From 79eb2e2fb9a765b4b6e6e439998d8ced99d688dd Mon Sep 17 00:00:00 2001 From: Tim Smith Date: Sat, 29 Aug 2026 19:12:00 -0700 Subject: [PATCH 1/2] ci: run lint and unit tests on pushes to main The workflow only ran on pull_request, so main itself was never verified. Two pull requests that are each green can still break main together, and release-please cuts a release straight off whatever is on main, so a break there goes out rather than being caught. Signed-off-by: Tim Smith --- .github/workflows/lint.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index 925ce2d..45917a5 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -3,7 +3,13 @@ name: "Test" "on": pull_request: + # Also on main, so a merge is verified in its own right. Two pull requests + # that are each green can still break main together, and release-please + # cuts releases straight off whatever is there. + push: + branches: [main] jobs: lint-unit: uses: test-kitchen/.github/.github/workflows/lint-unit.yml@main + From d180e4e42132fa2d6085fec05a095f0d6cd2ed28 Mon Sep 17 00:00:00 2001 From: Tim Smith Date: Sat, 29 Aug 2026 19:12:01 -0700 Subject: [PATCH 2/2] ci: check the built gem still contains the license and lib Nothing inspects the package between a merge and RubyGems: release-please merges, the publish workflow builds and pushes, and that is the whole path. A gemspec whose spec.files glob stops matching would therefore ship silently -- the file list here is built by grepping git ls-files, so a rename of LICENSE is all it would take. Build the gem on every pull request and assert LICENSE and lib/ are in it. Verified by pointing the glob at LICENSE.txt, which the check rejects. Signed-off-by: Tim Smith --- .github/workflows/lint.yml | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index 45917a5..9b09a1c 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -13,3 +13,30 @@ jobs: lint-unit: uses: test-kitchen/.github/.github/workflows/lint-unit.yml@main + # Nothing looks at the built gem before it is published: release-please + # merges, the publish workflow builds and pushes to RubyGems, and that is + # the whole path. So check here that the package still contains what it is + # supposed to, rather than finding out from a release. + package: + name: Gem packaging + runs-on: ubuntu-latest + steps: + - name: Checkout code + uses: actions/checkout@v7 + + - name: Setup Ruby + uses: ruby/setup-ruby@v1 + with: + ruby-version: "3.4" + + - name: Build the gem + run: gem build kitchen-cloudstack.gemspec + + - name: Check the package contains the license and the library + run: | + files="$(gem spec kitchen-cloudstack-*.gem files)" + echo "$files" + echo "$files" | grep -q '^- LICENSE$' \ + || { echo "::error::LICENSE is missing from the built gem"; exit 1; } + echo "$files" | grep -q '^- lib/kitchen/driver/cloudstack\.rb$' \ + || { echo "::error::lib/ is missing from the built gem"; exit 1; }