  });
+}
+
+function protectionReady(repository, rules = []) {
+  if (!repository.autoMergeAllowed || rules.some(rule => rule.type === 'merge_queue')) return false;
+  const protection = repository.ref && repository.ref.branchProtectionRule;
+  const contexts = new Set();
+  let strict = false;
+  if (protection && protection.requiresStatusChecks) {
+    strict = protection.requiresStrictStatusChecks;
+    protection.requiredStatusCheckContexts.forEach(name => contexts.add(name));
+  }
+  for (const rule of rules.filter(item => item.type === 'required_status_checks')) {
+    strict = strict || rule.parameters.strict_required_status_checks_policy;
+    rule.parameters.required_status_checks.forEach(check => contexts.add(check.context));
+  }
+  return strict && requiredChecks.every(name => contexts.has(name));
+}
+
+async function evaluate({ github, context, core, metadata }) {
+  const { owner, repo } = context.repo;
+  const number = context.payload.pull_request.number;
+  const { data: pr } = await github.rest.pulls.get({ owner, repo, pull_number: number });
+  if (pr.user.login !== 'dependabot[bot]' || pr.state !== 'open' || pr.draft ||
+      pr.base.ref !== 'master' || pr.base.repo.full_name !== `${owner}/${repo}` ||
+      !pr.head.repo || pr.head.repo.full_name !== `${owner}/${repo}` ||
+      pr.head.sha !== context.payload.pull_request.head.sha) return false;
+
+  const files = await github.paginate(github.rest.pulls.listFiles, {
+    owner, repo, pull_number: number, per_page: 100,
+  });
+  // GitHub's files endpoint is capped; refuse incomplete inspection.
+  if (files.length !== pr.changed_files) return false;
+  const input = { metadata, files };
+  if (metadata.ecosystem === 'bundler') {
+    const lockAt = async ref => {
+      const { data } = await github.rest.repos.getContent({ owner, repo, path: 'Gemfile.lock', ref });
+      if (data.encoding !== 'base64' || !data.content) throw new Error('Missing lockfile contents');
+      return Buffer.from(data.content, 'base64').toString('utf8');
+    };
+    [input.baseLock, input.headLock] = await Promise.all([lockAt(pr.base.sha), lockAt(pr.head.sha)]);
+  }
+  if (!assessUpdate(input)) return false;
+
+  const result = await github.graphql(`query($owner: String!, $repo: String!) {
+    repository(owner: $owner, name: $repo) {
+      autoMergeAllowed
+      ref(qualifiedName: "refs/heads/master") {
+        branchProtectionRule {
+          requiresStatusChecks requiresStrictStatusChecks requiredStatusCheckContexts
+        }
+      }
+    }
+  }`, { owner, repo });
+  const rules = await github.paginate('GET /repos/{owner}/{repo}/rules/branches/{branch}', {
+    owner, repo, branch: 'master', per_page: 100,
+  });
+  if (!protectionReady(result.repository, rules)) {
+    core.notice('Auto-merge requires the documented strict branch protection and all required CI checks.');
+    return false;
+  }
+  return true;
+}
+
+module.exports = { assessUpdate, protectionReady, evaluate, requiredChecks };

data/.github/scripts/dependabot-policy.test.cjs

@@ -0,0 +1,235 @@
+'use strict';
+const { test } = require('node:test');
+const assert = require('node:assert/strict');
+const { readFileSync } = require('node:fs');
+const { join } = require('node:path');
+const { assessUpdate, protectionReady, evaluate, requiredChecks } = require('./dependabot-policy.cjs');
+
+const metadata = {
+  ecosystem: 'bundler', updateType: 'version-update:semver-patch', dependencyNames: 'rspec',
+};
+const baseLock = `PATH
+  remote: .
