veragem 0.1.0 → 0.2.0

data/template/Steepfile.erb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-# Steep checks lib/ against sig/, its strictest diagnostics on: `rake steep`.
+# Steep checks lib/ against sig/, its strict diagnostics on: `rake steep`.
 target :lib do
   signature "sig"
   check "lib"

data/template/bin/setup

@@ -3,3 +3,5 @@
 
 # The gems at Gemfile.lock's versions; the first run writes the lock, to commit.
 system("bundle", "install", exception: true)
+# Windows' gems too, as CI checks the gem there and installs from the lock alone
+system("bundle", "lock", "--add-platform", "x64-mingw-ucrt", exception: true)

data/template/cliff.toml

@@ -1,9 +1,8 @@
 # git-cliff: CHANGELOG.md from the Conventional Commits, written by `rake bump` (never by hand).
-# Grouped by commit type, breaking changes first; what changes nothing a user meets (chores, CI,
-# formatting, the release commit itself) is left out.
 #
-# It names no project: the Rakefile passes the repository the headings' compare links need
-# (`--github-repo`, from the gemspec's source_code_uri). Run bare, the headings carry no link.
+# It names no project: the Rakefile passes the repository the links need (`--github-repo`, from
+# the gemspec's source_code_uri). Run bare, it takes the current branch's upstream remote where that
+# is GitHub's, and writes no link otherwise.
 
 [changelog]
 header = """
@@ -33,8 +32,11 @@ body = """
 {% for group, commits in commits | group_by(attribute="group") %}
     ### {{ group | striptags | trim }}
     {% for commit in commits %}
+        {# the description as its author wrote it: a name keeps its case (RuboCop, v0.1.0) -#}
+        {% set short = commit.id | truncate(length=7, end="") -%}
         - {% if commit.scope %}{{ commit.scope }}: {% endif %}\
-          {{ commit.message | split(pat="\n") | first | upper_first | trim }}\
+          {{ commit.message | split(pat="\n") | first | trim }} \
+          ({% if url %}[{{ short }}]({{ url }}/commit/{{ commit.id }}){% else %}{{ short }}{% endif %})\
     {% endfor %}
 {% endfor %}\n
 """
@@ -42,28 +44,43 @@ trim = true
 
