rspec_junit_formatter 0.6.1 → 0.6.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 892c4451f42f7fdbfe335df86dd6f910d5fc4a54b91614b2da4283490a635646
-  data.tar.gz: 870ebdab7dd2e600b57493ce26437cee64b73cdc1cd05b48d6f67ad7160e98e8
+  metadata.gz: 5284f5c3c374244eebe552b1284e12e846f0db274a6758ab2b3bf988828a5ecb
+  data.tar.gz: bba94018c3622f87b5a25d31d1dfcf6f3f52ab306234c67f32cfdb5526168835
 SHA512:
-  metadata.gz: 4b55d404b3e056fd85dcef4712c386de35448f442abbc750b8fe9fc5d9953b79bb9552790bff53f88f67a91d7685765d9ddbb9cbefba0317d7cd2c558dabd036
-  data.tar.gz: aa4f7f1061266efeb3e4da1756d5a47969c8f1964174dbba23054b580a035a356d8b8880f2da47b940f423a5f2fb35371eed52990ab2540f133f49708bbe2bf5
+  metadata.gz: 130f2aa5ff8c848fd971dd432a946452561eb8509bd9503525f4716d71acc7b7ac031ce81d0468eba463c0a808cb58e3c8121d9b139613af113397a1ef422126
+  data.tar.gz: db4e33312c94d947595627d342be7d3b483b4ca1c98fb53672851c58637728e11352d4a3102101a4f6cf81b0cf240a272dadd92c77c1861f0a3140727f52cd41

data/README.md

@@ -11,6 +11,18 @@
   [circleci-junit]: https://circleci.com/docs/2.0/collect-test-data/
   [gitlab-junit]: https://docs.gitlab.com/ee/ci/unit_test_reports.html#ruby-example
 
+## Legacy release
+
+**0.6.2 is the final release for older Ruby and RSpec versions.** It retains Ruby >= 2.3 and RSpec >= 2, < 4 (except 2.12.0), with the latest encoding and aggregate failure fixes. See [tested versus permitted versions](#tested-versus-permitted-versions) for coverage and limitations.
+
+The next release will require Ruby >= 3.3 and RSpec >= 3.13. If you must keep an older Ruby **or** an older RSpec, use:
+
+```ruby
+gem "rspec_junit_formatter", "0.6.2", require: false
+```
+
+Then run `bundle update rspec_junit_formatter`. Without Bundler, use `gem install rspec_junit_formatter -v 0.6.2`. Upgrading Ruby alone is not enough if your project must keep an older RSpec.
+
 ## Usage
 
 Install the gem:
@@ -95,18 +107,114 @@ Note that this example captures all output from every example all the time, pote
 ## Caveats
 
  * XML can only represent a [limited subset of characters][xml-charsets] which excludes null bytes and most control characters. This gem will use character entities where possible and fall back to replacing invalid characters with Ruby-like escape codes otherwise. For example, the null byte becomes `\0`.
+ * When converting report text to UTF-8 for XML output, invalid byte sequences and characters with no UTF-8 conversion are replaced with `�` (U+FFFD REPLACEMENT CHARACTER). The formatter uses each string's declared encoding; it does not guess the encoding of binary data.
 
   [xml-charsets]: https://www.w3.org/TR/xml/#charsets
 
 ## Development
 
-Run the specs with `bundle exec rake`, which uses [Appraisal][appraisal] to run the specs against all supported versions of rspec.
+Use Ruby 3.4 (see [`.ruby-version`](.ruby-version)) for maintenance. Ruby 3.4 is in [normal maintenance](https://www.ruby-lang.org/en/downloads/branches/). This selects the development Ruby without changing the installed gem's requirements. Keep Ruby requirements out of the root Gemfile: Appraisal copies them into legacy Gemfiles.
+
+Install the Bundler version recorded in `Gemfile.lock`, then test the locked development bundle:
+
+```sh
+gem install bundler -v 4.0.23
+bundle install
+bundle exec rake spec
+```
+
+The [development workflow](.github/workflows/development.yml) tests this bundle separately from the [compatibility workflow](.github/workflows/ci.yml). Use `bundle update --all` to refresh the development lockfile.
+
+Legacy bundles are defined by [Appraisal][appraisal] and have separate Gemfiles. Select a compatible Ruby and Bundler, then run an individual bundle without the root lockfile, for example on Ruby 2.6:
+
+```sh
+BUNDLE_GEMFILE=gemfiles/rspec_2_x.gemfile bundle install
+BUNDLE_GEMFILE=gemfiles/rspec_2_x.gemfile bundle exec rake spec
+```
+
+Plain `bundle exec rake` also runs all Appraisals outside CI. Not all historical RSpec versions run on modern Ruby, so use the combinations in the compatibility workflow rather than running all Appraisals on the maintainer Ruby.
 
