Ensure Bundler 2.2+ is used for all Rubies which support Bundler 2 (Ruby >= 2.3)

Restrict the GitHub token permissions only to the required ones; this way, even if the attackers will succeed in compromising your workflow, they won’t be able to do much.

- Included permissions for the action. https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions

https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions

https://docs.github.com/en/actions/using-jobs/assigning-permissions-to-jobs

[Keeping your GitHub Actions and workflows secure Part 1: Preventing pwn requests](https://securitylab.github.com/research/github-actions-preventing-pwn-requests/)

Signed-off-by: neilnaveen <42328488+neilnaveen@users.noreply.github.com>

.github/FUNDING.yml

@@ -0,0 +1 @@
+github: [eregon]

.github/workflows/release.yml

@@ -1,12 +1,17 @@
 name: Update the v1 branch when a release is published
 on:
   release:
+    permissions:
+      contents: write  # for Git to git push
     types: [published]
+permissions:
+  contents: read
+
 jobs:
   release:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v3
       with:
         fetch-depth: 0
     - run: git push origin HEAD:v1

.github/workflows/test.yml

@@ -9,6 +9,8 @@ on:
     paths-ignore:
     - README.md
   workflow_dispatch:
+permissions:
+  contents: read
 
 jobs:
   test:
@@ -44,7 +46,7 @@ jobs:
     name: ${{ matrix.os }} ${{ matrix.ruby }}
     runs-on: ${{ matrix.os }}
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v3
 
     - uses: ./
       with:
@@ -71,6 +73,8 @@ jobs:
           } else {
             echo 'ridk is unavailable'
           }
+        } elseif ($plat.Contains('mswin')) {
+          &"$env:VCPKG_INSTALLATION_ROOT\vcpkg" list
         }
     - name: RbConfig::CONFIG
       run: ruby -rrbconfig -rpp -e 'pp RbConfig::CONFIG'
@@ -96,6 +100,11 @@ jobs:
     - run: bundle exec rake --version
     - run: bundle exec rake
 
+    - name: Test `gem github:` in a Gemfile
+      run: bundle install
+      env:
+        BUNDLE_GEMFILE: ${{ github.workspace }}/gemfiles/gem_from_github.gemfile
+
     - name: which ruby, rake
       if: "!startsWith(matrix.os, 'windows')"
       run: which -a ruby rake
@@ -121,7 +130,7 @@ jobs:
     name: "Test rubygems: latest upgrades the default RubyGems version"
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v3
     - uses: ./
       with:
         ruby-version: '2.6'
@@ -132,7 +141,7 @@ jobs:
     name: "Test rubygems: version upgrades RubyGems to that version if the default is older"
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v3
     - uses: ./
       with:
         ruby-version: '2.6'
@@ -143,7 +152,7 @@ jobs:
     name: "Test rubygems: version noops if the default is newer"
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v3
     - uses: ./
       with:
         ruby-version: '3.1.0'
@@ -154,7 +163,7 @@ jobs:
     name: "Test rubygems: version uses the Bundler installed by the rubygems update"
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
       - uses: ./
         with:
           ruby-version: '2.2'
@@ -166,7 +175,7 @@ jobs:
     name: "Test bundler: 1.x for old Ruby"
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
       - uses: ./
         with:
           ruby-version: '2.2'
@@ -177,7 +186,7 @@ jobs:
     name: "Test with a major Bundler version"
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v3
     - uses: ./
       with:
         ruby-version: '2.6'
@@ -188,7 +197,7 @@ jobs:
     name: "Test with a minor Bundler version"
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v3
     - uses: ./
       with:
         ruby-version: '2.6'
@@ -199,7 +208,7 @@ jobs:
     name: "Test with an exact Bundler version"
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v3
     - uses: ./
       with:
         ruby-version: '2.6'
@@ -212,7 +221,7 @@ jobs:
     env:
       BUNDLE_GEMFILE: ${{ github.workspace }}/gemfiles/bundler1.gemfile
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
       - uses: ./
         with:
           ruby-version: '2.7'
@@ -230,7 +239,7 @@ jobs:
     env:
       BUNDLE_GEMFILE: ${{ github.workspace }}/gemfiles/${{ matrix.gemfile }}.gemfile
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
       - uses: ./
         with:
           ruby-version: '2.6'
@@ -243,7 +252,7 @@ jobs:
     env:
       BUNDLE_GEMFILE: ${{ github.workspace }}/gemfiles/nokogiri.gemfile
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
       - uses: ./
         with:
           ruby-version: truffleruby-head
@@ -253,7 +262,7 @@ jobs:
   lint:
     runs-on: ubuntu-20.04
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v3
     - run: yarn install
     - run: yarn run package
     - name: Check generated files are up to date

README.md

@@ -15,9 +15,9 @@ This action currently supports these versions of MRI, JRuby and TruffleRuby:
 | Interpreter | Versions |
 | ----------- | -------- |
 | `ruby` | 1.9.3, 2.0.0, 2.1.9, 2.2, all versions from 2.3.0 until 3.2.0-preview1, head, debug, mingw, mswin |
-| `jruby` | 9.1.17.0 - 9.3.4.0, head |
-| `truffleruby` | 19.3.0 - 22.1.0, head |
-| `truffleruby+graalvm` | 21.2.0 - 22.1.0, head |
+| `jruby` | 9.1.17.0 - 9.3.6.0, head |
+| `truffleruby` | 19.3.0 - 22.2.0, head |
+| `truffleruby+graalvm` | 21.2.0 - 22.2.0, head |
 
