Modernize testing: GitHub Actions CI, broader specs, dependabot

.expeditor/config.yml

@@ -46,8 +46,3 @@ subscriptions:
     actions:
       - built_in:rollover_changelog
       - built_in:publish_rubygems
-
-pipelines:
-  - verify:
-      description: Pull Request validation tests
-      public: true

.github/copilot-instructions.md

@@ -10,15 +10,15 @@
 mixlib-shellout/
 ├── .expeditor/                    # Expeditor CI/CD configuration
 │   ├── config.yml                # Main Expeditor configuration
-│   ├── verify.pipeline.yml       # Build pipeline definition
-│   ├── run_linux_tests.sh        # Linux test runner
-│   ├── run_windows_tests.ps1     # Windows test runner
 │   └── update_version.sh         # Version update script
 ├── .github/
 │   ├── CODEOWNERS               # Code ownership definitions
 │   ├── ISSUE_TEMPLATE/          # Issue templates
+│   ├── dependabot.yml           # Keeps actions and gems up to date
 │   ├── workflows/               # GitHub Actions workflows
-│   │   └── ci-main-pull-request-checks.yml
+│   │   ├── ci.yml               # Specs across OS/Ruby matrix, as root, packaging
+│   │   ├── lint.yml             # Cookstyle, spellcheck, linelint
+│   │   └── ci-main-pull-request-stub-*.yml  # Shared chef security/quality checks
 │   └── copilot-instructions.md  # This file
 ├── lib/mixlib/
 │   ├── shellout.rb             # Main ShellOut class
@@ -36,6 +36,7 @@ mixlib-shellout/
 │   │   ├── shellout_spec.rb  # Main test file
 │   │   └── shellout/
 │   │       ├── helper_spec.rb    # Helper tests
+│   │       ├── packaging_spec.rb # Gemspec, version and load-time tests
 │   │       └── windows_spec.rb   # Windows-specific tests
 │   └── support/              # Test support files
 ├── vendor/bundle/            # Bundled gems (gitignored in production)
@@ -128,12 +129,12 @@ Signed-off-by: Your Name <your.email@example.com>
 The repository uses **Expeditor** for automated CI/CD:
 
 - **Main config**: `.expeditor/config.yml`
-- **Build pipeline**: `.expeditor/verify.pipeline.yml`
 - **Notifications**: Sent to `#chef-found-notify` Slack channel
 - **Auto-versioning**: Supports major/minor version bumps via labels
 
 ### GitHub Actions
-- **Workflow**: `.github/workflows/ci-main-pull-request-checks.yml`
+- **Tests**: `.github/workflows/ci.yml` runs specs on Linux, macOS and Windows for every supported Ruby, as root on Linux, with frozen string literals, and against the built gem
+- **Workflow**: `.github/workflows/ci-main-pull-request-stub-*.yml`
 - **Triggers**: Pull requests and pushes to `main` and `release/**` branches
 - **Features**: Complexity checks, TruffleHog scanning, SBOM generation
 

.github/dependabot.yml

@@ -0,0 +1,25 @@
+---
+version: 2
+updates:
+  # Actions are pinned to commit SHAs with a version comment; dependabot
+  # updates both together.
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+
+  - package-ecosystem: bundler
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    groups:
+      development-dependencies:
+        dependency-type: development

.github/workflows/allchecks.yml

@@ -10,7 +10,7 @@ jobs:
       checks: read
       contents: read
     steps:
-      - uses: wechuli/allcheckspassed@v1
+      - uses: wechuli/allcheckspassed@e4240aa9cc76fd6828ce27a71ad16c406c25adb3 # v2.5.0
         with:
           # This seems to be working lately even for external
           # contributors, so maybe we don't need to exclude it?