+  specs:
+    redis-objects-periodical (0.7.0)
+      redis-objects (~> 1.0)
+
+GEM
+  remote: https://rubygems.org/
+  specs:
+    connection_pool (2.3.0)
+    redis (5.0.6)
+      redis-client (>= 0.9.0)
+    redis-client (0.12.1)
+      connection_pool
+    redis-objects (1.7.0)
+      redis
+    rspec (3.13.1)
+      rspec-core (~> 3.13.0)
+
+BUNDLED WITH
+  4.0.23
+`;
+const headLock = baseLock.replace('rspec (3.13.1)', 'rspec (3.13.2)');
+const file = (filename, removed, added) => ({
+  filename, status: 'modified', deletions: removed.length, additions: added.length,
+  patch: ['@@ -1,1 +1,1 @@', ...removed.map(line => '-' + line), ...added.map(line => '+' + line)].join('\n'),
+});
+const lockFile = file('Gemfile.lock', ['    rspec (3.13.1)'], ['    rspec (3.13.2)']);
+const lockInput = { metadata, files: [lockFile], baseLock, headLock };
+// Representative outputs from the pinned dependabot/fetch-metadata action:
+// src/dependabot/update_metadata.ts derives this ecosystem from dependabot/github_actions/...
+const actionOutputs = {
+  'package-ecosystem': 'github_actions',
+  'update-type': 'version-update:semver-patch',
+  'dependency-names': 'actions/checkout',
+};
+const actionMetadata = {
+  ecosystem: actionOutputs['package-ecosystem'],
+  updateType: actionOutputs['update-type'],
+  dependencyNames: actionOutputs['dependency-names'],
+};
+const actionFile = file('.github/workflows/ci.yml',
+  ['      - uses: actions/checkout@' + 'a'.repeat(40) + ' # v6.0.0'],
+  ['      - uses: actions/checkout@' + 'b'.repeat(40) + ' # v6.0.1']);
+const actionInput = { metadata: actionMetadata, files: [actionFile] };
+
+test('permits an allowlisted development lockfile patch or minor', () => {
+  assert.equal(assessUpdate(lockInput), true);
+  assert.equal(assessUpdate({ ...lockInput, metadata: { ...metadata, updateType: 'version-update:semver-minor' } }), true);
+});
+for (const name of ['redis-objects', 'redis', 'bundler', 'activesupport', 'unknown', 'rspec, redis-objects', '']) {
+  test(`rejects unapproved dependency list ${JSON.stringify(name)}`, () => {
+    assert.equal(assessUpdate({ ...lockInput, metadata: { ...metadata, dependencyNames: name } }), false);
+  });
+}
+for (const updateType of ['version-update:semver-major', '', 'unknown']) {
+  test(`rejects update type ${JSON.stringify(updateType)}`, () => {
+    assert.equal(assessUpdate({ ...lockInput, metadata: { ...metadata, updateType } }), false);
+  });
+}
+test('requires every dependency in a grouped update to be allowlisted', () => {
+  assert.equal(assessUpdate({ ...lockInput, metadata: { ...metadata, dependencyNames: 'rspec, yard' } }), true);
+});
+for (const filename of ['Gemfile', 'redis-objects-periodical.gemspec', 'gemfiles/active_support/Gemfile', 'gemfiles/active_support/Gemfile.lock', 'lib/redis-objects-periodical.rb']) {
+  test(`rejects manifest, integration, or implementation edits: ${filename}`, () => {
+    assert.equal(assessUpdate({ ...lockInput, files: [{ ...lockFile, filename }] }), false);
+  });
+}
+test('rejects any additional file, even alongside a valid lockfile change', () => {
+  assert.equal(assessUpdate({ ...lockInput, files: [lockFile, { ...lockFile, filename: 'Gemfile' }] }), false);
+});
+test('keeps a shared dependency update in both lockfiles under manual review', () => {
+  const integrationLock = { ...lockFile, filename: 'gemfiles/active_support/Gemfile.lock' };
+  assert.equal(assessUpdate({ ...lockInput, files: [lockFile, integrationLock] }), false);
+});
+for (const name of ['connection_pool', 'redis', 'redis-client', 'redis-objects', 'redis-objects-periodical']) {
+  test(`rejects changes to protected runtime entry ${name}`, () => {
+    const altered = headLock.replace(new RegExp(`(    ${name} \\()[^)]*`), (_, prefix) => prefix + '99.0.0');
+    assert.equal(assessUpdate({ ...lockInput, headLock: altered }), false);
+  });
+}
+for (const [removed, added] of [
+  ['  remote: https://rubygems.org/', '  remote: https://example.com/'],
