txray 0.2.0 → 0.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 692c693e82b7cafb8444a5e0ea2cc659a4a9db6f3f281833d0ae6638180a9a3d
-  data.tar.gz: ef4bc224bdbf06ae386731626d1f42120eb22dd884b4d35138c1dde1470e6ae7
+  metadata.gz: '04384fde1e534819ca3055d82a586c3da880b2ea97aa49d8fbe2c3eaa0182beb'
+  data.tar.gz: d8b1dd217628ad5a12780cd295d27bdb7c934b10907443d6afe95726925c62f2
 SHA512:
-  metadata.gz: 3317e5a2b15c124756cbfb044f53077cec168bb1491d162616cc90ae4f14c5f18e7e056299d7762e20eae2b940ed174e5641ed5a70648fa097e65282dca7f792
-  data.tar.gz: d8ee53b802c142da58d693d28c5d9ce994ce61a555232902a3115474cf152fbc253ddf285e1fbf0bd9a42439e86e80be994aff948582aa2bed47f46ab76946de
+  metadata.gz: 4f2ed21c432a811623ddfae148e50cbdd54283b71fc663f5ca67750fdbe5710c5810ec6ee2c64bc9ce134de420b0195f7f30e8ab0c5c1c54cdcfc2522567791f
+  data.tar.gz: 4eab65e95a199496556e0569667b09e414205e0bd8f21fd25af58636ff21a3107ca33b413789a00a8f55d6e4470181b03811e711a02bb007a65d561dfa05b6cc

data/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## 0.2.1
+
+Nothing in the analyzer, the runtime guard or the reporters changed. This release exists to exercise the publishing pipeline on something low stakes before a release that matters.
+
+- Releases are now published by GitHub Actions through RubyGems trusted publishing, so no API key is created, pasted or stored. Merging a version bump tags the commit, runs the suite, publishes the gem and creates the GitHub release with the notes taken from this file.
+- Corrected the release steps in `CONTRIBUTING.md`, which told contributors to push a version bump straight to a protected `main`.
+
 ## 0.2.0
 
 - Track clients held in local variables, instance variables, constants, memoized readers and `delegate` targets, so the request is reported rather than the harmless construction.

data/CONTRIBUTING.md

@@ -0,0 +1,43 @@
+# Contributing
+
+```sh
+bin/setup
+bundle exec rake        # specs and rubocop
+```
+
+## Adding a rule
+
+A rule is three things and a test.
+
+1. `Rules.register` in `lib/txray/rule.rb`, with the severity, what the reader sees, and the fix.
+2. A branch in `lib/txray/classifier.rb`, or a namespace in `lib/txray/catalog.rb` if the call is recognised by its receiver.
+3. A scenario in `spec/txray/scenarios_spec.rb` that proves it fires, and one that proves it stays quiet on the shape it should ignore.
+
+The second test matters more than the first. A rule that fires on correct code costs more than a rule that misses.
+
+## Adding a transactional scope
+
+`lib/txray/transaction_scope.rb` decides what counts as being inside a transaction. Anything added there needs a case showing that the corresponding commit-time callback is still left alone.
+
+## Testing against other Rails versions
+
+```sh
+RAILS_VERSION=7.1 bundle install && RAILS_VERSION=7.1 bundle exec rspec
+```
+
+CI runs 7.1, 7.2 and 8.0 alongside Ruby 3.2, 3.3 and 3.4.
+
+## Before opening a pull request
+
+Run the scanner against a real application, not only the suite. False positives are the failure mode that matters, and they show up in real code long before they show up in fixtures.
+
+## Releasing
+
+Merging a version bump releases the gem. There is nothing to run by hand.
+
+1. On a branch, bump `Txray::VERSION` in `lib/txray/version.rb` and add a `## x.y.z` section to `CHANGELOG.md`.
+2. Open the pull request and merge it once CI is green.
+
+On every push to `main` the release workflow reads `Txray::VERSION` and stops immediately if that version is already tagged, so ordinary merges do nothing. When the version is new it takes the release notes from the matching changelog section, runs the suite, tags the commit, publishes the gem to RubyGems through trusted publishing, and creates the GitHub release with the notes and the built gem attached.
+
+The tag is created locally and only pushed once the gem is published, so a failure leaves nothing behind: fix it and merge again. A missing changelog section fails before the suite even runs. No API key is involved anywhere.

data/README.md

@@ -350,6 +350,8 @@ bin/setup
 bundle exec rake
 ```
 
+Releases are cut by tagging; see [CONTRIBUTING.md](CONTRIBUTING.md).
+
 ## License
 
 MIT

data/lib/txray/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Txray
-  VERSION = "0.2.0"
+  VERSION = "0.2.1"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: txray
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.2.1
 platform: ruby
 authors:
 - Theo Wecker
@@ -37,6 +37,7 @@ extensions: []
 extra_rdoc_files: []
 files:
 - CHANGELOG.md
+- CONTRIBUTING.md
 - LICENSE.txt
 - README.md
 - Rakefile
@@ -98,7 +99,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.8
+rubygems_version: 3.6.9
 specification_version: 4
 summary: Static analysis that finds slow work hidden inside database transactions.
 test_files: []