.github/workflows/ci.yml

@@ -0,0 +1,116 @@
+---
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+env:
+  BUNDLE_WITHOUT: debug
+
+jobs:
+  test:
+    name: Ruby ${{ matrix.ruby }} on ${{ matrix.os }}
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 20
+    continue-on-error: ${{ matrix.experimental || false }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+        # keep in sync with required_ruby_version in the gemspec
+        ruby: ["3.1", "3.2", "3.3", "3.4", "4.0"]
+        include:
+          # early warning for the next ruby release; allowed to fail
+          - os: ubuntu-latest
+            ruby: head
+            experimental: true
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: ruby/setup-ruby@14594264cd68ce8a2345dd349bc3d138a4ef85c8 # v1.327.0
+        with:
+          ruby-version: ${{ matrix.ruby }}
+          bundler-cache: true
+      - run: bundle exec rspec
+
+  # User/group switching, login simulation and cgroups only run as root.
+  test-root:
+    name: Ruby ${{ matrix.ruby }} on ubuntu-latest as root
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        ruby: ["3.1", "4.0"]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: ruby/setup-ruby@14594264cd68ce8a2345dd349bc3d138a4ef85c8 # v1.327.0
+        with:
+          ruby-version: ${{ matrix.ruby }}
+          bundler-cache: true
+      - run: sudo --preserve-env env "PATH=$PATH" bundle exec rspec
+
+  # Ruby is moving towards frozen string literals by default. Run everything,
+  # dependencies included, with them forced on so we find out early.
+  frozen-string-literals:
+    name: Frozen string literals
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    env:
+      RUBYOPT: --enable-frozen-string-literal
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: ruby/setup-ruby@14594264cd68ce8a2345dd349bc3d138a4ef85c8 # v1.327.0
+        with:
+          ruby-version: "4.0"
+          bundler-cache: true
+      - run: bundle exec rspec
+
+  # Build the gems exactly as a release would, install the result somewhere
+  # isolated and make sure it works without the source tree.
+  package:
+    name: Build and install gem
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: ruby/setup-ruby@14594264cd68ce8a2345dd349bc3d138a4ef85c8 # v1.327.0
+        with:
+          ruby-version: "4.0"
+      - name: Build gems
+        run: |
+          gem build mixlib-shellout.gemspec --strict
+          gem build mixlib-shellout-universal-mingw-ucrt.gemspec --strict
+      - name: Install and smoke test outside the source tree
+        run: |
+          export GEM_HOME="$RUNNER_TEMP/gems" GEM_PATH="$RUNNER_TEMP/gems"
+          gem install --no-document "./mixlib-shellout-$(cat VERSION).gem"
+          cd "$RUNNER_TEMP"
+          ruby - <<'RUBY'
+            require "mixlib/shellout"
+            require "mixlib/shellout/helper"
+            require "mixlib/shellout/version"
+            abort "not loaded from the installed gem" unless Gem.loaded_specs.key?("mixlib-shellout")
+            cmd = Mixlib::ShellOut.new("echo", "hello").run_command
+            cmd.error!
+            abort "unexpected output: #{cmd.stdout.inspect}" unless cmd.stdout == "hello\n"
+            puts "mixlib-shellout #{Mixlib::ShellOut::VERSION} OK"
+          RUBY

.github/workflows/dco.yml

@@ -10,14 +10,16 @@ jobs:
       pull-requests: read
     runs-on: ubuntu-latest
     name: DCO Check
+    # dependabot cannot sign off its commits
+    if: github.event.pull_request.user.login != 'dependabot[bot]'
     steps:
     - name: Get PR Commits
-      uses: actionshub/get-pr-commits@main
+      uses: actionshub/get-pr-commits@0f1d778e95718cdf9a80f57d36c0a8754e874fa1 # v2.0.0
       id: 'get-pr-commits'
       with:
         token: ${{ secrets.GITHUB_TOKEN }}
     - name: DCO Check
-      uses: actionshub/dco@main
+      uses: actionshub/dco@624651527997baebfe5fd772d216f9c77bfd40f3 # v2.0.0
       with:
         commits: ${{ steps.get-pr-commits.outputs.commits }}
         allow-obvious-fix-label: "obvious-fix"

.github/workflows/lint.yml

@@ -7,40 +7,44 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 concurrency:
-  group: lint-${{ github.event.pull_request.number || github.run_id }}
-  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   cookstyle:
     runs-on: ubuntu-latest
     env:
-      BUNDLE_WITHOUT: ruby_shadow:packaging
+      BUNDLE_WITHOUT: debug
     steps:
-      - uses: actions/checkout@v6
-      - uses: ruby/setup-ruby@v1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          ruby-version: 3.4
-          bundler-cache: false
-      - uses: r7kamura/rubocop-problem-matchers-action@v1  # this shows the failures in the PR
-      - run: |
-          bundle install
-          bundle exec cookstyle --chefstyle -c .rubocop.yml
+          persist-credentials: false
+      - uses: ruby/setup-ruby@14594264cd68ce8a2345dd349bc3d138a4ef85c8 # v1.327.0
+        with:
+          ruby-version: "4.0"
+          bundler-cache: true
+      - uses: r7kamura/rubocop-problem-matchers-action@59f1a0759f50cc2649849fd850b8487594bb5a81 # v1.2.2
+      - run: bundle exec cookstyle --chefstyle -c .rubocop.yml
 
   spellcheck:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - run: |
           curl --location 'https://raw.githubusercontent.com/chef/chef_dictionary/main/chef.txt' --output chef_dictionary.txt
-      - uses: streetsidesoftware/cspell-action@v8.4.0
+      - uses: streetsidesoftware/cspell-action@6f3c77c1406bc930f944ba97e9801a22e42caf58 # v9.1.0
 
   linelint:
     runs-on: ubuntu-latest
     name: Check if all files end in newline
     steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-      - name: Linelint
-        uses: fernandrone/linelint@master
-        id: linelint
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: fernandrone/linelint@7907a5dca0c28ea7dd05c6d8d8cacded713aca11 # 0.0.6

.gitignore

@@ -15,3 +15,4 @@ Gemfile.lock
 */tags
 *~
 vendor/
+spec/examples.txt

.rspec

@@ -1 +1,3 @@
--f documentation --color
+--require spec_helper
+--format documentation
+--color

CONTRIBUTING.md

@@ -1 +1 @@
-Please refer to https://github.com/chef/chef/blob/master/CONTRIBUTING.md
+Please refer to https://github.com/chef/chef/blob/main/CONTRIBUTING.md