+  ['  4.0.23', '  4.1.0'],
+  ['  rspec (~> 3.13)', '  rspec (~> 4.0)'],
+  ['  x86_64-linux', '  other-platform'],
+]) {
+  test(`rejects lockfile control changes: ${removed.trim()}`, () => {
+    assert.equal(assessUpdate({ ...lockInput, files: [file('Gemfile.lock', [removed], [added])] }), false);
+  });
+}
+test('rejects absent, truncated, added or deleted files', () => {
+  for (const change of [{ patch: undefined }, { additions: 100 }, { status: 'added' }, { status: 'removed' }]) {
+    assert.equal(assessUpdate({ ...lockInput, files: [{ ...lockFile, ...change }] }), false);
+  }
+  assert.equal(assessUpdate({ ...lockInput, files: [] }), false);
+  assert.equal(assessUpdate({ ...lockInput, baseLock: '' }), false);
+});
+test('permits only pinned official action version replacements', () => {
+  assert.equal(assessUpdate(actionInput), true);
+});
+test('rejects tags, third-party actions, privileges, triggers, steps and missing patches', () => {
+  for (const added of [
+    '      - uses: actions/checkout@v6.0.1',
+    '      - uses: other/checkout@' + 'b'.repeat(40),
+    'permissions: write-all', '  pull_request_target:', '      - run: echo unsafe',
+  ]) {
+    const unsafe = file(actionFile.filename, ['      - uses: actions/checkout@' + 'a'.repeat(40)], [added]);
+    assert.equal(assessUpdate({ ...actionInput, files: [unsafe] }), false);
+  }
+  assert.equal(assessUpdate({ ...actionInput, files: [{ ...actionFile, patch: undefined }] }), false);
+  assert.equal(assessUpdate({ ...actionInput, metadata: { ...actionMetadata, dependencyNames: 'actions/checkout, ruby/setup-ruby' } }), false);
+});
+test('rejects an official-action PR that also alters permissions', () => {
+  const unsafe = file(actionFile.filename,
+    ['      - uses: actions/checkout@' + 'a'.repeat(40), '  contents: read'],
+    ['      - uses: actions/checkout@' + 'b'.repeat(40), '  contents: write']);
+  assert.equal(assessUpdate({ ...actionInput, files: [unsafe] }), false);
+});
+for (const ecosystem of ['github-actions', 'github_action', '', 'unknown']) {
+  test(`rejects an unrecognized Actions ecosystem ${JSON.stringify(ecosystem)}`, () => {
+    assert.equal(assessUpdate({ ...actionInput, metadata: { ...actionMetadata, ecosystem } }), false);
+  });
+}
+test('rejects unknown ecosystems and non-workflow action changes', () => {
+  assert.equal(assessUpdate({ ...actionInput, metadata: { ...actionMetadata, ecosystem: 'docker' } }), false);
+  assert.equal(assessUpdate({ ...actionInput, files: [{ ...actionFile, filename: '.github/scripts/policy.cjs' }] }), false);
+});
+
+const repository = {
+  autoMergeAllowed: true,
+  ref: { branchProtectionRule: {
+    requiresStatusChecks: true, requiresStrictStatusChecks: true,
+    requiredStatusCheckContexts: requiredChecks,
+  } },
+};
+test('requires auto-merge and every documented strict required check', () => {
+  assert.equal(protectionReady(repository), true);
+  assert.equal(Boolean(protectionReady({ ...repository, autoMergeAllowed: false })), false);
+  assert.equal(Boolean(protectionReady({ ...repository, ref: null })), false);
+  for (const name of requiredChecks) {
+    const protection = { ...repository.ref.branchProtectionRule,
+      requiredStatusCheckContexts: requiredChecks.filter(check => check !== name) };
+    assert.equal(protectionReady({ ...repository, ref: { branchProtectionRule: protection } }), false);
+  }
+  assert.equal(protectionReady({ ...repository, ref: { branchProtectionRule: {
+    ...repository.ref.branchProtectionRule, requiresStrictStatusChecks: false,
+  } } }), false);
+});
+
+function harness() {
+  const pr = { number: 1, user: { login: 'dependabot[bot]' }, state: 'open', draft: false,
+    base: { ref: 'master', sha: 'base', repo: { full_name: 'ryz310/redis-objects-periodical' } },
+    head: { sha: 'head', repo: { full_name: 'ryz310/redis-objects-periodical' } }, changed_files: 1 };
+  const context = { repo: { owner: 'ryz310', repo: 'redis-objects-periodical' },
