Pull Upstream

.github/CODEOWNERS

@@ -0,0 +1,12 @@
+# Default to requesting pull request reviews from the Heroku Languages team.
+#ECCN:Open Source
+#GUSINFO:Heroku - Languages,Heroku Ruby Platform
+* @heroku/languages
+
+# However, request review from the language owner instead for files that are updated
+# by Dependabot or release automation, to reduce team review request noise.
+CHANGELOG.md @schneems
+Gemfile.lock @schneems
+/.github/workflows/ @schneems
+/changelogs/ @schneems
+/lib/language_pack/version.rb @schneems

.github/dependabot.yml

@@ -0,0 +1,24 @@
+version: 2
+updates:
+  - package-ecosystem: "bundler"
+    directory: "/"
+    open-pull-requests-limit: 1 # Limit concurrent CI runs from executing, do not remove
+    schedule:
+      interval: "monthly"
+    labels:
+      - "dependencies"
+      - "ruby"
+      - "skip changelog"
+    groups:
+      ruby-dependencies:
+        update-types:
+          - "minor"
+          - "patch"
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    labels:
+      - "dependencies"
+      - "github actions"
+      - "skip changelog"

.github/workflows/check_changelog.yml

@@ -0,0 +1,20 @@
+name: Check Changelog
+
+on:
+  pull_request:
+    types: [opened, reopened, labeled, unlabeled, synchronize]
+
+permissions:
+  contents: read
+
+jobs:
+  check-changelog:
+    runs-on: ubuntu-latest
+    if: (!contains(github.event.pull_request.labels.*.name, 'skip changelog'))
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+      - name: Check that CHANGELOG is touched
+        run: |
+          git fetch origin ${{ github.base_ref }} --depth 1 && \
+          git diff remotes/origin/${{ github.base_ref }} --name-only | grep CHANGELOG.md

.github/workflows/ci.yml

@@ -0,0 +1,56 @@
+name: CI
+
+on:
+  push:
+    # Avoid duplicate builds on PRs.
+    branches:
+      - main
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+      - name: Install Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          bundler-cache: true
+          ruby-version: "3.3.9"
+      - name: Run StandardRB
+        run: bundle exec standardrb
+      - name: Run ShellCheck bin top level
+        run: |
+            # All bash files that don't end in '.rb'
+            # https://git-scm.com/docs/gitglossary#Documentation/gitglossary.txt-aiddefpathspecapathspec
+            git ls-files -z --cached --others --exclude-standard ':(exclude)*.rb' 'bin/*' '*/bin/*' '*.sh' | \
+              xargs -0 shellcheck --check-sourced --color=always
+
+  integration-test:
+      runs-on: ubuntu-24.04
+      env:
+        HATCHET_APP_LIMIT: 300
+        HATCHET_EXPENSIVE_MODE: 1
+        HEROKU_API_KEY: ${{ secrets.HEROKU_API_KEY }}
+        HEROKU_API_USER: ${{ secrets.HEROKU_API_USER }}
+        RAILS_LTS_CREDS: ${{ secrets.RAILS_LTS_CREDS }}
+        HEROKU_DISABLE_AUTOUPDATE: 1
+        PARALLEL_SPLIT_TEST_PROCESSES: 85
+        RSPEC_RETRY_RETRY_COUNT: 1
+      steps:
+        - name: Checkout
+          uses: actions/checkout@v7
+        - name: Install Ruby and dependencies
+          uses: ruby/setup-ruby@v1
+          with:
+            bundler-cache: true
+            ruby-version: "3.3.9"
+        - name: Hatchet setup
+          run: bundle exec hatchet ci:setup
+        - name: Run Hatchet integration tests
+          # parallel_split_test runs rspec in parallel, with concurrency equal to PARALLEL_SPLIT_TEST_PROCESSES.
+          run: bundle exec parallel_split_test spec/

.github/workflows/document_ruby_version.yml

@@ -0,0 +1,43 @@
+name: Add Ruby version to changelog && prepare release
+run-name: "Add ${{ inputs.is_jruby && 'J' || ''}}Ruby ${{ inputs.ruby_version }} to the CHANGELOG.md and prepare a release"
+
+on:
+  workflow_dispatch:
+    inputs:
+      ruby_version:
+          description: "The Ruby version to announce"
+          type: string
+          required: true
+      is_jruby:
+          description: "JRuby release? (as opposed to MRI)"
+          type: boolean
+          default: false
+          required: false
+
+# Disable all GITHUB_TOKEN permissions, since the GitHub App token is used instead.
+permissions: {}
+
+jobs:
+  prepare-release:
+    uses: heroku/languages-github-actions/.github/workflows/_classic-buildpack-prepare-release.yml@latest
+    secrets: inherit
+    with:
+      custom_update_command: |
+        set -euo pipefail
+        DATE_TODAY="$(date --utc --iso-8601)"
+
+        sed --in-place "/## \[v${NEW_VERSION}\] - ${DATE_TODAY}/a\\
+        \\
+        - ${{ inputs.is_jruby && 'J' || ''}}Ruby ${{inputs.ruby_version}} is now available" CHANGELOG.md
+
+        sed --in-place --regexp-extended \
+          --expression "s/v${EXISTING_VERSION}/v${NEW_VERSION}/" \
+          lib/language_pack/version.rb
+
+        if compgen -G 'changelogs/unreleased/*.md' > /dev/null; then
+          # The unreleased changelogs directory contains a `.gitkeep` file, so we have to
+          # copy the markdown files individually instead of renaming the directory.
+          NEW_CHANGELOG_DIR="changelogs/v${NEW_VERSION}/"
+          mkdir -p "${NEW_CHANGELOG_DIR}"
+          mv changelogs/unreleased/*.md "${NEW_CHANGELOG_DIR}"
+        fi