 [git]
 conventional_commits = true
-# a body right under its subject, which cog takes, set apart as git-cliff's parser needs it: its
-# footers (BREAKING CHANGE) read
-commit_preprocessors = [{ pattern = '\A([^\n]*)\n([^\n])', replace = "${1}\n\n${2}" }]
-# what cog lets through unconventional -- a fixup (cog.toml) -- left out
-filter_unconventional = true
+commit_preprocessors = [
+    # a body right under its subject, which cog takes, set apart as git-cliff's parser needs it:
+    # its footers (BREAKING CHANGE) read
+    { pattern = '\A([^\n]*)\n([^\n])', replace = "${1}\n\n${2}" },
+    # GitHub's markers that skip a commit's workflows, at a line's end: no changelog text
+    { pattern = '(?m)( *\[(skip ci|ci skip|no ci|skip actions|actions skip)\])+ *$', replace = "" },
+]
+# every commit to the parsers, then an unconventional one they keep fails the changelog: cog lets
+# through merges and fixups alone, which they skip (one that got past cog anyway: its SHA in
+# .cliffignore, which git-cliff skips). Filtered before the parsers instead, a merge warns as a
+# parse error
+require_conventional = true
 protect_breaking_commits = true # a breaking change is listed whatever its type, first
-# by type, in any case (cog takes `Feat:`), the HTML comments ordering the groups
+# every conventional commit, by type, in any case (cog takes `Feat:`); the HTML comments order the
+# groups, two digits as they sort as text
 commit_parsers = [
     # a merge, whatever its message: cog checks none (ignore_merge_commits)
     { field = "merge_commit", pattern = "true", skip = true },
-    { message = "^[a-zA-Z]+(\\([^)]*\\))?!:", group = "<!-- 0 -->Breaking changes" },
-    { footer = "^BREAKING[ -]CHANGE", group = "<!-- 0 -->Breaking changes" },
-    { message = "(?i)^(chore|ci|style)", skip = true },
-    { message = "(?i)^feat", group = "<!-- 1 -->Features" },
-    { message = "(?i)^fix", group = "<!-- 2 -->Fixes" },
-    { message = "(?i)^perf", group = "<!-- 3 -->Performance" },
-    { message = "(?i)^refactor", group = "<!-- 4 -->Refactoring" },
-    { message = "(?i)^build", group = "<!-- 5 -->Build" },
-    { message = "(?i)^doc", group = "<!-- 6 -->Documentation" },
-    { message = "(?i)^test", group = "<!-- 7 -->Tests" },
-    { message = "(?i)^revert", group = "<!-- 8 -->Reverts" },
-    { message = ".*", skip = true },
+    # what else cog lets through unconventional (ignore_fixup_commits)
+    { message = "^(fixup|squash|amend)!", skip = true },
+    # the release commit (`rake bump`'s), tagged: in its own section, which a later bump would
+    # rewrite once published
+    { message = "^chore\\(release\\): ", skip = true },
+    { message = "^[a-zA-Z]+(\\([^)]*\\))?!:", group = "<!-- 00 -->Breaking changes" },
+    { footer = "^BREAKING[ -]CHANGE", group = "<!-- 00 -->Breaking changes" },
+    { message = "(?i)^feat", group = "<!-- 01 -->Features" },
+    { message = "(?i)^fix", group = "<!-- 02 -->Fixes" },
+    { message = "(?i)^perf", group = "<!-- 03 -->Performance" },
+    { message = "(?i)^refactor", group = "<!-- 04 -->Refactoring" },
+    { message = "(?i)^build", group = "<!-- 05 -->Build" },
+    { message = "(?i)^doc", group = "<!-- 06 -->Documentation" },
+    { message = "(?i)^test", group = "<!-- 07 -->Tests" },
+    { message = "(?i)^revert", group = "<!-- 08 -->Reverts" },
+    { message = "(?i)^style", group = "<!-- 09 -->Styling" },
+    { message = "(?i)^(chore|ci)", group = "<!-- 10 -->Miscellaneous Tasks" },
+    # any other type cog takes
+    { message = ".*", group = "<!-- 11 -->Other" },
 ]
 sort_commits = "oldest"
 # the release tags, `v0.1.0` on (Bundler's own form, `rake release`)

data/template/dprint.json

@@ -1,23 +1,18 @@
-// Markdown and TOML (`rake dprint`, style-check-dprint.yml). The plugins pinned:
-// `dprint config update` moves them to their latest.
 {
   "markdown": {
     "textWrap": "maintain",
-    // the plugin's defaults are underscores
     "emphasisKind": "asterisks",
     "strongKind": "asterisks"
   },
-  // four spaces, as cliff.toml and cog.toml are written
   "toml": { "indentWidth": 4 },
   "excludes": [
-    // git-cliff's (cliff.toml): regenerated at each release, never edited
     "CHANGELOG.md",
     "coverage/",
     "pkg/",
     "vendor/"
   ],
   "plugins": [
-    "https://plugins.dprint.dev/markdown-0.26.0.wasm",
+    "https://plugins.dprint.dev/markdown-0.28.2.wasm",
     "https://plugins.dprint.dev/toml-0.9.0.wasm"
   ]
 }

data/template/flake.lock

@@ -2,11 +2,11 @@
   "nodes": {
     "nixpkgs": {
       "locked": {
-        "lastModified": 1792773339,
-        "narHash": "sha256-rZLrzrC6i+jnTAlvPZHogKDulY7WWDEv9hJeHieO7Zw=",
+        "lastModified": 1793540411,
+        "narHash": "sha256-fiPJ88izTVucjeo2EQ3jk4aWmLg03I1D4vxnX2QjEgE=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "3ec636362e1816bc2f0888fa0fa2c69f1bc9e504",
+        "rev": "0bb2eedc20e4739f29e8045034f2828ad7054f8f",
         "type": "github"
       },
       "original": {