+    payload: { pull_request: { number: 1, head: { sha: 'head' } } } };
+  const github = {
+    rest: { pulls: { get: async () => ({ data: pr }), listFiles: 'files' }, repos: {
+      getContent: async ({ ref }) => ({ data: { encoding: 'base64',
+        content: Buffer.from(ref === 'base' ? baseLock : headLock).toString('base64') } }),
+    } },
+    paginate: async endpoint => endpoint === 'files' ? [lockFile] : [],
+    graphql: async () => ({ repository }),
+  };
+  return { pr, github, context, core: { notice() {} }, metadata };
+}
+test('reads current PR and both immutable lockfile revisions without API writes', async () => {
+  assert.equal(await evaluate(harness()), true);
+});
+for (const scenario of ['human', 'fork', 'stale', 'release', 'closed', 'draft', 'missing-files']) {
+  test(`rejects current PR state: ${scenario}`, async () => {
+    const input = harness();
+    if (scenario === 'human') input.pr.user.login = 'someone';
+    if (scenario === 'fork') input.pr.head.repo.full_name = 'someone/fork';
+    if (scenario === 'stale') input.pr.head.sha = 'new-head';
+    if (scenario === 'release') input.pr.base.ref = 'release';
+    if (scenario === 'closed') input.pr.state = 'closed';
+    if (scenario === 'draft') input.pr.draft = true;
+    if (scenario === 'missing-files') input.pr.changed_files = 2;
+    assert.equal(await evaluate(input), false);
+  });
+}
+test('API or branch protection read failure cannot produce an approval', async () => {
+  const input = harness();
+  input.github.graphql = async () => { throw new Error('Forbidden'); };
+  await assert.rejects(evaluate(input), /Forbidden/);
+});
+
+const rules = [{ type: 'required_status_checks', parameters: {
+  strict_required_status_checks_policy: true,
+  required_status_checks: requiredChecks.map(context => ({ context })),
+} }];
+const rulesRepository = { autoMergeAllowed: true, ref: { branchProtectionRule: null } };
+test('accepts effective rulesets without requiring classic branch protection', () => {
+  assert.equal(protectionReady(rulesRepository, rules), true);
+});
+test('rulesets must require every check and strict updates', () => {
+  assert.equal(protectionReady(rulesRepository, [{ type: 'required_status_checks', parameters: {
+    ...rules[0].parameters, strict_required_status_checks_policy: false,
+  } }]), false);
+  for (const name of requiredChecks) {
+    assert.equal(protectionReady(rulesRepository, [{ type: 'required_status_checks', parameters: {
+      ...rules[0].parameters,
+      required_status_checks: rules[0].parameters.required_status_checks.filter(check => check.context !== name),
+    } }]), false);
+  }
+});
+test('rejects merge queues even with all checks configured', () => {
+  assert.equal(protectionReady(repository, [...rules, { type: 'merge_queue' }]), false);
+});
+test('checks effective branch rules before approving an update', async () => {
+  const input = harness();
+  input.github.graphql = async () => ({ repository: rulesRepository });
+  input.github.paginate = async endpoint => endpoint === 'files' ? [lockFile] : rules;
+  assert.equal(await evaluate(input), true);
+});
+
+test('required Ruby checks match the reusable CI matrix', () => {
+  const workflow = readFileSync(join(__dirname, '../workflows/checks.yml'), 'utf8');
+  const matrix = workflow.match(/ruby:\s*\[([^\]]+)\]/);
+  assert.ok(matrix, 'Expected an explicit Ruby matrix in checks.yml');
+  const versions = matrix[1].split(',').map(value => value.trim().replace(/['"]/g, ''));
+  assert.deepEqual(requiredChecks.filter(name => name.startsWith('checks / build_on_ruby_')),
+    versions.map(version => `checks / build_on_ruby_${version}`));
+});

data/.github/scripts/timezone-inventory.cjs

@@ -0,0 +1,48 @@
+'use strict';
+
+const { readFileSync } = require('node:fs');
+
+// Independent execution contract for the integration fixtures. Update this definition
+// when deliberately adding/removing fixture dimensions; do not derive it from the report.
