[RinseV]

Warning

Breaking change: drops support for Ruby 3.2 and Rails 7.1/7.2 (build!: commit). release-please will release this as 3.0.0.

Important

Apply Drieam/Terraform-Common#1526 first. Branch protection still requires the old rspec (3.2, rails_7_1)-style checks, which no longer run.

Summary

Fixes the broken CI and aligns the repo with drieam-oauth2.

 spec/spec_helper.rb
-Rails.application.config.cache_store = :null_store   # nil since combustion 1.7.0
-Combustion.initialize! :active_record, :action_controller
+Combustion.initialize! :active_record, :action_controller do
+  config.cache_store = :null_store
+end

 keypairs.gemspec
-  spec.required_ruby_version = '>= 3.2'
+  spec.required_ruby_version = '>= 3.3'
-  actionpack / activerecord '>= 7.1', '< 9'
+  actionpack / activerecord '>= 8.0', '< 9'
+  spec.add_dependency 'json', '< 3.0'

 CI matrix
-  ruby:    3.2, 3.3, 3.4
-  gemfile: rails_7_1, rails_7_2, rails_8_0
+  ruby:    3.3, 3.4, 4.0
+  gemfile: rails_8_0, rails_8_1

Commits:

• test: configure the cache store inside the combustion initializer. This is the actual CI fix. combustion 1.7.0 only loads its Rails app inside Combustion.initialize!.
• build: pin json to < 3.0 (same as drieam-oauth2)
• build!: drop Ruby 3.2 and Rails 7.1/7.2, test Ruby 3.3/3.4/4.0 on Rails 8.0/8.1
• ci: switch to release-please (still publishes to RubyGems and GitHub Packages)
• ci: run on pull requests, use --format github for rubocop/brakeman, lint on Ruby 3.4
• chore: load rubocop extensions as plugins:
• chore: stop tracking the sqlite -shm/-wal files that every spec run deletes
• ci: add .github/workflows/actions.lock (supersedes ci: Generate workflow lockfile #26, tracked in Drieam/SecDevOps#661). Without it, CI fails to start with startup_failure.

Evidence

• Before: every rspec job on main fails while loading spec_helper:

  Failure/Error: Rails.application.config.cache_store = :null_store
  NoMethodError: undefined method 'config' for nil
  0 examples, 0 failures, 1 error occurred outside of examples
  

  After (local): 100 examples, 0 failures on each combination:

  Ruby	Rails 8.0	Rails 8.1
  3.3.6	✅	✅
  3.4.5	✅	✅
  4.0.9	✅	✅

  CI on this PR: all 6 rspec jobs, rubocop and brakeman pass.

Merge Danger

Door: one-way

Once 3.0.0 is published, the release can't be taken back. Apps on Ruby 3.2 or Rails 7.x stay on 2.0.1.

Blast Radius: consumers

• Apps on Ruby 3.2 or Rails < 8.0 can't upgrade past 2.0.1.
• The json < 3.0 pin stops apps from moving to json 3.x while they use keypairs.
• Before the first release, check that GitHub Actions is allowed to create pull requests (Settings → Actions → General) and that the RUBYGEMS_AUTH_TOKEN secret still exists.

[Copilot]

🟡 Changes recommended

The workflow can publish a gem containing commits absent from its release tag, leaves release PRs without CI checks, and cannot recover failed or partial publication through reruns.

3 open issues

• Build from the release PR SHA, not the triggering commit · New
• Release PRs skip required CI checks with the default token · New
• Allow retries for partially published releases · New

What changed in this PR

This PR fixes test initialization, raises the gem’s supported Ruby and Rails versions, and replaces release-triggered publishing with release-please automation.

Changes:

• Configure the test cache store inside Combustion initialization.
• Require Ruby 3.3+ and Rails 8+, pin json < 3.0, and update the CI matrix.
• Introduce release-please for versioning and dual-registry publishing, refresh lint configuration, and ignore SQLite sidecar files.

File	Description
spec/​spec_helper.rb	Configure caching after the Combustion app is initialized.
release-please-config.json	Configure Ruby releases and version-file updates.
README.md	Document the release-please publishing process.
lib/​keypairs/​version.rb	Align the version with the 2.0.1 release baseline.
keypairs.gemspec	Raise minimum Ruby/Rails versions and constrain JSON.
gemfiles/​rails_8_1.gemfile	Define the Rails 8.1 dependency range.
gemfiles/​rails_8_0.gemfile	Define the Rails 8.0 dependency range.
gemfiles/​rails_7_2.gemfile	Remove the Rails 7.2 appraisal Gemfile.
Appraisals	Replace older Rails appraisals with Rails 8.0/8.1.
.rubocop.yml	Use plugin loading and target Ruby 3.3.
.release-please-manifest.json	Seed release tracking at 2.0.1.
.gitignore	Ignore SQLite sidecar files.
.github/​workflows/​publish.yml	Automate releases and publishing to both gem registries.
.github/​workflows/​ci.yml	Enable PR checks and update runtimes and lint output.

_{Review effort: Balanced}