CI: mingw: Use the official actions for msys2
Because ruby/setup-ruby is affected to test result.
Also includes the prerequisite changes from e4b386e090, 90f8199412,
a443cd012a and 4adb6f6969 (Remove Strawberry Perl pkg-config, misc
system & package info, `cmd` as the default shell, set up msys2
environment variables).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
setup-ruby v1.236.0 raises "Cannot find Git's cert file" on Windows
runners because Git for Windows moved from mingw64 to ucrt64.
This was fixed in ruby/setup-ruby#947 (v1.328.0).
The result jobs in macOS workflows only check if other jobs failed
(just runs `exit 1`). They don't need macOS runners. Using
ubuntu-latest instead frees up macOS runner slots and starts faster
due to shorter queue times.
[PATCH] Raise the ModGC `make check` timeout for MMTk to 90 minutes
MMTk's `make check` on macos-26 takes 27 minutes at the median and 37 at the 90th percentile, so the default 40 minute step limit sits inside the distribution of successful runs. Of the 61 MMTk macos-26 `make check` failures in the 1000 ModGC runs between 2026-09-04 and 09-17, 26 are the step timing out with no test failure at all. 90 minutes matches what macos.yml already gives the same step on the same runner.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
[PATCH] Add timeout scale to macOS ModGC CI jobs
Same fix as commit 8e8682fc23, which added
RUBY_TEST_TIMEOUT_SCALE=10 to all macOS check jobs in macos.yml but did
not cover modgc.yml. assert_separately subprocess assertions flake on
slower/contended macOS runners, especially with the slower MMTk GC.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
MSYS2 dropped perl from its base install and the windows-2022 runner
image picked that up in 20260818.277.1, so autogen.sh now dies with
`/usr/bin/perl: bad interpreter`. master and ruby_4_0 set up their own
MSYS2 with autoconf, which pulls perl in as a dependency, so only the
branches that reuse the image MSYS2 need this.
https://github.com/actions/runner-images/issues/14562
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
microsoft/vcpkg bumped `scripts/vcpkg-tools.json` to schema version 2,
which the vcpkg.exe bundled in the runner images cannot parse, so every
Windows job started failing at `vcpkg install` right after the `git pull`.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
(cherry picked from commit f275e95ff2)
The full macOS fan-out (10 jobs, about 117 runner-minutes) repeats
test tasks that macos.yml already runs from the git tree on every
event; what is tarball-specific is only that the packaged tarball
configures, builds and installs. Run a single check on macos-26 for
pull requests and pushes, and keep the full matrix for
workflow_dispatch, which is how the nightly schedule and release
verification invoke it. Only macOS is trimmed: its org-wide
concurrency pool of 50 runners saturates during peak hours and has
been delaying release jobs, while Linux and Windows share a pool with
headroom.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
(cherry picked from commit df977545f0)
The cache step hardcoded snapshot-*, which no longer matches when this
reusable workflow is called with a release archname such as
ruby-3.4.0-rc1 from ruby/actions, turning cache save and restore into
a no-op.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
(cherry picked from commit 674e93935c)
OPENSSL_MODULES moves into the setup env step where the triplet is
available as an environment variable.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
(cherry picked from commit 39a61bc1ef)
Compose VCPKG_BINARY_SOURCES from FEED_URL in the setup step so the
feed URL is defined in one place, and use github.repository_owner so
forks running these workflows use their own GitHub Packages feed
instead of failing to authenticate against the ruby feed.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
(cherry picked from commit 0574c02a6c)
A called workflow may only keep or reduce the permissions of the caller
job. On fork pull requests the caller token is capped to read-only, so
declaring packages: write here is an elevation request and the job
fails at startup. Inherit the caller's permissions instead.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
(cherry picked from commit 19b32cc45c)
vcpkg-tool removed the x-gha provider, and the actions/cache strategy
was wasteful: windows.yml rebuilt every port on each baseline bump, and
tarball-windows.yml keyed its cache on github.sha, saving a new ~22MB
entry per run and pinning the repository at the 10GB cache quota. A
NuGet feed on GitHub Packages caches binaries per port keyed by vcpkg's
ABI hash and is shared across branches and workflows. tarball-windows
now installs from the manifest included in the snapshot so it reuses
the packages built by windows.yml.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
(cherry picked from commit debd913e7e)
Backport the macos.yml matrix change from 5c762e786b so this branch
also exercises macos-15-intel (and makes macos-26 the default runner).
