Define a helper to download to avoid duplication

* And it is currently based on the latest release, that is 4.0.0.

.github/workflows/test.yml

@@ -32,7 +32,7 @@ jobs:
         - { os: windows-2025, ruby: mswin }
         - { os: windows-2025, ruby: ucrt  }
         - { os: ubuntu-24.04, ruby: asan }
-        - { os: ubuntu-24.04, ruby: 3.4-asan }
+        - { os: ubuntu-24.04, ruby: asan-release }
         exclude:
         # https://github.com/ruby/setup-ruby/issues/496
         - { os: ubuntu-22.04, ruby: '2.2' }
@@ -79,10 +79,6 @@ jobs:
         - { os: windows-2022, ruby: '1.9' }
         - { os: windows-2025, ruby: '1.9' }
         - { os: windows-11-arm, ruby: '1.9' }
-        # No preview builds on Windows
-        - { os: windows-2022, ruby: '4.0' }
-        - { os: windows-2025, ruby: '4.0' }
-        - { os: windows-11-arm, ruby: '4.0' }
         # TruffleRuby does not support Windows
         - { os: windows-2022, ruby: truffleruby }
         - { os: windows-2025, ruby: truffleruby }
@@ -352,6 +348,19 @@ jobs:
         bundler: 2.2.3
     - run: bundle --version | grep -F "Bundler version 2.2.3"
 
+  # https://github.com/ruby/setup-ruby/issues/845
+  testOlderBundlerVersion:
+    name: "Test with an older Bundler version than the one of the default gem"
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v6
+    - uses: ./
+      with:
+        ruby-version: '4.0'
+        bundler: 2.7.2
+        bundler-cache: true
+    - run: bundle --version | grep -F "Bundler version 2.7.2"
+
   testBundlerPre:
     name: "Test with a Bundler pre/rc version"
     runs-on: ubuntu-latest

README.md

@@ -15,7 +15,7 @@ This action currently supports these versions of MRI, JRuby and TruffleRuby:
 
 | Interpreter | Versions |
 | ----------- | -------- |
-| `ruby` | 1.9.3, 2.0.0, 2.1.9, 2.2, all versions from 2.3.0 until 4.0.0-preview2, head, debug, mingw, mswin, ucrt |
+| `ruby` | 1.9.3, 2.0.0, 2.1.9, 2.2, all versions from 2.3.0 until 4.0.0, head, debug, mingw, mswin, ucrt |
 | `jruby` | 9.1.17.0 - 10.0.2.0, head |
 | `truffleruby` | 19.3.0 - 25.0.0, head |
 | `truffleruby+graalvm` | 21.2.0 - 25.0.0, head |
@@ -26,7 +26,7 @@ This action currently supports these versions of MRI, JRuby and TruffleRuby:
 Native extensions are automatically compiled with AddressSanitizer when using `ruby-asan`.
 `ruby-asan` is currently only available on `ubuntu-24.04`.
 
-`ruby-3.4-asan` is similar to `ruby-asan` but built from the latest stable 3.4 release tag.
+`asan-release` is similar to `ruby-asan` but built from the latest stable release tag.
 Like `ruby-asan`, it's currently only available on `ubuntu-24.04`.
 
 Regarding Windows ruby master builds, `mingw` is a MSYS2/MinGW build, `head` & `ucrt` are MSYS2/UCRT64
@@ -230,6 +230,22 @@ It is also possible to cache gems manually, but this is not recommended because
 There are many concerns which means using `actions/cache` is never enough for caching gems (e.g., incomplete cache key, cleaning old gems when restoring from another key, correctly hashing the lockfile if not checked in, OS versions, ABI compatibility for `ruby-head`, etc).
 So, please use `bundler-cache: true` instead and report any issue.
 