data/template/flake.nix

@@ -1,15 +1,16 @@
 # The development shell, the gem as a package, and the checks that need no gem from the bundle:
 #
-#   nix develop      Ruby 4.0 and every tool `rake checks` runs besides the gems (Bundler's, from
+#   nix develop      Ruby 4.0 and every tool the Rakefile runs besides the gems (Bundler's, from
 #                    Gemfile.lock: `bin/setup`): cocogitto, git-cliff, dprint, shellcheck, shfmt,
-#                    actionlint, zizmor, nixfmt
+#                    actionlint, zizmor, nixfmt, lychee
 #   nix build        the gem, built from its gemspec and installed (nixpkgs' buildRubyGem);
 #                    with a command (exe/<name>): `nix run` runs it, and on Linux
 #                    `nix build .#image` builds it as an OCI image (image.yml publishes it)
 #   nix fmt          the Nix, by nixfmt
 #   nix flake check  the Nix format, the shell scripts (shellcheck, shfmt), the workflows
 #                    (actionlint, zizmor), the package and its library loaded -- and the command
-#                    run, and its image -- offline in the sandbox: git's files alone
+#                    run, and its image built -- and CITATION.cff where there is one (cffconvert);
+#                    offline in the sandbox: git's files alone
 #
 # Nothing here names the gem: its name is the gemspec's file; its version, lib/<path>/version.rb's
 # VERSION; its summary, homepage and licences, the gemspec's lines that set them.
@@ -36,7 +37,9 @@
         if lib.length gemspecs == 1 then
           lib.removeSuffix ".gemspec" (lib.head gemspecs)
         else
-          throw "flake.nix: one *.gemspec expected, found ${toString gemspecs}";
+          throw "flake.nix: one *.gemspec expected, found ${
+            if gemspecs == [ ] then "none" else toString gemspecs
+          }";
       path = lib.replaceStrings [ "-" ] [ "/" ] name;
       # the groups of the first of +file+'s lines that +pattern+ matches whole, or null
       line =
@@ -60,7 +63,7 @@
           found = line ''[[:space:]]*VERSION[[:space:]]*=[[:space:]]*"([^"]+)"${rest}'' ./lib/${path}/version.rb;
         in
         if found == null then
-          throw "flake.nix: no VERSION = \"...\" line in version.rb"
+          throw "flake.nix: no VERSION = \"...\" line in lib/${path}/version.rb"
         else
           lib.head found;
       # the SPDX identifiers of `spec.licenses = [...]` or `spec.license = "..."`
@@ -73,6 +76,7 @@
         else
           lib.concatLists (lib.filter lib.isList (builtins.split ''"([^"]*)"'' (lib.head found)));
       command = builtins.pathExists ./exe/${name};
+      citation = builtins.pathExists ./CITATION.cff;
 
       check =
         pkgs: checkName: tools: script:
@@ -91,6 +95,9 @@
           dependencies = [ ];
           package = pkgs.buildRubyGem {
             gemName = name;
+            # the root's: unset, buildRubyGem builds the first *.gemspec `find` lists, a test's
+            # fixture too
+            gemspec = "${name}.gemspec";
             inherit version ruby;
             src = self;
             gemPath = dependencies;
@@ -141,15 +148,17 @@
 
           checks = {
             format = check pkgs "format" [ pkgs.nixfmt ] "find . -name '*.nix' -exec nixfmt --check {} +";
-            # shfmt finds the scripts, by extension or shebang, and formats them as .editorconfig says
+            # shfmt finds the scripts, by extension or shebang, and checks them per .editorconfig
             shell = check pkgs "shell" [ pkgs.shellcheck pkgs.shfmt ] ''
-              shfmt --find . | xargs shellcheck
+              shfmt --find . | xargs -d '\n' shellcheck
               shfmt --diff .
             '';
             # actionlint runs shellcheck on each `run:` script too; zizmor audits Dependabot's
-            # configuration as well
+            # configuration as well. The workflows named: actionlint finds them in a git repository
+            # alone, and the sandbox has none
             workflows = check pkgs "workflows" [ pkgs.actionlint pkgs.shellcheck pkgs.zizmor ] ''
-              actionlint .github/workflows/*.yml
+              shopt -s nullglob
+              actionlint .github/workflows/*.{yml,yaml}
               zizmor --offline --quiet --strict-collection .
             '';
             inherit package;
@@ -186,6 +195,10 @@
                   touch $out
                 '';
           }
+          // lib.optionalAttrs citation {
+            # CFF's schema alone: Zenodo's import refuses more, which the generator never writes
+            citation = check pkgs "citation" [ pkgs.cffconvert ] "cffconvert --validate -i CITATION.cff";
+          }
           // lib.optionalAttrs linuxCommand { inherit image; };
 
           devShells.default = pkgs.mkShell {
@@ -199,10 +212,12 @@
               pkgs.actionlint
               pkgs.zizmor
               pkgs.nixfmt
+              pkgs.lychee
             ];
           };
         };
-      output = attribute: forAllSystems (pkgs: (perSystem pkgs).${attribute});
+      all = forAllSystems perSystem;
+      output = attribute: lib.mapAttrs (_: outputs: outputs.${attribute}) all;
     in
     {
       packages = output "packages";

data/template/lib/%path%/cli.rb.erb

@@ -3,43 +3,47 @@
 require "optparse"
 require_relative "../<%= File.basename(path) %>"
 
+<%# `::` where one of the gem's modules is named OptionParser, which its lookup would find first -%>
+<%- option_parser = "#{"::" if modules.include?("OptionParser")}OptionParser" -%>
 <%= nest(<<~RUBY)
-  # The command line: `#{name} [NAME]` prints the greeting.
+  # The command line, `#{name} [options] [NAME]`:
+  # it greets NAME, or prints the help or the version.
   module CLI
-    # Runs the command line with +argv+; returns the exit status.
+    # Runs the command line with +argv+.
+    # @param argv [Array<String>] the command's arguments
+    # @return [Integer] the exit status: 0, or 2 for an option refused, or more than one name
     def self.run(argv)
       options = { help: false, version: false }
-      names = parser.parse(argv, into: options)
-      puts output(options, names.first || "")
+      name, *others = parser.parse(argv, into: options)
+      raise #{option_parser}::NeedlessArgument.new(*others) unless others.empty?
+
+      puts output(options, name.to_s)
       0
-    rescue ::OptionParser::ParseError => e
-      warn e.message, parser.help
+    rescue #{option_parser}::ParseError => e
+      warn "#{name}: \#{e}", parser
       2
     end
 
-    # What +options+ ask for, the help or the version, else the greeting for +name+.
-    def self.output(options, name)
+    private_class_method def self.output(options, name)
       if options[:help]
-        parser.help
+        parser
       elsif options[:version]
         parser.ver
       else
         #{modules.last}.greeting(name)
       end
     end
-    private_class_method :output
 
-    # --help as an option of its own: OptionParser's built-in one exits the process. `::`: a module of
-    # the gem's could be named OptionParser
-    def self.parser
-      ::OptionParser.new("Usage: #{name} [options] [NAME]") do |opts|
+    # --help and --version as options of their own: OptionParser's own exit the process, as its
+    # shell completion still does (--*-completion-bash=WORD).
+    private_class_method def self.parser
+      #{option_parser}.new("Usage: #{name} [options] [NAME]") do |opts|
         opts.program_name = "#{name}"
         opts.version = VERSION
         opts.on("-h", "--help", "Print this help")
         opts.on("--version", "Print the version")
       end
     end
-    private_class_method :parser
   end
 RUBY
 -%>

data/template/lib/%path%/version.rb.erb

@@ -1,3 +1,3 @@
 # frozen_string_literal: true
 
-<%= nest(%(VERSION = "0.1.0"\n)) -%>
+<%= nest(%(# The gem's version.\nVERSION = "0.1.0"\n)) -%>

data/template/lib/%path%.rb.erb

@@ -3,7 +3,9 @@
 require_relative "<%= File.basename(path) %>/version"
 
 <%= nest(<<~RUBY, doc: summary)
-  # A greeting for +name+, its surrounding whitespace stripped; nobody named, the world.
+  # A greeting for +name+, its surrounding ASCII whitespace stripped; nobody named, the world.
+  # @param name [String] who to greet, "" for nobody
+  # @return [String]
   def self.greeting(name)
     who = name.strip
     who = "world" if who.empty?

data/template/sig/%path%.rbs.erb

@@ -8,7 +8,7 @@ RBS
   module CLI
     def self.run: (::Array[::String] argv) -> ::Integer
 
-    private def self.output: (::Hash[::Symbol, bool] options, ::String name) -> ::String?
+    private def self.output: (::Hash[::Symbol, bool] options, ::String name) -> (::OptionParser | ::String)?
 
