Support Rails 8.1 / Ruby 4

[lleirborras]

Summary

Makes eaco load and run on Rails 8.1 / Ruby 4 without changing how it behaves on the Rails versions consumers are on today. This is part of the fleet Rails 8.1 / Ruby 4 upgrade — eaco was a hard blocker for the apps that depend on it (edoc, hermeshq, noobs, scriptoria).

The problem

The Active Record compatibility layer looked up a per-version support module (V32, V42, … V61) by the AR major+minor version, and raised "Unsupported Active Record version" when none was found. There was no module past Rails 6.1, so eaco couldn't even load under Rails 7.0+ — let alone 8.1.

Worth noting: the Appraisals file already listed rails-7.0/7.1/7.2, but those rows would have raised at runtime — the compatibility layer never actually supported them.

What changed

• Added a Modern support module and a fallback for Active Record 7.0+. Every release from 5.2 onward needs the same treatment — JSONB is native, and the removed scoped / sanitize APIs are revived via the existing Scoped / Sanitized modules. Rather than copy an identical Vxx module for every future Rails release, the compatibility lookup now falls back to Modern for any AR major ≥ 7. The explicit V32…V61 modules are untouched, so nothing changes for older consumers.
• Added rails-8.0 / rails-8.1 Appraisal entries (and their gemfiles) alongside the existing 7.x ones.
• First lightweight smoke test. Added test/smoke.rb — it installs the authorization DSL on a model and checks an end-to-end decision (ACL grant → Actor#can?, plus the admin bypass) over sqlite. No Postgres, no network: the point is to prove the compatibility layer installs and the core authorization path runs on the new stack. The existing pg + cucumber suite (ci.yml) is unchanged.
• Bumped to 1.2.0 with a changelog entry.

How to test

The new smoke workflow (smoke.yml) sweeps:

• Ruby 4.0.5 / 3.4 — Rails 8.1
• Ruby 3.4 — Rails 7.2
• Ruby 2.7 — Rails 6.1 (backward-compat, explicit V61 module)

Locally: BUNDLE_GEMFILE=test/Gemfile.ci bundle install && BUNDLE_GEMFILE=test/Gemfile.ci bundle exec ruby test/smoke.rb (override the stack with RAILS_VERSION).

Verified green on Ruby 4.0.5 and 3.4 (Rails 8.1) and Ruby 3.3 (Rails 7.1).

Risks / follow-ups

• The smoke is deliberately Postgres-free, so it exercises the authorization decision (in-memory ACL eval) but not the pg_jsonb accessible_by SQL. The full pg + cucumber matrix in ci.yml still covers that; bumping that matrix to include Rails 7.x/8.x is a sensible follow-up now that the gem actually supports those versions.
• Sanitized calls connection.quote; ActiveRecord::Base.connection is soft-deprecated in newer Rails but still works on 8.1. Worth revisiting if it gets removed.

[lleirborras]

Heads-up on the red checks: the Smoke workflow (added here, and the one that actually exercises the Rails 8.1 / Ruby 4 upgrade) is green across the matrix. The failures are all in the pre-existing pg + cucumber CI workflow, and they're environmental drift unrelated to this change:

• Ruby 3.1 / rails_6.1 fails at require 'rails', before any eaco code loads: undefined method '[]' for Fiber:Class in i18n-1.15.0 (i18n 1.15 uses Fiber storage, which needs Ruby 3.2+). That matrix has no lockfile, so it resolves the latest i18n.
• Ruby 2.1–2.6 rows fail on toolchain rot (Bundler 2+ requires Ruby 2.3+, etc.) — those runtimes no longer assemble on current GitHub runners.

CI last ran green on master in December 2025; the breakage is six months of unpinned transitive-dependency drift, not this PR. This change is gated on Active Record ≥ 7 and doesn't touch the rails_6.1 (V61) path or anything loaded by require 'rails'.

Fixing that legacy matrix (pin i18n / drop ancient Rubies / extend it to Rails 7.x–8.x with cucumber) is a separate maintenance task — happy to do it in a follow-up, but kept it out of scope here so the upgrade stays reviewable.

[lleirborras]

Update: the legacy pg + cucumber CI workflow is now fixed and green, so this PR is green end-to-end (both Smoke and CI).

Modernized the CI matrix to current runtimes — Ruby 4.0.5 / 3.4 / 3.3 / 3.2 across Rails 8.1 / 8.0 / 7.2 / 7.1 / 7.0 / 6.1 — and dropped the ancient Ruby 2.x rows that no longer assemble. The full rspec + cucumber suite (Postgres-backed, so this exercises accessible_by / pg_jsonb, which the Smoke deliberately skips) passes on every row.

Test-infra fixes needed for the new stack, all version-agnostic:

• Compatibility#support_module now derives the "modern AR" decision from the looked-up version, so the "unsupported version" scenario (which stubs active_record_version) raises as expected instead of falling through to Modern.
• The parse-error feature matches the stable unexpected '=' substring rather than the exact pre-Prism SyntaxError wording (Ruby 3.3+).
• The ACL inspect specs compute their expectation from the running Ruby's Hash#inspect (spacing changed in 3.4).
• Dropped the redundant .config/cucumber.yml profile (its ERB parse hit the removed 3-arg ERB.new on Ruby 3.4) and pinned cucumber to ~> 9.2 (unpinned, the resolver picked 10.x on some rows and the ancient 3.2.0 on Ruby 4). Declared ostruct/base64/bigdecimal, which left the default gems on Ruby 3.4+/4.0.