Ruby 2.x Deprecation

.github/workflows/acceptance.yml

@@ -53,11 +53,11 @@ jobs:
 
   acceptance-suite:
     needs: changes
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-latest-xl
     name: runner / acceptance-tests
     strategy:
       matrix:
-        ruby: [ '2.7.5', '3.1.2', '3.2.2', '3.3.0', '3.3.1' ]
+        ruby: [ '3.1.2', '3.2.2', '3.3.0', '3.3.1' ]
 
     steps:
       - uses: ruby/setup-ruby@1198b074305f9356bd56dd4b311757cc0dab2f1c # [email protected]

.github/workflows/lint.yml

@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        ruby: [ '2.7.5', '3.1.2', '3.2.2', '3.3.0', '3.3.1' ]
+        ruby: [ '3.1.2', '3.2.2', '3.3.0', '3.3.1' ]
 
     steps:
       - name: checkout

.github/workflows/test.yml

@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        ruby: [ '2.7.5', '3.1.2', '3.2.2', '3.3.0', '3.3.1' ]
+        ruby: [ '3.1.2', '3.2.2', '3.3.0', '3.3.1' ]
 
     steps:
       - name: checkout

Gemfile.lock

@@ -1,68 +1,87 @@
 PATH
   remote: .
   specs:
-    entitlements-app (0.3.4)
-      concurrent-ruby (= 1.1.9)
-      faraday (> 2.0, <= 2.7.10)
+    entitlements-app (1.0.0)
+      concurrent-ruby (~> 1.3, >= 1.3.1)
+      faraday (~> 2.0)
       net-ldap (~> 0.19)
       octokit (~> 4.18)
-      optimist (= 3.0.0)
+      optimist (~> 3.1)
 