 `ruby-debug` is the same as `ruby-head` but with assertions enabled (`-DRUBY_DEBUG=1`).  
 On Windows, `mingw` and `mswin` are `ruby-head` builds using the MSYS2/MinGW and the MSVC toolchains respectively.
@@ -39,11 +39,11 @@ The action works on these [GitHub-hosted runners](https://help.github.com/en/act
 
 | Operating System | Recommended | Other Supported Versions |
 | ----------- | -------- | -------- |
-| Ubuntu  | `ubuntu-latest`  (= `ubuntu-20.04`) | `ubuntu-18.04`, `ubuntu-22.04` (beta, only `ruby: 3.1 - head`) |
+| Ubuntu  | `ubuntu-latest`  (= `ubuntu-20.04`) | `ubuntu-18.04`, `ubuntu-22.04` (beta, only `ruby: 3.1 - head, truffleruby`) |
 | macOS   | `macos-latest`   (= `macos-11`)  | `macos-10.15`, `macos-12` (beta) |
 | Windows | `windows-latest` (= `windows-2022`) | `windows-2019` |
 
-On `ubuntu-22.04` (beta), only `ruby: 3.1 - head` are supported, due to Ubuntu 22.04 only supporting OpenSSL 3.
+On `ubuntu-22.04` (beta), only `ruby: 3.1 - head, truffleruby` are supported, due to Ubuntu 22.04 only supporting OpenSSL 3.
 
 The prebuilt releases are generated by [ruby-builder](https://github.com/ruby/ruby-builder)
 and on Windows by [RubyInstaller2](https://github.com/oneclick/rubyinstaller2).
@@ -66,7 +66,7 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v3
     - uses: ruby/setup-ruby@v1
       with:
         ruby-version: '3.0' # Not needed with a .ruby-version file
@@ -91,7 +91,7 @@ jobs:
         ruby: ['2.7', '3.0', '3.1', head, jruby, jruby-head, truffleruby, truffleruby-head]
     runs-on: ${{ matrix.os }}
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v3
     - uses: ruby/setup-ruby@v1
       with:
         ruby-version: ${{ matrix.ruby }}
@@ -114,7 +114,7 @@ jobs:
     env: # $BUNDLE_GEMFILE must be set at the job level, so it is set for all steps
       BUNDLE_GEMFILE: ${{ github.workspace }}/gemfiles/${{ matrix.gemfile }}.gemfile
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
       - uses: ruby/setup-ruby@v1
         with:
           ruby-version: '3.0'
@@ -155,9 +155,12 @@ should be able to fix them by setting `rubygems: 3.0.0` or higher.
 
 ### Bundler
 
-By default, if there is a `Gemfile.lock` file (or `$BUNDLE_GEMFILE.lock` or `gems.locked`) with a `BUNDLED WITH` section,
-that version of Bundler will be installed and used.
-Otherwise, the latest compatible Bundler version is installed (Bundler 2 on Ruby >= 2.4, Bundler 1 on Ruby < 2.4).
+By default, Bundler is installed as follows:
+
+* If there is a `Gemfile.lock` file (or `$BUNDLE_GEMFILE.lock` or `gems.locked`) with a `BUNDLED WITH` section,
+  that version of Bundler will be installed and used.
+* If the Ruby ships with Bundler 2.2+ (as a default gem), that version is used.
+* Otherwise, the latest compatible Bundler version is installed (Bundler 2 on Ruby >= 2.3, Bundler 1 on Ruby < 2.3).
 
 This behavior can be customized, see [action.yml](action.yml) for more details about the `bundler` input.
 
@@ -228,6 +231,7 @@ It is recommended to first get your build working on Ubuntu and macOS before try
 * For Ruby ≥ 2.4, MSYS2 is prepended to the `Path`, similar to what RubyInstaller2 does.
 * For Ruby < 2.4, the DevKit MSYS tools are installed and prepended to the `Path`.
 * Use JRuby 9.2.20+ on Windows (older versions have [bugs](https://github.com/ruby/setup-ruby/issues/18#issuecomment-889072695)).
+* JRuby on Windows has multiple issues ([jruby/jruby#7106](https://github.com/jruby/jruby/issues/7106), [jruby/jruby#7182](https://github.com/jruby/jruby/issues/7182)).
 
 ## Versioning
 

action.yml

@@ -16,9 +16,11 @@ inputs:
       Similarly, if a version number is given, `gem update --system <version>` is run to update to that version of RubyGems, as long as that version is newer than the one provided by default.
   bundler:
     description: |
-      The version of Bundler to install. Either 'none', 'latest', 'Gemfile.lock', or a version number (e.g., 1, 2, 2.1, 2.1.4).
-      For 'Gemfile.lock', the version is determined based on the BUNDLED WITH section from the file Gemfile.lock, $BUNDLE_GEMFILE.lock or gems.locked.
-      Defaults to 'default', which means 'Gemfile.lock' if the file exists and 'latest' otherwise.
+      The version of Bundler to install. Either 'Gemfile.lock' (the default), 'default', 'latest', 'none', or a version number (e.g., 1, 2, 2.1, 2.1.4).
+      For 'Gemfile.lock', the version of the BUNDLED WITH section from the Gemfile.lock if it exists. If the file or section does not exist then the same as 'default'.
+      For 'default', if the Ruby ships with Bundler 2.2+ as a default gem, that version is used, otherwise the same as 'latest'.
+      For 'latest', the latest compatible Bundler version is installed (Bundler 2 on Ruby >= 2.3, Bundler 1 on Ruby < 2.3).
+      For 'none', nothing is done.
   bundler-cache:
     description: 'Run "bundle install", and cache the result automatically. Either true or false.'
     default: 'false'

bundler.js

@@ -53,15 +53,34 @@ async function afterLockFile(lockFile, platform, engine, rubyVersion) {
 export async function installBundler(bundlerVersionInput, rubygemsInputSet, lockFile, platform, rubyPrefix, engine, rubyVersion) {
   let bundlerVersion = bundlerVersionInput
 
