Merge pull request #2 from Abdul-Moiz31/feat/native-ruby-sdk-v1

Add native Ruby SDK v1 with universal auth and secrets CRUD

Author: varonix0

.github/workflows/release.yml

@@ -0,0 +1,47 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - "v*.*.*"
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      id-token: write
+      contents: read
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@e5517072e87f198d9533967ae13d97c11b604005 # v1.99.0
+        with:
+          ruby-version: "3.3"
+          bundler-cache: true
+
+      - name: Verify tag matches Infisical::VERSION
+        run: |
+          TAG_VERSION="${GITHUB_REF_NAME#v}"
+          GEM_VERSION="$(ruby -r ./lib/infisical/version -e 'puts Infisical::VERSION')"
+          if [ "$TAG_VERSION" != "$GEM_VERSION" ]; then
+            echo "::error::Tag ${GITHUB_REF_NAME} does not match Infisical::VERSION (${GEM_VERSION})."
+            echo "::error::Bump lib/infisical/version.rb on main, then re-tag."
+            exit 1
+          fi
+
+      - name: Run tests
+        run: bundle exec rspec
+
+      - name: Run rubocop
+        run: bundle exec rubocop
+
+      - name: Configure RubyGems credentials (trusted publishing)
+        uses: rubygems/configure-rubygems-credentials@dc5a8d8553e6ee01fc26761a49e99e733d17954a # v2.1.0
+
+      - name: Build gem
+        run: gem build infisical-sdk.gemspec
+
+      - name: Push to RubyGems
+        run: gem push "infisical-sdk-${GITHUB_REF_NAME#v}.gem"

.github/workflows/test.yml

@@ -0,0 +1,27 @@
+name: Test
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    strategy:
+      matrix:
+        ruby-version: ["3.0", "3.3"]
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@e5517072e87f198d9533967ae13d97c11b604005 # v1.99.0
+        with:
+          ruby-version: ${{ matrix.ruby-version }}
+          bundler-cache: true
+
+      - name: Run tests
+        run: bundle exec rspec
+
+      - name: Run rubocop
+        run: bundle exec rubocop

.gitignore

@@ -6,10 +6,15 @@
 /pkg/
 /spec/reports/
 /spec/examples.txt
+/.rspec_status
 /test/tmp/
 /test/version_tmp/
 /tmp/
 
+# Library gem: let each environment (and each CI matrix entry) resolve its
+# own compatible dependency set rather than pinning one.
+/Gemfile.lock
+
 # Used by dotenv library to load environment variables.
 # .env
 

.rspec

@@ -0,0 +1,3 @@
+--require spec_helper
+--format documentation
+--color

.rubocop.yml

@@ -0,0 +1,37 @@
+AllCops:
+  TargetRubyVersion: 3.0
+  NewCops: enable
+  SuggestExtensions: false
+  Exclude:
+    - "bin/**/*"
+    - "vendor/**/*"
+
+Style/Documentation:
+  Enabled: false
+
+Naming/FileName:
+  Exclude:
+    # Deliberately dashed: it must match the gem name so Bundler.require
+    # (`gem "infisical-sdk"`) resolves without a `require:` override.
+    - "lib/infisical-sdk.rb"
+
+Style/StringLiterals:
+  EnforcedStyle: double_quotes
+
+Metrics/MethodLength:
+  Max: 25
+
+Metrics/ClassLength:
+  Max: 150
+
+Metrics/AbcSize:
+  Max: 25
+
+Metrics/ParameterLists:
+  # Keyword args are self-documenting at the call site; don't penalize a
+  # wide options surface the way positional args would be.
+  CountKeywordArgs: false
+
+Metrics/BlockLength:
+  Exclude:
+    - "spec/**/*"

.ruby-version

@@ -0,0 +1 @@
+3.3.6

.yardopts

@@ -0,0 +1,5 @@
+--markup markdown
+lib/**/*.rb
+-
+README.md
+LICENSE

Gemfile

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+source "https://rubygems.org"
+
+gemspec
+
+group :development, :test do
+  gem "rspec", "~> 3.13"
+  gem "rubocop", "~> 1.65"
+  gem "webmock", "~> 3.23"
+  gem "yard", "~> 0.9"
+end

