Severity
High — the publish workflow can validate an effectively untested gem.
Problem
.github/workflows/release-ruby.yml runs bundle exec rake test without provisioning PostgreSQL or setting PGQUE_TEST_DSN.
The shared Ruby test helper skips database-backed test classes when that variable is absent. As a result, the release dry-run can report success while skipping send/receive, cooperative consumer, reconnect/backlog, error-classification, NULL-message, retry/DLQ, and other release-critical integration behavior.
The workflow also checks only whether its namespaced Git tag exists. RubyGems already contains pgque 0.3.0.rc.1, published manually. A rerun with that source version could pass build validation and create ruby/v0.3.0.rc.1, then fail only at gem push because the gem version is immutable.
Expected fix
- Provision a pinned supported PostgreSQL service in the Ruby build/dry-run job.
- Generate/install the current PgQue SQL and set
PGQUE_TEST_DSN before rake test.
- Make the release job fail if any tests are skipped unexpectedly.
- Check RubyGems version availability before artifact upload/tag creation, with a testable parser or API fixture.
- Keep the publish job consuming the exact already-validated artifact.
- Add actionlint/YAML coverage and document that a new version must be chosen after the manually published
0.3.0.rc.1.
This should stack on the namespaced-tag/OIDC correction in draft #323. External trusted-publisher/environment setup remains tracked separately in #328.
Severity
High — the publish workflow can validate an effectively untested gem.
Problem
.github/workflows/release-ruby.ymlrunsbundle exec rake testwithout provisioning PostgreSQL or settingPGQUE_TEST_DSN.The shared Ruby test helper skips database-backed test classes when that variable is absent. As a result, the release dry-run can report success while skipping send/receive, cooperative consumer, reconnect/backlog, error-classification, NULL-message, retry/DLQ, and other release-critical integration behavior.
The workflow also checks only whether its namespaced Git tag exists. RubyGems already contains
pgque 0.3.0.rc.1, published manually. A rerun with that source version could pass build validation and createruby/v0.3.0.rc.1, then fail only atgem pushbecause the gem version is immutable.Expected fix
PGQUE_TEST_DSNbeforerake test.0.3.0.rc.1.This should stack on the namespaced-tag/OIDC correction in draft #323. External trusted-publisher/environment setup remains tracked separately in #328.