+const inventory = {
+  boundaries: ['year and month boundary', 'week boundary'],
+  zones: ['"Asia/Tokyo"', 'nil'],
+  periods: ['annual', 'monthly', 'weekly', 'daily', 'hourly', 'minutely'],
+  types: ['counter', 'value', 'set', 'hash_key'],
+};
+const expectedDescriptions = inventory.boundaries.flatMap(boundary =>
+  inventory.zones.flatMap(zone =>
+    inventory.periods.flatMap(period =>
+      inventory.types.map(type =>
+        `Redis::RecurringAtIntervals when crossing the ${boundary} with Time.zone = ${zone} persists the ${period} ${type} in the selected timezone`))));
+
+function validateInventory(report) {
+  if (!Array.isArray(report.examples)) throw new Error('Missing RSpec examples array');
+  const expected = new Set(expectedDescriptions);
+  const seen = new Set();
+  const problems = [];
+  for (const example of report.examples) {
+    const name = example.full_description;
+    if (!expected.has(name)) problems.push(`Unexpected example: ${name}`);
+    if (seen.has(name)) problems.push(`Duplicate example: ${name}`);
+    if (example.status !== 'passed') problems.push(`Example ${example.status}: ${name}`);
+    seen.add(name);
+  }
+  for (const name of expected) {
+    if (!seen.has(name)) problems.push(`Missing example: ${name}`);
+  }
+  if (problems.length) throw new Error(problems.join('\n'));
+  return seen.size;
+}
+
+if (require.main === module) {
+  try {
+    const count = validateInventory(JSON.parse(readFileSync(process.argv[2], 'utf8')));
+    console.log(`Verified ${count} passed timezone integration examples`);
+  } catch (error) {
+    console.error(`Timezone inventory validation failed: ${error.message}`);
+    process.exitCode = 1;
+  }
+}
+
+module.exports = { expectedDescriptions, validateInventory };

data/.github/scripts/timezone-inventory.test.cjs

@@ -0,0 +1,86 @@
+'use strict';
+
+const { test } = require('node:test');
+const assert = require('node:assert/strict');
+const { spawnSync } = require('node:child_process');
+const { mkdtempSync, rmSync, writeFileSync } = require('node:fs');
+const { tmpdir } = require('node:os');
+const { join } = require('node:path');
+const { expectedDescriptions, validateInventory } = require('./timezone-inventory.cjs');
+
+const complete = () => ({
+  examples: expectedDescriptions.map(full_description => ({ full_description, status: 'passed' })),
+});
+
+test('accepts the complete passed inventory independently of report order', () => {
+  const report = complete();
+  report.examples.reverse();
+  assert.equal(validateInventory(report), expectedDescriptions.length);
+});
+
+for (const [dimension, match] of [
+  ['Tokyo zone', 'with Time.zone = "Asia/Tokyo"'],
+  ['unset zone', 'with Time.zone = nil'],
+  ['year/month boundary', 'when crossing the year and month boundary'],
+  ['week boundary', 'when crossing the week boundary'],
+  ['period', 'persists the weekly '],
+  ['type', ' hash_key in the selected timezone'],
+]) {
+  test(`rejects a missing ${dimension}`, () => {
+    const report = complete();
+    report.examples = report.examples.filter(example => !example.full_description.includes(match));
+    assert.throws(() => validateInventory(report), /Missing example/);
+  });
+}
+
+test('rejects an empty selection even when RSpec reports zero failures', () => {
+  assert.throws(() => validateInventory({ examples: [], summary: { failure_count: 0 } }), /Missing example/);
+});
+
+test('rejects a single missing combination even if a duplicate preserves the total count', () => {
+  const report = complete();
+  report.examples[0] = report.examples[1];
+  assert.throws(() => validateInventory(report), /Duplicate example[\s\S]*Missing example/);
+});
+
+for (const status of ['pending', 'failed', 'skipped', undefined]) {
+  test(`rejects an intended example with status ${status}`, () => {
+    const report = complete();
+    report.examples[0].status = status;
+    assert.throws(() => validateInventory(report), /Example/);
+  });
+}
+
+test('rejects unexpected examples rather than allowing substitutions', () => {
+  const report = complete();
+  report.examples[0].full_description = 'unrelated passed example';
+  assert.throws(() => validateInventory(report), /Unexpected example[\s\S]*Missing example/);
+});
+
+test('rejects a malformed report', () => {
+  assert.throws(() => validateInventory({}), /Missing RSpec examples array/);
+});
+
+test('CLI fails closed for missing, invalid, empty and pending reports, and accepts complete output', () => {
+  const directory = mkdtempSync(join(tmpdir(), 'timezone-inventory-'));
+  const filename = join(directory, 'report.json');