 GEM
   remote: https://rubygems.org/
   specs:
-    activesupport (7.0.7.2)
+    activesupport (7.1.3.3)
+      base64
+      bigdecimal
       concurrent-ruby (~> 1.0, >= 1.0.2)
+      connection_pool (>= 2.2.5)
+      drb
       i18n (>= 1.6, < 2)
       minitest (>= 5.1)
+      mutex_m
       tzinfo (~> 2.0)
-    addressable (2.8.5)
+    addressable (2.8.6)
       public_suffix (>= 2.0.2, < 6.0)
     ast (2.4.2)
-    concurrent-ruby (1.1.9)
-    crack (0.4.5)
+    base64 (0.2.0)
+    bigdecimal (3.1.8)
+    concurrent-ruby (1.3.1)
+    connection_pool (2.4.1)
+    crack (1.0.0)
+      bigdecimal
       rexml
     debug (1.8.0)
       irb (>= 1.5.0)
       reline (>= 0.3.1)
-    diff-lcs (1.5.0)
+    diff-lcs (1.5.1)
     docile (1.4.0)
-    faraday (2.7.10)
-      faraday-net_http (>= 2.0, < 3.1)
-      ruby2_keywords (>= 0.0.4)
-    faraday-net_http (3.0.2)
-    hashdiff (1.0.1)
-    i18n (1.14.1)
+    drb (2.2.1)
+    faraday (2.9.0)
+      faraday-net_http (>= 2.0, < 3.2)
+    faraday-net_http (3.1.0)
+      net-http
+    hashdiff (1.1.0)
+    i18n (1.14.5)
       concurrent-ruby (~> 1.0)
-    io-console (0.6.0)
-    irb (1.7.4)
-      reline (>= 0.3.6)
-    json (2.6.3)
-    minitest (5.19.0)
+    io-console (0.7.2)
+    irb (1.13.1)
+      rdoc (>= 4.0.0)
+      reline (>= 0.4.2)
+    json (2.7.2)
+    language_server-protocol (3.17.0.3)
+    minitest (5.23.1)
+    mutex_m (0.2.0)
+    net-http (0.4.1)
+      uri
     net-ldap (0.19.0)
     octokit (4.25.1)
       faraday (>= 1, < 3)
       sawyer (~> 0.9)
-    optimist (3.0.0)
-    parallel (1.23.0)
-    parser (3.2.2.3)
+    optimist (3.1.0)
+    parallel (1.24.0)
+    parser (3.3.1.0)
       ast (~> 2.4.1)
       racc
-    public_suffix (5.0.3)
-    racc (1.7.1)
-    rack (3.0.9.1)
+    psych (5.1.2)
+      stringio
+    public_suffix (5.0.5)
+    racc (1.8.0)
+    rack (3.0.11)
     rainbow (3.1.1)
-    rake (13.0.6)
-    regexp_parser (2.8.1)
-    reline (0.3.8)
+    rake (13.2.1)
+    rdoc (6.7.0)
+      psych (>= 4.0.0)
+    regexp_parser (2.9.2)
+    reline (0.5.8)
       io-console (~> 0.5)
     rexml (3.2.8)
       strscan (>= 3.0.9)
     rspec (3.8.0)
       rspec-core (~> 3.8.0)
       rspec-expectations (~> 3.8.0)
       rspec-mocks (~> 3.8.0)
-    rspec-core (3.8.0)
+    rspec-core (3.8.2)
       rspec-support (~> 3.8.0)
     rspec-expectations (3.8.6)
       diff-lcs (>= 1.2.0, < 2.0)
@@ -71,68 +90,73 @@ GEM
       diff-lcs (>= 1.2.0, < 2.0)
       rspec-support (~> 3.8.0)
     rspec-support (3.8.3)
-    rubocop (1.29.1)
+    rubocop (1.64.0)
+      json (~> 2.3)
+      language_server-protocol (>= 3.17.0)
       parallel (~> 1.10)
-      parser (>= 3.1.0.0)
+      parser (>= 3.3.0.2)
       rainbow (>= 2.2.2, < 4.0)
       regexp_parser (>= 1.8, < 3.0)
       rexml (>= 3.2.5, < 4.0)
-      rubocop-ast (>= 1.17.0, < 2.0)
+      rubocop-ast (>= 1.31.1, < 2.0)
       ruby-progressbar (~> 1.7)
-      unicode-display_width (>= 1.4.0, < 3.0)
-    rubocop-ast (1.29.0)
-      parser (>= 3.2.1.0)
-    rubocop-github (0.17.0)
-      rubocop
-      rubocop-performance
-      rubocop-rails
-    rubocop-performance (1.13.3)
-      rubocop (>= 1.7.0, < 2.0)
-      rubocop-ast (>= 0.4.0)
-    rubocop-rails (2.15.2)
+      unicode-display_width (>= 2.4.0, < 3.0)
+    rubocop-ast (1.31.3)
+      parser (>= 3.3.1.0)
+    rubocop-github (0.20.0)
+      rubocop (>= 1.37)
+      rubocop-performance (>= 1.15)
+      rubocop-rails (>= 2.17)
+    rubocop-performance (1.21.0)
+      rubocop (>= 1.48.1, < 2.0)
+      rubocop-ast (>= 1.31.1, < 2.0)
+    rubocop-rails (2.25.0)
       activesupport (>= 4.2.0)
       rack (>= 1.1)
-      rubocop (>= 1.7.0, < 2.0)
+      rubocop (>= 1.33.0, < 2.0)
+      rubocop-ast (>= 1.31.1, < 2.0)
     ruby-progressbar (1.13.0)
-    ruby2_keywords (0.0.5)
     rugged (1.7.2)
     sawyer (0.9.2)
       addressable (>= 2.3.5)
       faraday (>= 0.17.3, < 3)
-    simplecov (0.16.1)
+    simplecov (0.22.0)
       docile (~> 1.1)
-      json (>= 1.8, < 3)
-      simplecov-html (~> 0.10.0)
+      simplecov-html (~> 0.11)
+      simplecov_json_formatter (~> 0.1)
     simplecov-erb (1.0.1)
       simplecov (< 1.0)
-    simplecov-html (0.10.2)
+    simplecov-html (0.12.3)
+    simplecov_json_formatter (0.1.4)
+    stringio (3.1.0)
     strscan (3.1.0)
     tzinfo (2.0.6)
       concurrent-ruby (~> 1.0)
-    unicode-display_width (2.4.2)
-    vcr (4.0.0)
-    webmock (3.4.2)
-      addressable (>= 2.3.6)
+    unicode-display_width (2.5.0)
+    uri (0.13.0)
+    vcr (6.2.0)
+    webmock (3.23.1)
+      addressable (>= 2.8.0)
       crack (>= 0.3.2)
-      hashdiff
+      hashdiff (>= 0.4.0, < 2.0.0)
 
