portable-ruby: replace update-portable-ruby with a workflow

Drops the `brew update-portable-ruby` dev-cmd in favour of a new
`bump-portable-ruby.yml` workflow that reads the published
`portable-ruby` formula's bottle spec, regenerates the vendored
state, and opens a brew bump PR as `BrewTestBot`. Fires via
`repository_dispatch` from a paired homebrew-core PR, with
`workflow_dispatch` as a manual fallback.

Also scopes the `actions/create-github-app-token` permissions in
this workflow and `vendor-gems.yml` to just what they need, and
updates a stale `vendor-gems.yml` error-message reference.

Author: p-linnane

.github/workflows/bump-portable-ruby.yml

@@ -0,0 +1,161 @@
+name: Bump portable-ruby
+
+on:
+  workflow_dispatch:
+    inputs:
+      portable_ruby_pr:
+        description: "homebrew-core PR number that bumped portable-ruby"
+        type: string
+        required: false
+  repository_dispatch:
+    types: [portable-ruby-published]
+
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+  pull-requests: write
+
+defaults:
+  run:
+    shell: bash -xeuo pipefail {0}
+
+jobs:
+  open-pr:
+    if: github.repository_owner == 'Homebrew'
+    runs-on: macos-26
+    steps:
+      - name: Set up Homebrew
+        id: set-up-homebrew
+        uses: Homebrew/actions/setup-homebrew@main
+        with:
+          core: true
+          cask: false
+
+      - name: Configure Git user
+        uses: Homebrew/actions/git-user-config@main
+        with:
+          username: BrewTestBot
+
+      - name: Set up commit signing
+        uses: Homebrew/actions/setup-commit-signing@main
+        with:
+          signing_key: ${{ secrets.BREWTESTBOT_SSH_SIGNING_KEY }}
+
+      - name: Resolve target version
+        id: resolve
+        working-directory: ${{ steps.set-up-homebrew.outputs.repository-path }}
+        run: |
+          pkg_version="$(brew ruby -- -e 'puts Homebrew.with_no_api_env { Formulary.factory("portable-ruby") }.pkg_version.to_s')"
+          version="$(brew ruby -- -e 'puts Homebrew.with_no_api_env { Formulary.factory("portable-ruby") }.version.to_s')"
+          {
+            echo "pkg_version=${pkg_version}"
+            echo "version=${version}"
+            echo "branch=bump-portable-ruby-${pkg_version}"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Create branch
+        working-directory: ${{ steps.set-up-homebrew.outputs.repository-path }}
+        env:
+          BRANCH: ${{ steps.resolve.outputs.branch }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          if gh api "repos/${GITHUB_REPOSITORY}/branches/${BRANCH}" >/dev/null 2>&1
+          then
+            echo "::error::Branch ${BRANCH} already exists. Delete it or use the existing PR."
+            exit 1
+          fi
+          git checkout -b "${BRANCH}"
+
+      - name: Write vendor files from `portable-ruby` formula
+        working-directory: ${{ steps.set-up-homebrew.outputs.repository-path }}
+        run: |
+          brew ruby -- -e '
+            formula = Homebrew.with_no_api_env { Formulary.factory("portable-ruby") }
+            version = formula.version.to_s
+            pkg_version = formula.pkg_version.to_s
+            vendor_dir = HOMEBREW_LIBRARY_PATH/"vendor"
+
+            (vendor_dir/"portable-ruby-version").atomic_write("#{pkg_version}\n")
+            (HOMEBREW_LIBRARY_PATH/".ruby-version").atomic_write("#{version}\n")
+
+            formula.bottle_specification.checksums.each do |checksum|