+  const script = join(__dirname, 'timezone-inventory.cjs');
+  const run = () => spawnSync(process.execPath, [script, filename], { encoding: 'utf8' });
+  try {
+    assert.equal(run().status, 1);
+    for (const contents of ['{', JSON.stringify({ examples: [] }), JSON.stringify({
+      examples: complete().examples.map(example => ({ ...example, status: 'pending' })),
+    })]) {
+      writeFileSync(filename, contents);
+      const result = run();
+      assert.equal(result.status, 1);
+      assert.match(result.stderr, /Timezone inventory validation failed/);
+    }
+    writeFileSync(filename, JSON.stringify(complete()));
+    const result = run();
+    assert.equal(result.status, 0);
+    assert.match(result.stdout, /Verified .* passed timezone integration examples/);
+  } finally {
+    rmSync(directory, { recursive: true, force: true });
+  }
+});

data/.github/workflows/checks.yml

@@ -0,0 +1,124 @@
+name: Checks
+
+on:
+  workflow_call:
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    name: build_on_ruby_${{ matrix.ruby }}
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        ruby: ['3.3', '3.4', '4.0']
+    container:
+      image: cimg/ruby:${{ matrix.ruby }}
+      options: --user 0
+    services:
+      redis:
+        image: redis:latest@sha256:97ec88159e6d7cfb5ddef9015386087d58a912de80112f06ebdfa78fa5989901
+        options: >-
+          --health-cmd "redis-cli ping"
+          --health-interval 5s
+          --health-timeout 3s
+          --health-retries 10
+    defaults:
+      run:
+        shell: bash
+    env:
+      BUNDLE_FROZEN: 'true'
+      BUNDLE_PATH: vendor/bundle
+      SIMPLECOV_COMMAND_NAME: ruby-${{ matrix.ruby }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Install locked dependencies
+        run: |
+          # cimg's Bash HOME differs from the checkout action's temporary HOME.
+          git config --global --add safe.directory "$GITHUB_WORKSPACE"
+          git ls-files --error-unmatch lib/redis-objects-periodical.rb >/dev/null
+          gem install bundler -v 4.0.23 --no-document
+          bundle _4.0.23_ install
+
+      - name: Execute RSpec
+        run: |
+          mkdir -p test-results
+          bundle exec rspec --format documentation \
+                            --format RspecJunitFormatter \
+                            --out test-results/rspec.xml
+
+      - name: Build gem
+        run: bundle exec rake build
+
+      - name: Verify packaged Ruby sources
+        run: |
+          bundle exec ruby -rrubygems/package -e '
+            package = Gem::Package.new(Dir["pkg/*.gem"].fetch(0)).spec
+            sources = Dir["lib/**/*.rb"]
+            missing = sources - package.files
+            abort("Missing packaged sources: #{missing.join(", ")}") unless missing.empty?
+            puts "Verified #{sources.length} Ruby sources in #{package.full_name}"
+          '
+
+      - name: Prepare coverage merge input
+        if: ${{ always() && hashFiles('coverage/.resultset.json') != '' }}
+        run: cp coverage/.resultset.json coverage/resultset.json
+
+      - name: Store coverage merge input
+        if: ${{ always() && hashFiles('coverage/resultset.json') != '' }}
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
+        with:
+          name: simplecov-ruby-${{ matrix.ruby }}
+          path: coverage/resultset.json
+          if-no-files-found: error
+          retention-days: 14
+
+      - name: Store test results and coverage
+        if: ${{ always() }}
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
+        with:
+          name: test-results-ruby-${{ matrix.ruby }}
+          path: |
+            test-results/
+            coverage/
+          retention-days: 14
+
+      - name: Store gem
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
+        with:
+          name: gem-ruby-${{ matrix.ruby }}
+          path: pkg/*.gem
+          if-no-files-found: error
+          retention-days: 14
+
+  rubocop:
+    name: rubocop
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    container:
+      image: cimg/ruby:3.3
+      options: --user 0
+    defaults:
+      run:
+        shell: bash
+    env:
+      BUNDLE_FROZEN: 'true'
+      BUNDLE_PATH: vendor/bundle
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Install locked dependencies
+        run: |
+          git config --global --add safe.directory "$GITHUB_WORKSPACE"
+          git ls-files --error-unmatch lib/redis-objects-periodical.rb >/dev/null
+          gem install bundler -v 4.0.23 --no-document
+          bundle _4.0.23_ install
+      - name: Run RuboCop
+        run: bundle exec rubocop