Open master merge

.github/CODEOWNERS

@@ -1 +1 @@
-.github/workflows @toptal/platform-sre
+* @toptal/platform-foundation

.github/dependabot.yml

@@ -13,14 +13,14 @@ updates:
       interval: "weekly"
       day: "wednesday"
       time: "07:00"
+    cooldown:
+      default-days: 7
     pull-request-branch-name:
       separator: "-"
     labels:
       - "no-jira"
       - "ruby"
       - "dependencies"
-    reviewers:
-      - "toptal/devx"
     registries:
       - toptal-github
     insecure-external-code-execution: allow
@@ -31,12 +31,12 @@ updates:
       interval: "weekly"
       day: "wednesday"
       time: "07:00"
+    cooldown:
+      default-days: 7
     pull-request-branch-name:
       separator: "-"
     labels:
       - "no-jira"
       - "dependencies"
       - "gha"
-    reviewers:
-      - "toptal/devx"
     open-pull-requests-limit: 3

.github/workflows/plumber.yml

@@ -0,0 +1,34 @@
+name: Plumber
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  plumber:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      security-events: write
+      # Needed by score-push to publish the score for the README badge.
+      id-token: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - uses: getplumber/plumber@031bc86d1e5f661626e2000f4f8779912d608d5f # v0.4.39
+        with:
+          # Code scanning upload needs security-events write, which PRs
+          # from forks do not get. The report stays available as a
+          # workflow artifact there.
+          upload-sarif: ${{ github.event.pull_request.head.repo.fork != true }}
+          # Publishes the score to score.getplumber.io, which feeds the
+          # badge in the README. A failed push never fails the run.
+          score-push: true
+          # Gate at 85 points instead of the all-or-nothing default,
+          # leaves room for a small finding without blocking PRs.
+          min-points: 85

.github/workflows/ruby.yml

@@ -3,21 +3,30 @@ name: CI
 on:
   push:
     branches: [master]
+  workflow_dispatch:
   pull_request:
     types: [
       synchronize, # PR was updated
       opened, # PR was open
       reopened # PR was reopened
     ]
 
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
-  ruby-3:
+  test:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     strategy:
       fail-fast: false
       matrix:
-        ruby: [ '3.0', '3.1', '3.2' ]
-        gemfile: [rails.6.1.activerecord, rails.7.0.activerecord, rails.7.1.activerecord]
+        ruby: [ '3.2', '3.3', '3.4', '4.0' ]
+        gemfile: [rails.7.2.activerecord, rails.8.0.activerecord, rails.8.1.activerecord]
     name: ${{ matrix.ruby }}-${{ matrix.gemfile }}
 
     env:
@@ -35,26 +44,37 @@ jobs:
           --health-interval 10s
           --health-timeout 5s
           --health-retries 5
+      elasticsearch:
+        image: docker.elastic.co/elasticsearch/elasticsearch:8.19.13
+        ports:
+          - '9250:9200'
+        env:
+          discovery.type: single-node
+          xpack.security.enabled: 'false'
+          ES_JAVA_OPTS: '-Xms500m -Xmx500m'
+        # Set health checks to wait until Elasticsearch has started
+        options: >-
+          --health-cmd "curl -sf http://localhost:9200/_cluster/health?wait_for_status=yellow&timeout=5s"
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 10
+
     steps:
-      - uses: actions/checkout@v4
-      - uses: ruby/setup-ruby@v1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         with:
           ruby-version: ${{ matrix.ruby }}
           bundler-cache: true
-      - name: Run Elasticsearch
-        uses: elastic/elastic-github-actions/elasticsearch@9de0f78f306e4ebc0838f057e6b754364685e759
-        with:
-          stack-version: 7.10.1
-          port: 9250
       - name: Tests
         run: bundle exec rspec
 
   rubocop:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
-      - uses: ruby/setup-ruby@v1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         with:
-          ruby-version: 3.0
+          ruby-version: 3.4
           bundler-cache: true
-      - run: bundle exec rubocop --format simple
+      - run: bundle exec rubocop --format github

.gitignore

@@ -20,3 +20,4 @@ tmp
 _site
 .sass-cache
 file::memory:?cache=shared
+benchmark

.rubocop.yml

@@ -1,8 +1,12 @@
 inherit_from: .rubocop_todo.yml
 
+plugins:
+  - rubocop-rake
+
 AllCops:
   NewCops: enable
-  TargetRubyVersion: 3.0
+  TargetRubyVersion: 3.2
+  SuggestExtensions: false
 
 Layout/AccessModifierIndentation:
   EnforcedStyle: outdent
@@ -49,6 +53,9 @@ Style/AndOr:
 Style/DoubleNegation:
   Enabled: false
 
+Style/RedundantStructKeywordInit:
+  Enabled: false
+
 Metrics/BlockLength:
   Exclude:
     - '**/*_spec.rb'