-  if (rubygemsInputSet && bundlerVersion === 'default') {
+  if (rubygemsInputSet && (bundlerVersion === 'default' || bundlerVersion === 'Gemfile.lock')) {
     console.log('Using the Bundler installed by updating RubyGems')
     return 'unknown'
   }
 
-  if (bundlerVersion === 'default' || bundlerVersion === 'Gemfile.lock') {
-    bundlerVersion = readBundledWithFromGemfileLock(lockFile)
+  if (bundlerVersion === 'Gemfile.lock') {
+    let bundlerVersionFromGemfileLock = readBundledWithFromGemfileLock(lockFile)
 
-    if (!bundlerVersion) {
+    if (bundlerVersionFromGemfileLock) {
+      bundlerVersion = bundlerVersionFromGemfileLock
+    } else {
+      bundlerVersion = 'default'
+    }
+  }
+
+  const floatVersion = common.floatVersion(rubyVersion)
+
+  if (bundlerVersion === 'default') {
+    if (common.isBundler2dot2Default(engine, rubyVersion)) {
+      console.log(`Using Bundler 2 shipped with ${engine}-${rubyVersion}`)
+      return '2'
+    } else if (common.hasBundlerDefaultGem(engine, rubyVersion)) {
+      // Those Rubies have a old Bundler default gem < 2.2 which does not work well for `gem 'foo', github: 'foo/foo'`:
+      // https://github.com/ruby/setup-ruby/issues/358#issuecomment-1195899304
+      // Also, Ruby 2.6 would get Bundler 1 yet Ruby 2.3 - 2.5 get latest Bundler 2 which might be unexpected.
+      console.log(`Using latest Bundler for ${engine}-${rubyVersion} because the default Bundler gem is too old for that Ruby version`)
+      bundlerVersion = 'latest'
+    } else {
       bundlerVersion = 'latest'
     }
   }
@@ -76,8 +95,6 @@ export async function installBundler(bundlerVersionInput, rubygemsInputSet, lock
     throw new Error(`Cannot parse bundler input: ${bundlerVersion}`)
   }
 
-  const floatVersion = common.floatVersion(rubyVersion)
-
   // Use Bundler 1 when we know Bundler 2 does not work
   if (bundlerVersion.startsWith('2')) {
     if (engine === 'ruby' && floatVersion <= 2.2) {
@@ -92,30 +109,14 @@ export async function installBundler(bundlerVersionInput, rubygemsInputSet, lock
     }
   }
 
-  // Workaround for truffleruby 22.0 + latest Bundler, use shipped Bundler instead: https://github.com/oracle/truffleruby/issues/2586
-  const truffleruby22workaround = engine.startsWith('truffleruby') && rubyVersion.startsWith('22.0')
-  const useShippedBundler2 = common.isHeadVersion(rubyVersion) || truffleruby22workaround
+  const gem = path.join(rubyPrefix, 'bin', 'gem')
+  // Workaround for https://github.com/rubygems/rubygems/issues/5245
+  const force = (platform.startsWith('windows-') && engine === 'ruby' && floatVersion >= 3.1) ? ['--force'] : []
 
-  if (useShippedBundler2 && common.isBundler2Default(engine, rubyVersion) && bundlerVersion.startsWith('2')) {
-    // Avoid installing a newer Bundler version for head versions as it might not work.
-    // For releases, even if they ship with Bundler 2 we install the latest Bundler.
-    if (truffleruby22workaround) {
-      console.log(`Using Bundler 2 shipped with ${engine}-${rubyVersion} (workaround for https://github.com/oracle/truffleruby/issues/2586 on truffleruby 22.0)`)
-    } else {
-      console.log(`Using Bundler 2 shipped with ${engine}-${rubyVersion} (head versions do not always support the latest Bundler release)`)
-    }
-  } else if (engine.startsWith('truffleruby') && common.isBundler1Default(engine, rubyVersion) && bundlerVersion.startsWith('1')) {
-    console.log(`Using Bundler 1 shipped with ${engine}-${rubyVersion} (required for truffleruby < 21.0)`)
-  } else {
-    const gem = path.join(rubyPrefix, 'bin', 'gem')
-    // Workaround for https://github.com/rubygems/rubygems/issues/5245
-    const force = (platform.startsWith('windows-') && engine === 'ruby' && floatVersion >= 3.1) ? ['--force'] : []
+  const versionParts = [...bundlerVersion.matchAll(/\d+/g)].length
+  const bundlerVersionConstraint = versionParts === 3 ? bundlerVersion : `~> ${bundlerVersion}.0`
 
-    const versionParts = [...bundlerVersion.matchAll(/\d+/g)].length
-    const bundlerVersionConstraint = versionParts === 3 ? bundlerVersion : `~> ${bundlerVersion}.0`
-
-    await exec.exec(gem, ['install', 'bundler', ...force, '-v', bundlerVersionConstraint])
-  }
+  await exec.exec(gem, ['install', 'bundler', ...force, '-v', bundlerVersionConstraint])
 
   return bundlerVersion
 }
@@ -204,7 +205,7 @@ export async function bundleInstall(gemfile, lockFile, platform, engine, rubyVer
 
 async function computeBaseKey(platform, engine, version, lockFile, cacheVersion) {
   const cacheVersionSuffix = DEFAULT_CACHE_VERSION === cacheVersion ? '' : `-cachever:${cacheVersion}`
-  let key = `setup-ruby-bundler-cache-v3-${platform}-${engine}-${version}${cacheVersionSuffix}`
+  let key = `setup-ruby-bundler-cache-v4-${platform}-${engine}-${version}${cacheVersionSuffix}`
 
   if (common.isHeadVersion(version)) {
     if (engine !== 'jruby') {

common.js

@@ -55,8 +55,20 @@ export function isStableVersion(rubyVersion) {
   return /^\d+(\.\d+)*$/.test(rubyVersion)
 }
 
