CI: Expand ruby version matrix for broader Ruby compatibility by extern-c · Pull Request #58 · CycloneDX/cyclonedx-ruby-gem

extern-c · 2026-05-20T05:58:38Z

Description

This PR resolves issue #43 by addressing dependency conflicts and updating supported Ruby versions. CI was previously failing due to Gemfile.lock constraints across multiple Ruby versions. ~~Ruby 2.7 support was also causing dependency incompatibilities.~~

~~Please note that Ruby 2.7 reached end of life on March 31, 2023. Dropping support for this version helps reduce ongoing maintenance burden and avoid future dependency incompatibilities.~~

Ruby version	EOL
4.0	TBD
3.4	TBD
3.3	2027-03-31
3.2	2026-04-01
3.1	2025-03-26
3.0	2024-04-23
2.7	2023-03-31

Source: Ruby Maintenance Branches

I understand that there are different opinions on whether Gemfile.lock should be included in gems; however, in this case, I believe the benefits of omitting it outweigh the drawbacks.

AI Tool Disclosure

My contribution does not include any AI-generated content
My contribution includes AI-generated content, as disclosed below:
- AI Tools: [e.g. GitHub CoPilot, ChatGPT, JetBrains Junie etc.]
- LLMs and versions: [e.g. GPT-4.1, Claude Haiku 4.5, Gemini 2.5 Pro etc.]
- Prompts: [Summarize the key prompts or instructions given to the AI tools]

Affirmation

My code follows the CONTRIBUTING.md guidelines

Signed-off-by: Amauri Bizerra <10775696+extern-c@users.noreply.github.com>

codacy-production · 2026-05-20T05:59:29Z

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity · 0 duplication

Metric Results

Complexity 0

Duplication 0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer}
_{TIP This summary will be updated as you push new changes.}

Signed-off-by: Amauri Bizerra <10775696+extern-c@users.noreply.github.com>

Copilot

Pull request overview

Updates the gem’s supported Ruby baseline and CI matrix to validate compatibility across a wider set of modern Ruby versions, while removing the repository Gemfile.lock to avoid cross-version dependency resolution conflicts.

Changes:

Drop Ruby 2.7 support (gemspec + RuboCop target) and re-enable CI for Ruby 3.0/3.1 while adding Ruby 4.0 to the matrix.
Remove Gemfile.lock from the repo and ignore it going forward.
Adjust BOM component hash construction formatting and tweak dev dependency constraints.

Reviewed changes

Copilot reviewed 4 out of 6 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
lib/cyclonedx/bom_component.rb	Makes hashes/licenses array entries explicit hash objects.
Gemfile.lock	Removes the lockfile from the repository.
cyclonedx-ruby.gemspec	Raises minimum Ruby to 3.0 and adjusts `cucumber` dev dependency constraints.
.rubocop.yml	Updates RuboCop target Ruby version to 3.0.
.gitignore	Ignores `Gemfile.lock` going forward.
.github/workflows/ruby.yml	Expands CI Ruby version matrix (adds 4.0, re-adds 3.0/3.1).

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

jkowalleck · 2026-05-21T07:59:45Z

  spec.description = 'CycloneDX is a lightweight software bill-of-material (SBOM) specification designed for use in application security contexts and supply chain component analysis. This Gem generates CycloneDX BOMs from Ruby projects.'
  spec.homepage    = 'https://github.com/CycloneDX/cyclonedx-ruby-gem'
  spec.license     = 'Apache-2.0'
-  spec.required_ruby_version = '>= 2.7.0'


This change does change the supported ruby version, right?
If so, then this seems to be an unintended change.

Hi,

I'm proposing we drop support for Ruby 2.7.0 (EOL: 2023-03-31) to help reduce maintenance burden, avoid future dependency incompatibilities, and enable further modernization of the gem. This would make Ruby >= 3.0 a requirement to run cyclonedx-ruby-gem, starting with the next release.

Ney, this would be a completely different scope.
and mist importantly, this would be a breaking change, too.

this PR should be about one thing and one thing only: complete the CI/CT matrix.

please keep things simple, single-soped: one step at a time.

Bundler is unable to resolve dependencies for Ruby 2.7 with the current gemspec. I was able to retain support for Ruby 3.0+ and Ruby 4.0 in CI by loosening dependency constrains slightly, but Ruby 2.7 remains incompatible.

Resolving dependencies... ffi-1.17.4-x86_64-linux-musl requires ruby version < 4.1.dev, >= 3.0, which is incompatible with the current version, ruby 2.7.8p225

There are a few ways to address this, such as maintaining multiple Gemfile.lock files or using Appraisal to manage separate dependency sets. However, this would introduce additional complexity, especially given that Ruby 2.7 reached end-of-life in 2023.

If there is a strong need to continue supporting Ruby 2.7, I'm happy to revisit this and explore those alternatives.

UPD: Bundler successfully resolves the project's dependencies in the CI environment when running in a fork of the repository using the same configuration, so Ruby 2.7 support has been restored. The earlier error was specific to my development environment. Ruby 2.7 support can be kept for now, although the setup is somewhat fragile for that Ruby version. This can be improved in a follow-up PR.

jkowalleck · 2026-05-21T07:59:55Z

@@ -1,6 +1,6 @@
 AllCops:
  NewCops: enable
-  TargetRubyVersion: 2.7


why the change?

@extern-c please explain this change. is this related to the scope of completing the CI/CT matrix?

TargetRubyVersion was updated from 2.7 to 3.0 to align with the gem's new minimum supported Ruby version introduced in this PR.