+              tag_symbol = checksum.fetch("tag")
+              tag = Utils::Bottles::Tag.from_symbol(tag_symbol)
+              os = tag.linux? ? "linux" : "darwin"
+              path = vendor_dir/"portable-ruby-#{tag.standardized_arch}-#{os}"
+              path.atomic_write("ruby_TAG=#{tag_symbol}\nruby_SHA=#{checksum.fetch("digest")}\n")
+            end
+          '
+
+      - name: brew vendor-install ruby
+        working-directory: ${{ steps.set-up-homebrew.outputs.repository-path }}
+        run: brew vendor-install ruby
+
+      - name: Sync bundler version, vendored gems, and RBI files
+        working-directory: ${{ steps.set-up-homebrew.outputs.repository-path }}
+        env:
+          PKG_VERSION: ${{ steps.resolve.outputs.pkg_version }}
+        run: |
+          bundler_version="$(brew ruby -- -e "require 'utils/portable_ruby'; puts Utils::PortableRuby.sync_bundler_version!(ENV.fetch('PKG_VERSION'))")"
+          brew vendor-gems --no-commit --update=--ruby,--bundler="${bundler_version}"
+          brew typecheck --update
+
+      - name: Commit changes
+        id: commit
+        working-directory: ${{ steps.set-up-homebrew.outputs.repository-path }}
+        env:
+          PKG_VERSION: ${{ steps.resolve.outputs.pkg_version }}
+        run: |
+          git add -A
+          if git diff --cached --quiet
+          then
+            echo "::notice::No changes to commit; portable-ruby ${PKG_VERSION} is already vendored."
+            echo "changes=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          git commit -m "Bump portable-ruby to ${PKG_VERSION}." \
+                     -m "Autogenerated by the [bump-portable-ruby](https://github.com/Homebrew/brew/blob/HEAD/.github/workflows/bump-portable-ruby.yml) workflow."
+          echo "changes=true" >> "$GITHUB_OUTPUT"
+
+      - name: Generate push token
+        if: steps.commit.outputs.changes == 'true'
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          app-id: ${{ vars.BREW_COMMIT_APP_ID }}
+          private-key: ${{ secrets.BREW_COMMIT_APP_KEY }}
+          permission-contents: write
+          permission-pull-requests: write
+
+      - name: Push branch
+        if: steps.commit.outputs.changes == 'true'
+        uses: Homebrew/actions/git-try-push@main
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          directory: ${{ steps.set-up-homebrew.outputs.repository-path }}
+          branch: ${{ steps.resolve.outputs.branch }}
+
+      - name: Open pull request
+        if: steps.commit.outputs.changes == 'true'
+        working-directory: ${{ steps.set-up-homebrew.outputs.repository-path }}
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          PKG_VERSION: ${{ steps.resolve.outputs.pkg_version }}
+          BRANCH: ${{ steps.resolve.outputs.branch }}
+          SOURCE_PR: ${{ inputs.portable_ruby_pr || github.event.client_payload.portable_ruby_pr }}
+        run: |
+          body="Bumps the vendored \`portable-ruby\` to ${PKG_VERSION}."
+          if [[ -n "${SOURCE_PR}" ]]
+          then
+            body="${body}"$'\n\nSource: Homebrew/homebrew-core#'"${SOURCE_PR}"
+          fi
+          body="${body}"$'\n\nAutogenerated by the [bump-portable-ruby](https://github.com/Homebrew/brew/blob/HEAD/.github/workflows/bump-portable-ruby.yml) workflow.'
+
+          gh pr create \
+            --base main \
+            --head "${BRANCH}" \
+            --title "Bump vendored portable-ruby to ${PKG_VERSION}" \
+            --body "${body}"