Other workflows touched by the original commit are out of scope.
The macos-15 runner image ships a pre-installed Ruby under /usr/local
whose default-gem directory shares the 3.3.0 ABI path with the snapshot
build. With the default prefix, RDoc generation scans that directory and
dies on a stale bundler default-gem stub left by the runner's RubyGems
self-update. Build, install and verify under an isolated prefix instead.
(cherry picked from commit dc24122d90)
Dir.each_child yields entry names, so stat/digest/children ran against
the working directory instead of HOME. Join dir and name first.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
(cherry picked from commit 76be52bd01)
Make macos-26 the default runner for the tarball build verification and
keep macos-15, macos-15-intel, and macos-14 as regression coverage.
(cherry picked from commit 5c762e786b)
Replace secrets: inherit with explicit Slack webhook secrets, which are
the only secrets the ubuntu/macos/windows builds use. tarball-non-development
uses no secrets, so drop inherit there entirely.
(cherry picked from commit daea48078c)
The subsequent git steps only fetch from the public origin and operate
on local branches, so the token does not need to be persisted.
(cherry picked from commit f00e912db0)
[PATCH] Install gmp on every tarball-test platform
macOS already pulled gmp via brew so bignum tests linked against it,
while ubuntu/non-development/windows skipped it and quietly used the
pure-C fallback. Add libgmp-dev on apt and gmp on vcpkg so all platforms
build bignum.c against gmp consistently.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The composite is blob-identical across branches after PR #17063 lands
everywhere, so pointing maintenance branches at master removes the
need to re-cherry-pick future fixes. The local copy stays in place
because ruby/actions still calls it via ruby/ruby/.github/actions/make-snapshot@<branch>.
Backport of ruby/ruby#17063 to ruby_3_4. The reusables and the
make-snapshot composite are now blob-identical to master except for
tarball-windows, which keeps the windows-2022 + vs / vcvars matrix and
the manual vcvars64.bat setup env step. tarball-test no longer passes
apt-mode, notify-ruby-sha, or branch-label because the reusables no
longer accept them. notify-release-channel is wired through to all
three per-OS calls so the schedule dispatcher can keep routing
failures to two Slack channels.
zizmor flags `cd "${{ inputs.archname }}/"` inside `run:` blocks as
code injection via template expansion: GitHub Actions substitutes the
input value into the shell script verbatim, so a caller passing shell
metacharacters could execute arbitrary code.
Hoist `ARCHNAME: ${{ inputs.archname }}` to the job-level `env:` block
and reference it as `$ARCHNAME` in shell, matching the pattern already
used by tarball-windows.yml (see 942f45b2af).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The per-OS tarball-test workflows currently hard-code `cd snapshot-*/`
to enter the extracted tarball directory, which prevents callers from
producing tarballs under any other prefix (for example `ruby-3.4.0-rc1`
emitted by `tool/make-snapshot` when given a version argument).
Replace the glob with `cd "${{ inputs.archname }}/"`. Existing snapshot
callers still pass `snapshot-<branch>` so behavior is unchanged for
this repository, but ruby/actions can now reuse the same workflows
from `draft-release.yml` with `ruby-<version>` archnames.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
ruby_3_4 only builds with the vs2022 + vcvars 14.2 toolchain on this
branch because win32/vssetup.cmd has not been backported, so the mode
input and the modern branch are dead code here. Drop the input,
hardcode the legacy matrix and setup-env step, and stop passing
mode: legacy from tarball-test.yml.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
GitHub Actions schedule triggers only fire on the default branch, so
the daily cron in tarball-test.yml never ran on ruby_3_4. Switch the
trigger to workflow_dispatch so master's tarball-test-schedule.yml
can dispatch it via gh workflow run --ref ruby_3_4.
https://github.com/ruby/ruby/commit/9e92537490
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Port the daily snapshot tarball pipeline from ruby/actions into
ruby/ruby so the tarball build and per-OS tests run on every push and
pull request. The make-snapshot composite action gains a srcdir input so
the same logic can either clone ruby/ruby (daily upload from ruby/actions)
or operate on the working tree (this workflow).
ruby_3_4 keeps its branch-specific knobs in tarball-test.yml: ubuntu
runs with apt-mode=git-only and posts the ruby SHA notification on
schedule failures with branch-label=ruby_3_4, and windows uses the
legacy vcvars 14.2 path.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