Please see #58 (comment).

jkowalleck · 2026-05-21T08:00:44Z

why removed? not a blocker, just a question?

jkowalleck · 2026-05-21T08:01:20Z

        purl: @purl,
        hashes: [
-          alg: HASH_ALG,
-          content: @hash


this looks like a bugfix, not a CI pipeline relevant change

@extern-c please explain this change. is this related to the scope of completing the CI/CT matrix?

Rubocop started emitting Style/HashAsLastArrayItem: Wrap hash in { and} offenses after TargetRubyVersion was updated from 2.7 to 3.0. These changes address the new offenses introduced by the Ruby version bump to avoid adding additional violations. The codebase may still contain other existing offenses, but this change does not introduce new ones.

Please see #58 (comment).

Signed-off-by: Amauri Bizerra <10775696+extern-c@users.noreply.github.com>

jkowalleck · 2026-05-21T16:18:09Z

        purl: @purl,
        hashes: [
-          alg: HASH_ALG,
-          content: @hash


@extern-c please explain this change. is this related to the scope of completing the CI/CT matrix?

jkowalleck · 2026-05-21T16:18:31Z

why removed? not a blocker, just a question?

The current Gemfile.lock prevents Bundler from resolving dependencies across all Ruby versions supported by the project. Here is the output from bundler install with Ruby 2.7:

Bundler found conflicting requirements for the Ruby version: In Gemfile: Ruby cyclonedx-ruby was resolved to 1.2.0, which depends on Ruby (>= 2.7.0) cyclonedx-ruby was resolved to 1.2.0, which depends on nokogiri (~> 1.15) was resolved to 1.18.10, which depends on Ruby (>= 3.1.0) Ruby (>= 3.1.0), which is required by gem 'cyclonedx-ruby', is not available in the local ruby installation

While there are different views on committing Gemfile.lock for libraries/gems, in this case, I believe the benefits of omitting it outweigh the drawbacks. We could maintain multiple Gemfile.lock files or use Appraisal to handle this, but I think that would introduce unnecessary complexity.

jkowalleck · 2026-05-21T16:19:11Z

@@ -1,6 +1,6 @@
 AllCops:
  NewCops: enable
-  TargetRubyVersion: 2.7


@extern-c please explain this change. is this related to the scope of completing the CI/CT matrix?

Signed-off-by: Amauri Bizerra <10775696+extern-c@users.noreply.github.com>

extern-c added 5 commits May 20, 2026 02:24

Remove Gemfile.lock to avoid cross-Ruby dependency conflicts in CI

ac932bc

Signed-off-by: Amauri Bizerra <10775696+extern-c@users.noreply.github.com>

Drop support for Ruby 2.7

d762168

Signed-off-by: Amauri Bizerra <10775696+extern-c@users.noreply.github.com>

Expand CI test matrix to include Ruby 4.0.4

5f81f77

Signed-off-by: Amauri Bizerra <10775696+extern-c@users.noreply.github.com>

Adjust cucumber version to support Ruby 3.0

effc8c5

Signed-off-by: Amauri Bizerra <10775696+extern-c@users.noreply.github.com>

Fix Style/HashAsLastArrayItem Rubocop offenses

2cf2118

Signed-off-by: Amauri Bizerra <10775696+extern-c@users.noreply.github.com>

Add Gemfile.lock to .gitignore

4d7c520

Signed-off-by: Amauri Bizerra <10775696+extern-c@users.noreply.github.com>

extern-c marked this pull request as ready for review May 21, 2026 03:14

extern-c requested a review from a team as a code owner May 21, 2026 03:14

jkowalleck requested a review from Copilot May 21, 2026 06:13

Copilot started reviewing on behalf of jkowalleck May 21, 2026 06:13 View session

jkowalleck linked an issue May 21, 2026 that may be closed by this pull request

CI/CT: test with alls supported ruby versions #43

Open

jkowalleck self-requested a review May 21, 2026 06:14

Copilot AI reviewed May 21, 2026

View reviewed changes

Comment thread cyclonedx-ruby.gemspec Outdated

jkowalleck reviewed May 21, 2026

View reviewed changes

Fix cucumber gem version constraint

580655e

Signed-off-by: Amauri Bizerra <10775696+extern-c@users.noreply.github.com>

jkowalleck reviewed May 21, 2026

View reviewed changes

Restore suppor for Ruby 2.7

8ab4cf1

Signed-off-by: Amauri Bizerra <10775696+extern-c@users.noreply.github.com>

extern-c force-pushed the ci/expand-ruby-version-matrix branch from e5037d9 to 8ab4cf1 Compare May 22, 2026 11:28

Revert target Rubocop version from 3.0 to 2.7

959fac4

Signed-off-by: Amauri Bizerra <10775696+extern-c@users.noreply.github.com>

Uh oh!

Conversation

extern-c commented May 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

AI Tool Disclosure

Affirmation

Uh oh!

codacy-production Bot commented May 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Up to standards ✅

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

extern-c May 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

extern-c May 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

extern-c May 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

extern-c May 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

extern-c May 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

extern-c commented May 20, 2026 •

edited

Loading

codacy-production Bot commented May 20, 2026 •

edited

Loading

extern-c May 21, 2026 •

edited

Loading

extern-c May 22, 2026 •

edited

Loading

extern-c May 22, 2026 •

edited

Loading

extern-c May 22, 2026 •

edited

Loading

extern-c May 22, 2026 •

edited

Loading