     private def self.parser: () -> ::OptionParser
   end

data/template/test/test_%underscored%.rb.erb

@@ -15,12 +15,13 @@ class Test<%= constant.delete(":") %> < Minitest::Test
     assert_equal "Hello, world!", <%= constant %>.greeting(" \n")
   end
 
-  # A property, checked on many generated names (pbt): surrounding whitespace changes nothing.
+  # A property, checked on many generated names and whitespace around them (pbt).
   def test_surrounding_whitespace_changes_nothing
     gem = <%= constant %>
+    whitespace = Pbt.array(Pbt.one_of(*" \t\n\v\f\r".chars))
     Pbt.assert do
-      Pbt.property(Pbt.printable_string) do |name|
-        assert_equal gem.greeting(name), gem.greeting(" #{name}\n")
+      Pbt.property(Pbt.printable_string, whitespace, whitespace) do |name, before, after|
+        assert_equal gem.greeting(name), gem.greeting("#{before.join}#{name}#{after.join}")
       end
     end
   end

data/template/test/test_cli.rb.erb

@@ -4,7 +4,6 @@ require "test_helper"
 require "<%= path %>/cli"
 
 class Test<%= constant.delete(":") %>CLI < Minitest::Test
-  # no module of the gem's can be named so: its names have no `_`
   COMMAND_LINE = <%= constant %>::CLI
 
   def test_it_greets_the_name_given
@@ -15,26 +14,52 @@ class Test<%= constant.delete(":") %>CLI < Minitest::Test
     assert_output("Hello, world!\n") { assert_equal 0, COMMAND_LINE.run([]) }
   end
 
-  def test_version
+  def test_it_prints_its_version
     expected = "<%= name %> #{<%= constant %>::VERSION}\n"
-    assert_output(expected) { assert_equal 0, COMMAND_LINE.run(["--version"]) }
+    assert_output(expected) { assert_equal 0, command("--version") }
   end
 
-  def test_help
-    usage = /\AUsage: <%= name %> \[options\] \[NAME\]\n/
-
-    assert_output(usage) { assert_equal 0, COMMAND_LINE.run(["--help"]) }
+  def test_it_prints_its_help
+    help = <<~HELP
+      Usage: <%= name %> [options] [NAME]
+          -h, --help                       Print this help
+              --version                    Print the version
+    HELP
+    %w[-h --help].each { |option| assert_output(help) { assert_equal 0, command(option) } }
   end
 
   def test_an_unknown_option_is_refused
-    assert_output("", /invalid option: --nope/) { assert_equal 2, COMMAND_LINE.run(["--nope"]) }
+    assert_output("", /\A<%= name %>: invalid option: --nope\nUsage: /) do
+      assert_equal 2, COMMAND_LINE.run(["--nope"])
+    end
+  end
+
+  def test_more_than_one_name_is_refused
+    assert_output("", /\A<%= name %>: needless argument: Bob\n/) do
+      assert_equal 2, COMMAND_LINE.run(%w[Ada Bob])
+    end
   end
 
-  def test_the_executable_runs_it
-    executable = File.expand_path("../exe/<%= name %>", __dir__)
+  def test_the_executable_runs_it_and_exits_with_its_status
+    assert_equal ["Hello, Ada!\n", 0], executable("Ada")
+    assert_equal 2, executable("--nope").last
+  end
+
+  private
+
+  # exe/<%= name %>'s output, and its exit status
+  def executable(*argv)
+    exe = File.expand_path("../exe/<%= name %>", __dir__)
     lib = File.expand_path("../lib", __dir__)
-    out, = capture_subprocess_io { system(RbConfig.ruby, "-I", lib, executable, "Ada", exception: true) }
+    out, = capture_subprocess_io { system(RbConfig.ruby, "-I", lib, exe, *argv) }
+    [out, Process.last_status.exitstatus]
+  end
 