+export function hasBundlerDefaultGem(engine, rubyVersion) {
+  return isBundler1Default(engine, rubyVersion) || isBundler2Default(engine, rubyVersion)
+}
+
 export function isBundler1Default(engine, rubyVersion) {
-  return !isBundler2Default(engine, rubyVersion)
+  if (engine === 'ruby') {
+    return floatVersion(rubyVersion) >= 2.6 && floatVersion(rubyVersion) < 2.7
+  } else if (engine.startsWith('truffleruby')) {
+    return floatVersion(rubyVersion) < 21.0
+  } else if (engine === 'jruby') {
+    return false
+  } else {
+    return false
+  }
 }
 
 export function isBundler2Default(engine, rubyVersion) {
@@ -71,6 +83,18 @@ export function isBundler2Default(engine, rubyVersion) {
   }
 }
 
+export function isBundler2dot2Default(engine, rubyVersion) {
+  if (engine === 'ruby') {
+    return floatVersion(rubyVersion) >= 3.0
+  } else if (engine.startsWith('truffleruby')) {
+    return floatVersion(rubyVersion) >= 22.0
+  } else if (engine === 'jruby') {
+    return floatVersion(rubyVersion) >= 9.3
+  } else {
+    return false
+  }
+}
+
 export function floatVersion(rubyVersion) {
   const match = rubyVersion.match(/^\d+\.\d+/)
   if (match) {

dist/index.js

@@ -67,15 +67,34 @@ async function afterLockFile(lockFile, platform, engine, rubyVersion) {
 async function installBundler(bundlerVersionInput, rubygemsInputSet, lockFile, platform, rubyPrefix, engine, rubyVersion) {
   let bundlerVersion = bundlerVersionInput
 
-  if (rubygemsInputSet && bundlerVersion === 'default') {
+  if (rubygemsInputSet && (bundlerVersion === 'default' || bundlerVersion === 'Gemfile.lock')) {
     console.log('Using the Bundler installed by updating RubyGems')
     return 'unknown'
   }
 
-  if (bundlerVersion === 'default' || bundlerVersion === 'Gemfile.lock') {
-    bundlerVersion = readBundledWithFromGemfileLock(lockFile)
+  if (bundlerVersion === 'Gemfile.lock') {
+    let bundlerVersionFromGemfileLock = readBundledWithFromGemfileLock(lockFile)
 
-    if (!bundlerVersion) {
+    if (bundlerVersionFromGemfileLock) {
+      bundlerVersion = bundlerVersionFromGemfileLock
+    } else {
+      bundlerVersion = 'default'
+    }
+  }
+
+  const floatVersion = common.floatVersion(rubyVersion)
+
+  if (bundlerVersion === 'default') {
+    if (common.isBundler2dot2Default(engine, rubyVersion)) {
+      console.log(`Using Bundler 2 shipped with ${engine}-${rubyVersion}`)
+      return '2'
+    } else if (common.hasBundlerDefaultGem(engine, rubyVersion)) {
+      // Those Rubies have a old Bundler default gem < 2.2 which does not work well for `gem 'foo', github: 'foo/foo'`:
+      // https://github.com/ruby/setup-ruby/issues/358#issuecomment-1195899304
+      // Also, Ruby 2.6 would get Bundler 1 yet Ruby 2.3 - 2.5 get latest Bundler 2 which might be unexpected.
+      console.log(`Using latest Bundler for ${engine}-${rubyVersion} because the default Bundler gem is too old for that Ruby version`)
+      bundlerVersion = 'latest'
+    } else {
       bundlerVersion = 'latest'
     }
   }
@@ -90,8 +109,6 @@ async function installBundler(bundlerVersionInput, rubygemsInputSet, lockFile, p
     throw new Error(`Cannot parse bundler input: ${bundlerVersion}`)
   }
 
-  const floatVersion = common.floatVersion(rubyVersion)
-
   // Use Bundler 1 when we know Bundler 2 does not work
   if (bundlerVersion.startsWith('2')) {
     if (engine === 'ruby' && floatVersion <= 2.2) {
@@ -106,30 +123,14 @@ async function installBundler(bundlerVersionInput, rubygemsInputSet, lockFile, p
     }
   }
 
-  // Workaround for truffleruby 22.0 + latest Bundler, use shipped Bundler instead: https://github.com/oracle/truffleruby/issues/2586
-  const truffleruby22workaround = engine.startsWith('truffleruby') && rubyVersion.startsWith('22.0')
-  const useShippedBundler2 = common.isHeadVersion(rubyVersion) || truffleruby22workaround
+  const gem = path.join(rubyPrefix, 'bin', 'gem')
+  // Workaround for https://github.com/rubygems/rubygems/issues/5245
+  const force = (platform.startsWith('windows-') && engine === 'ruby' && floatVersion >= 3.1) ? ['--force'] : []
 
-  if (useShippedBundler2 && common.isBundler2Default(engine, rubyVersion) && bundlerVersion.startsWith('2')) {
-    // Avoid installing a newer Bundler version for head versions as it might not work.
-    // For releases, even if they ship with Bundler 2 we install the latest Bundler.
-    if (truffleruby22workaround) {
-      console.log(`Using Bundler 2 shipped with ${engine}-${rubyVersion} (workaround for https://github.com/oracle/truffleruby/issues/2586 on truffleruby 22.0)`)
-    } else {
-      console.log(`Using Bundler 2 shipped with ${engine}-${rubyVersion} (head versions do not always support the latest Bundler release)`)
-    }
-  } else if (engine.startsWith('truffleruby') && common.isBundler1Default(engine, rubyVersion) && bundlerVersion.startsWith('1')) {
-    console.log(`Using Bundler 1 shipped with ${engine}-${rubyVersion} (required for truffleruby < 21.0)`)
-  } else {
-    const gem = path.join(rubyPrefix, 'bin', 'gem')
-    // Workaround for https://github.com/rubygems/rubygems/issues/5245
-    const force = (platform.startsWith('windows-') && engine === 'ruby' && floatVersion >= 3.1) ? ['--force'] : []
+  const versionParts = [...bundlerVersion.matchAll(/\d+/g)].length
+  const bundlerVersionConstraint = versionParts === 3 ? bundlerVersion : `~> ${bundlerVersion}.0`
 
