CI: add bump-deps task for gems

[aramprice]

• update ruby-version to 3.3; version 3.2 is out of support
• add github action to run bosh-stemcell/ specs
• add dependabot config to update github actions

[coderabbitai]

Warning

Rate limit exceeded

@aramprice has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 16 minutes and 28 seconds before requesting another review.

Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 16 minutes and 28 seconds.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 7f5ee6dd-07e8-4cdc-8443-ddfc63e37c48

📥 Commits

Reviewing files that changed from the base of the PR and between eb95463 and 027361b.

📒 Files selected for processing (4)

• .github/dependabot.yml
• .github/workflows/ruby.yml
• .ruby-version
• ci/pipelines/builder.yml

Walkthrough

Updated .ruby-version from 3.2.0 to 3.3. Added a new bump-deps job to ci/pipelines/builder.yml that loads ruby_version from bosh-linux-stemcell-builder/.ruby-version, fetches multiple resources, runs bump-gems from the ruby-release repo using a registry image, executes a privileged test-unit task with bosh-integration-image, and puts bosh-linux-stemcell-builder with rebase: true. Introduced three Concourse resources: a weekly time trigger, bosh-ruby-release-registry-image (registry-image), and ruby-release (git).

Suggested reviewers

• rkoster

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Description check	❓ Inconclusive	The PR description mentions updating ruby-version to 3.3, which directly matches the .ruby-version file change. However, it omits the significant ci/pipelines/builder.yml changes (new bump-deps job and resources).	Update the description to document the new bump-deps CI job and related resources (weekly schedule, ruby-release git resource, and bosh-ruby-release-registry-image) that were added to ci/pipelines/builder.yml.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title focuses on adding a bump-deps task for gems, which is partially related to the changeset since the main change involves adding a bump-deps CI job, but the title omits the significant Ruby version update from 3.2.0 to 3.3.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch add-bump-task

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@ci/pipelines/builder.yml`:
- Around line 739-740: The pipeline references a resource named "weekly" via
"get: weekly" but no resource with that name exists in the resources: block;
either add a resource entry named weekly (e.g., a git/resource or time-trigger
resource matching your intended type) or update the "get: weekly" to the correct
existing resource name; locate the "get: weekly" usage and fix it by adding a
corresponding resource declaration named weekly (or renaming the get) so
pipeline validation succeeds.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 486990de-db39-4786-ba12-c110d3207ab6

📥 Commits

Reviewing files that changed from the base of the PR and between e024d71 and 40ddd29.

📒 Files selected for processing (2)

• .ruby-version
• ci/pipelines/builder.yml

[coderabbitai]

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@ci/pipelines/builder.yml`:
- Around line 844-850: The YAML schedule block for the pipeline named "weekly"
has extra spaces inside the bracketed list for the days field; update the 'days:
[ Saturday ]' entry (in the weekly schedule block) to remove the internal spaces
so it reads 'days: [Saturday]' to satisfy YAMLlint and maintain YAML formatting
consistency.
- Around line 761-764: The pipeline step currently uses the read-only HTTPS
resource `put: bosh-linux-stemcell-builder`, which will fail for write
operations; change the `put` resource to the write-capable resource
`bosh-linux-stemcell-builder-push` (the same resource used by `bump-bosh-agent`)
so the step gets the configured `private_key` credentials, and keep the existing
`params` block (e.g., `repository` and `rebase`) intact when swapping
`bosh-linux-stemcell-builder` to `bosh-linux-stemcell-builder-push`.
- Around line 735-760: The job is missing the bosh-stemcells-ci resource
required by the test-unit task; add a get: bosh-stemcells-ci entry to the
in_parallel block (with trigger: true/false as appropriate) so the referenced
file bosh-stemcells-ci/ci/tasks/test-unit.yml is available, and update the
test-unit task to include the expected input mapping (e.g., input_mapping or
input_repos entry that maps the task's required input name to bosh-stemcells-ci)
so the task has the required input.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 52f4cab6-4463-4d08-afdd-54903c19b16d

📥 Commits

Reviewing files that changed from the base of the PR and between 40ddd29 and eb95463.

📒 Files selected for processing (2)

• .ruby-version
• ci/pipelines/builder.yml

[Alphasite]

(An aside: It would be cool if we pinned the apt package versions as well. But I guess the current approach is fine too)

[aramprice]

(An aside: It would be cool if we pinned the apt package versions as well. But I guess the current approach is fine too)

This is sort a happening with the build-time marker file so that an apt repo from a given (¿hour, day?) can be used to more or less recreate a given build.