-    assert_equal "Hello, Ada!\n", out
+  # OptionParser's own --help and --version print as these do, then exit the process: the command
+  # returns its status instead
+  def command(option)
+    COMMAND_LINE.run([option])
+  rescue SystemExit
+    flunk "#{option} exited the process"
   end
 end

data/template/test/test_helper.rb.erb

@@ -1,13 +1,21 @@
 # frozen_string_literal: true
 
-# Coverage first, before lib/ loads: every line, branch and method of it, a file the tests never
-# load included (`cover`). But version.rb: the gemspec requires it, as Bundler reads the gemspec
-# before any test runs -- a constant alone.
-require "simplecov"
-SimpleCov.start "strict" do
-  cover "lib/**/*.rb"
-  skip "lib/<%= path %>/version.rb"
+# A warning Ruby reports from lib/ or the tests raises, failing the test, or the run when they load;
+# a gem's only prints. Every category is on: `ruby -w` turns on the deprecations alone.
+ours = [File.expand_path("../lib", __dir__), __dir__].map { "#{it}/" }
+# Anonymous: a constant would be the module of a gem named for it (own_warnings' OwnWarnings)
+own_warnings = Module.new do
+  define_method(:warn) do |message, **options|
+    # "PATH:LINE: ..." or, evaluated code's, "(eval at PATH:LINE):LINE: ..."; PATH relative or
+    # absolute (Windows': C:/...)
+    path = message[/\A(?:\(eval at )*(.+?):\d+[:)]/, 1]
+    raise message if path && File.expand_path(path).start_with?(*ours)
+
+    super(message, **options)
+  end
 end
+Warning.singleton_class.prepend(own_warnings)
+Warning.categories.each { Warning[it] = true }
 
 require "<%= path %>"
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: veragem
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.2.0
 platform: ruby
 authors:
 - veralvx
@@ -11,27 +11,34 @@ date: 1980-01-02 00:00:00.000000000 Z
 dependencies: []
 description: 'A Bundler plugin that generates a Ruby 4.0+ gem with what `bundle gem`
   gives and the rest: Steep and TypeProf, RuboCop and its extensions, Minitest with
-  a 100% coverage gate and property tests, bundler-audit, Conventional Commits, a
-  generated changelog, a Nix flake, and a release by Trusted Publishing.'
+  a 100% coverage gate, property tests and mutation testing, YARD held by yard-lint,
+  bundler-audit, Conventional Commits, a generated changelog, a Nix flake, and a release
+  by Trusted Publishing.'
 executables: []
 extensions: []
 extra_rdoc_files: []
 files:
 - CHANGELOG.md
+- Gemfile.lock
 - LICENSE-APACHE
 - LICENSE-MIT
 - README.md
 - lib/veragem.rb
+- lib/veragem/citation.rb
 - lib/veragem/generator.rb
+- lib/veragem/license.rb
 - lib/veragem/name.rb
 - lib/veragem/options.rb
 - lib/veragem/project.rb
+- lib/veragem/questions.rb
+- lib/veragem/summary.rb
 - lib/veragem/version.rb
 - plugins.rb
 - sig/bundler.rbs
 - sig/veragem.rbs
 - template/%name%.gemspec.erb
 - template/.editorconfig
+- template/.gitattributes
 - template/.githooks/commit-msg
 - template/.githooks/pre-commit
 - template/.githooks/pre-push
@@ -46,16 +53,21 @@ files:
 - template/.github/workflows/dependabot-automerge.yml
 - template/.github/workflows/dependency-review.yml
 - template/.github/workflows/image.yml
+- template/.github/workflows/links.yml
 - template/.github/workflows/nix.yml
 - template/.github/workflows/release.yml
-- template/.github/workflows/rubocop-autocorrect.yml
 - template/.github/workflows/ruby-ci.yml
 - template/.github/workflows/security.yml
 - template/.github/workflows/style-check-cocogitto.yml
 - template/.github/workflows/style-check-dprint.yml
 - template/.gitignore
+- template/.mutineer.yml
 - template/.rubocop.yml
+- template/.simplecov.erb
+- template/.yard-lint.yml
+- template/.yardopts
 - template/AGENTS.md.erb
+- template/CITATION.cff.erb
 - template/CODE_OF_CONDUCT.md.erb
 - template/CONTRIBUTING.md.erb
 - template/Gemfile