-    const versionParts = [...bundlerVersion.matchAll(/\d+/g)].length
-    const bundlerVersionConstraint = versionParts === 3 ? bundlerVersion : `~> ${bundlerVersion}.0`
-
-    await exec.exec(gem, ['install', 'bundler', ...force, '-v', bundlerVersionConstraint])
-  }
+  await exec.exec(gem, ['install', 'bundler', ...force, '-v', bundlerVersionConstraint])
 
   return bundlerVersion
 }
@@ -218,7 +219,7 @@ async function bundleInstall(gemfile, lockFile, platform, engine, rubyVersion, b
 
 async function computeBaseKey(platform, engine, version, lockFile, cacheVersion) {
   const cacheVersionSuffix = DEFAULT_CACHE_VERSION === cacheVersion ? '' : `-cachever:${cacheVersion}`
-  let key = `setup-ruby-bundler-cache-v3-${platform}-${engine}-${version}${cacheVersionSuffix}`
+  let key = `setup-ruby-bundler-cache-v4-${platform}-${engine}-${version}${cacheVersionSuffix}`
 
   if (common.isHeadVersion(version)) {
     if (engine !== 'jruby') {
@@ -255,8 +256,10 @@ __nccwpck_require__.r(__webpack_exports__);
 /* harmony export */   "measure": () => (/* binding */ measure),
 /* harmony export */   "isHeadVersion": () => (/* binding */ isHeadVersion),
 /* harmony export */   "isStableVersion": () => (/* binding */ isStableVersion),
+/* harmony export */   "hasBundlerDefaultGem": () => (/* binding */ hasBundlerDefaultGem),
 /* harmony export */   "isBundler1Default": () => (/* binding */ isBundler1Default),
 /* harmony export */   "isBundler2Default": () => (/* binding */ isBundler2Default),
+/* harmony export */   "isBundler2dot2Default": () => (/* binding */ isBundler2dot2Default),
 /* harmony export */   "floatVersion": () => (/* binding */ floatVersion),
 /* harmony export */   "hashFile": () => (/* binding */ hashFile),
 /* harmony export */   "supportedPlatforms": () => (/* binding */ supportedPlatforms),
@@ -324,8 +327,20 @@ function isStableVersion(rubyVersion) {
   return /^\d+(\.\d+)*$/.test(rubyVersion)
 }
 
+function hasBundlerDefaultGem(engine, rubyVersion) {
+  return isBundler1Default(engine, rubyVersion) || isBundler2Default(engine, rubyVersion)
+}
+
 function isBundler1Default(engine, rubyVersion) {
-  return !isBundler2Default(engine, rubyVersion)
+  if (engine === 'ruby') {
+    return floatVersion(rubyVersion) >= 2.6 && floatVersion(rubyVersion) < 2.7
+  } else if (engine.startsWith('truffleruby')) {
+    return floatVersion(rubyVersion) < 21.0
+  } else if (engine === 'jruby') {
+    return false
+  } else {
+    return false
+  }
 }
 
 function isBundler2Default(engine, rubyVersion) {
@@ -340,6 +355,18 @@ function isBundler2Default(engine, rubyVersion) {
   }
 }
 
+function isBundler2dot2Default(engine, rubyVersion) {
+  if (engine === 'ruby') {
+    return floatVersion(rubyVersion) >= 3.0
+  } else if (engine.startsWith('truffleruby')) {
+    return floatVersion(rubyVersion) >= 22.0
+  } else if (engine === 'jruby') {
+    return floatVersion(rubyVersion) >= 9.3
+  } else {
+    return false
+  }
+}
+
 function floatVersion(rubyVersion) {
   const match = rubyVersion.match(/^\d+\.\d+/)
   if (match) {
@@ -65028,8 +65055,8 @@ __nccwpck_require__.r(__webpack_exports__);
 /* harmony export */   "installJRubyTools": () => (/* binding */ installJRubyTools),
 /* harmony export */   "addVCVARSEnv": () => (/* binding */ addVCVARSEnv)
 /* harmony export */ });
-// Most of this logic is from
-// https://github.com/MSP-Greg/actions-ruby/blob/master/lib/main.js
+// 7z arguments
+//   -aoa overwrite existing, -bd disable progress indicator
 
 const fs = __nccwpck_require__(7147)
 const path = __nccwpck_require__(1017)
@@ -65043,9 +65070,11 @@ const rubyInstallerVersions = __nccwpck_require__(6459)
 
 const drive = common.drive
 
-const msys2BasePath = 'C:\\msys64'
 const msys2GCCReleaseURI  = 'https://github.com/ruby/setup-msys2-gcc/releases/download'
 
+const msys2BasePath = process.env['GHCUP_MSYS2']
+const vcPkgBasePath = process.env['VCPKG_INSTALLATION_ROOT']
+
 // needed for Ruby 2.0-2.3, and mswin, cert file used by Git for Windows
 const certFile = 'C:\\Program Files\\Git\\mingw64\\ssl\\cert.pem'
 
@@ -65111,6 +65140,10 @@ async function install(platform, engine, version) {
     await installGCCTools(msys2Type)
   }
 