   [appraisal]: https://github.com/thoughtbot/appraisal
 
+### Tested versus permitted versions
+
+The [gemspec](rspec_junit_formatter.gemspec) permits Ruby >= 2.3 and `rspec-core` >= 2, < 4, excluding 2.12.0. These requirements allow installation; they do not mean every Ruby/RSpec combination is tested or works together.
+
+The CI workflows test these combinations:
+
+| Ruby | RSpec | Bundle |
+| --- | --- | --- |
+| 2.6–3.4 | 3.4–3.13, each minor series | Legacy Appraisals |
+| 2.6–3.1 | 2.14 (`< 2.99`) and 3.0–3.3, each minor series | Legacy Appraisals |
+| 3.4 and 4.0 | Current 3.13, pinned by `Gemfile.lock` | Development |
+
+Ruby 4.0 coverage initially uses only the current RSpec development bundle, not the historical Appraisals. Ruby 2.3–2.5 remain permitted but are not covered by CI. RSpec versions allowed by the gemspec but outside the Appraisal ranges are also untested. Historical RSpec versions below 3.4 are not compatible with Ruby 3.2 or newer. Retaining installation permission does not imply that an end-of-life Ruby still receives upstream security updates.
+
 ## Releasing
 
-Bump the gem version in the gemspec, and commit. Then `bundle exec rake build` to build a gem package, `bundle exec rake install` to install and test it locally, then `bundle exec rake release` to tag and push the commits and gem.
+Releases use the [Release workflow](https://github.com/sj26/rspec_junit_formatter/actions/workflows/release.yml)
+and [RubyGems trusted publishing](https://guides.rubygems.org/trusted-publishing/).
+GitHub Actions builds **unsigned gems**: it needs no personal signing key, persistent
+RubyGems API key, or maintainer machine. Local `bundle exec rake build`, `install`,
+and `release` tasks remain available; local releases may retain the maintainer's
+traditional gem signatures. Do not publish the same version through both paths.
+
+1. Bump the gemspec version and update the changelog in a reviewed PR. Merge it
+   into `main`. Use a new stable `X.Y.Z` version; never reuse a published version.
+2. Tag that exact commit as `vX.Y.Z` and push the tag. Record its full commit SHA
+   with `git rev-parse 'vX.Y.Z^{commit}'`. Pushing a tag alone does not publish.
+3. Run the Release workflow **from `main`**, supplying the tag and full SHA. Leave
+   `publish` unchecked for validation only. It checks tag/version/commit agreement
+   and main ancestry, runs the compatibility and development suites at that SHA,
+   builds the gem, rejects embedded signatures, and tests a clean installation
+   outside the checkout. PRs also exercise the package build/install check, but
+   their artifacts can never be published by this workflow.
+4. Run again with the same tag and SHA and `publish` checked. After the checks pass,
+   review the commit and package SHA-256 in the build log, then approve the
+   `release` environment deployment. Sam can approve his own run. The publish job
+   downloads that run's exact immutable artifact, uses short-lived OIDC credentials,
+   and does not check out or build project code.
+5. The workflow verifies that RubyGems serves identical bytes before publishing a
+   GitHub release with the same gem. Check both the
+   [RubyGems version](https://rubygems.org/gems/rspec_junit_formatter/versions) and
+   [GitHub release](https://github.com/sj26/rspec_junit_formatter/releases).
+
+### One-time configuration
+
+The GitHub `release` environment must require approval by `sj26`, allow
+self-approval, disable admin bypass, and allow deployments only from the `main`
+branch. The **Immutable release tags** repository ruleset blocks updates and
+deletion of `v*` tags, with no bypass actors. Under the existing gem's
+**Trusted publishers** on RubyGems, configure:
+
+| Field | Value |
+| --- | --- |
+| Repository owner | `sj26` |
+| Repository name | `rspec_junit_formatter` |
+| Workflow filename | `release.yml` |
+| Environment | `release` |
+
+Leave reusable-workflow repository fields blank. This workflow grants
+`id-token: write` only to the environment-protected publish job. Do not add a
+RubyGems API key or personal signing key to repository secrets.
+
+### Recovery
+
+Release runs are serialized and never auto-cancel an active publication. If a
+push succeeds but a later step fails, **re-run failed jobs in the original run**
+while its `release-gem` artifact is retained (30 days). This reuses the validated
+bytes and requires environment approval again. An existing RubyGems version is
+accepted only if its SHA-256 matches, and its downloaded bytes must also match.
+An incomplete GitHub draft can resume; an existing asset must match byte-for-byte
+and is never overwritten. A published GitHub release missing its gem fails closed
+and needs manual inspection rather than silently changing a public release.
+
+If the tag moved, a digest differs, or the original artifact expired, stop and
+investigate. Do not delete/recreate tags, yank/re-push gems, or overwrite release
+assets to force a retry. A fresh run rebuilds and is safe only if it reproduces
+the same bytes; otherwise recover the original artifact or use a new version
+through the normal review process. Validation-only runs do not test OIDC exchange
+or publication; only a real, explicitly approved new release can prove those paths.
 
