(CAT-2840) Add Ruby 4.0 / Puppet 9 CI lane, source gems from PuppetCore

.github/workflows/ci.yml

@@ -11,12 +11,20 @@ jobs:
     name: Linux, Puppet ${{ matrix.cfg.puppet_version }}, Ruby ${{ matrix.cfg.ruby }}
     runs-on: ubuntu-22.04
     strategy:
+      fail-fast: false
       matrix:
         cfg:
           - {puppet_version: '8', ruby: '3.2'}
           - {puppet_version: '8', ruby: 'jruby-9.4.2.0'}
+          - {puppet_version: '9', ruby: '4.0'}
+          - {puppet_version: '9', ruby: 'jruby-10.1.1.0'}
     env:
       PUPPET_GEM_VERSION: ~> ${{ matrix.cfg.puppet_version }}
+      # Puppet 9 (and its facter/ffi dependencies compatible with Ruby 4.0) are not yet published to
+      # public RubyGems -- route the gem resolution through the private PuppetCore source instead.
+      # See rubygems-puppetcore usage in ruby-pwsh#385 / bolt-private#120 for the established pattern.
+      PUPPET_FORGE_TOKEN: ${{ secrets.PUPPET_FORGE_TOKEN }}
+      BUNDLE_RUBYGEMS___PUPPETCORE__PUPPET__COM: "forge-key:${{ secrets.PUPPET_FORGE_TOKEN }}"
       CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
     steps:
       - name: Checkout current PR
@@ -48,11 +56,15 @@ jobs:
     name: Windows, Puppet ${{ matrix.cfg.puppet_version }}, Ruby ${{ matrix.cfg.ruby }}
     runs-on: windows-latest
     strategy:
+      fail-fast: false
       matrix:
         cfg:
           - {puppet_version: '8', ruby: '3.2', extra: 'bundle config set with integration'}
+          - {puppet_version: '9', ruby: '4.0', extra: 'bundle config set with integration'}
     env:
       PUPPET_GEM_VERSION: ~> ${{ matrix.cfg.puppet_version }}
+      PUPPET_FORGE_TOKEN: ${{ secrets.PUPPET_FORGE_TOKEN }}
+      BUNDLE_RUBYGEMS___PUPPETCORE__PUPPET__COM: "forge-key:${{ secrets.PUPPET_FORGE_TOKEN }}"
     steps:
       - name: Checkout current PR
         uses: actions/checkout@v4

.github/workflows/nightly.yml

@@ -9,12 +9,17 @@ jobs:
     name: Linux, Puppet ${{ matrix.cfg.puppet_version }}, Ruby ${{ matrix.cfg.ruby }}
     runs-on: ubuntu-22.04
     strategy:
+      fail-fast: false
       matrix:
         cfg:
           - {puppet_version: '8', ruby: '3.2'}
           - {puppet_version: '8', ruby: 'jruby-9.4.2.0'}
+          - {puppet_version: '9', ruby: '4.0'}
+          - {puppet_version: '9', ruby: 'jruby-10.1.1.0'}
     env:
       PUPPET_GEM_VERSION: ~> ${{ matrix.cfg.puppet_version }}
+      PUPPET_FORGE_TOKEN: ${{ secrets.PUPPET_FORGE_TOKEN }}
+      BUNDLE_RUBYGEMS___PUPPETCORE__PUPPET__COM: "forge-key:${{ secrets.PUPPET_FORGE_TOKEN }}"
     steps:
       - name: Checkout current PR
         uses: actions/checkout@v4
@@ -45,11 +50,15 @@ jobs:
     name: Windows, Puppet ${{ matrix.cfg.puppet_version }}, Ruby ${{ matrix.cfg.ruby }}
     runs-on: windows-latest
     strategy:
+      fail-fast: false
       matrix:
         cfg:
           - {puppet_version: '8', ruby: '3.2', extra: 'bundle config set with integration'}
+          - {puppet_version: '9', ruby: '4.0', extra: 'bundle config set with integration'}
     env:
       PUPPET_GEM_VERSION: ~> ${{ matrix.cfg.puppet_version }}
+      PUPPET_FORGE_TOKEN: ${{ secrets.PUPPET_FORGE_TOKEN }}
+      BUNDLE_RUBYGEMS___PUPPETCORE__PUPPET__COM: "forge-key:${{ secrets.PUPPET_FORGE_TOKEN }}"
     steps:
       - name: Checkout current PR
         uses: actions/checkout@v4