+  if (version === 'mswin') {
+    await installVCPkg()
+  }
+
   const ridk = `${rubyPrefix}\\bin\\ridk.cmd`
   if (fs.existsSync(ridk)) {
     await common.measure('Adding ridk env variables', async () => addRidkEnv(ridk))
@@ -65129,7 +65162,6 @@ async function installGCCTools(type) {
   })
 
   await common.measure(`Extracting  ${type} build tools`, async () =>
-    // -aoa overwrite existing, -bd disable progress indicator
     exec.exec('7z', ['x', downloadPath, '-aoa', '-bd', `-o${msys2BasePath}`], { silent: true }))
 }
 
@@ -65147,7 +65179,6 @@ async function installMSYS2Tools() {
   fs.rmSync(`${msys2BasePath}\\var\\lib\\pacman\\local`, { recursive: true, force: true })
 
   await common.measure(`Extracting  msys2 build tools`, async () =>
-    // -aoa overwrite existing, -bd disable progress indicator
     exec.exec('7z', ['x', downloadPath, '-aoa', '-bd', `-o${msys2BasePath}`], { silent: true }))
 }
 
@@ -65158,6 +65189,18 @@ async function installJRubyTools() {
   await installGCCTools('mingw64')
 }
 
+// Install vcpkg files needed to build mswin Ruby
+async function installVCPkg() {
+  const downloadPath = await common.measure(`Downloading mswin vcpkg packages`, async () => {
+    let url = `${msys2GCCReleaseURI}/msys2-gcc-pkgs/mswin.7z`
+    console.log(url)
+    return await tc.downloadTool(url)
+  })
+
+  await common.measure(`Extracting  mswin vcpkg packages`, async () =>
+    exec.exec('7z', ['x', downloadPath, '-aoa', '-bd', `-o${vcPkgBasePath}`], { silent: true }))
+}
+
 async function downloadAndExtract(engine, version, url, base, rubyPrefix) {
   const parentDir = path.dirname(rubyPrefix)
 
@@ -65167,7 +65210,7 @@ async function downloadAndExtract(engine, version, url, base, rubyPrefix) {
   })
 
   await common.measure('Extracting  Ruby', async () =>
-    // -bd disable progress indicator, -xr extract but exclude share\doc files
+    // -xr extract but exclude share\doc files
     exec.exec('7z', ['x', downloadPath, '-bd', `-xr!${base}\\share\\doc`, `-o${parentDir}`], { silent: true }))
 
   if (base !== path.basename(rubyPrefix)) {
@@ -65214,18 +65257,28 @@ async function installMSYS1(version) {
 async function setupMSWin() {
   core.exportVariable('MAKE', 'nmake.exe')
 
-  // All standard MSVC OpenSSL builds use C:\Program Files\Common Files\SSL
-  const certsDir = 'C:\\Program Files\\Common Files\\SSL\\certs'
+  // Pre-installed OpenSSL use C:\Program Files\Common Files\SSL
+  let certsDir = 'C:\\Program Files\\Common Files\\SSL\\certs'
   if (!fs.existsSync(certsDir)) {
-    fs.mkdirSync(certsDir)
+    fs.mkdirSync(certsDir, { recursive: true })
   }
 
   // cert.pem location is hard-coded by OpenSSL msvc builds
-  const cert = 'C:\\Program Files\\Common Files\\SSL\\cert.pem'
+  let cert = 'C:\\Program Files\\Common Files\\SSL\\cert.pem'
   if (!fs.existsSync(cert)) {
     fs.copyFileSync(certFile, cert)
   }
 
+  // vcpkg openssl uses packages\openssl_x64-windows\certs
+  certsDir = `${vcPkgBasePath}\\packages\\openssl_x64-windows\\certs`
+  if (!fs.existsSync(certsDir)) {
+    fs.mkdirSync(certsDir, { recursive: true })
+  }
+
+  // vcpkg openssl uses packages\openssl_x64-windows\cert.pem
+  cert = `${vcPkgBasePath}\\packages\\openssl_x64-windows\\cert.pem`
+  fs.copyFileSync(certFile, cert)
+
   return await common.measure('Setting up MSVC environment', async () => addVCVARSEnv())
 }
 
@@ -65497,7 +65550,7 @@ module.exports = JSON.parse('[[[0,44],"disallowed_STD3_valid"],[[45,46],"valid"]
 /***/ ((module) => {
 