+### Authentication Token
+
+By default, this action uses `${{ github.token }}` to authenticate when downloading Ruby release assets from GitHub.
+This helps avoid rate limiting issues.
+
+If you're running this action on a GitHub Enterprise Server (GHES) instance, or if you're experiencing rate limiting,
+you can provide a custom token:
+
+```yaml
+    - uses: ruby/setup-ruby@v1
+      with:
+        token: ${{ secrets.MY_GITHUB_TOKEN }}
+```
+
+In most cases, you don't need to set this input as the default value is sufficient for use on github.com.
+
 ## Windows
 
 Note that running CI on Windows can be quite challenging if you are not very familiar with Windows.

action.yml

@@ -44,6 +44,12 @@ inputs:
       It also sets environment variables using 'ridk' or 'vcvars64.bat' based on the selected Ruby.
       At present, the only other setting than 'default' is 'none', which only adds Ruby to PATH.
       No build tools or packages are installed, nor are any ENV setting changed to activate them.
+  token:
+    description: |
+      Used to authenticate with GitHub when downloading Ruby release assets.
+      When running this action on github.com, the default value is sufficient.
+      When running on GHES, you can pass a personal access token for github.com if you are experiencing rate limiting.
+    default: ${{ github.server_url == 'https://github.com' && github.token || '' }}
 
 outputs:
   ruby-prefix:

bundler.js

@@ -162,10 +162,10 @@ export async function bundleInstall(gemfile, lockFile, platform, engine, rubyVer
   }
 
   let envOptions = {}
-  if (bundlerVersion.startsWith('1') && common.isBundler2PlusDefault(engine, rubyVersion)) {
-    // If Bundler 1 is specified on Rubies which ship with Bundler 2+,
-    // we need to specify which Bundler version to use explicitly until the lockfile exists.
-    console.log(`Setting BUNDLER_VERSION=${bundlerVersion} for "bundle config|lock" commands below to ensure Bundler 1 is used`)
+  if (bundlerVersion.match(/^\d+/)) {
+    // If a specific Bundler version is given or determined, we need to specify the version to use explicitly until the lockfile exists.
+    // Otherwise, a newer version of Bundler might be used.
+    console.log(`Setting BUNDLER_VERSION=${bundlerVersion} for "bundle config|lock" commands below to ensure Bundler ${bundlerVersion} is used`)
     envOptions = { env: { ...process.env, BUNDLER_VERSION: bundlerVersion } }
   }
 
@@ -218,7 +218,8 @@ export async function bundleInstall(gemfile, lockFile, platform, engine, rubyVer
   await exec.exec('bundle', ['install', '--jobs', `${jobs}`])
 
   // @actions/cache only allows to save for non-existing keys
-  if (!common.isExactCacheKeyMatch(key, cachedKey)) {
+  // Also, skip saving cache for merge_group event
+  if (!common.isExactCacheKeyMatch(key, cachedKey) && process.env['GITHUB_EVENT_NAME'] !== 'merge_group') {
     if (cachedKey) { // existing cache but Gemfile.lock differs, clean old gems
       await exec.exec('bundle', ['clean'])
     }

common.js

@@ -16,7 +16,8 @@ export const drive = (windows ? (process.env['RUNNER_TEMP'] || 'C')[0] : undefin
 const PATH_ENV_VAR = windows ? 'Path' : 'PATH'
 
 export const inputs = {
-  selfHosted: undefined
+  selfHosted: undefined,
+  token: undefined
 }
 
 export function partition(string, separator) {
@@ -68,8 +69,8 @@ export async function time(name, block) {
 }
 
 export function isHeadVersion(rubyVersion) {
-  // 3.4-asan counts as "head" because the version cannot be selected -- you can only get whatever's latest
-  return ['head', 'debug',  'mingw', 'mswin', 'ucrt', 'asan', '3.4-asan'].includes(rubyVersion)
+  // asan-release counts as "head" because the version cannot be selected -- you can only get whatever's latest
+  return ['head', 'debug',  'mingw', 'mswin', 'ucrt', 'asan', 'asan-release'].includes(rubyVersion)
 }
 