README.md

@@ -1 +1,134 @@
-# ruby-sdk
+<h1 align="center">Infisical Ruby SDK</h1>
+
+<h4 align="center">
+  <a href="https://infisical.com/docs/sdks/languages/ruby">Documentation</a> |
+  <a href="https://www.infisical.com">Website</a> |
+  <a href="https://infisical.com/slack">Slack</a>
+</h4>
+
+## Introduction
+
+**[Infisical](https://infisical.com)** is the open source secret management platform that teams use to centralize their secrets like API keys, database credentials, and configurations.
+
+This is the official native Ruby SDK — it talks directly to the Infisical REST API and has no Rust/FFI dependency. It replaces the deprecated `infisical-sdk` gem that was built on Infisical's legacy cross-language architecture, so it is **not** a drop-in replacement: the public API differs from the old gem.
+
+## Installation
+
+```ruby
+gem "infisical-sdk"
+```
+
+## Quick start
+
+```ruby
+require "infisical"
+
+client = Infisical::Client.new
+
+client.auth.universal_auth_login(
+  client_id: ENV.fetch("INFISICAL_CLIENT_ID"),
+  client_secret: ENV.fetch("INFISICAL_CLIENT_SECRET")
+)
+
+secrets = client.secrets.list(
+  project_id: "<your-project-id>",
+  environment: "dev"
+)
+
+secrets.each { |secret| puts "#{secret.secret_key}=#{secret.secret_value}" }
+```
+
+### Authentication
+
+```ruby
+# Universal Auth (machine identity client id/secret). Returns the full
+# credential, so you can build your own token refresh on top of it.
+credential = client.auth.universal_auth_login(client_id: "...", client_secret: "...")
+credential.access_token       # the token this client now uses
+credential.expires_in         # seconds until it expires
+credential.access_token_max_ttl
+credential.token_type         # "Bearer"
+
+# Or use a token you already have
+client.auth.access_token("existing-access-token")
+```
+
+### Secrets
+
+```ruby
+client.secrets.list(project_id: "...", environment: "dev", secret_path: "/")
+
+# Imported secrets are folded in by default; pass include_imports: false to
+# opt out. Recursive mode collapses duplicate keys across folders to one
+# secret per key unless skip_unique_validation: true is passed.
+client.secrets.list(project_id: "...", environment: "dev", recursive: true)
+
+# Export fetched secrets into the process environment (never overrides
+# variables that already have a value):
+client.secrets.list(project_id: "...", environment: "dev", attach_to_process_env: true)
+ENV.fetch("DATABASE_URL")
+
+client.secrets.get("DATABASE_URL", project_id: "...", environment: "dev")
+client.secrets.create("DATABASE_URL", "postgres://...", project_id: "...", environment: "dev")
+client.secrets.update("DATABASE_URL", project_id: "...", environment: "dev", secret_value: "postgres://...")
+client.secrets.delete("DATABASE_URL", project_id: "...", environment: "dev")
+
+# create and update accept skip_multiline_encoding: true to disable the
+# API's encoding of multi-line values.
+```
+
+Each returned secret exposes `secret_key`, `secret_value`, `secret_comment`,
+`secret_path`, `version`, `metadata` (an array of key/value entries), and
+`tags` (an array with `id`, `slug`, `name`, and `color`).
+
+### Error handling
+
+Every error raised by the SDK inherits from `Infisical::Error`. API failures
+raise `Infisical::APIError` (with `status`, `url`, `http_method`, and
+`request_id` readers), and well-known statuses raise a dedicated subclass:
+
+```ruby
+begin
+  client.secrets.get("DATABASE_URL", project_id: "...", environment: "dev")
+rescue Infisical::NotFoundError        # 404
+  # secret does not exist
+rescue Infisical::AuthenticationError  # 401: bad or expired credentials
+  # re-authenticate
+rescue Infisical::APIError => e        # anything else the API rejected
+  # e.status, e.url, e.http_method, e.request_id
+end
+```
+
+Also available: `Infisical::PermissionError` (403), `Infisical::RateLimitError`
+(429, raised only after automatic retries are exhausted), and
+`Infisical::ServerError` (5xx). Network-level failures (timeouts, DNS,
+connection resets) raise `Infisical::RequestError` after retries.
+
+### Self-hosted instances
+
+```ruby
+client = Infisical::Client.new(site_url: "https://your-infisical-instance.com")
+```
+
+A trailing `/api` on the site URL (as used with some other Infisical SDKs) is
+accepted and normalized away.
+
+## Documentation
+
+You can find the documentation for the Ruby SDK on our [SDK documentation page](https://infisical.com/docs/sdks/languages/ruby).
+
+## Development
+
+```bash
+bin/setup        # bundle install
+bundle exec rspec
+bundle exec rubocop
+```
+
+## Security
+
+Please do not file GitHub issues or post on our public forum for security vulnerabilities, as they are public!
+
+Infisical takes security issues very seriously. If you have any concerns about Infisical or believe you have uncovered a vulnerability, please get in touch via the e-mail address security@infisical.com. In the message, try to provide a description of the issue and ideally a way of reproducing it. The security team will get back to you as soon as possible.
+
+Note that this security address should be used only for undisclosed vulnerabilities. Please report any security problems to us before disclosing it publicly.

Rakefile

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+require "bundler/gem_tasks"
+require "rspec/core/rake_task"
+
+RSpec::Core::RakeTask.new(:spec)
+
+require "rubocop/rake_task"
+RuboCop::RakeTask.new
+
+task default: %i[spec rubocop]