 "use strict";
-module.exports = JSON.parse('{"ruby":["1.9.3-p551","2.0.0-p648","2.1.9","2.2.10","2.3.0","2.3.1","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.8","2.4.0","2.4.1","2.4.2","2.4.3","2.4.4","2.4.5","2.4.6","2.4.7","2.4.9","2.4.10","2.5.0","2.5.1","2.5.2","2.5.3","2.5.4","2.5.5","2.5.6","2.5.7","2.5.8","2.5.9","2.6.0","2.6.1","2.6.2","2.6.3","2.6.4","2.6.5","2.6.6","2.6.7","2.6.8","2.6.9","2.6.10","2.7.0","2.7.1","2.7.2","2.7.3","2.7.4","2.7.5","2.7.6","3.0.0-preview1","3.0.0-preview2","3.0.0-rc1","3.0.0","3.0.1","3.0.2","3.0.3","3.0.4","3.1.0-preview1","3.1.0","3.1.1","3.1.2","3.2.0-preview1","head","debug"],"jruby":["9.1.17.0","9.2.9.0","9.2.10.0","9.2.11.0","9.2.11.1","9.2.12.0","9.2.13.0","9.2.14.0","9.2.15.0","9.2.16.0","9.2.17.0","9.2.18.0","9.2.19.0","9.2.20.0","9.2.20.1","9.3.0.0","9.3.1.0","9.3.2.0","9.3.3.0","9.3.4.0","head"],"truffleruby":["19.3.0","19.3.1","20.0.0","20.1.0","20.2.0","20.3.0","21.0.0","21.1.0","21.2.0","21.2.0.1","21.3.0","22.0.0.2","22.1.0","head"],"truffleruby+graalvm":["21.2.0","21.3.0","22.0.0.2","22.1.0","head"]}');
+module.exports = JSON.parse('{"ruby":["1.9.3-p551","2.0.0-p648","2.1.9","2.2.10","2.3.0","2.3.1","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.8","2.4.0","2.4.1","2.4.2","2.4.3","2.4.4","2.4.5","2.4.6","2.4.7","2.4.9","2.4.10","2.5.0","2.5.1","2.5.2","2.5.3","2.5.4","2.5.5","2.5.6","2.5.7","2.5.8","2.5.9","2.6.0","2.6.1","2.6.2","2.6.3","2.6.4","2.6.5","2.6.6","2.6.7","2.6.8","2.6.9","2.6.10","2.7.0","2.7.1","2.7.2","2.7.3","2.7.4","2.7.5","2.7.6","3.0.0-preview1","3.0.0-preview2","3.0.0-rc1","3.0.0","3.0.1","3.0.2","3.0.3","3.0.4","3.1.0-preview1","3.1.0","3.1.1","3.1.2","3.2.0-preview1","head","debug"],"jruby":["9.1.17.0","9.2.9.0","9.2.10.0","9.2.11.0","9.2.11.1","9.2.12.0","9.2.13.0","9.2.14.0","9.2.15.0","9.2.16.0","9.2.17.0","9.2.18.0","9.2.19.0","9.2.20.0","9.2.20.1","9.2.21.0","9.3.0.0","9.3.1.0","9.3.2.0","9.3.3.0","9.3.4.0","9.3.6.0","head"],"truffleruby":["19.3.0","19.3.1","20.0.0","20.1.0","20.2.0","20.3.0","21.0.0","21.1.0","21.2.0","21.2.0.1","21.3.0","22.0.0.2","22.1.0","22.2.0","head"],"truffleruby+graalvm":["21.2.0","21.3.0","22.0.0.2","22.1.0","22.2.0","head"]}');
 
 /***/ }),
 
@@ -65598,7 +65651,7 @@ const windows = common.windows
 const inputDefaults = {
   'ruby-version': 'default',
   'rubygems': 'default',
-  'bundler': 'default',
+  'bundler': 'Gemfile.lock',
   'bundler-cache': 'false',
   'working-directory': '.',
   'cache-version': bundler.DEFAULT_CACHE_VERSION,
@@ -65736,8 +65789,7 @@ function validateRubyEngineAndVersion(platform, engineVersions, engine, parsedVe
     } else {
       throw new Error(`Unknown version ${parsedVersion} for ${engine} on ${platform}
         available versions for ${engine} on ${platform}: ${engineVersions.join(', ')}
-        Make sure you use the latest version of the action with - uses: ruby/setup-ruby@v1
-        File an issue at https://github.com/ruby/setup-ruby/issues if you would like support for a new version`)
+        Make sure you use the latest version of the action with - uses: ruby/setup-ruby@v1`)
     }
   }
 

gemfiles/gem_from_github.gemfile

@@ -0,0 +1,12 @@
+source "https://rubygems.org"
+
+# Ruby < 2.3 only support Bundler 1, which no longer works with gem github:
+if RUBY_VERSION >= '2.3'
+  unless Gem::Version.new(Bundler::VERSION) >= Gem::Version.new("2.2.0")
+    raise "Expected Bundler 2.2+ is used on Ruby >= 2.3"
+  end
+
+  # From https://github.com/ruby/setup-ruby/issues/358#issuecomment-1195899304
+  # Tests using github: and the repository uses a non-master default branch.
+  gem 'rack-test', github: 'rack/rack-test'
+end

index.js

@@ -12,7 +12,7 @@ const windows = common.windows
 const inputDefaults = {
   'ruby-version': 'default',
   'rubygems': 'default',
-  'bundler': 'default',
+  'bundler': 'Gemfile.lock',
   'bundler-cache': 'false',
   'working-directory': '.',
   'cache-version': bundler.DEFAULT_CACHE_VERSION,
@@ -150,8 +150,7 @@ function validateRubyEngineAndVersion(platform, engineVersions, engine, parsedVe
     } else {
       throw new Error(`Unknown version ${parsedVersion} for ${engine} on ${platform}
         available versions for ${engine} on ${platform}: ${engineVersions.join(', ')}
-        Make sure you use the latest version of the action with - uses: ruby/setup-ruby@v1
-        File an issue at https://github.com/ruby/setup-ruby/issues if you would like support for a new version`)
+        Make sure you use the latest version of the action with - uses: ruby/setup-ruby@v1`)
     }
   }
 

ruby-builder-versions.json

@@ -16,20 +16,20 @@
   ],
   "jruby": [
     "9.1.17.0",
-    "9.2.9.0", "9.2.10.0", "9.2.11.0", "9.2.11.1", "9.2.12.0", "9.2.13.0", "9.2.14.0", "9.2.15.0", "9.2.16.0", "9.2.17.0", "9.2.18.0", "9.2.19.0", "9.2.20.0", "9.2.20.1",
-    "9.3.0.0", "9.3.1.0", "9.3.2.0", "9.3.3.0", "9.3.4.0",
+    "9.2.9.0", "9.2.10.0", "9.2.11.0", "9.2.11.1", "9.2.12.0", "9.2.13.0", "9.2.14.0", "9.2.15.0", "9.2.16.0", "9.2.17.0", "9.2.18.0", "9.2.19.0", "9.2.20.0", "9.2.20.1", "9.2.21.0",
+    "9.3.0.0", "9.3.1.0", "9.3.2.0", "9.3.3.0", "9.3.4.0", "9.3.6.0",
     "head"
   ],
   "truffleruby": [
     "19.3.0", "19.3.1",
     "20.0.0", "20.1.0", "20.2.0", "20.3.0",
     "21.0.0", "21.1.0", "21.2.0", "21.2.0.1", "21.3.0",
-    "22.0.0.2", "22.1.0",
+    "22.0.0.2", "22.1.0", "22.2.0",
     "head"
   ],
   "truffleruby+graalvm": [
     "21.2.0", "21.3.0",
-    "22.0.0.2", "22.1.0",
+    "22.0.0.2", "22.1.0", "22.2.0",
     "head"
   ]
 }

