From cc544502a32c6d3625c6a1646ac1459e1159b6b1 Mon Sep 17 00:00:00 2001
From: Christopher Horrell <christopher@horrell.ca>
Date: Thu, 9 Jul 2026 14:22:59 -0400
Subject: [PATCH] ci: fix ruby/setup-ruby cache poisoning and stale version
 comment

- Disable bundler-cache and add explicit bundle install step to
  eliminate a zizmor cache-poisoning finding (bundler cache combined
  with docker/build-push-action publishing runtime artifacts)
- Correct the trailing version comment on ruby/setup-ruby from
  v1.310.0 to v1.315.0 to match the pinned commit SHA
---
 .github/workflows/ruby.yml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ruby.yml b/.github/workflows/ruby.yml
index 1f78c8f..5906e38 100644
--- a/.github/workflows/ruby.yml
+++ b/.github/workflows/ruby.yml
@@ -20,10 +20,12 @@ jobs:
       with:
         persist-credentials: false
     - name: Set up Ruby ${{ matrix.ruby-version }}
-      uses: ruby/setup-ruby@0dafeac902942906541bc140009cdbf32665b601 # v1.310.0 # zizmor: ignore[cache-poisoning]
+      uses: ruby/setup-ruby@0dafeac902942906541bc140009cdbf32665b601 # v1.315.0
       with:
         ruby-version: ${{ matrix.ruby-version }}
-        bundler-cache: true
+        bundler-cache: false
+    - name: Install gems
+      run: bundle install
     - name: Set up Docker Buildx
       uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
       with: