update-portable-ruby: hide and consolidate into one-shot

Rewrites `update-portable-ruby` as a single hidden command that reads the
`portable-ruby` formula, writes vendor files, runs `brew vendor-install
ruby`, then syncs `utils/ruby.sh`, vendored gems and RBI files via the
new `Utils::PortableRuby.sync_bundler_version!` helper. Drops
`--dry-run` and `--skip-vendor-install` and hides from `brew help` since
this is now meant to be invoked from the homebrew-core bottle-publish
workflow rather than by hand.

Also scopes the `actions/create-github-app-token` permissions in
`vendor-gems.yml` to `contents: write`.

Author: p-linnane

.github/workflows/vendor-gems.yml

@@ -128,6 +128,7 @@ jobs:
         with:
           app-id: ${{ vars.BREW_COMMIT_APP_ID }}
           private-key: ${{ secrets.BREW_COMMIT_APP_KEY }}
+          permission-contents: write
 
       - name: Push to pull request
         if: github.event_name == 'workflow_dispatch'

Library/Homebrew/dev-cmd/update-portable-ruby.rb

@@ -4,88 +4,48 @@
 require "abstract_command"
 require "formula"
 require "utils/bottles"
+require "utils/portable_ruby"
 
 module Homebrew
   module DevCmd
     class UpdatePortableRuby < AbstractCommand
       cmd_args do
         description <<~EOS
-          Update the vendored portable Ruby version files, bottle checksums,
-          `utils/ruby.sh` and `Gemfile.lock` entries from the current
-          `portable-ruby` formula.
+          Update the vendored `portable-ruby` from the current `portable-ruby` formula:
+          write the version files and bottle checksums, run `brew vendor-install ruby`,
+          then sync `utils/ruby.sh`, vendored gems and RBI files to the bundler shipped
+          by the new ruby.
         EOS
-        switch "-n", "--dry-run",
-               description: "Print what would be done rather than doing it."
-        switch "--skip-vendor-install",
-               description: "Do not run `brew vendor-install ruby`; skip the `utils/ruby.sh`, " \
-                            "`Gemfile.lock` and RBI updates."
-
         named_args :none
+
+        hide_from_man_page!
       end
 
       sig { override.void }
       def run
         formula = Homebrew.with_no_api_env { Formulary.factory("portable-ruby") }
-
         version = formula.version.to_s
         pkg_version = formula.pkg_version.to_s
         vendor_dir = HOMEBREW_LIBRARY_PATH/"vendor"
 
-        write_file(vendor_dir/"portable-ruby-version", "#{pkg_version}\n")
-        write_file(HOMEBREW_LIBRARY_PATH/".ruby-version", "#{version}\n")
+        (vendor_dir/"portable-ruby-version").atomic_write("#{pkg_version}\n")
+        (HOMEBREW_LIBRARY_PATH/".ruby-version").atomic_write("#{version}\n")
 
         formula.bottle_specification.checksums.each do |checksum|
           tag_symbol = checksum.fetch("tag")
           tag = Utils::Bottles::Tag.from_symbol(tag_symbol)
           os = tag.linux? ? "linux" : "darwin"
           path = vendor_dir/"portable-ruby-#{tag.standardized_arch}-#{os}"
-          write_file(path, "ruby_TAG=#{tag_symbol}\nruby_SHA=#{checksum.fetch("digest")}\n")
+          path.atomic_write("ruby_TAG=#{tag_symbol}\nruby_SHA=#{checksum.fetch("digest")}\n")
         end
 
-        return if args.skip_vendor_install?
-
-        if args.dry_run?
-          ohai "brew vendor-install ruby"
-          ohai "Would update #{HOMEBREW_LIBRARY_PATH/"utils/ruby.sh"} and #{HOMEBREW_LIBRARY_PATH/"Gemfile.lock"} " \
-               "with the bundler version shipped by portable-ruby #{pkg_version}."
-          ohai "brew typecheck --update"
-          return
-        end
-
-        ohai "brew vendor-install ruby"
         safe_system HOMEBREW_BREW_FILE, "vendor-install", "ruby"
 
-        bundler_dir = Pathname.glob(vendor_dir/"portable-ruby/#{pkg_version}/lib/ruby/gems/*/gems/bundler-*").first
-        odie "Cannot find vendored bundler for portable-ruby #{pkg_version}." if bundler_dir.nil?
-        bundler_version = bundler_dir.basename.to_s.delete_prefix("bundler-")
-
-        ruby_sh = HOMEBREW_LIBRARY_PATH/"utils/ruby.sh"
-        original = ruby_sh.read
-        updated = original.sub(/(?<=^export HOMEBREW_BUNDLER_VERSION=")[^"]+/, bundler_version)
-        if original != updated
-          ohai "Writing #{ruby_sh}"
-          ruby_sh.atomic_write(updated)
-        end
-
-        ohai "brew vendor-gems --no-commit --update=--ruby,--bundler=#{bundler_version}"
-        safe_system HOMEBREW_BREW_FILE, "vendor-gems", "--no-commit", "--update=--ruby,--bundler=#{bundler_version}"
-
-        ohai "brew typecheck --update"
+        bundler_version = Utils::PortableRuby.sync_bundler_version!(pkg_version)
+        safe_system HOMEBREW_BREW_FILE, "vendor-gems", "--no-commit",
+                    "--update=--ruby,--bundler=#{bundler_version}"
         safe_system HOMEBREW_BREW_FILE, "typecheck", "--update"
       end
-
-      private
-
-      sig { params(path: Pathname, contents: String).void }
-      def write_file(path, contents)
-        if args.dry_run?
-          ohai "Write #{path}:"
-          puts contents
-        else
-          ohai "Writing #{path}"
-          path.atomic_write(contents)
-        end
-      end
     end
   end
 end