CI: Expand ruby version matrix for broader Ruby compatibility

[extern-c]

Description

This PR resolves issue #43 by addressing dependency conflicts and updating supported Ruby versions. CI was previously failing due to Gemfile.lock constraints across multiple Ruby versions. Ruby 2.7 support was also causing dependency incompatibilities.

Please note that Ruby 2.7 reached end of life on March 31, 2023. Dropping support for this version helps reduce ongoing maintenance burden and avoid future dependency incompatibilities.

Ruby version	EOL
4.0	TBD
3.4	TBD
3.3	2027-03-31
3.2	2026-04-01
3.1	2025-03-26
3.0	2024-04-23
2.7	2023-03-31

Source: Ruby Maintenance Branches

I understand that there are different opinions on whether Gemfile.lock should be included in gems; however, in this case, I believe the benefits of omitting it outweigh the drawbacks.

AI Tool Disclosure

• My contribution does not include any AI-generated content
• My contribution includes AI-generated content, as disclosed below:
  • AI Tools: [e.g. GitHub CoPilot, ChatGPT, JetBrains Junie etc.]
  • LLMs and versions: [e.g. GPT-4.1, Claude Haiku 4.5, Gemini 2.5 Pro etc.]
  • Prompts: [Summarize the key prompts or instructions given to the AI tools]

Affirmation

• My code follows the CONTRIBUTING.md guidelines

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity · 0 duplication

Metric	Results
Complexity	0
Duplication	0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[Copilot]

Pull request overview

Updates the gem’s supported Ruby baseline and CI matrix to validate compatibility across a wider set of modern Ruby versions, while removing the repository Gemfile.lock to avoid cross-version dependency resolution conflicts.

Changes:

• Drop Ruby 2.7 support (gemspec + RuboCop target) and re-enable CI for Ruby 3.0/3.1 while adding Ruby 4.0 to the matrix.
• Remove Gemfile.lock from the repo and ignore it going forward.
• Adjust BOM component hash construction formatting and tweak dev dependency constraints.

Reviewed changes

Copilot reviewed 4 out of 6 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
lib/cyclonedx/bom_component.rb	Makes hashes/licenses array entries explicit hash objects.
Gemfile.lock	Removes the lockfile from the repository.
cyclonedx-ruby.gemspec	Raises minimum Ruby to 3.0 and adjusts cucumber dev dependency constraints.
.rubocop.yml	Updates RuboCop target Ruby version to 3.0.
.gitignore	Ignores Gemfile.lock going forward.
.github/workflows/ruby.yml	Expands CI Ruby version matrix (adds 4.0, re-adds 3.0/3.1).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[jkowalleck]

@pboling may i ask for a review?

[pboling]

The benefits of omitting Gemfile.lock are negligible/non-existent when the surrounding harness allows it. Over time we can build that harness, so omitting it initially is fine.

[pboling]

LGTM! We'll add the Gemfile.lock back once it makes sense to do so (once we have appraisals splitting each ruby version into an isolated bucket).

[jkowalleck]

thank you so much for your work.