Gemfile

@@ -1,5 +1,15 @@
 source 'https://rubygems.org'
 
+# Puppet 9 (and the facter/ffi versions it requires under Ruby 4.0) are not published to public
+# RubyGems yet -- resolve them from the private PuppetCore source instead, when a forge token is
+# available. Falls back to the default source otherwise (e.g. local dev on the Puppet 8 lane).
+# See ruby-pwsh#385 / bolt-private#120 for the established pattern this mirrors.
+gemsource_puppetcore = if ENV['PUPPET_FORGE_TOKEN'] && !ENV['PUPPET_FORGE_TOKEN'].empty?
+                          'https://rubygems-puppetcore.puppet.com'
+                        else
+                          ENV['GEM_SOURCE_PUPPETCORE'] || 'https://rubygems.org'
+                        end
+
 git_source(:github) { |repo_name| "https://github.com/#{repo_name}" }
 
 # Specify your gem's dependencies in puppet-resource_api.gemspec
@@ -11,7 +21,13 @@ group :tests do
   gem 'simplecov-console'
 
   # the test gems required for module testing
-  gem 'puppetlabs_spec_helper', '~> 8.0'
+  # puppetlabs_spec_helper 9.0.0 requires Ruby >= 3.2, which jruby-9.4.2.0 (our Puppet 8 JRuby
+  # lane, ~Ruby 3.1 compatible) doesn't satisfy -- keep that lane on 8.0, bump everything else.
+  if Gem::Requirement.create('>= 3.2').satisfied_by?(Gem::Version.new(RUBY_VERSION))
+    gem 'puppetlabs_spec_helper', '~> 9.0'
+  else
+    gem 'puppetlabs_spec_helper', '~> 8.0'
+  end
   gem 'rspec-puppet'
   gem 'codecov'
   gem 'rake', '~> 13.0'
@@ -38,21 +54,26 @@ end
 # testing Puppet 8 / Ruby 3.2 on Windows. See PA-5406 for more.
 group :integration do
   # Pin due to an issue with FFI, Windows, and Facter. See FACT-3434
-  gem 'ffi', '1.15.5'
+  # Bumped from 1.15.5 for Ruby 4.0/Puppet 9 compatibility (see also open dependabot PR #364,
+  # which proposed this same bump independently for Puppet 8) -- verify against the actual
+  # Puppet 9 gemspec's ffi constraint once available, the public Puppet 8 gemspec still caps at < 1.17.0.
+  gem 'ffi', '1.17.1'
 end
 
 # Find a location or specific version for a gem. place_or_version can be a
 # version, which is most often used. It can also be git, which is specified as
 # `git://somewhere.git#branch`. You can also use a file source location, which
 # is specified as `file://some/location/on/disk`.
-def location_for(place_or_version, fake_version = nil)
+def location_for(place_or_version, fake_version = nil, opts = {})
   if place_or_version =~ /^((?:git|https)[:@][^#]*)#(.*)/
     [fake_version, { :git => $1, :branch => $2, :require => false }].compact
   elsif place_or_version =~ /^file:\/\/(.*)/
     ['>= 0', { :path => File.expand_path($1), :require => false }]
   else
-    [place_or_version, { :require => false }]
+    [place_or_version, { :require => false }.merge(opts)]
   end
 end
 
-gem 'puppet', *location_for(ENV['PUPPET_GEM_VERSION'])
+# facter is a transitive dependency of puppet's gemspec; bundler resolves it from the same
+# PuppetCore remote automatically once puppet itself is pinned there, so no separate pin needed.
+gem 'puppet', *location_for(ENV['PUPPET_GEM_VERSION'], nil, { source: gemsource_puppetcore })