 ## License
 

data/lib/rspec_junit_formatter.rb

@@ -166,7 +166,7 @@ private
 
   def escape(text)
     # Make sure it's utf-8, replace illegal characters with ruby-like escapes, and replace special and discouraged characters with entities
-    text.to_s.encode(Encoding::UTF_8).gsub(ILLEGAL_REGEXP, ILLEGAL_REPLACEMENT).gsub(DISCOURAGED_REGEXP, DISCOURAGED_REPLACEMENTS)
+    text.to_s.encode(Encoding::UTF_8, invalid: :replace, undef: :replace, replace: "\uFFFD").gsub(ILLEGAL_REGEXP, ILLEGAL_REPLACEMENT).gsub(DISCOURAGED_REGEXP, DISCOURAGED_REPLACEMENTS)
   end
 
   STRIP_DIFF_COLORS_BLOCK_REGEXP = /^ ( [ ]* ) Diff: (?: \e\[ 0 m )? (?: \n \1 \e\[ \d+ (?: ; \d+ )* m .* )* /x

metadata

@@ -1,33 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: rspec_junit_formatter
 version: !ruby/object:Gem::Version
-  version: 0.6.1
+  version: 0.6.2
 platform: ruby
 authors:
 - Samuel Cochran
 bindir: bin
-cert_chain:
-- |
-  -----BEGIN CERTIFICATE-----
-  MIIDKDCCAhCgAwIBAgIBBTANBgkqhkiG9w0BAQsFADA6MQ0wCwYDVQQDDARzajI2
-  MRQwEgYKCZImiZPyLGQBGRYEc2oyNjETMBEGCgmSJomT8ixkARkWA2NvbTAeFw0y
-  NjEwMjAyMzA3MDhaFw0yNzEwMjAyMzA3MDhaMDoxDTALBgNVBAMMBHNqMjYxFDAS
-  BgoJkiaJk/IsZAEZFgRzajI2MRMwEQYKCZImiZPyLGQBGRYDY29tMIIBIjANBgkq
-  hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsr60Eo/ttCk8GMTMFiPr3GoYMIMFvLak
-  xSmTk9YGCB6UiEePB4THSSA5w6IPyeaCF/nWkDp3/BAam0eZMWG1IzYQB23TqIM0
-  1xzcNRvFsn0aQoQ00k+sj+G83j3T5OOV5OZIlu8xAChMkQmiPd1NXc6uFv+Iacz7
-  kj+CMsI9YUFdNoU09QY0b+u+Rb6wDYdpyvN60YC30h0h1MeYbvYZJx/iZK4XY5zu
-  4O/FL2ChjL2CPCpLZW55ShYyrzphWJwLOJe+FJ/ZBl6YXwrzQM9HKnt4titSNvyU
-  KzE3L63A3PZvExzLrN9u09kuWLLJfXB2sGOlw3n9t72rJiuBr3/OQQIDAQABozkw
-  NzAJBgNVHRMEAjAAMAsGA1UdDwQEAwIEsDAdBgNVHQ4EFgQU99dfRjEKFyczTeIz
-  m3ZsDWrNC80wDQYJKoZIhvcNAQELBQADggEBAEHT9KAaQy80m6KKiJiuVVq96HNo
-  sub7+06IGfsNqxJHJPZoqsdRUkH+WUliVdQ1yAI35QmO2glCJt1UvQU7vkI6CQBB
-  rjFWNmbQhyK2fjiwuvSI1QmgH/NeT45lzW4TSg04hmIhtX8G+1HeyKck/qDaDyoO
-  GgETed1QI+mcbxl1+O8w1QSuvClVm7y+Nk5PeOxjPT/2DMuChLyTP3NYnyiHifdS
-  OKO8Px6knr64z1LWwB+m04k+z+D1oD6757fkD96O1C1AtMtNoQHwfNX7JSPhQSQM
-  z4nsMtYoPwFoGnDqvraRmVqMLL3asgAh8SYE6c4eoaX1b0r83v6aLnIh3ew=
-  -----END CERTIFICATE-----
-date: 1980-01-02 00:00:00.000000000 Z
+cert_chain: []
+date: 2026-10-21 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rspec-core

checksums.yaml.gz.sig

@@ -1,2 +0,0 @@
-;�c��M���L���i�`-%uE���^o�_��+�=^����(L�֏!m�?�h+��W<c
-)���@,��v�R��x䆎���Uc