data/template/.github/workflows/rubocop-autocorrect.yml

@@ -1,114 +0,0 @@
-# A Dependabot pull request that moves Gemfile.lock gets RuboCop's safe corrections
-# (`rake rubocop:autocorrect`), when the bumped RuboCop finds any, as a commit of their own on its
-# branch, then merges as any bump once its checks pass. No token is stored: the job's GITHUB_TOKEN
-# pushes, and GitHub may hold the checks of that token's commit until a maintainer approves them
-# (the pull request's "Approve workflows to run"); no workflow can start them sooner -- dispatched,
-# theirs are not the pull request's required checks. `[dependabot skip]`: Dependabot rebases the
-# bump still, over the commit, and this workflow corrects the new one.
-name: RuboCop Autocorrect
-
-on:
-  pull_request:
-    paths:
-      - "Gemfile.lock"
-
-permissions: {}
-
-jobs:
-  correct:
-    name: Safe corrections
-    # Dependabot's own branches alone: never a fork's, never a person's pull request
-    if: >-
-      github.event.pull_request.user.login == 'dependabot[bot]' &&
-      github.event.pull_request.head.repo.full_name == github.repository
-    runs-on: ubuntu-latest
-    # the bumped gems run here, so this job's token writes nothing: the next job, which pushes,
-    # runs no gem
-    permissions:
-      contents: read
-    outputs:
-      changed: ${{ steps.correct.outputs.changed }}
-    steps:
-      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          ref: ${{ github.event.pull_request.head.sha }}
-          persist-credentials: false
-
-      - name: Set up Ruby
-        uses: ruby/setup-ruby@7f797815d8adceb1c412e7abefdd1ab4abc47a5f # v1.335.0
-        with:
-          ruby-version: "4.0"
-          bundler-cache: true
-
-      - name: RuboCop's safe corrections
-        id: correct
-        run: |
-          set -euo pipefail
-          # what is left once corrected fails CI's own RuboCop, for a person to fix
-          bundle exec rake rubocop:autocorrect || true
-          git diff --binary > "$RUNNER_TEMP/corrections.patch"
-          if [[ -s $RUNNER_TEMP/corrections.patch ]]; then
-            echo "changed=true" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Keep the corrections
-        if: steps.correct.outputs.changed == 'true'
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
-        with:
-          name: corrections
-          path: ${{ runner.temp }}/corrections.patch
-          if-no-files-found: error
-
-  push:
-    name: Commit them
-    needs: correct
-    if: needs.correct.outputs.changed == 'true'
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-    steps:
-      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          ref: ${{ github.event.pull_request.head.ref }}
-          # the push below uses it
-          persist-credentials: true
-
-      - name: The corrections
-        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
-        with:
-          name: corrections
-          path: ${{ runner.temp }}
-
-      - name: Commit and push
-        env:
-          BRANCH: ${{ github.event.pull_request.head.ref }}
-          CORRECTED: ${{ github.event.pull_request.head.sha }}
-          PATCH: ${{ runner.temp }}/corrections.patch
-        run: |
-          set -euo pipefail
-          # corrections of the commit they were made on: on a newer one, Dependabot's or these
-          # corrections', a re-run has nothing to do
-          if [[ $(git rev-parse HEAD) != "$CORRECTED" ]]; then
-            echo "$BRANCH is past $CORRECTED: corrected already, or a newer commit its own run corrects"
-            exit 0
-          fi
-          # RuboCop's files alone, edited in place: nothing else the bumped gems could write
-          ruby_files='^([^/]+/)*([^/]+\.(rb|gemspec)|Gemfile|Rakefile|Steepfile|(bin|exe)/[^/]+)$'
-          if [[ -n $(git apply --summary "$PATCH") ]] ||
-            git apply --numstat "$PATCH" | cut -f 3 | grep -Ev "$ruby_files"; then
-            echo "::error::the corrections change more than RuboCop's files, in place: not committed"
-            exit 1
-          fi
-          git apply "$PATCH"
-          git -c user.name="github-actions[bot]" \
-            -c user.email="41898282+github-actions[bot]@users.noreply.github.com" \
-            commit --all --quiet --message "style: apply RuboCop's safe corrections [dependabot skip]"
-          if ! git push origin "HEAD:$BRANCH"; then
-            # refused because Dependabot pushed meanwhile, whose own run corrects its commit;
-            # refused otherwise, a failure
-            remote=$(git ls-remote origin "refs/heads/$BRANCH" | cut -f 1)
-            if [[ $remote == "$CORRECTED" ]]; then exit 1; fi
-            echo "$BRANCH moved on: its own run corrects it"
-          fi