Ensure Bundler 2.2+ is used for all Rubies which support Bundler 2 (Ruby >= 2.3)

Restrict the GitHub token permissions only to the required ones; this way, even if the attackers will succeed in compromising your workflow, they won’t be able to do much.

- Included permissions for the action. https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions

https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions

https://docs.github.com/en/actions/using-jobs/assigning-permissions-to-jobs

[Keeping your GitHub Actions and workflows secure Part 1: Preventing pwn requests](https://securitylab.github.com/research/github-actions-preventing-pwn-requests/)

Signed-off-by: neilnaveen <42328488+neilnaveen@users.noreply.github.com>

.github/workflows/release.yml

@@ -1,7 +1,12 @@
 name: Update the v1 branch when a release is published
 on:
   release:
+    permissions:
+      contents: write  # for Git to git push
     types: [published]
+permissions:
+  contents: read
+
 jobs:
   release:
     runs-on: ubuntu-latest

.github/workflows/test.yml

@@ -9,6 +9,8 @@ on:
     paths-ignore:
     - README.md
   workflow_dispatch:
+permissions:
+  contents: read
 
 jobs:
   test:
@@ -98,6 +100,11 @@ jobs:
     - run: bundle exec rake --version
     - run: bundle exec rake
 
+    - name: Test `gem github:` in a Gemfile
+      run: bundle install
+      env:
+        BUNDLE_GEMFILE: ${{ github.workspace }}/gemfiles/gem_from_github.gemfile
+
     - name: which ruby, rake
       if: "!startsWith(matrix.os, 'windows')"
       run: which -a ruby rake

README.md

@@ -159,8 +159,8 @@ By default, Bundler is installed as follows:
 
 * If there is a `Gemfile.lock` file (or `$BUNDLE_GEMFILE.lock` or `gems.locked`) with a `BUNDLED WITH` section,
   that version of Bundler will be installed and used.
-* If the Ruby ships with Bundler (as a default gem), that version is used.
-* Otherwise, the latest compatible Bundler version is installed (Bundler 2 on Ruby >= 2.4, Bundler 1 on Ruby < 2.4).
+* If the Ruby ships with Bundler 2.2+ (as a default gem), that version is used.
+* Otherwise, the latest compatible Bundler version is installed (Bundler 2 on Ruby >= 2.3, Bundler 1 on Ruby < 2.3).
 
 This behavior can be customized, see [action.yml](action.yml) for more details about the `bundler` input.
 

action.yml

@@ -18,8 +18,8 @@ inputs:
     description: |
       The version of Bundler to install. Either 'Gemfile.lock' (the default), 'default', 'latest', 'none', or a version number (e.g., 1, 2, 2.1, 2.1.4).
       For 'Gemfile.lock', the version of the BUNDLED WITH section from the Gemfile.lock if it exists. If the file or section does not exist then the same as 'default'.
-      For 'default', the version of Bundler that comes with that Ruby by default is used, or if that Ruby comes without Bundler then the same as 'latest'.
-      For 'latest', the latest compatible Bundler version is installed (Bundler 2 on Ruby >= 2.4, Bundler 1 on Ruby < 2.4).
+      For 'default', if the Ruby ships with Bundler 2.2+ as a default gem, that version is used, otherwise the same as 'latest'.
+      For 'latest', the latest compatible Bundler version is installed (Bundler 2 on Ruby >= 2.3, Bundler 1 on Ruby < 2.3).
       For 'none', nothing is done.
   bundler-cache:
     description: 'Run "bundle install", and cache the result automatically. Either true or false.'

bundler.js

@@ -68,13 +68,18 @@ export async function installBundler(bundlerVersionInput, rubygemsInputSet, lock
     }
   }
 
+  const floatVersion = common.floatVersion(rubyVersion)
+
   if (bundlerVersion === 'default') {
-    if (common.isBundler2Default(engine, rubyVersion)) {
+    if (common.isBundler2dot2Default(engine, rubyVersion)) {
       console.log(`Using Bundler 2 shipped with ${engine}-${rubyVersion}`)
       return '2'
-    } else if (common.isBundler1Default(engine, rubyVersion)) {
-      console.log(`Using Bundler 1 shipped with ${engine}-${rubyVersion}`)
-      return '1'
+    } else if (common.hasBundlerDefaultGem(engine, rubyVersion)) {
+      // Those Rubies have a old Bundler default gem < 2.2 which does not work well for `gem 'foo', github: 'foo/foo'`:
+      // https://github.com/ruby/setup-ruby/issues/358#issuecomment-1195899304
+      // Also, Ruby 2.6 would get Bundler 1 yet Ruby 2.3 - 2.5 get latest Bundler 2 which might be unexpected.
+      console.log(`Using latest Bundler for ${engine}-${rubyVersion} because the default Bundler gem is too old for that Ruby version`)
+      bundlerVersion = 'latest'
     } else {
       bundlerVersion = 'latest'
     }
@@ -90,8 +95,6 @@ export async function installBundler(bundlerVersionInput, rubygemsInputSet, lock
     throw new Error(`Cannot parse bundler input: ${bundlerVersion}`)
   }
 
-  const floatVersion = common.floatVersion(rubyVersion)
-
   // Use Bundler 1 when we know Bundler 2 does not work
   if (bundlerVersion.startsWith('2')) {
     if (engine === 'ruby' && floatVersion <= 2.2) {

common.js

@@ -55,6 +55,10 @@ export function isStableVersion(rubyVersion) {
   return /^\d+(\.\d+)*$/.test(rubyVersion)
 }
 