 PLATFORMS
   ruby
+  x86_64-linux
 
 DEPENDENCIES
   debug (<= 1.8.0)
   entitlements-app!
-  rake (= 13.0.6)
+  rake (~> 13.2, >= 13.2.1)
   rspec (= 3.8.0)
-  rspec-core (= 3.8.0)
-  rubocop (= 1.29.1)
-  rubocop-github (= 0.17.0)
-  rubocop-performance (= 1.13.3)
+  rubocop (~> 1.64)
+  rubocop-github (~> 0.20)
+  rubocop-performance (~> 1.21)
   rugged (~> 1.7, >= 1.7.2)
-  simplecov (= 0.16.1)
-  simplecov-erb (= 1.0.1)
-  vcr (= 4.0.0)
-  webmock (= 3.4.2)
+  simplecov (~> 0.22.0)
+  simplecov-erb (~> 1.0, >= 1.0.1)
+  vcr (~> 6.2)
+  webmock (~> 3.23, >= 3.23.1)
 
 BUNDLED WITH
-   2.3.19
+   2.5.9

bin/deploy-entitlements

@@ -6,6 +6,7 @@ require "ruby_version_check"
 
 # Note that contracts.ruby has two specific ruby-version specific libraries, which we have vendored into lib/
 if RubyVersionCheck.ruby_version2?
+  puts "WARNING: Ruby 2.x is deprecated and will be removed in a future release. Please upgrade to Ruby 3.x."
   $LOAD_PATH.unshift(File.expand_path(File.join(__dir__, "../lib/contracts-ruby2/lib")))
 else
   $LOAD_PATH.unshift(File.expand_path(File.join(__dir__, "../lib/contracts-ruby3/lib")))

entitlements-app.gemspec

@@ -14,22 +14,23 @@ Gem::Specification.new do |s|
   s.homepage = "https://github.com/github/entitlements-app"
   s.executables = %w[deploy-entitlements]
 
-  s.add_dependency "concurrent-ruby", "= 1.1.9"
-  s.add_dependency "faraday", "> 2.0", "<= 2.7.10"
+  s.required_ruby_version = ">= 3.0.0"
+
+  s.add_dependency "concurrent-ruby", "~> 1.3", ">= 1.3.1"
+  s.add_dependency "faraday", "~> 2.0"
   s.add_dependency "net-ldap", "~> 0.19"
   s.add_dependency "octokit", "~> 4.18"
-  s.add_dependency "optimist", "= 3.0.0"
+  s.add_dependency "optimist", "~> 3.1"
 
   s.add_development_dependency "debug", "<= 1.8.0"
-  s.add_development_dependency "rake", "= 13.0.6"
+  s.add_development_dependency "rake", "~> 13.2", ">= 13.2.1"
   s.add_development_dependency "rspec", "= 3.8.0"
-  s.add_development_dependency "rspec-core", "= 3.8.0"
-  s.add_development_dependency "rubocop", "= 1.29.1"
-  s.add_development_dependency "rubocop-github", "= 0.17.0"
-  s.add_development_dependency "rubocop-performance", "= 1.13.3"
+  s.add_development_dependency "rubocop", "~> 1.64"
+  s.add_development_dependency "rubocop-github", "~> 0.20"
+  s.add_development_dependency "rubocop-performance", "~> 1.21"
   s.add_development_dependency "rugged", "~> 1.7", ">= 1.7.2"
-  s.add_development_dependency "simplecov", "= 0.16.1"
-  s.add_development_dependency "simplecov-erb", "= 1.0.1"
-  s.add_development_dependency "vcr", "= 4.0.0"
-  s.add_development_dependency "webmock", "3.4.2"
+  s.add_development_dependency "simplecov", "~> 0.22.0"
+  s.add_development_dependency "simplecov-erb", "~> 1.0", ">= 1.0.1"
+  s.add_development_dependency "vcr", "~> 6.2"
+  s.add_development_dependency "webmock", "~> 3.23", ">= 3.23.1"
 end