windows.js

@@ -1,5 +1,5 @@
-// Most of this logic is from
-// https://github.com/MSP-Greg/actions-ruby/blob/master/lib/main.js
+// 7z arguments
+//   -aoa overwrite existing, -bd disable progress indicator
 
 const fs = require('fs')
 const path = require('path')
@@ -13,9 +13,11 @@ const rubyInstallerVersions = require('./windows-versions.json')
 
 const drive = common.drive
 
-const msys2BasePath = 'C:\\msys64'
 const msys2GCCReleaseURI  = 'https://github.com/ruby/setup-msys2-gcc/releases/download'
 
+const msys2BasePath = process.env['GHCUP_MSYS2']
+const vcPkgBasePath = process.env['VCPKG_INSTALLATION_ROOT']
+
 // needed for Ruby 2.0-2.3, and mswin, cert file used by Git for Windows
 const certFile = 'C:\\Program Files\\Git\\mingw64\\ssl\\cert.pem'
 
@@ -81,6 +83,10 @@ export async function install(platform, engine, version) {
     await installGCCTools(msys2Type)
   }
 
+  if (version === 'mswin') {
+    await installVCPkg()
+  }
+
   const ridk = `${rubyPrefix}\\bin\\ridk.cmd`
   if (fs.existsSync(ridk)) {
     await common.measure('Adding ridk env variables', async () => addRidkEnv(ridk))
@@ -99,7 +105,6 @@ async function installGCCTools(type) {
   })
 
   await common.measure(`Extracting  ${type} build tools`, async () =>
-    // -aoa overwrite existing, -bd disable progress indicator
     exec.exec('7z', ['x', downloadPath, '-aoa', '-bd', `-o${msys2BasePath}`], { silent: true }))
 }
 
@@ -117,7 +122,6 @@ async function installMSYS2Tools() {
   fs.rmSync(`${msys2BasePath}\\var\\lib\\pacman\\local`, { recursive: true, force: true })
 
   await common.measure(`Extracting  msys2 build tools`, async () =>
-    // -aoa overwrite existing, -bd disable progress indicator
     exec.exec('7z', ['x', downloadPath, '-aoa', '-bd', `-o${msys2BasePath}`], { silent: true }))
 }
 
@@ -128,6 +132,18 @@ export async function installJRubyTools() {
   await installGCCTools('mingw64')
 }
 
+// Install vcpkg files needed to build mswin Ruby
+async function installVCPkg() {
+  const downloadPath = await common.measure(`Downloading mswin vcpkg packages`, async () => {
+    let url = `${msys2GCCReleaseURI}/msys2-gcc-pkgs/mswin.7z`
+    console.log(url)
+    return await tc.downloadTool(url)
+  })
+
+  await common.measure(`Extracting  mswin vcpkg packages`, async () =>
+    exec.exec('7z', ['x', downloadPath, '-aoa', '-bd', `-o${vcPkgBasePath}`], { silent: true }))
+}
+
 async function downloadAndExtract(engine, version, url, base, rubyPrefix) {
   const parentDir = path.dirname(rubyPrefix)
 
@@ -137,7 +153,7 @@ async function downloadAndExtract(engine, version, url, base, rubyPrefix) {
   })
 
   await common.measure('Extracting  Ruby', async () =>
-    // -bd disable progress indicator, -xr extract but exclude share\doc files
+    // -xr extract but exclude share\doc files
     exec.exec('7z', ['x', downloadPath, '-bd', `-xr!${base}\\share\\doc`, `-o${parentDir}`], { silent: true }))
 
   if (base !== path.basename(rubyPrefix)) {
@@ -184,18 +200,28 @@ async function installMSYS1(version) {
 async function setupMSWin() {
   core.exportVariable('MAKE', 'nmake.exe')
 
-  // All standard MSVC OpenSSL builds use C:\Program Files\Common Files\SSL
-  const certsDir = 'C:\\Program Files\\Common Files\\SSL\\certs'
+  // Pre-installed OpenSSL use C:\Program Files\Common Files\SSL
+  let certsDir = 'C:\\Program Files\\Common Files\\SSL\\certs'
   if (!fs.existsSync(certsDir)) {
-    fs.mkdirSync(certsDir)
+    fs.mkdirSync(certsDir, { recursive: true })
   }
 
   // cert.pem location is hard-coded by OpenSSL msvc builds
-  const cert = 'C:\\Program Files\\Common Files\\SSL\\cert.pem'
+  let cert = 'C:\\Program Files\\Common Files\\SSL\\cert.pem'
   if (!fs.existsSync(cert)) {
     fs.copyFileSync(certFile, cert)
   }
 
+  // vcpkg openssl uses packages\openssl_x64-windows\certs
+  certsDir = `${vcPkgBasePath}\\packages\\openssl_x64-windows\\certs`
+  if (!fs.existsSync(certsDir)) {
+    fs.mkdirSync(certsDir, { recursive: true })
+  }
+
+  // vcpkg openssl uses packages\openssl_x64-windows\cert.pem
+  cert = `${vcPkgBasePath}\\packages\\openssl_x64-windows\\cert.pem`
+  fs.copyFileSync(certFile, cert)
+
   return await common.measure('Setting up MSVC environment', async () => addVCVARSEnv())
 }