.github/workflows/vendor-gems.yml

@@ -128,6 +128,7 @@ jobs:
         with:
           app-id: ${{ vars.BREW_COMMIT_APP_ID }}
           private-key: ${{ secrets.BREW_COMMIT_APP_KEY }}
+          permission-contents: write
 
       - name: Push to pull request
         if: github.event_name == 'workflow_dispatch'
@@ -147,7 +148,7 @@ jobs:
           then
             {
               echo "::error::Vendored gems, license metadata and/or RBI files are out of date."
-              echo "Run 'brew vendor-gems && brew typecheck --update' (or 'brew update-portable-ruby' for portable-ruby bumps) and commit the changes."
+              echo "Run 'brew vendor-gems && brew typecheck --update' (or trigger the 'Bump portable-ruby' workflow for portable-ruby bumps) and commit the changes."
               echo "RubyGems licence metadata is refreshed by this workflow."
               echo
               echo "${status}"

Library/Homebrew/dev-cmd/update-portable-ruby.rb

@@ -3156,24 +3156,6 @@ _brew_update_perl_resources() {
   __brew_complete_formulae
 }
 
-_brew_update_portable_ruby() {
-  local cur="${COMP_WORDS[COMP_CWORD]}"
-  case "${cur}" in
-    -*)
-      __brewcomp "
-      --debug
-      --dry-run
-      --help
-      --quiet
-      --skip-vendor-install
-      --verbose
-      "
-      return
-      ;;
-    *) ;;
-  esac
-}
-
 _brew_update_python_resources() {
   local cur="${COMP_WORDS[COMP_CWORD]}"
   case "${cur}" in
@@ -3577,7 +3559,6 @@ _brew() {
     update-license-data) _brew_update_license_data ;;
     update-maintainers) _brew_update_maintainers ;;
     update-perl-resources) _brew_update_perl_resources ;;
-    update-portable-ruby) _brew_update_portable_ruby ;;
     update-python-resources) _brew_update_python_resources ;;
     update-reset) _brew_update_reset ;;
     update-sponsors) _brew_update_sponsors ;;

Library/Homebrew/sorbet/rbi/dsl/homebrew/dev_cmd/update_portable_ruby.rbi

@@ -1986,15 +1986,6 @@ __fish_brew_complete_arg 'update-perl-resources' -l verbose -d 'Make some output
 __fish_brew_complete_arg 'update-perl-resources' -a '(__fish_brew_suggest_formulae_all)'
 
 
-__fish_brew_complete_cmd 'update-portable-ruby' 'Update the vendored portable Ruby version files, bottle checksums, `utils/ruby.sh` and `Gemfile.lock` entries from the current `portable-ruby` formula'
-__fish_brew_complete_arg 'update-portable-ruby' -l debug -d 'Display any debugging information'
-__fish_brew_complete_arg 'update-portable-ruby' -l dry-run -d 'Print what would be done rather than doing it'
-__fish_brew_complete_arg 'update-portable-ruby' -l help -d 'Show this message'
-__fish_brew_complete_arg 'update-portable-ruby' -l quiet -d 'Make some output more quiet'
-__fish_brew_complete_arg 'update-portable-ruby' -l skip-vendor-install -d 'Do not run `brew vendor-install ruby`; skip the `utils/ruby.sh`, `Gemfile.lock` and RBI updates'
-__fish_brew_complete_arg 'update-portable-ruby' -l verbose -d 'Make some output more verbose'
-
-
 __fish_brew_complete_cmd 'update-python-resources' 'Update versions for PyPI resource blocks in formula'
 __fish_brew_complete_arg 'update-python-resources' -l debug -d 'Display any debugging information'
 __fish_brew_complete_arg 'update-python-resources' -l exclude-packages -d 'Exclude these packages when finding resources'

Library/Homebrew/test/dev-cmd/update-portable-ruby_spec.rb

@@ -110,7 +110,6 @@ update-if-needed
 update-license-data
 update-maintainers
 update-perl-resources
-update-portable-ruby
 update-python-resources
 update-reset
 update-sponsors

completions/bash/brew

@@ -245,7 +245,6 @@ __brew_internal_commands() {
     'update-license-data:Update SPDX license data in the Homebrew repository'
     'update-maintainers:Update the list of maintainers in the `Homebrew/brew` README'
     'update-perl-resources:Update versions for CPAN resource blocks in formula'
-    'update-portable-ruby:Update the vendored portable Ruby version files, bottle checksums, `utils/ruby.sh` and `Gemfile.lock` entries from the current `portable-ruby` formula'
     'update-python-resources:Update versions for PyPI resource blocks in formula'
     'update-reset:Fetch and reset Homebrew and all tap repositories (or any specified repository) using `git`(1) to their latest `origin/HEAD`'
     'update-sponsors:Update the list of GitHub Sponsors in the `Homebrew/brew` README'
@@ -2534,17 +2533,6 @@ _brew_update_perl_resources() {
     '*:formula:__brew_formulae'
 }
 
-# brew update-portable-ruby
-_brew_update_portable_ruby() {
-  _arguments \
-    '--debug[Display any debugging information]' \
-    '--dry-run[Print what would be done rather than doing it]' \
-    '--help[Show this message]' \
-    '--quiet[Make some output more quiet]' \
-    '--skip-vendor-install[Do not run `brew vendor-install ruby`; skip the `utils/ruby.sh`, `Gemfile.lock` and RBI updates]' \
-    '--verbose[Make some output more verbose]'
-}
-
 # brew update-python-resources
 _brew_update_python_resources() {
   _arguments \