+export function hasBundlerDefaultGem(engine, rubyVersion) {
+  return isBundler1Default(engine, rubyVersion) || isBundler2Default(engine, rubyVersion)
+}
+
 export function isBundler1Default(engine, rubyVersion) {
   if (engine === 'ruby') {
     return floatVersion(rubyVersion) >= 2.6 && floatVersion(rubyVersion) < 2.7
@@ -79,6 +83,18 @@ export function isBundler2Default(engine, rubyVersion) {
   }
 }
 
+export function isBundler2dot2Default(engine, rubyVersion) {
+  if (engine === 'ruby') {
+    return floatVersion(rubyVersion) >= 3.0
+  } else if (engine.startsWith('truffleruby')) {
+    return floatVersion(rubyVersion) >= 22.0
+  } else if (engine === 'jruby') {
+    return floatVersion(rubyVersion) >= 9.3
+  } else {
+    return false
+  }
+}
+
 export function floatVersion(rubyVersion) {
   const match = rubyVersion.match(/^\d+\.\d+/)
   if (match) {

dist/index.js

@@ -82,13 +82,18 @@ async function installBundler(bundlerVersionInput, rubygemsInputSet, lockFile, p
     }
   }
 
+  const floatVersion = common.floatVersion(rubyVersion)
+
   if (bundlerVersion === 'default') {
-    if (common.isBundler2Default(engine, rubyVersion)) {
+    if (common.isBundler2dot2Default(engine, rubyVersion)) {
       console.log(`Using Bundler 2 shipped with ${engine}-${rubyVersion}`)
       return '2'
-    } else if (common.isBundler1Default(engine, rubyVersion)) {
-      console.log(`Using Bundler 1 shipped with ${engine}-${rubyVersion}`)
-      return '1'
+    } else if (common.hasBundlerDefaultGem(engine, rubyVersion)) {
+      // Those Rubies have a old Bundler default gem < 2.2 which does not work well for `gem 'foo', github: 'foo/foo'`:
+      // https://github.com/ruby/setup-ruby/issues/358#issuecomment-1195899304
+      // Also, Ruby 2.6 would get Bundler 1 yet Ruby 2.3 - 2.5 get latest Bundler 2 which might be unexpected.
+      console.log(`Using latest Bundler for ${engine}-${rubyVersion} because the default Bundler gem is too old for that Ruby version`)
+      bundlerVersion = 'latest'
     } else {
       bundlerVersion = 'latest'
     }
@@ -104,8 +109,6 @@ async function installBundler(bundlerVersionInput, rubygemsInputSet, lockFile, p
     throw new Error(`Cannot parse bundler input: ${bundlerVersion}`)
   }
 
-  const floatVersion = common.floatVersion(rubyVersion)
-
   // Use Bundler 1 when we know Bundler 2 does not work
   if (bundlerVersion.startsWith('2')) {
     if (engine === 'ruby' && floatVersion <= 2.2) {
@@ -253,8 +256,10 @@ __nccwpck_require__.r(__webpack_exports__);
 /* harmony export */   "measure": () => (/* binding */ measure),
 /* harmony export */   "isHeadVersion": () => (/* binding */ isHeadVersion),
 /* harmony export */   "isStableVersion": () => (/* binding */ isStableVersion),
+/* harmony export */   "hasBundlerDefaultGem": () => (/* binding */ hasBundlerDefaultGem),
 /* harmony export */   "isBundler1Default": () => (/* binding */ isBundler1Default),
 /* harmony export */   "isBundler2Default": () => (/* binding */ isBundler2Default),
+/* harmony export */   "isBundler2dot2Default": () => (/* binding */ isBundler2dot2Default),
 /* harmony export */   "floatVersion": () => (/* binding */ floatVersion),
 /* harmony export */   "hashFile": () => (/* binding */ hashFile),
 /* harmony export */   "supportedPlatforms": () => (/* binding */ supportedPlatforms),
@@ -322,6 +327,10 @@ function isStableVersion(rubyVersion) {
   return /^\d+(\.\d+)*$/.test(rubyVersion)
 }
 
+function hasBundlerDefaultGem(engine, rubyVersion) {
+  return isBundler1Default(engine, rubyVersion) || isBundler2Default(engine, rubyVersion)
+}
+
 function isBundler1Default(engine, rubyVersion) {
   if (engine === 'ruby') {
     return floatVersion(rubyVersion) >= 2.6 && floatVersion(rubyVersion) < 2.7
@@ -346,6 +355,18 @@ function isBundler2Default(engine, rubyVersion) {
   }
 }
 
+function isBundler2dot2Default(engine, rubyVersion) {
+  if (engine === 'ruby') {
+    return floatVersion(rubyVersion) >= 3.0
+  } else if (engine.startsWith('truffleruby')) {
+    return floatVersion(rubyVersion) >= 22.0
+  } else if (engine === 'jruby') {
+    return floatVersion(rubyVersion) >= 9.3
+  } else {
+    return false
+  }
+}
+
 function floatVersion(rubyVersion) {
   const match = rubyVersion.match(/^\d+\.\d+/)
   if (match) {

gemfiles/gem_from_github.gemfile

@@ -0,0 +1,12 @@
+source "https://rubygems.org"
+
+# Ruby < 2.3 only support Bundler 1, which no longer works with gem github:
+if RUBY_VERSION >= '2.3'
+  unless Gem::Version.new(Bundler::VERSION) >= Gem::Version.new("2.2.0")
+    raise "Expected Bundler 2.2+ is used on Ruby >= 2.3"
+  end
+
+  # From https://github.com/ruby/setup-ruby/issues/358#issuecomment-1195899304
+  # Tests using github: and the repository uses a non-master default branch.
+  gem 'rack-test', github: 'rack/rack-test'
+end