lib/entitlements/data/groups/calculated/text.rb

@@ -275,7 +275,7 @@ def parsed_data
                 raw_key, operator, val = Regexp.last_match(1), Regexp.last_match(2), Regexp.last_match(3)
 
                 key = if filter_keywords.include?(raw_key)
-                  "filter_#{raw_key}"
+                        "filter_#{raw_key}"
                 elsif MODIFIERS.include?(raw_key)
                   "modifier_#{raw_key}"
                 else

lib/entitlements/data/groups/calculated/yaml.rb

@@ -68,7 +68,7 @@ def initialize_filters
               end
 
               values = if val.is_a?(String)
-                [val]
+                         [val]
               elsif val.is_a?(Array)
                 val
               else
@@ -164,7 +164,7 @@ def remove_expired_rules(rules_hash)
           Contract C::None => C::HashOf[String => C::Any]
           def parsed_data
             @parsed_data ||= if RubyVersionCheck.ruby_version2?
-              ::YAML.load(File.read(filename)).to_h
+                               ::YAML.load(File.read(filename)).to_h
             else
               ::YAML.load(File.read(filename), permitted_classes: [Date]).to_h
             end

lib/entitlements/data/people/yaml.rb

@@ -80,7 +80,7 @@ def read(uid = nil)
 
             # :nocov:
             raw_person_data = if RubyVersionCheck.ruby_version2?
-              ::YAML.load(File.read(filename)).to_h
+                                ::YAML.load(File.read(filename)).to_h
             else
               ::YAML.load(File.read(filename), permitted_classes: [Date]).to_h
             end

lib/entitlements/extras/ldap_group/rules/ldap_group.rb

@@ -27,7 +27,7 @@ def self.matches(value:, filename: nil, options: {})
               entry = ldap.read(value)
               unless entry
                 message = if filename
-                  "Failed to read ldap_group = #{value} (referenced in #{filename})"
+                            "Failed to read ldap_group = #{value} (referenced in #{filename})"
                 else
                   # :nocov:
                   "Failed to read ldap_group = #{value}"

lib/entitlements/service/ldap.rb

@@ -383,7 +383,7 @@ def self.entry_to_group(entry)
       Contract Net::LDAP::Entry => C::ArrayOf[String]
       def self.member_array(entry)
         members = if entry[:objectclass].include?("groupOfUniqueNames")
-          entry[:uniquemember]
+                    entry[:uniquemember]
         elsif entry[:objectclass].include?("groupOfNames")
           entry[:member]
         elsif entry[:objectclass].include?("posixGroup")

lib/entitlements/util/override.rb

@@ -26,7 +26,7 @@ def self.override_hash_from_plugin(plugin, group, ldap)
         end
 
         file = if plugin["file"] !~ %r{/}
-          File.expand_path(File.join("../plugins", plugin["file"]), File.dirname(__FILE__))
+                 File.expand_path(File.join("../plugins", plugin["file"]), File.dirname(__FILE__))
         elsif plugin["file"].start_with?("/")
           plugin["file"]
         else

lib/entitlements/util/util.rb

@@ -81,7 +81,7 @@ def self.path_for_group(group)
 
         dir = Entitlements.config["groups"][group]["dir"]
         result_dir = if dir.nil?
-          File.join(Entitlements.config_path, group)
+                       File.join(Entitlements.config_path, group)
         elsif dir.start_with?("/")
           dir
         else

lib/version.rb

@@ -2,6 +2,6 @@
 
 module Entitlements
   module Version
-    VERSION = "0.3.4"
+    VERSION = "1.0.0"
   end
 end

spec/acceptance/Dockerfile.entitlements-app

@@ -1,4 +1,4 @@
-FROM ruby:3.1-slim
+FROM ruby:3.3.1-slim
 LABEL maintainer="GitHub Security Ops <[email protected]>"
 ENV HOME /root
 ENV RELEASE=buster
@@ -17,7 +17,7 @@ RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y \
     pkg-config
 
 # Install bundler
-RUN gem install bundler -v 2.4.22
+RUN gem install bundler -v 2.5.9
 
 # Bootstrap files and caching for speed
 COPY "vendor/cache/" "/data/entitlements-app/vendor/cache/"