 export function isStableVersion(engine, rubyVersion) {
@@ -441,3 +442,8 @@ export function isExactCacheKeyMatch(key, cacheKey) {
       }) === 0
   );
 }
+
+export async function download(url) {
+  const auth = inputs.token ? `token ${inputs.token}` : undefined
+  return await tc.downloadTool(url, undefined, auth)
+}

index.js

@@ -18,6 +18,7 @@ const inputDefaults = {
   'cache-version': bundler.DEFAULT_CACHE_VERSION,
   'self-hosted': 'false',
   'windows-toolchain': 'default',
+  'token': '',
 }
 
 // entry point when this action is run on its own
@@ -45,6 +46,7 @@ export async function setupRuby(options = {}) {
     }
   }
   common.inputs.selfHosted = inputs['self-hosted']
+  common.inputs.token = inputs['token']
 
   process.chdir(inputs['working-directory'])
 

ruby-builder-versions.json

@@ -13,10 +13,10 @@
     "3.1.0-preview1", "3.1.0", "3.1.1", "3.1.2", "3.1.3", "3.1.4", "3.1.5", "3.1.6", "3.1.7",
     "3.2.0-preview1", "3.2.0-preview2", "3.2.0-preview3", "3.2.0-rc1", "3.2.0", "3.2.1", "3.2.2", "3.2.3", "3.2.4", "3.2.5", "3.2.6", "3.2.7", "3.2.8", "3.2.9",
     "3.3.0-preview1", "3.3.0-preview2", "3.3.0-preview3", "3.3.0-rc1", "3.3.0", "3.3.1", "3.3.2", "3.3.3", "3.3.4", "3.3.5", "3.3.6", "3.3.7", "3.3.8", "3.3.9", "3.3.10",
-    "3.4.0-preview1", "3.4.0-preview2", "3.4.0-rc1", "3.4.0", "3.4.1", "3.4.2", "3.4.3", "3.4.4", "3.4.5", "3.4.6", "3.4.7",
+    "3.4.0-preview1", "3.4.0-preview2", "3.4.0-rc1", "3.4.0", "3.4.1", "3.4.2", "3.4.3", "3.4.4", "3.4.5", "3.4.6", "3.4.7", "3.4.8",
     "3.5.0-preview1",
-    "4.0.0-preview2",
-    "head", "debug", "asan", "3.4-asan"
+    "4.0.0-preview2", "4.0.0-preview3", "4.0.0",
+    "head", "debug", "asan", "asan-release"
   ],
   "jruby": [
     "9.1.17.0",

ruby-builder.js

@@ -4,7 +4,6 @@ const path = require('path')
 const core = require('@actions/core')
 const exec = require('@actions/exec')
 const io = require('@actions/io')
-const tc = require('@actions/tool-cache')
 const common = require('./common')
 const rubyBuilderVersions = require('./ruby-builder-versions')
 
@@ -75,7 +74,7 @@ async function downloadAndExtract(platform, engine, version, rubyPrefix) {
     const url = getDownloadURL(platform, engine, version)
     console.log(url)
     try {
-      return await tc.downloadTool(url)
+      return await common.download(url)
     } catch (error) {
       if (error.message.includes('404')) {
         throw new Error(`Unavailable version ${version} for ${engine} on ${platform}

windows-toolchain-versions.json

@@ -267,6 +267,14 @@
     "arm64": "https://github.com/ruby/setup-msys2-gcc/releases/latest/download/msys2-clangarm64.7z",
     "x64": "https://github.com/ruby/setup-msys2-gcc/releases/latest/download/msys2-ucrt64.7z"
   },
+  "3.4.8": {
+    "arm64": "https://github.com/ruby/setup-msys2-gcc/releases/latest/download/msys2-clangarm64.7z",
+    "x64": "https://github.com/ruby/setup-msys2-gcc/releases/latest/download/msys2-ucrt64.7z"
+  },
+  "4.0.0": {
+    "arm64": "https://github.com/ruby/setup-msys2-gcc/releases/latest/download/msys2-clangarm64.7z",
+    "x64": "https://github.com/ruby/setup-msys2-gcc/releases/latest/download/msys2-ucrt64.7z"
+  },
   "head": {
     "arm64": "https://github.com/ruby/setup-msys2-gcc/releases/latest/download/msys2-clangarm64.7z",
     "x64": "https://github.com/ruby/setup-msys2-gcc/releases/latest/download/msys2-ucrt64.7z"

