[gavindidrichsen]

Summary

Fixes the nightly spec (ruby 3.2 | puppet ~> 8.0) job, which has failed every night since 2026-10-22 (e.g. run 40248590141).

Two commits:

1. pdk update to the latest pdk-templates (PDK 4.0.1, template heads/main). Mechanical; touches only managed files (.gitignore, .pdkignore, .puppet-lint.rc, .rubocop.yml, Gemfile, metadata.json).
2. Raise the Puppet 8 CI floor in ci.yml and nightly.yml from ~> 8.0 to ~> 8.17.

Additional Context

• Root cause. The job fails while loading the specs: FrozenError: can't modify frozen Hash at puppet-8.16.0/lib/puppet/util/monkey_patches.rb:56 (SSLContext). That is a bug in Puppet 8.16.0 itself, which is fixed in later 8.x. CI should never have resolved 8.16.0. It did because of a Bundler resolution trap: with only puppet ~> 8.0, Bundler picks multi_json 1.21 first; Puppet 8.17+ caps multi_json at <= 1.19.0, so Bundler silently backtracks puppet to 8.16.0, the newest release with no such cap. Same trap as bolt-private PRs #123 and #126, and pdk-templates #662 (ADR 0001).
• Why two changes. pdk-templates #662 (merged 2026-09-08) adds puppet_floor_version to the template Gemfile, defaulting PUPPET_GEM_VERSION to ~> 8.17. This module was still on template 3.2.0, so it lacked that. The default only applies when PUPPET_GEM_VERSION is unset, and ci.yml/nightly.yml (both unmanaged: true in .sync.yml) set it to ~> 8.0 explicitly, so the pdk update alone would not change CI. Hence the second commit.
• Reproduction (local, Ruby 3.2.11). Before: bundle install resolves puppet 8.16.0. After pdk update and a new bundle install: puppet 8.22.

Known risks (please check CI)

pdk update replaces the Gemfile and removes two hand edits that were in it:

• gem "ffi", platforms: [:mswin, :mingw, :x64_mingw] in the system_tests group (commit 4744b3c restored it for Windows). Watch the Windows acceptance job.
• The Ruby 4.0-only gemsource_facter scoping from the same commit. The template now routes facter through puppetcore on every Ruby, which that commit said crashed require 'facter' on Ruby 3.2. I have not shown whether this still happens with the current facter build.

If either shows up red, the fix is to add them back through .sync.yml (or keep the Gemfile unmanaged) in a follow-up commit on this PR.

Related Issues (if any)

Jira: CAT-2946.

Nightly failures since 2026-10-22; bolt-private #123, #126; pdk-templates #662.

Docs assessment

Read the repo CONTRIBUTING.md and PR template. No documentation change needed: no behaviour change for users of the gem or module, and the CHANGELOG is generated at release prep.

Checklist

• 🟢 Spec tests.
• 🟢 Acceptance tests.
• Manually verified. (bundle install resolves puppet 8.22 locally; CI to confirm.)

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 88.98%. Comparing base (da86617) to head (46227a2).

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #403      +/-   ##
==========================================
- Coverage   90.77%   88.98%   -1.80%     
==========================================
  Files           6        6              
  Lines        1257      853     -404     
==========================================
- Hits         1141      759     -382     
+ Misses        116       94      -22     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[jst-cyr]

@gavindidrichsen : Won't raising the Puppet 8 floor to 8.17 mean that it requires the private Puppet Core and there will no longer be any unit tests run on forks?