.github/workflows/hatchet_app_cleaner.yml

@@ -0,0 +1,31 @@
+name: Hatchet app cleaner
+
+on:
+  schedule:
+    # Daily at 6am UTC.
+    - cron: "0 6 * * *"
+  # Allow the workflow to be manually triggered too.
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  hatchet-app-cleaner:
+    runs-on: ubuntu-latest
+    env:
+      HEROKU_API_KEY: ${{ secrets.HEROKU_API_KEY }}
+      HEROKU_API_USER: ${{ secrets.HEROKU_API_USER }}
+      HEROKU_DISABLE_AUTOUPDATE: 1
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+      - name: Install Ruby and dependencies
+        uses: ruby/setup-ruby@v1
+        with:
+          bundler-cache: true
+          ruby-version: "3.3.9"
+      - name: Run Hatchet destroy
+        # Only apps older than 10 minutes are destroyed, to ensure that any
+        # in progress CI runs are not interrupted.
+        run: bundle exec hatchet destroy --older-than 10

.github/workflows/prepare-release.yml

@@ -0,0 +1,27 @@
+name: Prepare Release
+
+on:
+  workflow_dispatch:
+
+# Disable all GITHUB_TOKEN permissions, since the GitHub App token is used instead.
+permissions: {}
+
+jobs:
+  prepare-release:
+    uses: heroku/languages-github-actions/.github/workflows/_classic-buildpack-prepare-release.yml@latest
+    secrets: inherit
+    with:
+      custom_update_command: |
+        set -euo pipefail
+
+        sed --in-place --regexp-extended \
+          --expression "s/v${EXISTING_VERSION}/v${NEW_VERSION}/" \
+          lib/language_pack/version.rb
+
+        if compgen -G 'changelogs/unreleased/*.md' > /dev/null; then
+          # The unreleased changelogs directory contains a `.gitkeep` file, so we have to
+          # copy the markdown files individually instead of renaming the directory.
+          NEW_CHANGELOG_DIR="changelogs/v${NEW_VERSION}/"
+          mkdir -p "${NEW_CHANGELOG_DIR}"
+          mv changelogs/unreleased/*.md "${NEW_CHANGELOG_DIR}"
+        fi

.github/workflows/release.yml

@@ -0,0 +1,36 @@
+name: Release Buildpack
+
+on:
+  # Auto-trigger when the "Prepare release" PR (created by the
+  # _classic-buildpack-prepare-release.yml workflow) is merged.
+  pull_request:
+    branches:
+      - main
+    types:
+      - closed
+  workflow_dispatch:
+
+permissions:
+  id-token: write
+  contents: write
+
+jobs:
+  release:
+    name: Release
+    # On `pull_request`, only run for the merged auto-generated
+    # "Prepare release" PR (branch name set by
+    # _classic-buildpack-prepare-release.yml). Manual dispatches always run.
+    if: >-
+      github.event_name == 'workflow_dispatch' ||
+      (github.event.pull_request.merged == true &&
+       github.event.pull_request.head.repo.full_name == github.repository &&
+       github.event.pull_request.head.ref == 'prepare-release' &&
+       github.event.pull_request.user.login == 'heroku-linguist[bot]')
+    uses: heroku/languages-github-actions/.github/workflows/_classic-buildpack-publish.yml@latest
+    with:
+      buildpack_id: "heroku/ruby"
+      app_id: ${{ vars.LINGUIST_GH_APP_ID }}
+    secrets:
+      app_private_key: ${{ secrets.LINGUIST_GH_PRIVATE_KEY }}
+      slack_webhook_url: ${{ secrets.BUILDPACK_RELEASE_FAILURE_WEBHOOK_URL }}
+      honeycomb_api_key: ${{ secrets.HONEYCOMB_API_KEY }}

.gitignore

@@ -6,3 +6,6 @@ vendor/bundle/*
 .ruby-version
 buildpacks/*
 .anvil/
+tmp/*.log
+log/*.log
+spec/examples.txt

.standard.yml

@@ -0,0 +1,7 @@
+# StandardRB configuration
+# https://github.com/standardrb/standard
+
+ignore:
+  - "repos/**/*"  # Test fixture repos (external Rails apps for integration tests)
+  - "lib/language_pack/ruby.rb":
+    - Lint/IneffectiveAccessModifier  # Class methods after `private` are intentionally public; private only affects instance methods