windows-versions.json

@@ -267,6 +267,14 @@
     "arm64": "https://github.com/oneclick/rubyinstaller2/releases/download/RubyInstaller-3.4.7-1/rubyinstaller-3.4.7-1-arm.7z",
     "x64": "https://github.com/oneclick/rubyinstaller2/releases/download/RubyInstaller-3.4.7-1/rubyinstaller-3.4.7-1-x64.7z"
   },
+  "3.4.8": {
+    "arm64": "https://github.com/oneclick/rubyinstaller2/releases/download/RubyInstaller-3.4.8-1/rubyinstaller-3.4.8-1-arm.7z",
+    "x64": "https://github.com/oneclick/rubyinstaller2/releases/download/RubyInstaller-3.4.8-1/rubyinstaller-3.4.8-1-x64.7z"
+  },
+  "4.0.0": {
+    "arm64": "https://github.com/oneclick/rubyinstaller2/releases/download/RubyInstaller-4.0.0-1/rubyinstaller-4.0.0-1-arm.7z",
+    "x64": "https://github.com/oneclick/rubyinstaller2/releases/download/RubyInstaller-4.0.0-1/rubyinstaller-4.0.0-1-x64.7z"
+  },
   "head": {
     "arm64": "https://github.com/oneclick/rubyinstaller2/releases/download/rubyinstaller-head/rubyinstaller-head-arm.7z",
     "x64": "https://github.com/oneclick/rubyinstaller2/releases/download/rubyinstaller-head/rubyinstaller-head-x64.7z"

windows.js

@@ -7,7 +7,6 @@ const path = require('path')
 const cp = require('child_process')
 const core = require('@actions/core')
 const exec = require('@actions/exec')
-const tc = require('@actions/tool-cache')
 const common = require('./common')
 const rubyInstallerVersions = require('./windows-versions.json')
 const toolchainVersions = require('./windows-toolchain-versions.json')
@@ -81,7 +80,7 @@ export async function install(platform, engine, version) {
 async function downloadAndExtract(engine, version, url, base, rubyPrefix) {
   const downloadPath = await common.measure('Downloading Ruby', async () => {
     console.log(url)
-    return await tc.downloadTool(url)
+    return await common.download(url)
   })
 
   const extractPath = process.env.RUNNER_TEMP
@@ -113,7 +112,7 @@ export async function installJRubyTools() {
 async function installMSYS2(url, rubyPrefix = process.env.RUNNER_TEMP) {
   const downloadPath = await common.measure('Downloading msys2 build tools', async () => {
     console.log(url)
-    return await tc.downloadTool(url)
+    return await common.download(url)
   })
 
   const extractPath = path.join(process.env.RUNNER_TEMP, 'msys64')
@@ -160,7 +159,7 @@ async function installMSYS1(url) {
 
   const downloadPath = await common.measure('Downloading msys1 build tools', async () => {
     console.log(url)
-    return await tc.downloadTool(url)
+    return await common.download(url)
   })
 
   const msys1Path = `${common.drive}:\\DevKit64`
@@ -196,7 +195,7 @@ async function installMSYS1(url) {
 async function installVCPKG(url) {
   const downloadPath = await common.measure('Downloading mswin vcpkg packages', async () => {
     console.log(url)
-    return await tc.downloadTool(url)
+    return await common.download(url)
   })
 
   const extractPath = process.env.VCPKG_INSTALLATION_ROOT